Exploit Collector
ImpressCMS 1.4.2 Incorrect Access Control

https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
ImpressCMS versions 1.4.2 and below suffer from an incorrect access control vulnerability.

MD5 | 3eef0d54701c87520c4c7a944b7f47a5

Download
--------------------------------------------------------------------------
ImpressCMS <=
--------------------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.2 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

16. include "../mainfile.php";
17. xoops_header(false);
18.
19. $denied = true;
20. if (!empty($_REQUEST['token'])) {
21. if (icms::$security->validateToken($_REQUEST['token'], false)) {
22. $denied = false;
23. }
24. } elseif (is_object(icms::$user) && icms::$user->isAdmin()) {
25. $denied = false;
26. }
27. if ($denied) {
28. icms_core_Message::error(_NOPERM);
29. exit();
30. } }

This script should be accessible to authenticated users only. However,
because of the "if" statement at lines 20-23, this script could be
accessed by unauthenticated attackers if they will provide a valid
security token. Such a token will be generated in several places within
the application, and some of them do not require the user to be
authenticated, like in the misc.php script. This might be exploited to
access an otherwise restricted functionality of the application, which
in turn might allow an information disclosure about the CMS users.
[-] Solution:

Upgrade to version 1.4.3 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26598 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081137
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-03

Source:packetstormsecurity.com

Exploit Collector
ImpressCMS 1.4.2 SQL Injection

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
ImpressCMS versions 1.4.3 and below suffer from a remote SQL injection vulnerability.

MD5 | 87f67399dc57cf0886d71c379f9cc8b8

Download
---------------------------------------------------------------
ImpressCMS <=
---------------------------------------------------------------
[-] Software Link:

https://www.impresscms.org
[-] Affected Versions:

Version 1.4.3 and prior versions.
[-] Vulnerability Description:

The vulnerability is located in the /include/findusers.php script:

281. $total =
$user_handler->getUserCountByGroupLink(@$_POST["groups"], $criteria);
282.
283. $validsort = array("uname", "email", "last_login",
"user_regdate", "posts");
284. $sort = (!in_array($_POST['user_sort'], $validsort)) ?
"uname" : $_POST['user_sort'];
285. $order = "ASC";
286. if (isset($_POST['user_order']) && $_POST['user_order']
== "DESC") {
287. $order = "DESC";
288. }
289.
290. $criteria->setSort($sort);
291. $criteria->setOrder($order);
292. $criteria->setLimit($limit);
293. $criteria->setStart($start);
294. $foundusers =
$user_handler->getUsersByGroupLink(@$_POST["groups"], $criteria, TRUE);

User input passed through the "groups" POST parameter is not properly
sanitized before being passed to the
icms_member_Handler::getUserCountByGroupLink() and
icms_member_Handler::getUsersByGroupLink() methods at lines 281 and 294.
These methods use the first argument to construct a SQL query without
proper validation, and this can be exploited by remote attackers to e.g.
read sensitive data from the "users" database table through
boolean-based SQL Injection attacks. The application allows for stacked
SQL queries, as such this vulnerability could be exploited to e.g.
create a new admin user and execute arbitrary PHP code.
[-] Solution:

Upgrade to version 1.4.4 or later.
[-] Disclosure Timeline:

[19/01/2021] - Vendor notified through HackerOne
[29/01/2021] - Vulnerability acknowledged by the vendor
[03/02/2021] - CVE number assigned
[06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed
[11/02/2022] - Vendor was informed about the ineffective fix
[09/03/2022] - Version 1.4.4 released
[22/03/2022] - Public disclosure
[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2021-26599 to this vulnerability.
[-] Credits:

Vulnerability discovered by Egidio Romano.
[-] Other References:

https://hackerone.com/reports/1081145
[-] Original Advisory:

http://karmainsecurity.com/KIS-2022-04

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Zscaler Unveils Security Service Edge Innovations to Protect Enterprises From Cyberattacks

Advancements to the most deployed ZTNA solution strengthen the Zscaler Zero Trust Exchange with new private app protection, deception, and privileged remote access capabilities.

Dark Reading: Attacks/Breaches
Trustero Exits Stealth Mode and Launches its Compliance as a Service Platform

Proven best practices create integrity and trustworthiness.

Dark Reading: Attacks/Breaches
Checkmarx Launches Comprehensive Supply Chain Security Solution

Now available for use with Checkmarx Software Composition Analysis (SCA), the solution restores trust in modern application development while letting developers embrace open source code.

Dark Reading: Attacks/Breaches
Logpoint Unleashes SaaS-Delivered Converged SIEM

Only solution to deliver integrated cloud-based SIEM, SOAR, and UEBA services directly to organizations of all sizes.

Caso de uso não autorizados de chave da API do Google Maps
https://medium.com/@cupc4k3/caso-de-uso-n%C3%A3o-autorizados-de-chave-da-api-do-google-maps-89498752cf7d?source=rss------bug_bounty-5

Fala galera,Continue reading on Medium » (https://medium.com/@cupc4k3/caso-de-uso-n%C3%A3o-autorizados-de-chave-da-api-do-google-maps-89498752cf7d?source=rss------bug_bounty-5)

Hi I need some help.
https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/

So my girlfriends Instagram account is apart of that onlyfans/porn scam thing going around. I wanted to know what legal actions I could take. I’m waiting on a response from his account so I can figure out where it came from. Is it legal/possible to find his digital footprint from his/her Instagram response to my account? I’m studying cybersecurity in hopes to get into the industry, but I don’t know what to do. I’m more concerned about that it’s ruining her image, and I want to do something about it. What can I do? submitted by /u/Wonderful-Captain-92 (https://www.reddit.com/user/Wonderful-Captain-92)
[link] (https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/) [comments] (https://www.reddit.com/r/redteamsec/comments/tkbxo3/hi_i_need_some_help/)

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
How are people hacking instagram account with links

I see a bunch of my friends accounts getting stolen with some links , how are they getting all there info from one simple link they send on instagram dms ?

submitted by /u/Bacon4U1400
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How do you spy on someone else’s phone without them knowing?

Phone hacking is the hone of investigating a portable gadget regularly utilizing computer abuses to analyze everything from the least…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CVE-2021–40662 Chamilo LMS 1.11.14 RCE

This is Febin, a Security Researcher. This article is about my third CVE that I got for finding a Remote Code Execution in a popular…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Los piratas informáticos apuntan a las redes bancarias con un nuevo rootkit para robar dinero de…

https://cdn-images-1.medium.com/max/1606/0*-d2alFj_qBLIDWgp
PUBLICADO EN 22 MARZO, 2022 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Human Connection: the Story of Awedience

https://cdn-images-1.medium.com/max/2600/1*wYiW3cB5YfO_oLC9CVHW3A.jpeg
How a home-grown product helps Airbnb employees feel more connected during solitary times

Continue reading on The Airbnb Tech Blog »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Idk if this is related to hacking but hear me out....

So Iv'e been seeing these random "text" posts on live streams (pokemon unite) but at 1st glance I thought it was just a random dude tryna act all cool and all. Now I just searched for some unite vid and in one of the comment section I saw multiple "text" written from like 2-3 accounts with weird names. So I decide to check a profile out and I see some random vids with rgb pixels that make no sense....do they mean anything like a secret code or something??? Here's the link to the Youtube channel - https://www.youtube.com/channel/UCmS9H8nIBbyKhBBFhsuQiiQ

submitted by /u/Dark_Phantom2003
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video