Exploit Collector
Online Railway Reservation System 1.0 SQL Injection

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Online Railway Reservation System version 1.0 suffers from an unauthenticated remote SQL injection vulnerability.

MD5 | 2a0806303eb3cb758ed3f98588e91417

Download
# Exploit Title: Online Railway Reservation System 1.0 - 'id' SQL Injection (Unauthenticated)
# Date: 07/01/2022
# Exploit Author: twseptian
# Vendor Homepage: https://www.sourcecodester.com/php/15121/online-railway-reservation-system-phpoop-project-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/orrs.zip
# Version: v1.0
# Tested on: Kali Linux 2021.4,PHP 7.4.26

*SQL Injection*
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to it's database. Online Railway Reservation System v1.0 is vulnerable to SQL injection via the 'id' parameter on the Reservation Form.

*Attack Vector*
An attacker can compromise the database of the application using some automated(or manual) tools like SQLmap.

*Steps of reproduce:*
Step-1: Navigate to 'Schedule' > go to 'Book' or 'Revervation Form' page using the following URL:
http://localhost/orrs/?page=reserve&sid=1

Step-2: Put the SQL Injection payloads in 'id' field.
In this we used time-based blind payload: /orrs/?page=reserve&sid=1') AND (SELECT 6842 FROM (SELECT(SLEEP(5)))UsWr) AND ('WBCm'='WBCm

Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Domain Escalation – sAMAccountName Spoofing
https://www.reddit.com/r/redteamsec/comments/s0qvq6/domain_escalation_samaccountname_spoofing/

submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://pentestlab.blog/2022/01/10/domain-escalation-samaccountname-spoofing/) [comments] (https://www.reddit.com/r/redteamsec/comments/s0qvq6/domain_escalation_samaccountname_spoofing/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Flash Player has been discontinued for almost a year, so what exactly are you updating?

https://cdn-images-1.medium.com/max/1200/1*9YVxnHwyhinrOeCWk1nxhQ.jpeg
You’re completely right if you were astonished to receive a notification for Flash Player updates on your phone, assuming it had died…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here’s How Hackathons Can Equate to Baking Cakes

https://cdn-images-1.medium.com/max/600/1*ebJW-1hFEvdUEvo7KBJEHA.jpeg
Audrey has been attending a lot of hackathons in the past year. She came to the conclusion that hackathons are just like baking cakes.

Continue reading on TechTogether »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cross-Origin Resource Sharing (CORS) Misconfiguration leads to User’s PII leaks.

https://cdn-images-1.medium.com/max/600/1*9tXKSi7uQmbFivoLfhy1og.png
Hello everyone,

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cybercriminals are shipping out ransomware-infected USB devices

https://cdn-images-1.medium.com/max/2000/1*Cb6t0HR91DKPGyJ4jbr22w.jpeg
The FBI has issued a warning to the US defense industry that a cybercriminal organization is sending infected flash drives to businesses…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Facebook lanza ‘Centro de privacidad’ para educar a los usuarios sobre la recopilación de datos y…

https://cdn-images-1.medium.com/max/1638/0*bB7O4ildjsvDzQYX
PUBLICADO EN 10 ENERO, 2022 POR EHACKING

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I hacked my Manager!

https://cdn-images-1.medium.com/max/2600/0*5sqMuvMIZTK1viCN
I am always the guy in the room who likes to poke things even if those are not my field. I work in a Software Firm located in Bangladesh…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
NHS advierte sobre piratas informáticos que apuntan a fallas de Log4j en VMware Horizon

https://cdn-images-1.medium.com/max/1339/0*S13D0aCppgNC_Vda
PUBLICADO EN 10 ENERO, 2022 POR EHACKING

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How not to get Hacked. Security 101 for Startups.

https://cdn-images-1.medium.com/max/2600/0*29tbgiLp6gkG9tcE
Formalize Security I: Information Security Governance, Risk Management, and Compliance (GRC)

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I scan large files ?

How do i scan large files on internet for viruses and malware ? Thanks 😊

submitted by /u/Iproman
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video