Tejas Pingulkar

Vulnerable Software: UTI Mutual fund Android Application Vulnerability:  Username Enumeration Affected Version: 5.4.28 Patch: Not Released (03-December-2021) Vendor Homepage:   https://utimf.com/ CVE:  CVE-2020-11561 CVE Author:  Tejas Nitin Pingulkar Exploit Available: POC available About Affected Software Investing in Mutual Funds is now easy with the UTI MF (UTI Mutual Funds) App. It gives you a hassle-free experience to invest in any mutual fund scheme of your choice from anywhere, anytime with just a few clicks. The paperless transactions allow new investors to start a SIP or invest a lumpsum with ease. Exploit Input an incorrect username (one that don't exist), the application will respond with an error message "we are unable to recognize the use user id entered" were as if the valid username is entered and invalid password is provided application responds with "the password entered is incorrect" which assist attacker to enumerate v...

CVE-2020-27414 Mahavitaran Android Application: Insecure Communication of Sensitive Data Vulnerable Software:  Maharashtra State Electricity Board Android Application Vulnerability:  Insecure Communication of sensitive data Affected Version:  7.50 and prior Patched:  Yes Vendor Homepage:  https://www.mahadiscom.in/en/home/ App store link:  https://play.google.com/store/apps/details?id=com.msedcl.app&hl=en_IN&gl=US CVE:  CVE-2020-27414 CVE Author:  Tejas Nitin Pingulkar Exploit Available:  POC Available About Affected Software The Official App for Consumer by Mahavitaran ( M.S.E.D.C.L.). Mahavitaran Consumer App enables consumers to avail Mahavitaran services at his/her fingertips. The app is simple and easy to use. It provides transparency in delivering services to consumers. ►Features : *View and Pay bill *Register and Track complaints *View Bill and Payment history *Manage Multiple Electricity Connections *Contact 24 x7 MSEDCL Call ...

CVE:  CVE-2020-11561 Title:  Privilege Escalation via Forceful Browsing About NCH express invoice software Express Invoice lets you create invoices you can print, email or fax directly to clients for faster payment. The reporting functionality allows you to keep track of payments, overdue accounts, sales team performance and more. Vulnerability:  NCH express invoice software allows to access it over the web.  A web interface provides 3 types of user Administrator  user viewer  The administrator user has access to all modules including "Add New Item" "Add New Customer". User with viewer privileges don't have access to "Add New Item" "Add New Customer" by forceful browsing, we will access admin modules using viewer user privileges  Impact:   An authenticated low privileged user can access modules which are accessible only to higher privileged user  POC:

CVE: CVE-2020-11560 Title: Clear text password storage in NCH express invoice software About NCH express invoice software: Express Invoice lets you create invoices you can print, email or fax directly to clients for faster payment. The reporting functionality allows you to keep track of payments, overdue accounts, sales team performance and more. Vulnerability: Express Invoice has functionality that allows to access it over the web. While configuring web access function application ask for user details such as username, password, email, etc Application stores this information in "C:\ProgramData\NCH Software\ExpressInvoice\Accounts" folder in clear-text. Impact: An authenticated malicious user with access to the configuration file may obtain the exposed password to gain access to any user account POC