Vulners
Lucene search
Prisma Industriale Checkweigher PrismaWEB 1.21 Authentication Bypass
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2018-9161 | 31 Mar 201822:29 | – | attackerkb |
 | Prisma Industriale Checkweigher PrismaWEB Hardcoded Credentials Vulnerability | 19 Apr 201800:00 | – | cnvd |
 | CVE-2018-9161 | 31 Mar 201822:00 | – | cve |
 | CVE-2018-9161 | 31 Mar 201822:00 | – | cvelist |
 | PrismaWEB - Credentials Disclosure | 5 Jun 202603:02 | – | nuclei |
 | CVE-2018-9161 | 31 Mar 201822:29 | – | nvd |
 | Hardcoded credentials | 31 Mar 201822:29 | – | prion |
 | CVE-2018-9161 | 22 May 202507:28 | – | redhatcve |
<html><body><p>Prisma Industriale Checkweigher PrismaWEB 1.21 Authentication Bypass
Vendor: Prisma Industriale S.r.l.
Product web page: https://www.prismaindustriale.com
Affected version: 1.0 (Rev 21, EPROM 202FWSAM ??)
Summary: Web Administration of Machine.
Desc: The vulnerability exists due to the disclosure of hard-coded credentials allowing
an attacker to effectively bypass authentication of PrismaWEB with administrator
privileges. The credentials can be disclosed by simply navigating to the login_par.js
JavaScript page that holds the username and password for the management interface that
are being used via the Login() function in /scripts/functions_cookie.js script.
Tested on: HMS AnyBus-S WebServer
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2018-5453
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5453.php
06.02.2018
---
$ curl http://10.10.10.70/user/scripts/login_par.js
// JavaScript Document
// 11 Dicembre 2009 Release 1.0 Rev.10
var txtChkUser = "prismaweb"; // Nome utente Login
var txtChkPassword = "prisma"; // Password Login
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
10 Mar 2018 00:00Current
7.2High risk
Vulners AI Score7.2
CVSS 27.5
CVSS 39.8
EPSS0.55123