{"vulnerability": "cve-2020-3577", "sightings": [{"uuid": "0a8db8be-fb72-4fdb-bf85-69ac30090517", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35775", "type": "seen", "source": "MISP/f0f9de97-2a34-4d25-ba7a-59950efb2837", "content": "", "creation_timestamp": "2024-11-14T06:08:56.000000Z"}, {"uuid": "11e3cfcd-2d26-407f-af4f-0b154ed5d0f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35775", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/166", "content": "CVE-2020-35775 Digital Crime Report Management System 1.0 SQL\u6ce8\u5165\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-35775_Digital_Crime_Report_Management_System_1.0_SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T06:42:48.000000Z"}, {"uuid": "1eae87e5-aaea-470e-8976-d21bb3e958ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35775", "type": "published-proof-of-concept", "source": "https://t.me/pwnwiki_zhchannel/165", "content": "CVE-2020-35775 CITSmart ITSM 9.1.2.22 - LDAP\u6ce8\u5165\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2020-35775_CITSmart_ITSM_9.1.2.22_-_LDAP%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T06:42:48.000000Z"}, {"uuid": "0b319127-7c35-44a3-9f37-bb4993953e4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35775", "type": "seen", "source": "https://t.me/cibsecurity/23600", "content": "\u203c CVE-2020-35775 \u203c\n\nCITSmart before 9.1.2.23 allows LDAP Injection.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-15T18:46:45.000000Z"}, {"uuid": "01fa0eee-c625-4ab3-afaf-b0efcaaf8806", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35776", "type": "seen", "source": "https://t.me/cibsecurity/23830", "content": "\u203c CVE-2020-35776 \u203c\n\nA buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-18T22:50:23.000000Z"}, {"uuid": "536e6018-a2ba-43b3-84cd-98a264e02cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35779", "type": "seen", "source": "https://t.me/cibsecurity/21406", "content": "\u203c CVE-2020-35779 \u203c\n\nNETGEAR NMS300 devices before 1.6.0.27 are affected by denial of service.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-30T02:30:09.000000Z"}, {"uuid": "d78f3200-e790-4e0f-962f-42c3f7a7c92e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35774", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/2466", "content": "#exploit\nCVE-2020-35774:\nTwitter-server XSS Vulnerability\nhttps://securityboulevard.com/2021/01/cve-2020-35774-twitter-server-xss-vulnerability-discovered", "creation_timestamp": "2024-09-16T16:08:19.000000Z"}, {"uuid": "f5d80c64-5365-4651-a7c5-0b96f9fd54a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35777", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqum4lftbj22", "content": "\ud83d\udccc CVE-2020-35777 - NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection. https://www.cyberhub.blog/cves/CVE-2020-35777", "creation_timestamp": "2026-07-17T20:37:07.270760Z"}, {"uuid": "1d69d144-1d0f-4bb3-8c06-a0bed9729d47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35774", "type": "seen", "source": "https://t.me/cissp/2057", "content": "1. C2 Traffic Patterns\nhttps://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes\n\n2. \"Little Yellow Duck\" APT\nhttps://github.com/Loveforkeeps/Lemon-Duck\n\n3. Meet Oski Stealer: An In-depth Analysis of the Popular Credential Stealer\nhttps://www.cyberark.com/resources/threat-research-blog/meet-oski-stealer-an-in-depth-analysis-of-the-popular-credential-stealer\n\n4. Analysis of the NetWire RAT campaign\nhttps://blog.bushidotoken.net/2021/01/analysis-of-netwire-rat-campaign.html?m=1\n\nUsing Windows Disposable VMs for test and research\nhttps://rolando.anton.sh/blog/2021/01/01/using-windows-disposable-vms-for-test-and-research\n\n]-> A packer project to generate Windows EVAL images to use it on test/dev/hack/IR labs\nhttps://github.com/rolando-anton/packer-disposable-windows\n\n1. Hack crypto secrets from heap memory to exploit Android application\nhttps://medium.com/bugbountywriteup/hack-crypto-secrets-from-heap-memory-to-exploit-android-application-728097fcda3\n\n2. CMS Made Simple 2.2.15 - Authenticated RCE\nhttps://infosecresearchlab.blogspot.com/2020/12/cms-made-simple-2215-authenticated-rce.html?m=1\n\n3. NTLM BITS SYSTEM Token Impersonation\nhttps://packetstormsecurity.com/files/160829/bits_ntlm_token_impersonation.rb.txt\n\n\"Bypassing Anti-Viruses by C#.NET Programming\", 2020.\nhttps://damonmohammadbagher.github.io/Posts/ebookBypassingAVsByCsharpProgramming/index.htm\n\nCVE-2020-35774:\nTwitter-server XSS Vulnerability (PoC)\nhttps://securityboulevard.com/2021/01/cve-2020-35774-twitter-server-xss-vulnerability-discovered/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29", "creation_timestamp": "2026-09-01T17:01:07.901119Z"}, {"uuid": "44e79fc0-8981-4831-8f34-4a3c86683610", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35775", "type": "seen", "source": "https://t.me/hacking_Attack/4922", "content": "Exploit Collector\nCITSmart ITSM 9.1.2.22 LDAP Injection\n\nhttps://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png \nCITSmart ITSM version 9.1.2.22 suffers from an LDAP injection vulnerability.\n\nMD5 | 4ac23ee971f692bf2ad5ddba1be97403\n\nDownload\n# Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection\n# Google Dork: \"citsmart.local\"\n# Date: 29/12/2020\n# Exploit Author: skysbsb\n# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html\n# Version: < 9.1.2.23\n# CVE : CVE-2020-35775\n\nTo exploit this flaw it is necessary to have at least one user/password previously registered, because the system checks (ldap bind) the first user returned in the ldap search. However, it returns the last user found in the search to the function that called it (logic error).\n\nSo, I call this problem an LDAP injection in conjunction with a programming logic error that allows you to authenticate to CITSmart ITSM with another valid user without needing to know the target user's password.\n\nAffected versions: < 9.1.2.23\nFixed versions: >= 9.1.2.23\n\nUsing this LDAP query in the username field of login page you could login with the target_username account without knowing the target account password.\n\n*)(|(sAMAccountName=valid_username)(sAMAccountName=target_username)\n\nYou must know at least one username/password because the autenticacaoAD() function at LDAPUtils.java class (package br.com.centralit.citcorpore.integracao.ad) will try to bind with the first user (valid_username) of the query result.\n\nVendor has acknowledge this vulnerability at ticket 5929 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:46.757064Z"}, {"uuid": "8233886c-a913-43a6-b1ae-c38f92ad5e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35775", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/4922", "content": "Exploit Collector\nCITSmart ITSM 9.1.2.22 LDAP Injection\n\nhttps://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png \nCITSmart ITSM version 9.1.2.22 suffers from an LDAP injection vulnerability.\n\nMD5 | 4ac23ee971f692bf2ad5ddba1be97403\n\nDownload\n# Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection\n# Google Dork: \"citsmart.local\"\n# Date: 29/12/2020\n# Exploit Author: skysbsb\n# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html\n# Version: < 9.1.2.23\n# CVE : CVE-2020-35775\n\nTo exploit this flaw it is necessary to have at least one user/password previously registered, because the system checks (ldap bind) the first user returned in the ldap search. However, it returns the last user found in the search to the function that called it (logic error).\n\nSo, I call this problem an LDAP injection in conjunction with a programming logic error that allows you to authenticate to CITSmart ITSM with another valid user without needing to know the target user's password.\n\nAffected versions: < 9.1.2.23\nFixed versions: >= 9.1.2.23\n\nUsing this LDAP query in the username field of login page you could login with the target_username account without knowing the target account password.\n\n*)(|(sAMAccountName=valid_username)(sAMAccountName=target_username)\n\nYou must know at least one username/password because the autenticacaoAD() function at LDAPUtils.java class (package br.com.centralit.citcorpore.integracao.ad) will try to bind with the first user (valid_username) of the query result.\n\nVendor has acknowledge this vulnerability at ticket 5929 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T10:00:06.336167Z"}, {"uuid": "bd9f601a-b787-479e-b1f9-af30ca05bc92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-35774", "type": "published-proof-of-concept", "source": "https://t.me/cissp/2057", "content": "1. C2 Traffic Patterns\nhttps://marcoramilli.com/2021/01/09/c2-traffic-patterns-personal-notes\n\n2. \"Little Yellow Duck\" APT\nhttps://github.com/Loveforkeeps/Lemon-Duck\n\n3. Meet Oski Stealer: An In-depth Analysis of the Popular Credential Stealer\nhttps://www.cyberark.com/resources/threat-research-blog/meet-oski-stealer-an-in-depth-analysis-of-the-popular-credential-stealer\n\n4. Analysis of the NetWire RAT campaign\nhttps://blog.bushidotoken.net/2021/01/analysis-of-netwire-rat-campaign.html?m=1\n\nUsing Windows Disposable VMs for test and research\nhttps://rolando.anton.sh/blog/2021/01/01/using-windows-disposable-vms-for-test-and-research\n\n]-> A packer project to generate Windows EVAL images to use it on test/dev/hack/IR labs\nhttps://github.com/rolando-anton/packer-disposable-windows\n\n1. Hack crypto secrets from heap memory to exploit Android application\nhttps://medium.com/bugbountywriteup/hack-crypto-secrets-from-heap-memory-to-exploit-android-application-728097fcda3\n\n2. CMS Made Simple 2.2.15 - Authenticated RCE\nhttps://infosecresearchlab.blogspot.com/2020/12/cms-made-simple-2215-authenticated-rce.html?m=1\n\n3. NTLM BITS SYSTEM Token Impersonation\nhttps://packetstormsecurity.com/files/160829/bits_ntlm_token_impersonation.rb.txt\n\n\"Bypassing Anti-Viruses by C#.NET Programming\", 2020.\nhttps://damonmohammadbagher.github.io/Posts/ebookBypassingAVsByCsharpProgramming/index.htm\n\nCVE-2020-35774:\nTwitter-server XSS Vulnerability (PoC)\nhttps://securityboulevard.com/2021/01/cve-2020-35774-twitter-server-xss-vulnerability-discovered/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+SecurityBloggersNetwork+%28Security+Bloggers+Network%29", "creation_timestamp": "2026-09-11T21:00:04.176271Z"}]}