Researchers have released details on a trio of cross-site scripting (XSS) vulnerabilities in popular open source apps that could lead to remote code execution (RCE).
The security bugs, found by a research team from PT Swarm, were discovered in web development applications Evolution CMS, FUDForum, and GitBucket.
Web security researcher Aleksey Solovev told The Daily Swig that this research, detailed in PT Swarm’s blog, relates to how “the combination of the discovered possibility of conducting an XSS attack and the built-in file manager (or executing a SQL query) in the administrator panel can lead to a complete compromise of the system”.
The first vulnerability, in Evolution CMS v3.1.8, could allow an attacker to carry out a reflected XSS attack in several places in the admin panel.
“The consequence would be a complete compromise of the system by overwriting the executable file using the built-in file manager.”
A second flaw, found in FUDforum v3.1.1, could potentially allow a malicious actor to carry out a stored XSS attack in the name of the attached file in private messages.
“An attacker could send a private message to an administrator with a malicious payload in the name of the attached file,” said Solovev.
Finally, in GitBucket v4.37.1, a security bug was discovered that could enable an attacker to carry out a stored XSS attack in “several places”, according to Solovev.
“In the admin panel, it was possible to execute SQL code based on the H2 Database Engine, for which there is already an exploit that allows you to execute a command on the server,” Solovev explained.
“Putting everything together, an attacker could attack the administrator and gain the ability to execute commands on the server.”
All three vulnerabilities are pending a CVE but have been patched by the maintainers of the projects, Solovev told The Daily Swig.
The researcher added that the main difficulty in discovering these flaws was to find the possibility of conducting an XSS attack.
“The rest of the steps were easier because they had public exploits for legitimate functionality in the form of a file manager in the admin panel,” he explained.
More information about the vulnerabilities and technical detail on the exploit can be found in PT Swarm’s blog.
Your daily horoscope for Friday, August 19, 2022
Nigeria Spends N18.3bn Daily On Fuel Subsidy – Finance Minister
Ortom Bans Mining Activities In Benue
Adamu Reveal Why Jonathan’s Almajiri School Programme Failed
eNaira Has Recorded 840,000 Downloads, N4bn Transactions – CBN Governor
I Started Singing To Get Girls – Patoranking
TCN: We’ve implemented new technology to enhance the performance of the national grid
546 kilometers of roads have been built in Edo over the past six years, while 886 kilometers have been planned – Government
Court sentences a man to 37 years of imprisonment for fingering a minor
Segun Showunmi, Ogun PDP: “I will fight this struggle to the end”
Plateau PDP nominates former APC chairman as governorship campaign DG
Officials from Manchester United are in negotiations to sign Joao Felix from Atletico Madrid
Manchester United is teased by Atletico Madrid on their transfer request for Joao Felix
Son Heung-min may have been the target of racial remarks when Tottenham and Chelsea drew at the weekend
Sir Jim Ratcliffe, the richest man in Great Britain, expresses interest in purchasing Manchester United
2023 Budget: Nigerian govt slams N8.52trn for staff salaries, others, Presidency gets N14.2bn
U20WWC: France joins the Falconets from Group C, breaking South Korea’s heart.
Apple To Launch iPhone 14 On September [See Date]
At London’s Soultown Festival, lead performers included Gabrielle, Soul 2 Soul, and Heather Small
British billionaire, Jim Ratcliffe to buy Man United
U-20 WWC: Super Falconets flogs Canada, to meet Netherlands in quarter-finals
National Blackout: Electricity Workers Call Off Strike
Why I visited Femi Kuti – Peter Obi
Reps To Investigate Agric Ministry Over N18.6bn Spent To Clear Bush, Prepare Land
What fans should expect from sequel – “Squid Game” creator
Buju has questions to answer, a police spokesman claims, after he boasted of spitting on an officer
Buju BNXN engages in a near-free-for-all brawl with police officers
Your daily horoscope for Thursday, August 18, 2022
A robot designed by a snake-loving engineer to restore the reptile’s legs
WhatsApp is working on a feature that would allow you to retrieve deleted messages
Chaos as students drown while having fun on the Lagos beach
Ngige convenes an emergency meeting with electricity employees during a blackout.
How Magu botched high-profile corruption cases while pursuing “Yahoo Boys”
Snapchat’s Paid Users Hit 1 Million
Nigeria Police Officer Rewarded For Rejecting $200,000 Bribe
Police Caution Ronaldo Over Fan Phone Incident
Peter Obi no threat to APC in Imo – Hope Uzodinma
Peter Obi Visit Femi Kuti After Threats From Obidients [VIDEO]
Blackout Looms In Nigeria As Electricity Workers Begin Strike
APC Fires Bauchi Youth Vanguard
Barcelona Finally Register New Signing To La Liga, Lewandowski, Raphinha, Christensen and Kessie
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Complete Episodes)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Final Episode 14)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 12)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 11)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 10)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 02)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 01)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 06)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 08)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 13)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 03)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 05)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 07)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 09)
[STORY] MY HOUSEMAID IS A MARINE SPIRIT (Episode 04)
[STORY] MY LANDLADY (Episode 01)
[STORY] DELILAH’S CURVE (Complete Episodes)
[STORY] MY LANDLADY (Complete Episodes)
[STORY] SADE’S HEART TALE (Episode 22)
[STORY] SADE’S HEART TALE (Episode 21)
[STORY] MY LANDLADY (Episode 06)
NLC demands 50% increase in workers’ salaries
Your weekly tarot horoscope for August 14 to August 20 and Mars entering Gemini
[STORY] MY LANDLADY (Episode 17)
[STORY] MY LANDLADY (Episode 04)
2023 Elections: Presidential Candidates To Pay ₦10 Million For Campaign Posters In Anambra
[STORY] MY LANDLADY (Episode 07)
[STORY] DELILAH’S CURVE (Episode 04)
[STORY] MY LANDLADY (Final Episode 20)
[STORY] MY LANDLADY (Episode 03)
[STORY] DELILAH’S CURVE (Episode 01)
Browser-powered desync: Black Hat USA presents a new class of HTTP request smuggling attacks
[STORY] MY LANDLADY (Episode 08)
[STORY] MY LANDLADY (Episode 09)
[STORY] MY LANDLADY (Episode 11)
Images and videos from Mercy Chinwo’s wedding ceremony
[STORY] MY LANDLADY (Episode 15)
[STORY] MY LANDLADY (Episode 18)
Nigerians’ reactions to Amaarae’s bare-butt dance[Video]
ANE's Billboard Hots
Technology2 months ago
VoIP Number: Everything You Need To Know
Music5 years ago
[Music] Wiz Khalifa – See You Again ft. Charlie Puth
Music2 months ago
[Instrumental] Wiz Khalifa – See You Again ft. Charlie Puth
Music6 years ago
[Music] Ed Sheeran – Perfect
Movie Subtitle2 months ago
DOWNLOAD Complete Money Heist Season 1 Subtitles File [English SRT] 2017
ANE Stories2 months ago
The Story Of My Life (Complete Episode 1 – 47)
Music2 months ago
[Video] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me
Music3 years ago
[Music] Gnash Ft Olivia O’Brien – I Hate you, I Love you