The vulnerability allows an attacker to bypass authentication by setting the username and password to 'or''=' and hitting enter.
The functions.php file line 88 has hardcoded admin credentials. Using the hardcoded admin credentials we then have access to the process.php file that is vulnerable to SQL injection. The parameter cId is vulnerable to boolean-based blind, error-based and AND/OR time-based blind SQL injection.
The TSP touchscreen controller driver exposes several sysfs entries through which the driver may be configured. One such entry, 'cmd', allows the user to write commands to be executed by the driver. Specifically, the 'cmd' entry is writable, and is present under '/sys/devices/virtual/sec/tsp/cmd'. Writes to this sysfs entry are handled by the function 'cmd_store', under drivers/input/touchscreen/sec_ts/sec_ts_fn.c. This function fails to validate the length of the supplied buffer, before copying data from it into two memory locations. First, the data is copied into a static structure and second, the user-supplied data is copied into a local stack-allocated buffer, allowing the attacker to overwrite the data on the stack, including the value of frame pointer and return address, simply by providing a buffer of length >CMD_STR_LEN.
The vulnerability exist in the web interface, which is accessible without authentication. Once modified, systems use foreign DNS servers, which are usually set up by cybercriminals. Users with vulnerable systems or devices who try to access certain sites are instead redirected to possibly malicious sites. Modifying systems' DNS settings allows cybercriminals to perform malicious activities like steering unknowing users to bad sites, replacing ads on legitimate sites, controlling and redirecting network traffic, and pushing additional malware.
The vulnerability exist in the web interface, which is accessible without authentication. Once modified, systems use foreign DNS servers, which are usually set up by cybercriminals. Users with vulnerable systems or devices who try to access certain sites are instead redirected to possibly malicious sites. Modifying systems' DNS settings allows cybercriminals to perform malicious activities like steering unknowing users to bad sites, replacing ads on legitimate sites, controlling and redirecting network traffic, and pushing additional malware.
An attacker can exploit this vulnerability to read from the database. The attacker can use the SQLmap tool to exploit the vulnerability. The payloads used are boolean-based blind, AND/OR time-based blind and UNION query.
The login portal of Courier Management System is vulnerable to SQL Injection and Cross-Site Scripting attacks. An attacker can exploit this vulnerability by sending a malicious payload in the POST request to the login portal. The payload can be used to extract sensitive information from the database or to execute malicious scripts on the user's browser.
The vulnerability allows an attacker to bypass authentication by setting the Username and Password to 'or''=' and then hitting enter. Additionally, the attacker can exploit SQL injection vulnerabilities in the category.entryform.php and page.editor.php files, as well as other files.
Authentication Bypass: An attacker can bypass authentication by setting the Username and Password to 'or''=' and hitting enter. SQL Injection/Exploit: An attacker can exploit the vulnerability by injecting malicious SQL code into the following URLs: http://localhost/[PATH]/backoffice/security.php?act=edit_cat&id=[SQL], http://localhost/[PATH]/backoffice/blog_category.php?act=edit_cat&blog_category_id=[SQL], http://localhost/[PATH]/backoffice/photo.php?act=edit_cat&photo_id=[SQL], http://localhost/[PATH]/backoffice/video.php?act=edit_cat&video_id=[SQL], http://localhost/[PATH]/backoffice/banner_list.php?act=edit_cat&banner_id=[SQL], etc.
Every user can read c:Program Files (x86)SentryHDconfig.ini which contains login and password for web panel. UPSMan is running on autostart as System. Using Execute Command File, commands can be executed on Scheduled system shutdown as System.
Services By CQR