Tejas Pingulkar

Vulnerable Software :  Verint Workforce Optimization (WFO) Vulnerability :   Unauthenticated Information Disclosure via API Affected Version:  15.1 (15.1.0.37634) Vendor Homepage: Link CVE:   2020-23446 CVE Author:  Tejas Nitin Pingulkar Exploit Available:   POC Available About Affected Software: Verint Workforce Optimization is a suite of unified software and services for capturing interactions and managing the performance of employees across the enterprise or in targeted areas of your business, including: Back-office operations Branch operations Contact centers Financial trading rooms Additional Information : Verint WFO application provides functionality to download topology reports to authenticated users, however, using direct object reference/API unauthenticated attacker can obtain reports. Exploit: Access URL :   [IP/Domain]/wfo/rest/em-api/v1/topology/ generation Note: only most recently generated report can be obtained by the attacker Patch...

Vulnerable Software:  Turbo VPN Affected Version:  1.1.0.0 Vendor Homepage:   https://www.turbovpn.co/#/views/index CVE:  – CVE Author:  Tejas Nitin Pingulkar Exploit Available:   POC Available About Affected Software: Turbo VPN For PC is a free VPN client which offers free VPN proxy giving you the chance to unblock sites and applications and gain access to restricted resources. Exploit: Turbo VPN 1.1.0.0 installers and applications are vulnerable to unquoted search path vulnerability as application search path are not quoted that is when application search for binaries TurboVPN folder stored in “C:\Program files(x86)\TurboVPN” it uses below search order as path is not quoted C:\Program.exe C:\Program (x86)\TurboVPN As on drive C:\ all users have full access, an attacker can place malicious exe with name “Program.exe” in C:\ path and wait for application to call Program.exe and escalate his/her privileges Affecte...

Vulnerable Software : Verint Workforce Optimization (WFO) Vulnerability:  HTML Injection Affected Version:  15.2 Vendor Homepage:    https://www.verint.com CVE:  CVE-2020-13480 CVE Author:  Tejas Nitin Pingulkar Exploit Available:  POC Available About Affected Software Verint Workforce Optimization is a suite of unified software and services for capturing interactions and managing the performance of employees across the enterprise or in targeted areas of your business, including: Back-office operations Branch operations Contact centers Financial trading rooms Additional Information Verint WFO application provides functionality to send receive emails within an application. However application fails to sanitize user input. Exploit: 1. Open send email function  2. Write your payload inside the body POC: Timeline: Initial Email Sent: 21 May 2020 — No response Followup 2: 25 May 2020 — No response Followup 3: 26 May 2020 — No response CVE Generate...

CVE:  CVE-2020-11561 Title:  Privilege Escalation via Forceful Browsing About NCH express invoice software Express Invoice lets you create invoices you can print, email or fax directly to clients for faster payment. The reporting functionality allows you to keep track of payments, overdue accounts, sales team performance and more. Vulnerability:  NCH express invoice software allows to access it over the web.  A web interface provides 3 types of user Administrator  user viewer  The administrator user has access to all modules including "Add New Item" "Add New Customer". User with viewer privileges don't have access to "Add New Item" "Add New Customer" by forceful browsing, we will access admin modules using viewer user privileges  Impact:   An authenticated low privileged user can access modules which are accessible only to higher privileged user  POC:

CVE: CVE-2020-11560 Title: Clear text password storage in NCH express invoice software About NCH express invoice software: Express Invoice lets you create invoices you can print, email or fax directly to clients for faster payment. The reporting functionality allows you to keep track of payments, overdue accounts, sales team performance and more. Vulnerability: Express Invoice has functionality that allows to access it over the web. While configuring web access function application ask for user details such as username, password, email, etc Application stores this information in "C:\ProgramData\NCH Software\ExpressInvoice\Accounts" folder in clear-text. Impact: An authenticated malicious user with access to the configuration file may obtain the exposed password to gain access to any user account POC

Hi I am Tejas Pingulkar Security Researcher