XSS Filter Evasion + IDOR

Hi there. I’m JM Sanchez, a student, and a bug bounty hunter. After months of duplicate reports, I finally found a valid high severity bug.Continue reading on Medium »
Read more...

Exploit Collector
DMCA.com Improper Access Control / Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
DMCA.com suffers from improper access control, persistent cross site scripting, and improper input validation vulnerabilities.

MD5 | de3eab0ce1d4e59fca59fb8cb0848dc7

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SonicWall SMA 100 Series Authenticated Command Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Diagnostic Lab Management System 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
Online Diagnostic Lab Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 35588b27be6d86e8b5952153487f66da

Download
#Exploit Title: Online Diagnostic Lab Management System 1.0 - Stored Cross Site Scripting (XSS)
#Date: 11/01/2022
#Exploit Author: Himash
#Vendor Homepage: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/odlms.zip
#Version: 1.0
#Tested on: Kali Linux

Online Diagnostic Lab Management System 1.0 is vulnerable to stored cross-site-scripting.
Stored cross-site scripting (persistent XSS) arises when an application receives its data from
an untrusted source and includes that data within its responses in an unsafe way.

#Steps to Reproduce

1. Login to the admin account with username 'admin' and password 'admin123'

2. Navigate to the 'User List' option

3. Create new user by adding following payload in
First Name and Last Name fields.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Hospitals Patient Records Management System 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-HlvbbOwsdTc/WWlvV_wSsQI/AAAAAAAAIOA/psrlTyexNtUDdre2JEY7YvqsGP1V8LJKQCLcBGAs/s1600/h47.png
Hospitals Patient Records Management System version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.

MD5 | b843c5dce45d39b6dcbcd8448e2e1ba7

Download
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'doctors' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A Stored XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
q

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=doctors
2- Add a Doctor, paste the payload in specialization
3- Alert will pop whenever the page is accessed.
----
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_list' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
q

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=room_list
2- Add Room type, paste the payload in description
3- Alert will pop whenever the page is accessed.
----

# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_types' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
q

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=room_types
2- Add Room type, paste the payload in description
3- Alert will pop whenever the page is accessed.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Core 5.8.2 SQL Injection

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
WordPress Core version 5.8.2 suffers from a remote SQL injection vulnerability.

MD5 | d7d5f48971d62eb48cd036c99568cc99

Download
# Exploit Title: WordPress Core 5.8.2 - 'WP_Query' SQL Injection
# Date: 11/01/2022
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://wordpress.org
# Software Link: https://wordpress.org/download/releases
# Version: < 5.8.3
# Tested on: Windows 10
# CVE : CVE-2022-21661

# [ VULNERABILITY DETAILS ] :

#This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core,
#Authentication is not required to exploit this vulnerability, The specific flaw exists within the WP_Query class,
#The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries,
#An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.

# [ References ] :

https://wordpress.org/news/category/releases
https://www.zerodayinitiative.com/advisories/ZDI-22-020
https://hackerone.com/reports/1378209

# [ Sample Request ] :

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Upgrade-Insecure_Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.99
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Cache-Control: max-age=0
Connection: close
Content-Type: application/x-www-form-urlencoded

action=
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome IPC::ChannelAssociatedGroupController Memory Corruption

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
Chrome suffers from a memory corruption vulnerability in IPC::ChannelAssociatedGroupController due to interface ID reuse.

MD5 | 97649e149f12ef8107db4bccd41ca04b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Diagnostic Lab Management System 1.0 Missing Access Control

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
RLM 14.2 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Diagnostic Lab Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video