This module exploits multiple vulnerabilities found in Solarwinds Firewall Security Manager 6.6.5. The first vulnerability is an authentication bypass via the Change Advisor interface due to a user-controlled session.putValue API in userlogin.jsp, allowing the attacker to set the 'username' attribute before authentication. The second problem is that the settings-new.jsp file will only check the 'username' attribute before authorizing the 'uploadFile' action, which can be exploited and allows the attacker to upload a fake xls host list file to the server, and results in arbitrary code execution under the context of SYSTEM. Depending on the installation, by default the Change Advisor web server is listening on port 48080 for an express install. Otherwise, this service may appear on port 8080. Solarwinds has released a fix for this vulnerability as FSM-v6.6.5-HotFix1.zip. You may download it from the module's References section.
The vulnerability allows remote attackers to bypass the authentication mechanism and gain unauthorized access.
The Owl Intranet Engine is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to bypass the authentication process and gain administrative access to the application.
The vulnerability exists due to the disclosure of hard-coded credentials allowing an attacker to effectively bypass authentication of PrismaWEB with administrator privileges. The credentials can be disclosed by simply navigating to the login_par.js JavaScript page that holds the username and password for the management interface that are being used via the Login() function in /scripts/functions_cookie.js script.
The "WebServer.cfg" file used by WebLog Expert Web Server Enterprise 9.4 has weak permissions, allowing local users to set a cleartext password and login as admin.
A flaw in the profile section of Online Voting System allows an unauthenticated user to set an arbitrary password for accounts registered in the application. The application does not check the validity of the session cookie and updates the password and other fields of a user based on an incremental identifier and without requiring the current valid password for target account.
An attacker can bypass authentication in the admin dashboard and gain full access to the application and users. Additionally, an attacker can send a malicious page to an authenticated user to change their password.
This module exploits object injection, authentication bypass, and IP spoofing vulnerabilities all together. Unauthenticated users can execute arbitrary commands under the context of the root user. By abusing an authentication bypass issue on gauge.php, adversaries can exploit an object injection vulnerability that leads to an SQL injection attack, which leaks an administrator session token. Attackers can create a rogue action and policy that enables them to execute operating system commands using the captured session token. As a final step, an SSH login attempt with invalid credentials can trigger the created rogue policy, which in turn triggers an action that executes an operating system command with root user privileges. This module was tested against the following product and versions: AlienVault USM 5.3.0, 5.2.5, 5.0.0, 4.15.11, 4.5.0 AlienVault OSSIM 5.0.0, 4.6.1
C2S DVR allows an unauthenticated user to disclose the username & password remotely by a simple request to the server page 'read.cgi?page=2'. Moreover, an attacker could easily access the password change page without any authentication, as the web application does not perform any session management.
The ATCOM PBX system is affected by an authentication bypass vulnerability that allows an attacker to gain admin access without prior authentication. The vulnerability exists in the 'js/util.js' file, where the security check relies on the presence of a 'username' value in the cookies. If the value is not present, the user is redirected to the login page. By manipulating the cookies and setting 'username=admin', an attacker can bypass the authentication and gain admin access.
Services By CQR