H00Die

A stored cross-site scripting issue exists where attackers who control files on a target endpoint can execute JavaScript within the Mythic UI origin. This is achieved by placing HTML content inside files with a .pdf extension. When an operator selects Preview Media after downloading such a file, the HTML is rendered as same-origin via the '/direct/view' endpoint due to content-sniffing. This allows the attacker to steal JSON Web Tokens (JWTs) from `localStorage`, granting full access to GraphQL and REST interfaces.

The post module `post/apple ios/gather/ios image gather` contains a relative path traversal issue. The module takes file names from a Meterpreter directory listing, which can be controlled by a compromised iOS device, and passes them without sanitization to the `client.fs.file.download file()` function. This allows a malicious device to escape the intended storage directory and overwrite sensitive files on the operator's workstation, such as the `msfconsole.rc` resource file. Since `msfconsole.rc` is executed automatically at startup, an attacker can achieve persistent code execution and obtain an interactive shell with the privileges of the operator, often root, by loading a malicious Ruby plugin.

An unhandled panic exists in the operator gRPC handler. An attacker controlling a compromised implant can crash the teamserver by returning a malformed or empty Download response. By sending zero-length or 1-3 byte data payloads through a hostile implant session, an out-of-bounds slice access is triggered in the `BinaryMagic()` function of the vendored Binject library. This failure propagates through the operator gRPC interceptor chain and terminates the server process, disconnecting all operators.

A remote code execution issue exists due to an undocumented backdoor listener on UDP port 53413. An unauthenticated remote attacker can send specially crafted UDP packets to execute arbitrary commands on the affected device. The backdoor uses a hardcoded authentication mechanism and accepts shell commands post-authentication. Some device models include a non-standard implementation of the `echo` command, which may affect exploitability.

The issue arises due to the product's reliance on a trivial substitution cipher sent in cleartext and its use of a default password when no password is set by the user. This allows attackers to inject OS commands over the product's custom control protocol.

The web management interface for Unified Intents' Unified Remote solution does not require authentication, allowing a remote, unauthenticated attacker to change or disable authentication requirements for the Unified Remote protocol. This can be leveraged to run code of the attacker's choosing. The issue is related to an incorrect authorization procedure in the web management interface.

The issue is related to a SQL Injection vulnerability in the admin interface of VICIdial, specifically affecting the `/vicidial/admin.php` endpoint through the `modify email accounts`, `access recordings`, and `agentcall email` parameters. This allows an attacker to spoof identity, tamper with existing data, disclose all data on the system, destroy data, or become administrators of the database server.

The issue is related to a SQL Injection vulnerability in the AST Agent Time Sheet interface of VICIdial, specifically in the `/vicidial/AST agent time sheet.php` endpoint, via the `agent` parameter. This allows an attacker to spoof identity, tamper with existing data, disclose all data on the system, destroy data, or make it unavailable, and potentially become administrators of the database server.

The issue allows an attacker to spoof identity, tamper with existing data, disclose all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server via a SQL Injection vulnerability in the User Stats interface. The vulnerability is exploited through the `file download` parameter in the `/vicidial/user stats.php` API endpoint.

The issue allows an unauthenticated user to bypass authentication and inject arbitrary commands into the `parameters` using backquotes in the "/api/hosts" API endpoint.

A security issue was found where the authentication in libbpext.so could be bypassed using a SQL injection, allowing a remote attacker to potentially place a privilege escalation exploit on the system and execute arbitrary commands.

The issue is related to the `api/storage` web interface, where an input parameter was not validated, allowing a remote attacker to bypass authentication and execute arbitrary commands with root privilege on the target system. This flaw is associated with deficiencies in the authentication procedure, which can be exploited by a remote attacker to bypass authentication or execute arbitrary commands with root privileges.

The issue allows local users to gain root privileges. This is achieved by sending "rootmydevice" to the /proc/sunxi debug/sunxi debug API endpoint.

An issue was discovered in dnaLIMS, where it is vulnerable to session hijacking by guessing the `UID` parameter.

An issue was discovered in dnaLIMS where it stores passwords in plaintext. The passwords are stored in the /home/dna/spool/.pfile file.

An issue was discovered in dnaLIMS, allowing an unauthenticated attacker to access system files readable by the web server user through a NUL-terminated directory traversal attack. This is achieved by exploiting the `seqID` parameter in the "viewAppletFsa.cgi" endpoint.

The issue concerns an improperly protected administrative web shell, allowing unauthenticated command execution. This can be exploited through `cgi-bin/dna/sysAdmin.cgi` using specially crafted POST requests, enabling a remote attacker to execute arbitrary commands. The vulnerability is related to the lack of input data sanitization measures in the administrative web shell of the dnaLIMS software.

The issue is related to multiple buffer overflows in the FTP server, which can be exploited by remote attackers to cause a denial of service, specifically a TCP/IP outage. This can be achieved by sending long arguments to certain commands, including the `XRMD`, `delete`, `RNFR`, or `RNTO` command.