9b56e8731e
25 changes to exploits/shellcodes/ghdb EQ Enterprise management system v2.2.0 - SQL Injection qubes-mirage-firewall v0.8.3 - Denial Of Service (DoS) ASKEY RTF3505VW-N1 - Privilege Escalation Bangresto 1.0 - SQL Injection Bludit 3-14-1 Plugin 'UploadPlugin' - Remote Code Execution (RCE) (Authenticated) Cacti v1.2.22 - Remote Command Execution (RCE) Judging Management System v1.0 - Authentication Bypass Judging Management System v1.0 - Remote Code Execution (RCE) rconfig 3.9.7 - Sql Injection (Authenticated) Senayan Library Management System v9.0.0 - SQL Injection Spitfire CMS 1.0.475 - PHP Object Injection Textpattern 4.8.8 - Remote Code Execution (RCE) (Authenticated) WooCommerce v7.1.0 - Remote Code Execution(RCE) CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Denial Of Service (DoS) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Directory Traversal File Write Exploit SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE) SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset SOUND4 Server Service 4.1.102 - Local Privilege Escalation macOS/x64 - Execve Null-Free Shellcode
165 lines
No EOL
4 KiB
Text
165 lines
No EOL
4 KiB
Text
# Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authorization Bypass (IDOR)
|
|
# Exploit Author: LiquidWorm
|
|
|
|
Vendor: SOUND4 Ltd.
|
|
Product web page: https://www.sound4.com | https://www.sound4.biz
|
|
Affected version: FM/HD Radio Processing:
|
|
Impact/Pulse/First (Version 2: 1.1/2.15)
|
|
Impact/Pulse/First (Version 1: 2.1/1.69)
|
|
Impact/Pulse Eco 1.16
|
|
Voice Processing:
|
|
BigVoice4 1.2
|
|
BigVoice2 1.30
|
|
Web-Audio Streaming:
|
|
Stream 1.1/2.4.29
|
|
Watermarking:
|
|
WM2 (Kantar Media) 1.11
|
|
|
|
Summary: The SOUND4 IMPACT introduces an innovative process - mono and
|
|
stereo parts of the signal are processed separately to obtain perfect
|
|
consistency in terms of both sound and level. Therefore, in moving
|
|
reception, when the FM receiver switches from stereo to mono and back to
|
|
stereo, the sound variations and changes in level are reduced by over 90%.
|
|
In the SOUND4 IMPACT processing chain, the stereo expander can be used
|
|
substantially without any limitations.
|
|
|
|
With its advanced functionalities and impressive versatility, SOUND4
|
|
PULSE gives clients the ultimate price - performance ratio, providing
|
|
much more than just a processor. Flexible and powerful, it ensures perfect
|
|
sound quality and full compatibility with radio broadcasting standards
|
|
and can be used simultaneously for FM and HD, DAB, DRM or streaming.
|
|
|
|
SOUND4 FIRST provides all the most important functionalities you need
|
|
in an FM/HD processor and sets the bar high both in terms of performance
|
|
and affordability. Designed to deliver a sound of uncompromising quality,
|
|
this tool gives you 2-band processing, a digital stereo generator and an
|
|
IMPACT Clipper.
|
|
|
|
Desc: The application is vulnerable to insecure direct object references
|
|
that occur when the application provides direct access to objects based
|
|
on user-supplied input. As a result of this vulnerability attackers can
|
|
bypass authorization and access the hidden resources on the system and
|
|
execute privileged functionalities.
|
|
|
|
Tested on: Apache/2.4.25 (Unix)
|
|
OpenSSL/1.0.2k
|
|
PHP/7.1.1
|
|
GNU/Linux 5.10.43 (armv7l)
|
|
GNU/Linux 4.9.228 (armv7l)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
Macedonian Information Security Research and Development Laboratory
|
|
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2022-5723
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5723.php
|
|
|
|
|
|
26.09.2022
|
|
|
|
--
|
|
|
|
|
|
(GET|POST) /** HTTP/1.1
|
|
|
|
/var/www/:
|
|
----------
|
|
|
|
.SOUND4
|
|
about.php
|
|
actioninprogress.php
|
|
broken_error.php
|
|
cfg_filewatch.xml
|
|
cfg_filewatch_specific.xml
|
|
checklogin.php
|
|
checkserver.php
|
|
config.php
|
|
datahandlerdlg.php
|
|
descrxml.php
|
|
dns.php
|
|
downloads
|
|
downloads.php
|
|
fullrebootsystem.php
|
|
global.php
|
|
globaljs.php
|
|
guifactorysettings.xml
|
|
guixml.php
|
|
guixml_error.php
|
|
header.php
|
|
images
|
|
index.php
|
|
isreboot.php
|
|
jquery-3.2.1.min.js
|
|
jquery-plugins
|
|
jquery-ui-custom
|
|
jquery-ui-i18n.js
|
|
jquery-ui.css
|
|
jquery-ui.js
|
|
jquery.js
|
|
jquery.ui.touch-punch.min.js
|
|
killffmpeg.php
|
|
linkandshare.php
|
|
login.php
|
|
logout.php
|
|
monitor.php
|
|
networkdiagnostic.php
|
|
partialrebootsystem.php
|
|
ping.php
|
|
playercfg.xml
|
|
rebootsystem.php
|
|
restoreinprogress.php
|
|
script.min.js
|
|
secure.php
|
|
serverinprogress.php
|
|
settings.php
|
|
setup.php
|
|
setup_ethernet.php
|
|
style.min.css
|
|
traceroute.php
|
|
upgrade
|
|
upgrade.php
|
|
upgradeinprogress.php
|
|
uploaded_guicustomload.php
|
|
uploaded_kantarlic.php
|
|
uploaded_licfile.php
|
|
uploaded_logo.php
|
|
uploaded_presetfile.php
|
|
uploaded_restorefile.php
|
|
uploaded_upgfile.php
|
|
validate_tz.php
|
|
ws.min.js
|
|
ws.php
|
|
wsjquery-class.min.js
|
|
www-data-handler.php
|
|
|
|
/usr/cgi-bin/:
|
|
--------------
|
|
|
|
(GET|POST) /** HTTP/1.1
|
|
|
|
backup.cgi
|
|
cgi-form-data
|
|
downloadkantarlic.cgi
|
|
ffmpeg.cgi
|
|
frontpanel
|
|
getlogs.cgi
|
|
getlogszip.cgi
|
|
guicustomsettings.cgi
|
|
guicustomsettingsload.cgi
|
|
guifactorysettings.cgi
|
|
importpreset.cgi
|
|
loghandler.php
|
|
logo
|
|
logoremove.cgi
|
|
logoupload.cgi
|
|
phptail.php
|
|
printenv
|
|
printenv.vbs
|
|
printenv.wsf
|
|
restore.cgi
|
|
restorefactory.cgi
|
|
test-cgi
|
|
upgrade.cgi
|
|
upload.cgi |