PHPJabbers Cinema Booking System version 1.0 suffers from a CSV injection vulnerability.

    # Exploit Title: PHPJabbers Cinema Booking System v1.0 - CSV Injection# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11# CVE-2023-51333Descriptions:PHPJabbers Cinema Booking System v1.0 is vulnerable to CSV injectionvulnerability which allows an attacker to execute remote code. Thevulnerability exists due to insufficient input validation on theUnique ID field in the Reservations list that is used to construct aCSV file.Steps to Reproduce:1. Login your panel.2. Go to Options Menu then click Language then click Labels section.3. Now use CSV Injection Payload in any field and go to Import/Export.4. Now click export and open your system.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51333)

PHPJabbers Cinema Booking System 1.0 CSV Injection

PHPJabbers Meeting Room Booking System version 1.0 suffers from a missing rate limiting vulnerability.

    # Exploit Title: PHPJabbers Meeting Room Booking System v1.0 - No Rate Limit# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/meeting-room-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51332Descriptions:A lack of rate limiting in the "Forgot Email" feature of PHPJabbersMeeting Room Booking System v1.0 allows attackers to send an excessiveamount of reset requests for a legitimate user, leading to a possibleDenial of Service (DoS) via a large amount of generated e-mailmessages.Steps to Reproduce:1. Visit this URLhttps://demo.phpjabbers.com/1704805602_793/index.php?controller=pjAdmin&action=pjActionLogin2. Now use the account mail that is already registered on this website.3. Capture request data using burp suite and send it to Intruder Tab4. Configure Intruder and Start Attack5. Check your email.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51332)

PHPJabbers Meeting Room Booking System 1.0 Missing Rate Limiting

PHPJabbers Cleaning Business Software version 1.0 suffers from a CSV injection vulnerability.

    # Exploit Title: PHPJabbers Cleaning Business Software v1.0 - CSV Injection# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/cleaning-business-software/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11# CVE-2023-51331Descriptions:PHPJabbers Cleaning Business Software v1.0 is vulnerable to CSVinjection vulnerability which allows an attacker to execute remotecode. The vulnerability exists due to insufficient input validation onthe Unique ID field in the Reservations list that is used to constructa CSV file.Steps to Reproduce:1. Login your panel.2. Go to Options Menu then click Language then click Labels section.3. Now use CSV Injection Payload in any field and go to Import/Export.4. Now click export and open your system.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51331)

PHPJabbers Cleaning Business Software 1.0 CSV Injection

PHPJabbers Cinema Booking System version 1.0 suffers from reflective and persistent cross site scripting vulnerabilities.

    # Exploit Title: PHPJabbers Cinema Booking System v1.0 - Reflected Cross-Site Scripting# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/cinema-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51330Descriptions:Reflected cross-site scripting (XSS) vulnerability exists inReservations menu, Schedule section and "date" parameter of PHPJabbersCinema Booking System v1.0 that allows attackers to execute arbitraryweb scripts or HTML via a crafted payload injected into the Websitelogin page parameter.Steps to Reproduce:1. Login your panel.2. Go to Now Showing menu then click Print.3. Now use XSS Payload in "date" parameter.4. You will see xss popup.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51330)# Exploit Title: PHPJabbers Cinema Booking System v1.0 - Multiple Stored XSS# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/cinema-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51335Descriptions:PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple StoredCross-Site Scripting. Multiple Stored XSS is a type of securityvulnerability that occurs when an application or website allows anattacker to inject malicious scripts into the content that ispermanently stored on the server.Steps to Reproduce:1. Login your panel.2. Vulnerable parameters are "title, name".3. Go to System Users Menu then click add user.4. Then use any XSS Payload in "Name" input field and Save.5. You will see xss popup.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51335)

PHPJabbers Cinema Booking System 1.0 Cross Site Scripting

PHPJabbers Cleaning Business Software version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.

    # Exploit Title: PHPJabbers Cleaning Business Software v1.0 - MultipleStored XSS# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/cleaning-business-software/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51328Descriptions:PHPJabbers Cleaning Business Software v1.0 is vulnerable to MultipleStored Cross-Site Scripting. Multiple Stored XSS is a type of securityvulnerability that occurs when an application or website allows anattacker to inject malicious scripts into the content that ispermanently stored on the server.Steps to Reproduce:1. Login your panel.2. Vulnerable parameters are "c_name, name".3. Go to System Users Menu then click add user.4. Then use any XSS Payload in "Name" input field and Save.5. You will see xss popup.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51328)

PHPJabbers Cleaning Business Software 1.0 Cross Site Scripting

PHPJabbers Cleaning Business Software version 1.0 suffers from multiple missing rate limiting vulnerabilities.

    # Exploit Title: PHPJabbers Cleaning Business Software v1.0 - No Rate Limit# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/cleaning-business-software/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51326Descriptions:A lack of rate limiting in the "Forgot Email" feature of PHPJabbersCleaning Business Software v1.0 allows attackers to send an excessiveamount of reset requests for a legitimate user, leading to a possibleDenial of Service (DoS) via a large amount of generated e-mailmessages.Steps to Reproduce:1. Visit this URLhttps://demo.phpjabbers.com/1704803403_514/index.php?controller=pjAdmin&action=pjActionLogin2. Now use the account mail that is already registered on this website.3. Capture request data using burp suite and send it to Intruder Tab4. Configure Intruder and Start Attack5. Check your email.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51326)# Exploit Title: PHPJabbers Cleaning Business Software v1.0 - Missing Rate Limit# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/cleaning-business-software/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51327Descriptions:A lack of rate limiting in the "Forgot Email" feature of PHPJabbersCleaning Business Software v1.0 allows attackers to send an excessiveamount of reset requests for a legitimate user, leading to a possibleDenial of Service (DoS) via a large amount of generated e-mailmessages.Steps to Reproduce:1. Visit this URLhttps://demo.phpjabbers.com/{*}/index.php?controller=pjAdmin&action=pjActionLogin2. Now use the account mail that is already registered on this website.3. Capture request data using burp suite and send it to Intruder Tab4. Configure Intruder and Start Attack5. Check your email.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51327)

PHPJabbers Cleaning Business Software 1.0 Missing Rate Limiting

PHPJabbers Shared Asset Booking System version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.

    # Exploit Title: PHPJabbers Shared Asset Booking System v1.0 -Multiple Stored XSS# Date: 19/12/2023# Exploit Author: BugsBD Limited# Discover by: Rahad Chowdhury# Vendor Homepage: https://www.phpjabbers.com/# Software Link:https://www.phpjabbers.com/shared-asset-booking-system/#sectionDemo# Version: v1.0# Tested on: Windows 10, Windows 11, Linux# CVE-2023-51325Descriptions:PHPJabbers Shared Asset Booking System v1.0 is vulnerable to MultipleStored Cross-Site Scripting. Multiple Stored XSS is a type of securityvulnerability that occurs when an application or website allows anattacker to inject malicious scripts into the content that ispermanently stored on the server.Steps to Reproduce:1. Login your panel.2. Vulnerable parameters are "title, name".3. Go to System Users Menu then add user.4. Then use any XSS Payload in "Name" input field and Save.5. You will see xss popup.## Reproduce:[href](https://github.com/bugsbd/CVE/tree/main/2023/CVE-2023-51325)

PHPJabbers Shared Asset Booking System 1.0 Cross Site Scripting

Several international security agencies are echoing a warning by Ivanti about actively exploited vulnerabilities in its VPN solution.

Software vendor Ivanti has warned customers about two actively exploited vulnerabilities in all supported versions of Ivanti Connect Secure and Ivanti Policy Secure Gateways. Successful exploitation would give an attacker the ability to run arbitrary code on Ivanti’s Virtual Private Network (VPN) system.

The warning is echoed by several international security agencies like CISA and the German BSI. Both are flagging active exploitation of these two chained vulnerabilities. Ivanti Connect Secure is a widely used VPN solution that allows users to connect to their organization’s network.

The Common Vulnerabilities and Exposures (CVE) database lists publicly disclosed computer security flaws. The CVEs mentioned in these reports are:

CVE-2023-46805 (CVSS score 8.2 out of 10): an authentication bypass vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure, which allows a remote attacker to access restricted resources by bypassing control checks.

CVE-2024-21887 (CVSS score 9.1 out of 10): A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Ivanti Neurons for Secure Access is not vulnerable to these CVEs. However, the gateways being managed are independently vulnerable to them.

After attackers have used the authentication bypass to authenticate as an administrator they are able to install webshells on the VPN system to gain persistence, allowing them to execute commands on the compromised devices.

Active exploitation has been seen as far back as December 3, 2023. These attackers erased log files and turned logging off on the compromised system. Besides that, they had stolen configuration files, altered existing files, dropped remote files, and established a reverse tunnel allowing them unrestricted access.

One of the dropped files contained a JavaScript that stole the credentials of users that logged in, which could also be used for lateral movement.

**Mitigation**

Patches will be released on a schedule based on versions, with the first coming out in the week of January 22. The last version will come out the week of February 19.

> “We are releasing patches based upon telemetry information available to us from current installed solutions that notify us of the version number they are running. We are releasing patches for the highest number of installs first and then continuing in declining order.”

Until then, customers are under advice to apply a workaround and monitor their network traffic for suspicious activity and analyze the logs on their Connect Secure device.

The workaround requires importing a mitigation.release.20240107.1.xml file which can be obtained via the download portal (login required). The XML file is in the zipped format, so you’ll need to unzip and then import the XML file.

*   Navigate to **Maintenance** > **Import/Export** > **Import XML**
*   Use the **Browse** button to point to the unzipped XML file
*   Click the **Import** Button

Import of this XML into any one node of a Cluster is enough. A FAQ and more detailed instructions can be found in the Ivanti advisory article.

It is important to note that applying the workaround or a patch, when they are made available, is not enough to undo the effects of an attack. If you see signs that your instances have been compromised you should investigate or hire a specialized investigator to find out what the attackers may have obtained and what needs to be done to regain the required safety level.

CISA has added CVE-2023-46805 and CVE-2024-21887 to its Known Exploited Vulnerabilities Catalog, which requires Federal Civilian Executive Branch (FCEB) agencies to remediate identified vulnerabilities by January 21, 2024 to protect FCEB networks against active threats.

**We don’t just report on vulnerabilities—we identify them, and prioritize action.**

Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using ThreatDown Vulnerability and Patch Management.

 Act now! Ivanti vulnerabilities are being actively exploited 

By Waqas
Mandiant had its X account (formerly Twitter) hacked on January 3rd, 2024.
This is a post from HackRead.com Read the original post: Mandiant: X Account Hacked in Brute-Force Attack Linked to ClinkSink Campaign

Mandiant’s investigation unveiled that the attack was part of a larger operation known as “ClinkSink,” which employed a “Drainer-as-a-Service” (DaaS) model to steal Solana cryptocurrency.

Mandiant, a renowned cybersecurity firm and Google subsidiary found itself facing the very threat it combats on January 3rd, 2024. In an ironic twist, Mandiant’s own X account (formerly Twitter) was compromised through a brute-force attack, highlighting the ever-present vulnerability of even the most well-defended systems.

Hacked X account of Mandiant (Hackread.com)

****The Breach: Phishing for Profits****

The attacker, leveraging a brute-force method, cracked Mandiant’s X account password and gained access. With control in hand, the perpetrator swiftly transformed the account into a malicious tool, spewing links to a cleverly disguised phishing webpage.

This page mimicked a legitimate X login portal, luring unsuspecting users to enter their credentials. Upon entering their information, users were unknowingly redirected to a hidden page that would siphon their cryptocurrency funds if signed in – a digital heist unfolding right under the noses of cybersecurity experts.

> _“On January 3, 2024, Mandiant’s X social media account was taken over and subsequently used to distribute links to a cryptocurrency drainer phishing page. Working with X, we were able to regain control of the account and, based on our investigation over the following days, we found no evidence of malicious activity on, or compromise of, any Mandiant or Google Cloud systems that led to the compromise of this account.”_
> 
> Mandiant

****ClinkSink: The Drain Behind the Curtain****

In a commendable display of transparency, Mandiant publicly acknowledged the breach and shared its findings in a detailed blog post published on Wednesday 11, 2024. The cybersecurity giant revealed that a “weak password” was the likely culprit, emphasizing the importance of password best practices. Additionally, they confirmed that only their X account was compromised and no other systems were breached.

Mandiant’s investigation also revealed the attack was part of a larger operation dubbed “ClinkSink.” This campaign utilized a “Drainer-as-a-Service” (DaaS) model, where pre-built phishing kits and tools are readily available for purchase by cyber criminals. ClinkSink specifically targeted owners of Solana cryptocurrency, a popular blockchain platform.

According to the company, so far, malicious threat actors have stolen hundreds of thousands of dollars worth of Solana cryptocurrency assets in the recent ClinkSink drainer campaigns.

A Telegram channel part of the ClinkSink attack campaign (Screenshot: Mandiant)

****A Defender Breached: Lessons Learned****

While Mandiant eventually regained control of its X account and the immediate threat was neutralized, the incident served as a harsh reality check and points out several crucial cybersecurity lessons:

*   **No one is invincible:** Even the most secure systems are vulnerable to determined attackers.
*   **Password hygiene is paramount:** Strong, unique passwords and robust two-factor authentication are essential defence mechanisms.
*   **Vigilance is key:** Constant monitoring and quick response are crucial in mitigating damage from cyberattacks.

Nevertheless, this is not the first time that a cybersecurity firm fell prey to hackers or was targeted by malicious threat actors. In March 2023, a Swiss technology and cybersecurity company, Acronis, experienced a data breach, with over 21 GB of files and folders being leaked by a hacker known as Kernelware.

In February 2023, the Singapore-based Group-IB cybersecurity firm revealed that it has been constantly targeted by malicious threat actors based in the People’s Republic of China. In February 2021, the French cybersecurity company Stormshield suffered a data breach in which its source code and customer data were stolen by unknown hackers.

****_RELATED ARTICLES_****

Mandiant: X Account Hacked in Brute-Force Attack Linked to ClinkSink Campaign

By Deeba Ahmed
Another day, another malware threat against Linux systems!
This is a post from HackRead.com Read the original post: Mirai-based NoaBot Botnet Targeting Linux Systems with Cryptominer

A noticeable difference between NoaBot and Mirai is that rather than DDoS attacks, the botnet targets weak passwords connecting SSH connections to install cryptocurrency mining software.

Cybersecurity researchers at Akamai have discovered cryptomining malware called NoaBot based on the notorious **Mirai botnet**. The crytojacking malware NoaBot is currently targeting Linux servers and has been active since January 2023.

According to Akamai, a noticeable difference between NoaBot and Mirai is that rather than **DDoS attacks** (Distributed Denial of Service attacks), the malware targets weak passwords connecting SSH connections and installs cryptocurrency mining software, allowing attackers to generate digital coins using victims’ computing resources, electricity, and bandwidth.

Here, it is important to mention that NoaBot malware has also been used to deliver **P2PInfect**, a separate worm discovered by Palo Alto Networks in July 2023.

NoaBot is compiled using the UClibc code library, unlike the standard Mirai library. This changes how the antivirus protections detect NoaBot, categorizing it as an SSH scanner or generic trojan. The malware is statically compiled and stripped of symbols, while strings are obfuscated instead of saved as plaintext, making it harder for reverse engineers to extract details.

The NoaBot binary runs from a randomly generated folder, making searching devices harder. The standard Mirai dictionary is replaced with a large one, and a custom-made SSH scanner is used. Post-breach capabilities include installing a new SSH-authorized key.

This botnet has grown significantly, with over 800 unique IP addresses worldwide showing signs of NoaBot infections. The worm is a **customized version of Mirai**, a malware that infects Linux-based servers, routers, web cameras, and other Internet of Things devices.

Interestingly, the malware includes embedded song lyrics from the “**Who’s Ready for Tomorrow**” song by Rat Boy and IBDY, but later samples do not have these. The botnet also adds command line arguments, such as the “noa” flag, which installs a persistence method after a reboot.

Screenshot: Akamai

Screenshot: Akamai

Threat actors modified the **XMRig miner** to extract the mining configuration before execution. The miner’s functions involve function calls and signals. The configuration contains the mining pool and wallet address details. However, IDA misses the binary name and pool IP placeholder, allowing attackers to estimate the profitability of the cryptomining gig.

Researchers noted that the attackers were running their private pool instead of a public one, eliminating the need for a wallet. However, domains are no longer resolvable with Google’s DNS, and no recent incidents involving the dropping of the miner are noticed, suggesting the threat actors may have halted the campaign for better opportunities.

Hackread has been following incidents involving Mirai since it was **discovered** in 2016. Mirai is a self-replicating malware targeting Linux-based IoT devices, used to infect other vulnerable devices.

In 2016, it was used in a massive **DDoS attack against Dyn DNS**, paralyzing the internet. The creators released the source code, allowing crime groups to incorporate it into their attacks. Mirai scans the internet for Telnet connections via infected devices to crack Telnet passwords, then targets additional devices using the same technique.

**Akamai urges** Linux server administrators to protect their systems from NoaBot by keeping software updated, using strong passwords, enabling two-factor authentication, and monitoring unauthorized activity. This is crucial as NoaBot can launch DDoS, data breaches, and **cryptojacking attacks**.

****_RELATED ARTICLES_****

1.  **Hackers behind Mirai botnet & DYN DDoS attacks plead guilty**
2.  **Hackers behind Mirai botnet to avoid jail for working with the FBI**
3.  **Tiny Mantis Botnet Can Launch Powerful DDoS Attacks Than Mirai**
4.  **Reaper malware outshines Mirai; hits millions of IoT devices worldwide**
5.  **Mirai Variant ‘OMG’ Turns IoT Devices into Proxy Servers for Cryptomining**

Tag

#auth