mirror of
https://github.com/0xMarcio/cve.git
synced 2025-11-30 18:56:19 +00:00
20 lines
1.2 KiB
Markdown
20 lines
1.2 KiB
Markdown
### [CVE-2021-37364](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37364)
|
|
|
|
|
|
|
|
|
|
### Description
|
|
|
|
OpenClinic GA 5.194.18 is affected by Insecure Permissions. By default the Authenticated Users group has the modify permission to openclinic folders/files. A low privilege account is able to rename mysqld.exe or tomcat8.exe files located in bin folders and replace with a malicious file that would connect back to an attacking computer giving system level privileges (nt authority\system) due to the service running as Local System. While a low privilege user is unable to restart the service through the application, a restart of the computer triggers the execution of the malicious file. The application also have unquoted service path issues.
|
|
|
|
### POC
|
|
|
|
#### Reference
|
|
- https://sourceforge.net/projects/open-clinic/
|
|
- https://sourceforge.net/projects/open-clinic/files/latest/download
|
|
- https://www.exploit-db.com/exploits/50448
|
|
|
|
#### Github
|
|
No PoCs found on GitHub currently.
|
|
|