PT-2024-15370 · Unknown · Huiran Host Reseller System

Glzjin · Published 2024-01-01 · Updated 2024-05-17 · CVE-2024-0186

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HuiRan Host Reseller System versions up to 2.0.0

Description A vulnerability has been found in the HuiRan Host Reseller System, affecting an unknown function of the file /user/index/findpass?do=4 of the component HTTP POST Request Handler. This leads to weak password recovery and can be launched remotely. The complexity of an attack is rather high, and the exploitability is told to be difficult. The exploit has been disclosed to the public and may be used.

Recommendations For HuiRan Host Reseller System versions up to 2.0.0, consider disabling the weak password recovery function until a patch is available. Restrict access to the /user/index/findpass?do=4 endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2024-0186

Affected Products

Huiran Host Reseller System

References · 9

• 🔥 https://note.zhaoj.in/share/WwPWWizD2Spk · Exploit
• https://osv.dev/vulnerability/CVE-2024-0186 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0186 · Security Note
• https://twitter.com/NUYTSTECH/status/1743843676772766169 · Twitter Post
• https://t.me/cibsecurity/74121 · Telegram Post
• https://twitter.com/CVEnew/status/1741988626676814167 · Twitter Post
• https://vuldb.com/?id.249444 · Note
• https://vuldb.com/?ctiid.249444 · Note
• https://t.me/cvenotify/70868 · Telegram Post