0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Livetecs Timelive 6.2.71 Unauthenticated Access / File Upload Vulnerabilities
Author
Risk
[Security Risk Critical
]0day-ID
Category
Date add
CVE
Platform
Vulnerability title: Unauthenticated access to sensitive information and
functionality in Livetecs Timelive
CVE: CVE-2014-1217
Vendor: Livetecs
Product: Timelive
Affected version: 6.2.71
Fixed version: 6.2.8
Reported by: Richard Hatch
Details:
It was possible to access a URL that allowed unauthenticated access
to sensitive configuration change functionality, and also revealed the
database connection
string (including authentication credentials) used by TimeLive to access
the database.
The following URL was identified:
http://MyTimeLiveServer/home/systemsetting.aspx
Note: This URL was identified by entering "timelive default credentials"
into the Google
Internet search engine. At time of writing the URL was revealed by the
first result returned
by Google.
Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1217/
Vulnerability title: Unrestricted file upload in Livetecs Timelive
CVE: CVE-2014-2042
Vendor: Livetecs
Product: Timelive
Affected version: 6.2.71
Fixed version: 6.5.1
Reported by: Richard Hatch
Details:
It was discovered that it was possible for low-level TimeLive
application users to upload
files (by using the "My Projects".."Manage Project" functionality).
There was no restriction on
file types that could be uploaded and the permissions applied to those
uploaded files included
"Read and Execute".
1. Using any text editor create a new file "run-cacl.aspx" and add the
following content:
<%@ Page Language="VB" %>
<%
System.Diagnostics.Process.Start("calc.exe")
%>
2. Login to the TimeLive application as a low-level (standard) user
3. Click "My Projects" from the left-hand menu
4. Click the "Manage" icon - It looks like a notepad and pen
5. Scroll to the bottom of the page that opens and click "Attachment"
6. Click "Browse" and navigate to to where you saved "run-cacl.exe"
7. Click "Upload"
8. Logout of TimeLive [Optional]
9. On the server hosting the TimeLive application run "TaskMgr"
9. Browse to http://MyTimeLiveURL/Uploads/1/1/run-cacl.aspx
10. Observe "calc.exe" running as "NETWORK_SERVICE" in the Task manager
Note: Depending on the configuration of the TimeLive application used
for testing it may be
necessary to change the "1/1" part of the URL.
Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2042/
# 0day.today [2024-11-16] #