Hacking Articles Tips Tricks Videos Tutorials

WordPress WP-Invoice 4.3.1 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

13 viewsedited 17:52

10 views17:52

Exploit Collector
Gitlab 14.9 Authentication Bypass

https://3.bp.blogspot.com/-p2bRUn4ag8U/WWlvPJDaCwI/AAAAAAAAIMw/gkQGiTtaXucRRVbpvBkwiWIbJMO4BFlLwCLcBGAs/s1600/h28.png
Gitlab versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.7 prior to 14.7.7 suffer from a bypass vulnerability due to having set a hardcoded password for accounts registered using an OmniAuth provider.

SHA-256 | b9871a137c86a7af7a3f259af24481816299cde62d5eef695abcb78150bb320f

Download

# Exploit Title: Gitlab 14.9 - Authentication Bypass
# Date: 12/04/2022
# Exploit Authors: Greenwolf & stacksmashing
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://about.gitlab.com/install
# Version: GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2
# Tested on: Linux
# CVE : CVE-2022-1162
# References: https://github.com/Greenwolf/CVE-2022-1162

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts.

Exploit:

New Gitlab Accounts (created since the first affect version and if Gitlab is before the patched version) can be logged into with the following password:

123qweQWE!@#000000000

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Gitlab 14.9 Authentication Bypass

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 17:52

9 views17:53

10 views17:53

Exploit Collector
Gitlab 14.9 Cross Site Scripting

https://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png
Gitlab versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.7 prior to 14.7.7 suffer from a persistent cross site scripting vulnerability.

SHA-256 | 8cb78a3472e539403d6d39fd3ad3b5fdeb25087820f659a117ceeeb4ad1a58b6

Download

# Exploit Title: Gitlab Stored XSS
# Date: 12/04/2022
# Exploit Authors: Greenwolf & stacksmashing
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://about.gitlab.com/install
# Version: GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2
# Tested on: Linux
# CVE : CVE-2022-1175
# References: https://github.com/Greenwolf/CVE-2022-1175

Any user can create a project with Stored XSS in an issue. XSS on Gitlab is very dangerous and it can create personal access tokens leading users who visit the XSS page to silently have the accounts backdoor.

Can be abused by changing the base of the project to your site, so scripts are sourced by your site. Change javascript on your site to match the script names being called in the page. This can break things on the page though.



Standard script include also works depending on the sites CSP policy. This is more stealthy.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Gitlab 14.9 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 17:53

9 views17:53

Exploit Collector
Mandos Encrypted File System Unattended Reboot Utility 1.8.15

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.

SHA-256 | 74e7e1915cb5cb3617d80c379d9ecac315cfe154c815faf6a226ae482383f03f

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Mandos Encrypted File System Unattended Reboot Utility 1.8.15

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 17:53

Exploit Collector
WordPress Coru LFMember 1.0.2 Cross Site Scripting

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
WordPress Coru LFMember plugin version 1.0.2 suffers from a persistent cross site scripting vulnerability.

SHA-256 | 74b9ec56ae316f5978465b98643c80e1a1217fc29f5dac8d5a1a8f0f73c876b9

Download

# Exploit Title: WordPress Plugin Coru LFMember - Stored Cross Site
Scripting
# Date: 26-04-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage: https://wordpress.org/plugins/Coru LFMember/
# Version: 1.0.2
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com
# Vulnerable Code:

```

cols="10">
```

# POC

1. Install the Coru LFMember WordPress plugin and activate it.
2. Go to LFMember -> Add New and inject XSS payload “> 
onerror=alert(1)> in the fields given i.e, Game Image Name, Game Short
Name, Game Long Name, Game Description, and Links to.
3. XSS will trigger and will be stored.
## POC Image

https://imgur.com/kZDtIVz

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WordPress Coru LFMember 1.0.2 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

11 viewsedited 17:53