A tale of a kiosk escape: ‘Sricam CMS’ Stack Buffer Overflow

TL;DR: Shenzhen Sricctv Technology Sricam CMS (SricamPC.exe) <= v.1.0.0.53(4) and DeviceViewer (DeviceViewer.exe) <= v.3.10.12.0 (CVE-2019-11563) are affected by a local Stack Buffer Overflow. By creating a specially crafted "Username" and copying its value in the "User/mail" login field, an attacker will be able to gain arbitrary code execution in the context of the currently logged-in user. Please Note: by default, Sricam CMS requires elevation and runs in High Integrity mode; exploitation of the above software will result in a compromise of...

Posted By

Phorum – Full Disclosure

Reporter VoidSec Security Team Advisory VoidSec-16-002 Date of contact 03-03-16 2nd date of contact 16-03-16 3rd date of contact 04-04-16 Vendor last reply 03-03-16 Date of public disclosure 21-04-16 Product Phorum Open Source PHP Forum Software Version 5.2.20   Download the Report [EN] Introduction The purpose of the present project is to assess the security posture of some important aspects of Phorum Forum Software. Phorum is open source forum software with a penchant for speed. Phorum's very flexible hook and module system can satisfy every web master's needs. During the web application security assessment for Phorum, VoidSec assessed the following systems using...

Posted By

Avactis – Full Disclosure

Advisory: VoidSec-16-001 Date of contact: 19-01-16 2nd date of contact: 23-01-16 Vendor reply: N/A Date of public disclosure: 12-04-16 Product: Avactis PHP Shopping Cart Version: 4.7.9.Next.47900 Vendor: Avactis   Download the Report [EN] Introduction Avactis is an open source ecommerce Shopping Cart software. The purpose of the present project is to assess the security posture of some important aspects of Avactis PHP Shopping Cart. The activity is performed through Web Application Penetration Test using Grey Box approach. Vulnerabilities: Spreading of Files with Malicious Extensions on Upload New Design and Execution in some circumstances Non-Admin PHP Shell...

Posted By

Tecniche Evasive #2

In seguito al primo articolo relativo alle tecniche evasive mi avete scritto in tanti dandomi feedback e generando discussioni utili, ecco pertanto un “secondo capitolo”. Premessa Mi è stato fatto notare come il termine attaccante venga utilizzato nello sport mentre la traduzione corretta di “attacker” sia aggressore, ho quindi “patchato” il seguente articolo sistemando la terminologia. Un piccolo approfondimento per quanto riguarda la mia frase: “Il Social Engineering incontra una forte resistenza da parte delle singole aziende e dei sindacati, non è infatti...

Posted By

Tecniche Evasive

Recentemente, per lavoro, ho preso parte a un’operazione di Red Teaming. Ho trovato l’esperienza interessante ed emozionante poiché è l’unica tipologia di test in cui si possono mettere a frutto tutte le competenze e spaziare nella tipologia di attacchi da effettuare e di bersagli da colpire. Hacknowledge Red Team: gruppo indipendente di penetration tester assunto dall’organizzazione bersaglio che, all’insaputa dei suoi stessi reparti tecnici, effettua un attacco contro l’organizzazione stessa. L’obiettivo del team è di testare difese e “risposte” nell’ambito di un...

Posted By