Attacker Value
Very High
1
MSMS-PHP (by: oretnom23 ) v1.0 - HIT STRIKE!
1
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
Attacker Value
Very High
(1 user assessed)
Exploitability
Very High
(1 user assessed)User Interaction
Unknown
Privileges Required
Unknown
Attack Vector
Unknown
1
MSMS-PHP (by: oretnom23 ) v1.0 - HIT STRIKE!
Last updated September 02, 2021 ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Execution
Techniques
Validation
Validated
Validated
Validated
MITRE ATT&CK
Select the MITRE ATT&CK Tactics that apply to this CVE
Collection
Select any Techniques used:
Command and Control
Select any Techniques used:
Credential Access
Select any Techniques used:
Defense Evasion
Select any Techniques used:
Discovery
Select any Techniques used:
Execution
Select any Techniques used:
Exfiltration
Select any Techniques used:
Impact
Select any Techniques used:
Initial Access
Select any Techniques used:
Lateral Movement
Select any Techniques used:
Persistence
Select any Techniques used:
Privilege Escalation
Select any Techniques used:
Topic Tags
Select the tags that apply to this CVE (Assessment added tags are disabled and cannot be removed)
What makes this of high-value to an attacker?
What makes this of low-value to an attacker?
Description
CVE-nu11-05 MSMS-PHP (by: oretnom23 ) v1.0 HIT STRIKE
Description:
The MSMS-PHP (by: oretnom23 ) v1.0 is vulnerable in three sections!
- – – remote SQL-Injection-Bypass-Authentication
- m0re info: https://portswigger.net/support/using-sql-injection-to-bypass-authentication.
The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads.
When the user will sending a malicious query or malicious payload to the MySQL server he can bypass the login credentials and take control of the administer account.
- – – XSS – Stored PHPSESSID Vulnerable
- – The vulnerable XSS app: is “brand”, parameters: “name” and “description”
After the successful SQL injection, the malicious user can be storing an XSS payload whit who can take the
active PHPSESSID session.
- – – remote PHPSESSID – Hijacking
- After the successful XSS attack the malicious user can take control of the administrative account of the system from everywhere
by using the PHPSESSID, and then he can make a lot of bad things!
Add Assessment
1
Ratings
-
Attacker ValueVery High
-
ExploitabilityVery High
Technical Analysis
CVE-nu11-05 MSMS-PHP (by: oretnom23 ) v1.0 HIT STRIKE
Description:
The MSMS-PHP (by: oretnom23 ) v1.0 is vulnerable in three sections!
- – – remote SQL-Injection-Bypass-Authentication
- m0re info: https://portswigger.net/support/using-sql-injection-to-bypass-authentication.
The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads.
When the user will sending a malicious query or malicious payload to the MySQL server he can bypass the login credentials and take control of the administer account.
- – – XSS – Stored PHPSESSID Vulnerable
- – The vulnerable XSS app: is “brand”, parameters: “name” and “description”
After the successful SQL injection, the malicious user can be storing an XSS payload whit who can take the
active PHPSESSID session.
- – – remote PHPSESSID – Hijacking
- After the successful XSS attack the malicious user can take control of the administrative account of the system from everywhere
by using the PHPSESSID, and then he can make a lot of bad things!
Remote vulnerable links execution:
- – – [+] . http://localhost/mobile_store/admin/login.php
- – – [+] . http://localhost/mobile_store/admin/?page=maintenance/brand
Broken query:
public function login(){ extract($_POST); $qry = $this->conn->query("SELECT * from users where username = '$username' and password = md5('$password') "); if($qry->num_rows > 0){ foreach($qry->fetch_array() as $k => $v){ if(!is_numeric($k) && $k != 'password'){ $this->settings->set_userdata($k,$v); } }
The fix, but not strong enough!
public function login(){ extract($_POST); $qry = $this->conn->query("SELECT * from users where username = ('$username') and password = md5('$password') "); if($qry->num_rows > 0){ foreach($qry->fetch_array() as $k => $v){ if(!is_numeric($k) && $k != 'password'){ $this->settings->set_userdata($k,$v); } }
Stored XSS payload:
<p class="truncate-1 m-0">alert(document.cookie)</p>
Proof:
- [+] href
CONCLUSION:
- – – [+]
This vendor must STOP creating all these broken projects and vulnerable software programs, probably he is not a developer!
BR
- [+] @nu11secur1ty System Administrator – Infrastructure and Penetration Testing Engineer
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportGeneral Information
Offensive Application
remote
Utility Class
credential
Ports
Unknown
OS
Unknown
Vulnerable Versions
Unknown
Prerequisites
Unknown
Discovered By
nu11 secur1ty
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
nu11 secur1ty
References
Additional Info
Authenticated
Always
Exploitable
Always
Reliability
Very Weak
Stability
Very Weak
Available Mitigations
Very Weak
Shelf Life
Very Short
Userbase/Installbase
Very Small
Patch Effectiveness
Medium
Rapid7
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
