CVE-2020-24227 PoC — Playground Sessions 信息泄露漏洞

Source

https://github.com/nathunandwani/CVE-2020-24227

Associated Vulnerability

Title:Playground Sessions 信息泄露漏洞 (CVE-2020-24227)
Description:Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to UserProfiles.sol to extract the email and password.

Description

Playground Sessions - Storing User Credentials in Plaintext

Readme

# CVE-2020-24227
Playground Sessions - Storing User Credentials in Plaintext

Playground Sessions v2.5.582 (and earlier) for Windows, stores the user credentials in plain text allowing anyone with access to C:\Users\<USER>\AppData\Roaming\Playground\Local Store\#SharedObjects\Playground.swf\UserProfiles.sol to extract the email and password.

Login Page:<br><br>
![alt text](https://github.com/nathunandwani/CVE-2020-24227/blob/main/login-page.jpg?raw=true)

Password:<br><br>
![alt text](https://github.com/nathunandwani/CVE-2020-24227/blob/main/password.jpg?raw=true)

<br><br>Disclosure Timeline:<br>
*August 18, 2020 - Reported to info@playgroundsessions.com - Gave 90 day disclosure timeline - No response
*November 21, 2020 - Public Disclosure

File Snapshot


 [4.0K]  /data/pocs/88ff0ff36fbb53fa53ecff6c6cd29ed924d62442
├── [ 23K]  login-page.jpg
├── [298K]  password.jpg
└── [ 751]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!