2f07358143
16 changes to exploits/shellcodes/ghdb InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS) Bludit 4.0.0-rc-2 - Account takeover Microsoft Windows 11 - 'cmd.exe' Denial of Service
59 lines
No EOL
1.7 KiB
Text
59 lines
No EOL
1.7 KiB
Text
## Exploit Title: Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking
|
|
## Exploit Author: LiquidWorm
|
|
|
|
Vendor: Sielco S.r.l
|
|
Product web page: https://www.sielco.org
|
|
Affected version: 2.12 (EXC5000GX)
|
|
2.12 (EXC120GX)
|
|
2.11 (EXC300GX)
|
|
2.10 (EXC1600GX)
|
|
2.10 (EXC2000GX)
|
|
2.08 (EXC1600GX)
|
|
2.08 (EXC1000GX)
|
|
2.07 (EXC3000GX)
|
|
2.06 (EXC5000GX)
|
|
1.7.7 (EXC30GT)
|
|
1.7.4 (EXC300GT)
|
|
1.7.4 (EXC100GT)
|
|
1.7.4 (EXC5000GT)
|
|
1.6.3 (EXC1000GT)
|
|
1.5.4 (EXC120GT)
|
|
|
|
Summary: Sielco designs and produces FM radio transmitters
|
|
for professional broadcasting. The in-house laboratory develops
|
|
standard and customised solutions to meet all needs. Whether
|
|
digital or analogue, each product is studied to ensure reliability,
|
|
resistance over time and a high standard of safety. Sielco
|
|
transmitters are distributed throughout the world and serve
|
|
many radios in Europe, South America, Africa, Oceania and China.
|
|
|
|
Desc: The Cookie session ID 'id' is of an insufficient length and
|
|
can be exploited by brute force, which may allow a remote attacker
|
|
to obtain a valid session, bypass authentication and manipulate
|
|
the transmitter.
|
|
|
|
Tested on: lwIP/2.1.1
|
|
Web/3.0.3
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2023-5758
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5758.php
|
|
|
|
|
|
26.01.2023
|
|
|
|
--
|
|
|
|
|
|
# Session values (len=5)
|
|
|
|
Cookie: id=44189
|
|
Cookie: id=37692
|
|
Cookie: id=+6638
|
|
Cookie: id=+3077
|
|
...
|
|
... |