QiHang Media Web Digital Signage Sensitive Information Disclosure Vulnerability

A vulnerability in QiHang Media Web Digital Signage version 3.0.9 has been identified, allowing remote attackers to intercept user authentication credentials. This issue arises from the cleartext transmission of sensitive information in cookies, which can be exploited through man-in-the-middle attacks. The vulnerability was tested on multiple Windows Server editions and involves the HowFor Web Server and Microsoft ASP.NET Web QiHang IIS Server.

Impact

Exploitation of this vulnerability allows for the interception of HTTP cookie authentication credentials, which could be misused to bypass security measures or gain unauthorized access to user accounts.

Reproduction

The vulnerability can be reproduced by sending a POST request to 'QH.aspx' without encryption. The intercepted request will reveal cookies containing sensitive authentication information, such as the username and password.