7 Sticky Notes v1.9 – OS Command Injection

Exploit Database
95 阅读

作者： Ahmet Ümit BAYRAM

日期： 2024-01-29
类别：
- local
平台：
- windows
来源：https://www.exploit-db.com/exploits/51748/

# Exploit Title: 7 Sticky Notes v1.9 - OS Command Injection
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 12.09.2023
# Vendor Homepage: http://www.7stickynotes.com
# Software Link:
http://www.7stickynotes.com/download/Setup7StickyNotesv19.exe
# Tested Version: 1.9 (latest)
# Tested on: Windows 2019 Server 64bit

# # #Steps to Reproduce # # #

# Open the program.
# Click on "New Note".
# Navigate to the "Alarms" tab.
# Click on either of the two buttons.
# From the "For" field, select "1" and "seconds" (to obtain the shell
within 1 second).
# From the "Action" dropdown, select "command".
# In the activated box, enter the reverse shell command and click the "Set"
button to set the alarm.
# Finally, click on the checkmark to save the alarm.
# Reverse shell obtained!

last Exploits
7 Sticky Notes v1.9 – OS Command Injection的更多信息

VisiWave – ‘.VWR’ File Parsing Trusted Pointer (Metasploit)：
MuPDF 1.3 – ‘xps_parse_color()’ Stack Buffer Overflow：
Winamp 5.572 (Windows XP SP3 DE) – ‘whatsnew.txt’ Local Buffer Overflow：
SOUND4 IMPACT/FIRST/PULSE/Eco v2.x – Authentication Bypass：
Microsoft Windows 10 – Runtime Broker ClipboardBroker Privilege Escalation：
Amarok 2.8.0 – Denial-of-Service：
CyberArk Viewfinity 5.5.10.95 – Local Privilege Escalation：
Firefox 72 IonMonkey – JIT Type Confusion：