Introduction
Hello security community! I am Mughunthen K, an independent security researcher from Neyveli
This writeup details a critical security vulnerability—an Unauthenticated Admin Panel in Sun TV Network's HRMS portal that posed a risk of Remote Code Execution (RCE).
Reconnaissance & Subdomain Discovery
Target: [https://hrms.sunnetwork.in/]
While conducting surface reconnaissance on sunnetwork.in, I identified hrms.sunnetwork.in, an internal Human Resource Management System portal.
Step 1: Directory Fuzzing
To discover unlinked or hidden paths, I ran directory brute-forcing:
Bash
gobuster dir -u https://hrms.sunnetwork.in/ -w directory-list-2.3-medium.txt -k
Results:
/Admin.aspx (Status: 200) [Size: 34671]
/ADMIN.ASPX (Status: 200)
/access.aspx (Status: 200)
/billing.aspx (Status: 200)
/app/ (Status: 301)
/scripts/ (Status: 301)
The endpoint /Admin.aspx returned a 200 OK status code instead of a expected 302 Redirect to a login interface.
Technical Details & Impact
Step 2: Accessing the Panel
Navigating directly to https://hrms.sunnetwork.in/Admin.aspx loaded an administrative panel with no authentication challenge.
Exposed Interface Capabilities:
Interface Title: Administrative / Media Upload Manager
Functional Input Fields:
Title field
Thumbnail File Upload (Choose File)
URL / File Attachment Upload (Choose File)
Video Player / Category dropdown
Submission Handler
The interface exposed direct file-upload functionality publicly without verifying active session tokens or user roles and files like .aspx are uploaded directly into a publicly or internally accessible web server path (flv/), an attacker can upload a web shell or malicious script. Once navigated to, the server processes the file, enabling remote code execution on the backend IIS server under the service account context.
Step 3: Attack Scenario (Potential RCE)
Without authentication restrictions, the panel exposed the application to potential arbitrary file uploads:
Unrestricted Upload: An attacker could attempt to upload a custom ASPX web shell (e.g., shell.aspx).
Execution Path: If file extension validation or MIME-type filtering was missing, the file would be stored in a web-accessible directory such as /uploads/ or /app/.
Remote Code Execution: Accessing the uploaded file path ([https://hrms.sunnetwork.in/uploads/shell.aspx] could execute server-side code under the context of the web application user.
Note on Responsible Disclosure: No arbitrary code execution files or malicious payloads were uploaded during this research. Upon confirming the exposure of the functional endpoint, testing was halted immediately to adhere to ethical testing guidelines.
Impact Assessment
Severity: Critical (CVSS v3.1: 9.8)
Access Vector: Network (Unauthenticated)
Impact Areas: Confidentiality, Integrity, and Availability
Risk Context: Threat actors could compromise internal HR data or deface external web resources.
Remediation & Defensive Recommendations
Enforce Authentication Middleware: Verify active administrative session state prior to processing routes for /Admin.aspx. If non-authenticated, redirect to the centralized authentication route.
Strict File Extension Whitelisting: Validate uploaded files against a strict whitelist (e.g., .jpg, .png, .mp4). Explicitly reject executable server-side extensions (.aspx, .asp, .php, .exe).
Storage Isolation: Store uploaded media outside the web root directory or on an isolated static content bucket (e.g., AWS S3) with execution permissions disabled (No-Exec).
Implement Role-Based Access Control (RBAC): Restrict access control based on user privileges.
Code Fix Example (C# ASP.NET)
protected void Page_Load(object sender, EventArgs e)
{
if (Session["UserRole"] == null || Session["UserRole"].ToString() != "Administrator")
{
Response.Redirect("~/Login.aspx", true);
}
}
Disclosure Timeline
August 27, 2026: Vulnerability identified during routine research.
August 27, 2026: Submitted detailed report and PoC to CERT-In.
August 29, 2026: CERT-In acknowledged the vulnerability and notified the Sun TV Network security team.
August 30, 2026: Remediation deployed by Sun TV Network team (Access to /Admin.aspx now correctly enforces authentication).
Key Takeaways for Security Researchers
Always check case-sensitivity variations during endpoint discovery (/Admin.aspx vs /admin.aspx).
IIS / Windows environments treat URLs as case-insensitive, but underlying authentication filters or custom routing rules occasionally fail to normalize uppercase variants.
Written by Mughunthen K | Independent Cybersecurity Researcher
Top comments (0)