Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-3350. PoCs published by itres-labs.
AI-analyzed exploit summary This repository provides a detailed technical analysis of CVE-2023-3350, a cryptographic design flaw in IBERMATICA RPS 2019 where passwords are encrypted with AES-CBC using predictable keying material derived from usernames. The included C# code demonstrates decryption of a sample ciphertext, illustrating the vulnerability's mechanics.
Description
A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded with AES-CBC-128 bits algorithm, which can be decrypted with a .NET function, obtaining the username's password in plain text.
Exploits (1)
This repository provides a detailed technical analysis of CVE-2023-3350, a cryptographic design flaw in IBERMATICA RPS 2019 where passwords are encrypted with AES-CBC using predictable keying material derived from usernames. The included C# code demonstrates decryption of a sample ciphertext, illustrating the vulnerability's mechanics.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N