897c47e020
7 changes to exploits/shellcodes Joomla! 3.9.13 - 'Host' Header Injection orangescrum 1.8.0 - Privilege escalation (Authenticated) orangescrum 1.8.0 - 'Multiple' SQL Injection (Authenticated) orangescrum 1.8.0 - 'Multiple' Cross-Site Scripting (XSS) (Authenticated) opencart 3.0.3.8 - Sessjion Injection
30 lines
No EOL
1.1 KiB
Text
30 lines
No EOL
1.1 KiB
Text
# Exploit Title: orangescrum 1.8.0 - Privilege escalation (Authenticated)
|
|
# Date: 07/10/2021
|
|
# Exploit Author: Hubert Wojciechowski
|
|
# Contact Author: snup.php@gmail.com
|
|
# Company: https://redteam.pl
|
|
# Vendor Homepage: https://www.orangescrum.org/
|
|
# Software Link: https://www.orangescrum.org/
|
|
# Version: 1.8.0
|
|
# Tested on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23
|
|
|
|
### Privilege escalation
|
|
|
|
|
|
# The user must be assigned to the project with the account he wants to take over
|
|
# The vulnerabilities in the application allow for:
|
|
|
|
* Taking over any account with which the project is assigned
|
|
|
|
-----------------------------------------------------------------------------------------------------------------------
|
|
# POC
|
|
-----------------------------------------------------------------------------------------------------------------------
|
|
|
|
## Example
|
|
|
|
1. Go to the dashboard
|
|
2. Go to the page source view
|
|
3. Find in source "var PUSERS"
|
|
4. Copy "uniq_id" victim
|
|
5. Change cookie "USER_UNIQ" to "USER_UNIQ" victim from page source
|
|
6. After refreshing the page, you are logged in to the victim's account |