PHP Uber-style GeoTracking 1.1 SQL Injection

Exploit Title: PHP Uber-style GeoTracking 1.1 - SQL Injection Dork: N/A Date: 2019-01-21 Exploit Author: Ihsan Sencan Vendor Homepage: http://dataninja.biz Software Link: https://codecanyon.net/item/php-uberstyle-geotracking/20320021 Version: 1.1 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

PHP Uber-style GeoTracking 1.1 - SQL Injection

Exploit Title: PHP Uber-style GeoTracking 1.1 - SQL Injection Dork: N/A Date: 2019-01-21 Exploit Author: Ihsan Sencan Vendor Homepage: http://dataninja.biz Software Link: https://codecanyon.net/item/php-uberstyle-geotracking/20320021 Version: 1.1 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64...

A week in security (November 26 – December 2)

Last week on Malwarebytes Labs, we took a look at our cybersecurity predictions for 2019, we explained why Malwarebytes participated in AV testing and how we took part in an joint take down of massive ad fraud botnets, warned that ESTA registration websites still lurk in paid ads on Google,...

This Week in Security News: Ethics and Law in the Dark Web

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, learn how Trend Micro software can aid in safely securing containers on the AWS Cloud. Also, how the dark web has become a new advertising...

Uber fined $1.1 million by UK and Dutch regulators over 2016 data breach

British and Dutch data protection regulators Tuesday hit the ride-sharing company Uber with a total fine of $1,170,892 1.1 million for failing to protect its customers' personal information during a 2016 cyber attack involving millions of users. Late last year, Uber unveiled that the company had...

Uber: [usuppliers.uber.com] - Server Side Request Forgery via XXE OOB

It was possible to determine open internal ports on an usuppliers.uber.com server, via examination of different error messages to a specific POST request made with various payloads. This error message discrepancy would allow an attacker to discover open internal ports, potentially allowing more...

Uber: Access to SQL server of ubergreen.pt through password disclosure from different domain on same IP

The uber microsite http://ubergreen.pt has an open MYSQL port on 3306. ubergreen.pt itself is hosted on the IP 109.71.41.173. After some research, it was found that this IP also hosts many other domains. As of yesterday 11/10/18, this included the domain apps.etnos.co. This domain existed on the...

Uber: Client secret, server tokens for developer applications returned by internal API

@appsecurein identified an internal API for https://riders.uber.com that could return clientsecret and server token for applications authorized by the account owner to access their Uber account. We restricted the data returned by this endpoint. Thanks for bringing this to our attention,...

Uber: Full Path and internal information disclosure+ SQLNet.log file disclose internal network information

The site at lab.usuppliers.uber.com was intended only for authenticated users, but certain internal pages did not enforce an authentication requirement. The log file at /OAHTML/bin/sqlnet.log disclosed internal Uber IP addresses, hostnames, and one internal username. Thanks again for this report...

CVE-2017-13104

CVE-2017-13104 affects UberEATS: Uber for Food Delivery (iOS) version 1.108.10001; vulnerability stems from a hard-coded encryption key used by the app, enabling data stored with that key to be decrypted by anyone who has the key. Public CVSS metrics in the record show total base score 7.5 (HIGH)...

CVE-2017-13104 Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption

Uber Technologies, Inc. UberEATS: Uber for Food Delivery, 1.108.10001, 2017-11-02, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

Uber: Reflected XSS on https://www.uber.com

By getting an authenticated victim to visit a malicious website, an attacker can cause that victim to execute arbitrary JavaScript in the context of the uber.com domain. More details here: https://medium.com/@saamux/applying-a-small-bypass-to-steal-facebook-session-tokens-in-uber-5b9638b7a18c...

Uber: Reflected XSS on Partners Subdomain

There was a reflected cross site scripting vulnerability at https://partners.uber.com/. By providing a specifically crafted value, it was possible for an attacker to inject malicious content into the partners.uber.com site, which would then be executed when the site is loaded. We enjoyed working...

Uber: [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools

A configuration file on experience.uber.com exposed details for the server configuration as well as information about the content hosted on the site. The site itself did require authentication to log in, but this config file was publicly accessible. Other accessible URLs included slide deck...

Uber driver recorded passengers & live-streamed videos on Twitch

By Carolina What is shocking about this incident is that what the Uber driver did was legal under Missouri law. Jason Gargac, an Uber and Lyft driver from St Louis Missouri, USA recorded and live-streamed his passengers' activities on the video-sharing website Twitch, without their consent and...

Uber: Information Leak - GitHub - Endpoint Configuration Details

@peuch found a publicly available Github repository providing insight about security controls in place on Uber workstations. We enjoyed working with @peuch on this issue and look forward to their future submissions to our program...

uber-test501.adaptavist.cloud XSS vulnerability

Open Bug Bounty ID: OBB-631950 Description| Value ---|--- Affected Website:| uber-test501.adaptavist.cloud Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Uber: Privacy policy contains hardcoded link using unencrypted HTTP

The link to Uber’s privacy policy was using the unencrypted http:// scheme, making it possible for an attacker with the ability to Man-in-The-Middle MiTM traffic. This would allow them to replace normal responses with malicious content such as a phishing page. The content would then render within...

Uber: Information Leakage - GitHub - VCenter configuration scripts, StorMagic usernames and password along with default ESXi root password

@peuch found data exposure on Github - expired passwords and usernames for ESXi a bare metal hypervisor. The researcher also found credentials to a SendGrid instance uberinfradevtools, which would have allowed them to log in to SendGrid and send email from any @uber.com address. However, this wou...

Uber: SQLI on uberpartner.eu leads to exposure of sensitive user data of Uber partners

The Uber EU test site has a SQLI vulnerability exposing several databased and based on the database names, may expose hashed passwords and Uber partner information. Basic time-based SQLI that disclosed a database on a Uber EU test site. Check out my blog https://healdb.tech/blog/ or my Twitter...