989122095f
11 changes to exploits/shellcodes/ghdb AppSmith 1.47 - Remote Code Execution (RCE) ollama 0.6.4 - Server Side Request Forgery (SSRF) Vite 6.2.2 - Arbitrary File Read ABB Cylon Aspect 3.07.02 - File Disclosure (Authenticated) Nagios Log Server 2024R1.3.1 - Stored XSS Webmin Usermin 2.100 - Username Enumeration ABB Cylon Aspect 3.07.01 - Hard-coded Default Credentials openSIS 9.1 - SQLi (Authenticated) Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure ProSSHD 1.2 - Denial of Service (DOS)
82 lines
No EOL
4.2 KiB
Text
82 lines
No EOL
4.2 KiB
Text
ABB Cylon Aspect 3.07.01 (config.inc.php) Hard-coded Credentials in phpMyAdmin
|
|
|
|
|
|
Vendor: ABB Ltd.
|
|
Product web page: https://www.global.abb
|
|
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
|
|
Firmware: <=3.07.01
|
|
|
|
Summary: ASPECT is an award-winning scalable building energy management
|
|
and control solution designed to allow users seamless access to their
|
|
building data through standard building protocols including smart devices.
|
|
|
|
Desc: The ABB BMS/BAS controller is operating with default and hard-coded
|
|
credentials contained in install package while exposed to the Internet.
|
|
|
|
Tested on: GNU/Linux 3.15.10 (armv7l)
|
|
GNU/Linux 3.10.0 (x86_64)
|
|
GNU/Linux 2.6.32 (x86_64)
|
|
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
|
|
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
|
|
PHP/7.3.11
|
|
PHP/5.6.30
|
|
PHP/5.4.16
|
|
PHP/4.4.8
|
|
PHP/5.3.3
|
|
AspectFT Automation Application Server
|
|
lighttpd/1.4.32
|
|
lighttpd/1.4.18
|
|
Apache/2.2.15 (CentOS)
|
|
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
|
|
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
|
|
phpMyAdmin 2.11.9
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
Reported by DIVD
|
|
|
|
|
|
Advisory ID: ZSL-2024-5830
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5830.php
|
|
CVE ID: CVE-2024-4007
|
|
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-4007
|
|
|
|
|
|
21.04.2024
|
|
|
|
--
|
|
|
|
|
|
$ cat project
|
|
|
|
P R O J E C T
|
|
|
|
.|
|
|
| |
|
|
|'| ._____
|
|
___ | | |. |' .---"|
|
|
_ .-' '-. | | .--'| || | _| |
|
|
.-'| _.| | || '-__ | | | || |
|
|
|' | |. | || | | | | || |
|
|
____| '-' ' "" '-' '-.' '` |____
|
|
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
|
|
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
|
|
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
|
|
|
|
|
|
$ cat max/var/www/html/phpMyAdmin/config.inc.php | grep control
|
|
$cfg['Servers'][$i]['controluser'] = 'root';
|
|
$cfg['Servers'][$i]['controlpass'] = 'F@c1liTy'; |