7 Sticky Notes v1.9 - OS Command Injection

vendor:

7 Sticky Notes

by:

Ahmet Ümit BAYRAM

6.1

CVSS

HIGH

OS Command Injection

CWE

Product Name: 7 Sticky Notes

Affected Version From: 1.9.2024

Affected Version To: 1.9.2024

Patch Exists: NO

Related CWE: CVE-2023-XXXX (Example CVE)

CPE: a:7stickynotes:7_sticky_notes:1.9

Metasploit:

Other Scripts:

Platforms Tested: Windows

2023

7 Sticky Notes v1.9 – OS Command Injection

7 Sticky Notes v1.9 is vulnerable to OS command injection. By manipulating the 'Action' field in the 'Alarms' tab, an attacker can execute arbitrary commands on the system. An attacker can set a malicious command as an alarm action, leading to the execution of the command when the alarm triggers.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user inputs to prevent command injection attacks. Additionally, limiting the functionalities of the application to only necessary operations can reduce the attack surface.

Source

Exploit-DB raw data:

# Exploit Title: 7 Sticky Notes v1.9 - OS Command Injection
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 12.09.2023
# Vendor Homepage: http://www.7stickynotes.com
# Software Link:
http://www.7stickynotes.com/download/Setup7StickyNotesv19.exe
# Tested Version: 1.9 (latest)
# Tested on: Windows 2019 Server 64bit

# # #  Steps to Reproduce # # #

# Open the program.
# Click on "New Note".
# Navigate to the "Alarms" tab.
# Click on either of the two buttons.
# From the "For" field, select "1" and "seconds" (to obtain the shell
within 1 second).
# From the "Action" dropdown, select "command".
# In the activated box, enter the reverse shell command and click the "Set"
button to set the alarm.
# Finally, click on the checkmark to save the alarm.
# Reverse shell obtained!