BadPatch Análisis

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (30)

Idioma

en	26
fr	4

País

us	6
de	2
fr	2

Actores

BadPatch	1
Mozi	1
KasperAgent	1

Interesar

Escribe

Not Defined	6
Web Server	2
Photo Gallery Software	2

Proveedor

Apache	2
yiisoft	2
Infiray	2
Not Defined	2
ElkaGroup	2

Producto

Apache HTTP Server	2
yiisoft yii	2
Infiray IRAY-A8Z3	2
ampleShop	2
ElkaGroup Image Gallery	2

Vulnerabilidad

#	Vulnerabilidad	Base	Temp	0day	Hoy	Exp	Con	EPSS	CTI	CVE
1	Netgear DGN1000B setup.cgi escalada de privilegios	9.8	9.3	$25k-$100k	$0-$5k	Proof-of-Concept	Not Defined	0.00000	0.00
2	yiisoft yii unserialize escalada de privilegios	7.8	7.8	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00378	0.03	CVE-2023-47130
3	POS Codekop print.php cross site scripting	4.8	4.8	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00096	0.02	CVE-2023-36346
4	Saskia Bruckner Saskias Shopsystem content.php directory traversal	7.3	7.1	$0-$5k	$0-$5k	High	Unavailable	0.00445	0.02	CVE-2010-0957
5	ElkaGroup Image Gallery view.php sql injection	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00125	0.00	CVE-2008-5037
6	ampleShop category.cfm sql injection	7.3	7.3	$0-$5k	$0-$5k	Not Defined	Unavailable	0.00621	0.02	CVE-2006-2038
7	Apache HTTP Server mod_proxy_fcgi.c handle_headers desbordamiento de búfer	5.3	5.1	$25k-$100k	$0-$5k	Not Defined	Official Fix	0.00953	0.03	CVE-2014-3583
8	Infiray IRAY-A8Z3 Web Application set_param.cgi autenticación débil	8.0	8.0	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00201	0.00	CVE-2022-31210
9	AjPortal2Php pages.inc.php Remote Code Execution	7.3	6.9	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.43742	0.00	CVE-2007-2142

IOC - Indicator of Compromise (3)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	dirección IP	Hostname	Actor	Identified	Escribe	Confianza
1	6.43.51.17		Badpatch	2019-10-23	verified	Alto
2	XXX.XXX.XXX.XXX	xxxxxx.xxxxxx.xx	Xxxxxxxx	2020-12-23	verified	Alto
3	XXX.XXX.XXX.XX	xxx-xxx-xxx-xx.xxx.xxxxxxxxxxxx.xx	Xxxxxxxx	2020-12-23	verified	Alto

TTP - Tactics, Techniques, Procedures (5)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilidad	Vector de acceso	Escribe	Confianza
1	T1006	CWE-22	Path Traversal	predictive	Alto
2	TXXXX.XXX	CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Alto
3	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
4	TXXXX.XXX	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Alto
5	TXXXX	CWE-XX	Xxx Xxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (14)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Clase	Indicator	Escribe	Confianza
1	File	/usr/local/sbin/webproject/set_param.cgi	predictive	Alto
2	File	category.cfm	predictive	Medio
3	File	xxxxxxx.xxx	predictive	Medio
4	File	xxxxxxxx/xxxxx.xxx.xxx	predictive	Alto
5	File	xxx_xxxxx_xxxx.x	predictive	Alto
6	File	xxxxx.xxx	predictive	Medio
7	File	xxxxx.xxx	predictive	Medio
8	File	xxxx.xxx	predictive	Medio
9	Argument	xxx	predictive	Bajo
10	Argument	xxx	predictive	Bajo
11	Argument	xx	predictive	Bajo
12	Argument	xx_xxxxxx	predictive	Medio
13	Argument	xxxxxxxxxx	predictive	Medio
14	Argument	xxxxxxxxxx	predictive	Medio

Referencias (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ AnteriorVisión De ConjuntoPróximo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!