Vulners
Lucene search
SharpLynx v9.2.3 Insecure File Permissions
<html><body><p>SharpLynx v9.2.3 Insecure File Permissions
Vendor: Lynx Software Pty Ltd.
Product web page: https://www.sharplynx.com
Affected version: 9.02.0003
Summary: Back Office Software for Sharp POS Terminals. Catering for
the needs of retail and hospitality businesses, SharpLynx has been
developed as a modular software solution with options from simple
program management and sales analysis through to multi-location stock
control.
Desc: SharpLynx suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'C' flag (Change) for 'Authenticated
Users' group.
Tested on: Microsoft Windows 7 Professional SP1 (EN)
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2018-5456
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5456.php
27.03.2018
--
C:\>cacls "Lynx Software"
C:\Lynx Software BUILTIN\Administrators:(ID)F
BUILTIN\Administrators:(OI)(CI)(IO)(ID)F
NT AUTHORITY\SYSTEM:(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\Lynx Software\SharpLynx v9>dir *.exe
Volume in drive C has no label.
Volume Serial Number is 54D3-A5E6
Directory of C:\Lynx Software\SharpLynx v9
02/22/2018 02:23 PM 527,840 SL.exe
02/22/2018 02:23 PM 6,747,104 SLE.exe
02/22/2018 02:23 PM 6,747,104 SLED.exe
02/22/2018 02:23 PM 6,747,104 SLER.exe
02/22/2018 02:23 PM 4,932,064 SLU.exe
02/22/2018 02:23 PM 4,932,064 SLUR.exe
07/15/2016 05:58 PM 7,590,288 TeamViewerQS_en.exe
7 File(s) 38,223,568 bytes
0 Dir(s) 2,677,899,264 bytes free
C:\Lynx Software\SharpLynx v9>cacls *.exe
C:\Lynx Software\SharpLynx v9\SL.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\Lynx Software\SharpLynx v9\SLE.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\Lynx Software\SharpLynx v9\SLED.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\Lynx Software\SharpLynx v9\SLER.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\Lynx Software\SharpLynx v9\SLU.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\Lynx Software\SharpLynx v9\SLUR.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\Lynx Software\SharpLynx v9\TeamViewerQS_en.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Use
rs:(ID)C
C:\Lynx Software\SharpLynx v9>icacls SLE.exe
SLE.exe BUILTIN\Administrators:(I)(F)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Users:(I)(RX)
NT AUTHORITY\Authenticated Users:(I)(M)
Successfully processed 1 files; Failed processing 0 files
</p></body></html>Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
02 Apr 2018 00:00Current
5.7Medium risk
Vulners AI Score5.7