CS Money: Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)

Description Hello there, on new.cs.money or cs.money, there is anti-CSRF mechanism, which is Referer header check. However, I discovered that regex logic for checking Referer header is flawed. I found that adding or at the end of the domain pass the validation. Therefore, if a request comes from...

TP-Link WDR4300 Remote Code Execution

!/usr/bin/python3 import sys import hashlib import base64 import requests import binascii import socket """ RCE via stack-based overflow on TP-Link WDR4300 N750 devices, using CVE-2017-13772. Tested on Firmware versions 3.13.33, Build 130618 and 3.14.3 Build 150518, hardware WDR4300 v1 Usage: 1...

CVE-2020-7932

OMERO.web before 5.6.3 optionally allows sensitive data elements e.g., a session key to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target...

PYSEC-2020-244

OMERO.web before 5.6.3 optionally allows sensitive data elements e.g., a session key to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target...

Path traversal

OMERO.web before 5.6.3 optionally allows sensitive data elements e.g., a session key to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target...

CVE-2020-13167

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters...

Same-site Request Forgery (SSRF)

typo3/cms-core is vulnerable to a same-site request forgery. The attack is possible to trigger because it does not properly enforce HTTP Referer header that usually protects against cross-site request forgery, allowing an authenticated backend user to launch the attack...

Netsweeper WebAdmin unixlogin.php Python Code Injection

This module exploits a Python code injection in the Netsweeper WebAdmin component's unixlogin.php script, for versions 6.4.4 and prior, to execute code as the root user. Authentication is bypassed by sending a random whitelisted Referer header in each request. Tested on the CentOS Linux-based...

Netsweeper WebAdmin unixlogin.php Python Code Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netsweeper WebAdmin unixlogin.php Python Code Injection', 'Description' = %q This module exploits a Python code injection in the Netsweeper...

Rockstar Games: Referer Referer Header Leakage in language changer may lead to FB token theft

In this report, the researcher discovered an open redirect vulnerability that could be exploited by changing the language on the page at https://www.rockstargames.com/GTAOnline, and cause the user's full URL potentially including sensitive tokens to be included in the Referer header to the new...

Kartris 1.6 Arbitrary File Upload

Exploit Title: Kartris 1.6 - Arbitrary File Upload Dork: N/A Date: 2020-05-08 Exploit Author: Nhat Ha - Sun CSR Vendor Homepage: https://www.cactusoft.com/ Software Link: https://www.kartris.com/ Version: 1.6 Category: Webapps Tested on: WiN10x64/KaLiLinuXx64 CVE: N/A POC:...

PlayStation: Access Token Smuggling from my.playstation.com via Referer Header

I discovered a way to smuggle an access token from my.playstation.com via Referer header through chain of open redirection vulnerability. On my investigation of authentication flow I found this endpoint with potential site for open redirect vulnerability...

TP-Link Archer C50 Denial of Service Vulnerability

The TP-Link Archer C50 is a wireless router from China P&L TP-Link. A security vulnerability exists in versions prior to TP-Link Archer C50 V3 Build 200318 Rel. 62209. A remote attacker can exploit this vulnerability to cause a denial of service via an HTTP header with an illegal referer field...

CVE-2020-9375

TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field...

Chadha Software Technologies PHPKB Standard Multi-Language article.php Cross-Site Scripting Vulnerability

Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A cross-site scripting vulnerability exists in the way the Referer header is handled in the article.php file in Chadha Software...

CVE-2020-10388

The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/report-referrers.php vulnerable file admin/include/functions-articles.php...

CVE-2020-10388

The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/report-referrers.php vulnerable file admin/include/functions-articles.php...

Cross site scripting

The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/report-referrers.php vulnerable file admin/include/functions-articles.php...

CVE-2020-10388

Chadha PHPKB Standard Multi-Language v9 is affected by CVE-2020-10388 due to improper handling/validation of the Referer header in article.php, enabling Stored (Blind) XSS via admin/report-referrers.php (vulnerable code in admin/include/functions-articles.php). Affected component: PHPKB’s article...

CVE-2020-10388

The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored Blind XSS injecting arbitrary web script or HTML in admin/report-referrers.php vulnerable file admin/include/functions-articles.php...