compop.ca 3.5.3 - Arbitrary Code Execution

vendor:

compop

by:

dmlino

6.1

CVSS

HIGH

Improper Authentication

287

CWE

Product Name: compop

Affected Version From: 3.5.2003

Affected Version To: 3.5.2003

Patch Exists: NO

Related CWE: CVE-2024-48445

CPE: a:compop:compop:3.5.3

Metasploit:

Other Scripts:

Platforms Tested:

2024

compop.ca 3.5.3 – Arbitrary Code Execution

The compop.ca 3.5.3 version of the restaurant management system is susceptible to arbitrary code execution due to the insecure implementation of authentication using a Unix timestamp parameter ('ts') in the URL. This vulnerability allows attackers to manipulate the timestamp parameter, which lacks proper authentication controls.

Mitigation:

To mitigate this vulnerability, it is recommended to implement secure authentication mechanisms, such as session tokens or multi-factor authentication, instead of relying solely on timestamp values for validation.

Source

Exploit-DB raw data:

# Exploit Title: compop.ca 3.5.3 - Arbitrary code Execution
# Google Dork: Terms of Use inurl:compop.vip
# Date: 22/12/2024
# Exploit Author: dmlino
# Vendor Homepage: https://www.compop.ca/
# Version: 3.5.3
# CVE : CVE-2024-48445


The restaurant management system implements authentication using a Unix
timestamp parameter ("ts") in the URL. This implementation is vulnerable to
manipulation as it relies solely on time-based validation without proper
authentication mechanisms.

Technical Details:
The application uses a URL parameter "ts" which accepts a Unix timestamp
value.

Steps:
1. Find a vulnerable restaurant.

2. Get the current time in the UNIX format:
    Linux: $date +%s
    Windows Powershell: [int](Get-Date -UFormat %s -Millisecond 0)

3. Replace parameter in url with the new value