9b56e8731e
25 changes to exploits/shellcodes/ghdb EQ Enterprise management system v2.2.0 - SQL Injection qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) ASKEY RTF3505VW-N1 - Privilege Escalation Bangresto 1.0 - SQL Injection Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated) Cacti v1.2.22 - Remote Command Execution (RCE) Judging Management System v1.0 - Authentication Bypass Judging Management System v1.0 - Remote Code Execution (RCE) rconfig 3.9.7 - Sql Injection (Authenticated) Senayan Library Management System v9.0.0 - SQL Injection Spitfire CMS 1.0.475 - PHP Object Injection Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated) WooCommerce v7.1.0 - Remote Code Execution(RCE) CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset SOUND4 Server Service 4.1.102 - Local Privilege Escalation macOS/x64 - Execve Null-Free Shellcode
67 lines
No EOL
2.6 KiB
Text
67 lines
No EOL
2.6 KiB
Text
# Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass
|
|
# Exploit Author: LiquidWorm
|
|
|
|
Vendor: SOUND4 Ltd.
|
|
Product web page: https://www.sound4.com | https://www.sound4.biz
|
|
Affected version: FM/HD Radio Processing:
|
|
Impact/Pulse/First (Version 2: 1.1/2.15)
|
|
Impact/Pulse/First (Version 1: 2.1/1.69)
|
|
Impact/Pulse Eco 1.16
|
|
Voice Processing:
|
|
BigVoice4 1.2
|
|
BigVoice2 1.30
|
|
Web-Audio Streaming:
|
|
Stream 1.1/2.4.29
|
|
Watermarking:
|
|
WM2 (Kantar Media) 1.11
|
|
|
|
Summary: The SOUND4 IMPACT introduces an innovative process - mono and
|
|
stereo parts of the signal are processed separately to obtain perfect
|
|
consistency in terms of both sound and level. Therefore, in moving
|
|
reception, when the FM receiver switches from stereo to mono and back to
|
|
stereo, the sound variations and changes in level are reduced by over 90%.
|
|
In the SOUND4 IMPACT processing chain, the stereo expander can be used
|
|
substantially without any limitations.
|
|
|
|
With its advanced functionalities and impressive versatility, SOUND4
|
|
PULSE gives clients the ultimate price - performance ratio, providing
|
|
much more than just a processor. Flexible and powerful, it ensures perfect
|
|
sound quality and full compatibility with radio broadcasting standards
|
|
and can be used simultaneously for FM and HD, DAB, DRM or streaming.
|
|
|
|
SOUND4 FIRST provides all the most important functionalities you need
|
|
in an FM/HD processor and sets the bar high both in terms of performance
|
|
and affordability. Designed to deliver a sound of uncompromising quality,
|
|
this tool gives you 2-band processing, a digital stereo generator and an
|
|
IMPACT Clipper.
|
|
|
|
Desc: The application suffers from an SQL Injection vulnerability. Input
|
|
passed through the 'password' POST parameter in 'index.php' is not properly
|
|
sanitised before being returned to the user or used in SQL queries. This
|
|
can be exploited to manipulate SQL queries by injecting arbitrary SQL code
|
|
and bypass the authentication mechanism.
|
|
|
|
Tested on: Apache/2.4.25 (Unix)
|
|
OpenSSL/1.0.2k
|
|
PHP/7.1.1
|
|
GNU/Linux 5.10.43 (armv7l)
|
|
GNU/Linux 4.9.228 (armv7l)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
Macedonian Information Security Research and Development Laboratory
|
|
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5726
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php
|
|
|
|
|
|
26.09.2022
|
|
|
|
--
|
|
|
|
|
|
POST /index.php HTTP/1.1
|
|
|
|
username=t00t&password='+joxy--+z |