6829e7f3b7
17 changes to exploits/shellcodes RDP Manager 4.9.9.3 - Denial-of-Service (PoC) PHPJabbers Simple CMS 5 - 'name' Persistent Cross-Site Scripting (XSS) WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting (XSS) Fuel CMS 1.4.1 - Remote Code Execution (3) Eclipse Jetty 11.0.5 - Sensitive File Disclosure WordPress Plugin Popup Anything 2.0.3 - 'Multiple' Stored Cross-Site Scripting (XSS) OpenAM 13.0 - LDAP Injection Simplephpscripts Simple CMS 2.1 - 'Multiple' Stored Cross-Site Scripting (XSS) Simplephpscripts Simple CMS 2.1 - 'Multiple' SQL Injection Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'Multiple' Cross-Site Scripting (XSS) PHP Melody 3.0 - 'vid' SQL Injection Mult-e-Cart Ultimate 2.4 - 'id' SQL Injection PHP Melody 3.0 - Persistent Cross-Site Scripting (XSS) Isshue Shopping Cart 3.5 - 'Title' Cross Site Scripting (XSS) Vanguard 2.1 - 'Search' Cross-Site Scripting (XSS) Ultimate POS 4.4 - 'name' Cross-Site Scripting (XSS)
166 lines
No EOL
6.1 KiB
Text
166 lines
No EOL
6.1 KiB
Text
# Exploit Title: RDP Manager 4.9.9.3 - Denial-of-Service (PoC)
|
|
# Date: 2021-10-18
|
|
# Exploit Author: Vulnerability Lab
|
|
# Vendor Homepage: https://www.cinspiration.de/uebersicht4.html
|
|
# Software Link: https://www.cinspiration.de/download.html
|
|
# Version: 4.9.9.3
|
|
# Tested on: Linux
|
|
|
|
Document Title:
|
|
===============
|
|
RDP Manager v4.9.9.3 - Local Denial of Servie Vulnerability
|
|
|
|
|
|
References (Source):
|
|
====================
|
|
https://www.vulnerability-lab.com/get_content.php?id=2309
|
|
|
|
|
|
Release Date:
|
|
=============
|
|
2021-10-18
|
|
|
|
|
|
Vulnerability Laboratory ID (VL-ID):
|
|
====================================
|
|
2309
|
|
|
|
|
|
Common Vulnerability Scoring System:
|
|
====================================
|
|
3.6
|
|
|
|
|
|
Vulnerability Class:
|
|
====================
|
|
Denial of Service
|
|
|
|
|
|
Current Estimated Price:
|
|
========================
|
|
500€ - 1.000€
|
|
|
|
|
|
Product & Service Introduction:
|
|
===============================
|
|
RDP-Manager is a program for the better administration of several remote desktops and further connections. The connection parameters
|
|
as well as user name and password can be stored in the program, the latter also encrypted by an external password if desired. When opened,
|
|
the connections created are clearly structured in individual tabs in the application window, which means that the overview is retained even
|
|
if several connections are open.
|
|
|
|
(Copy of the Homepage: https://www.cinspiration.de/download.html )
|
|
|
|
|
|
Abstract Advisory Information:
|
|
==============================
|
|
The vulnerability laboratory core research team discovered a local denial of service vulnerability in the RDP Manager v4.9.9.3 windows software client.
|
|
|
|
|
|
Vulnerability Disclosure Timeline:
|
|
==================================
|
|
2021-06-01: Researcher Notification & Coordination (Security Researcher)
|
|
2021-06-02: Vendor Notification (Security Department)
|
|
2021-**-**: Vendor Response/Feedback (Security Department)
|
|
2021-**-**: Vendor Fix/Patch (Service Developer Team)
|
|
2021-**-**: Security Acknowledgements (Security Department)
|
|
2021-10-18: Public Disclosure (Vulnerability Laboratory)
|
|
|
|
|
|
Discovery Status:
|
|
=================
|
|
Published
|
|
|
|
|
|
Exploitation Technique:
|
|
=======================
|
|
Local
|
|
|
|
|
|
Severity Level:
|
|
===============
|
|
Low
|
|
|
|
|
|
Authentication Type:
|
|
====================
|
|
Restricted Authentication (User Privileges)
|
|
|
|
|
|
User Interaction:
|
|
=================
|
|
No User Interaction
|
|
|
|
|
|
Disclosure Type:
|
|
================
|
|
Independent Security Research
|
|
|
|
|
|
Technical Details & Description:
|
|
================================
|
|
A local denial of service vulnerability has been discovered in the official RDP Manager v4.9.9.3 windows software client.
|
|
The denial of service attack allows an attacker to freeze, block or crash a local process, service or component to compromise.
|
|
|
|
The local vulnerability is located in the Verbindungsname and Server input fields of the Verbindung (Neu/Bearbeiten).
|
|
The Verbindungsname and Server inputs are not limited by the size of characters. Thus allows a local privileged attacker
|
|
to add a malformed server entry with a large size that crashs (multiple application errors) the application permanently.
|
|
The entry can be modified as zip backup for imports as sqLitedatabase.db3 to make the software unusable until a full
|
|
reinstall with separate deletes is performed to recover.
|
|
|
|
Successful exploitation of the denial of service vulnerability results in permanent unhandled software and application crashs.
|
|
|
|
Vulnerable Input(s):
|
|
[+] Verbindungsname
|
|
[+] Server
|
|
|
|
Affected Module(s):
|
|
[+] Wiederherstellen (sqLitedatabase.db3)
|
|
|
|
|
|
Proof of Concept (PoC):
|
|
=======================
|
|
The local denial of service vulnerability can be exploited by attackers with system access privileges without user interaction.
|
|
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
|
|
|
|
|
|
Manual steps to reproduce ...
|
|
1. Install the RDP-Manager.exe software for windows
|
|
2. Start the software and add a new entry in the main tab
|
|
3. Include a large amount of characters max 1024 and save the entry
|
|
4. The software freezes and crashs with multiple errors in the actual session and after restart it crash permanently as well
|
|
Note: Alternativly you can export a database with regular valid entry and modify it via backup for a import
|
|
5. Successful reproduce of the local denial of service vulnerability!
|
|
|
|
|
|
Credits & Authors:
|
|
==================
|
|
N/A - Anonymous [research@vulnerability-lab.com] - https://www.vulnerability-lab.com/show.php?user=N%2FA+-+Anonymous
|
|
|
|
|
|
Disclaimer & Information:
|
|
=========================
|
|
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
|
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab
|
|
or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits
|
|
or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do
|
|
not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
|
|
We do not approve or encourage anybody to break any licenses, policies, deface websites, hack into databases or trade with stolen data.
|
|
|
|
Domains: https://www.vulnerability-lab.com ; https://www.vuln-lab.com ; https://www.vulnerability-db.com
|
|
|
|
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
|
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
|
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other
|
|
information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or
|
|
edit our material contact (admin@ or research@) to get a ask permission.
|
|
|
|
Copyright © 2021 | Vulnerability Laboratory - [Evolution Security GmbH]™
|
|
|
|
|
|
|
|
--
|
|
VULNERABILITY LABORATORY (VULNERABILITY LAB)
|
|
RESEARCH, BUG BOUNTY & RESPONSIBLE DISCLOSURE
|
|
LUDWIG-ERHARD STRAßE 4
|
|
34131 KASSEL - HESSEN
|
|
DEUTSCHLAND (DE) |