H00Die

توجد ثغرة cross-site scripting مخزنة حيث يمكن للمهاجمين الذين يتحكمون في ملفات نقطة النهاية المستهدفة تنفيذ JavaScript ضمن أصل واجهة مستخدم Mythic. يتم تحقيق ذلك عن طريق وضع محتوى HTML داخل ملفات ذات امتداد .pdf. عندما يقوم المشغل باختيار Preview Media بعد تنزيل مثل هذا الملف، يتم عرض HTML كأصل واحد عبر نقطة النهاية '/direct/view' بسبب content-sniffing. يسمح هذا للمهاجم بسرقة JSON Web Tokens (JWTs) من `localStorage` مما يمنح وصولاً كاملاً إلى واجهات GraphQL و REST.

The post module `post/apple ios/gather/ios image gather` contains a relative path traversal issue. The module takes file names from a Meterpreter directory listing, which can be controlled by a compromised iOS device, and passes them without sanitization to the `client.fs.file.download file()` function. This allows a malicious device to escape the intended storage directory and overwrite sensitive files on the operator's workstation, such as the `msfconsole.rc` resource file. Since `msfconsole.rc` is executed automatically at startup, an attacker can achieve persistent code execution and obtain an interactive shell with the privileges of the operator, often root, by loading a malicious Ruby plugin.

An unhandled panic exists in the operator gRPC handler. An attacker controlling a compromised implant can crash the teamserver by returning a malformed or empty Download response. By sending zero-length or 1-3 byte data payloads through a hostile implant session, an out-of-bounds slice access is triggered in the `BinaryMagic()` function of the vendored Binject library. This failure propagates through the operator gRPC interceptor chain and terminates the server process, disconnecting all operators.

توجد ثغرة أمنية تسمح بتنفيذ التعليمات البرمجية عن بُعد بسبب وجود باب خلفي غير موثق في المنفذ UDP 53413. يمكن لمهاجم عن بُعد غير مصدق عليه إرسال حزم UDP مصممة خصيصًا لتنفيذ أوامر تعسفية على الجهاز المتأثر. يستخدم الباب الخلفي آلية مصادقة مبرمجة بشكل ثابت ويقبل أوامر shell بعد المصادقة. تتضمن بعض طرازات الأجهزة تنفيذًا غير قياسي للأمر `echo`، مما قد يؤثر على قابلية الاستغلال.

تنشأ المشكلة بسبب اعتماد المنتج على تشفير استبدال بسيط يتم إرساله بنص عادي، واستخدامه لكلمة مرور افتراضية في حالة عدم تعيين المستخدم لكلمة مرور. وهذا يتيح للمهاجمين إدخال أوامر نظام التشغيل عبر بروتوكول التحكم المخصص للمنتج.

The web management interface for Unified Intents' Unified Remote solution does not require authentication, allowing a remote, unauthenticated attacker to change or disable authentication requirements for the Unified Remote protocol. This can be leveraged to run code of the attacker's choosing. The issue is related to an incorrect authorization procedure in the web management interface.

The issue is related to a SQL Injection vulnerability in the admin interface of VICIdial, specifically affecting the `/vicidial/admin.php` endpoint through the `modify email accounts`, `access recordings`, and `agentcall email` parameters. This allows an attacker to spoof identity, tamper with existing data, disclose all data on the system, destroy data, or become administrators of the database server.

The issue is related to a SQL Injection vulnerability in the AST Agent Time Sheet interface of VICIdial, specifically in the `/vicidial/AST agent time sheet.php` endpoint, via the `agent` parameter. This allows an attacker to spoof identity, tamper with existing data, disclose all data on the system, destroy data, or make it unavailable, and potentially become administrators of the database server.

The issue allows an attacker to spoof identity, tamper with existing data, disclose all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server via a SQL Injection vulnerability in the User Stats interface. The vulnerability is exploited through the `file download` parameter in the `/vicidial/user stats.php` API endpoint.

The issue allows an unauthenticated user to bypass authentication and inject arbitrary commands into the `parameters` using backquotes in the "/api/hosts" API endpoint.

A security issue was found where the authentication in libbpext.so could be bypassed using a SQL injection, allowing a remote attacker to potentially place a privilege escalation exploit on the system and execute arbitrary commands.

The issue is related to the `api/storage` web interface, where an input parameter was not validated, allowing a remote attacker to bypass authentication and execute arbitrary commands with root privilege on the target system. This flaw is associated with deficiencies in the authentication procedure, which can be exploited by a remote attacker to bypass authentication or execute arbitrary commands with root privileges.

The issue allows local users to gain root privileges. This is achieved by sending "rootmydevice" to the /proc/sunxi debug/sunxi debug API endpoint.

An issue was discovered in dnaLIMS, where it is vulnerable to session hijacking by guessing the `UID` parameter.

An issue was discovered in dnaLIMS where it stores passwords in plaintext. The passwords are stored in the /home/dna/spool/.pfile file.

An issue was discovered in dnaLIMS, allowing an unauthenticated attacker to access system files readable by the web server user through a NUL-terminated directory traversal attack. This is achieved by exploiting the `seqID` parameter in the "viewAppletFsa.cgi" endpoint.

The issue concerns an improperly protected administrative web shell, allowing unauthenticated command execution. This can be exploited through `cgi-bin/dna/sysAdmin.cgi` using specially crafted POST requests, enabling a remote attacker to execute arbitrary commands. The vulnerability is related to the lack of input data sanitization measures in the administrative web shell of the dnaLIMS software.

The issue is related to multiple buffer overflows in the FTP server, which can be exploited by remote attackers to cause a denial of service, specifically a TCP/IP outage. This can be achieved by sending long arguments to certain commands, including the `XRMD`, `delete`, `RNFR`, or `RNTO` command.