Exploit Collector
Product Show Room Site 1.0 Cross Site Scripting

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png Product Show Room Site version 1.0 suffers from multiple persistent cross site scripting vulnerabilities.

SHA-256 | a796961a488458cb4bb41f2e00c8a65730ac1bded2e03daff8ea9786a74d591eDownload # Product Show Room Site - 'Telephone' Stored Cross-Site Scripting(XSS)
#### Exploit Title: Product Show Room Site - 'Telephone' Stored Cross-Site Scripting(XSS)
#### Exploit Author: webraybtl@webray.com.cn inc
#### Vendor Homepage: https://www.sourcecodester.com/php/15370/product-show-room-site-phpoop-free-source-code.html
#### Software Link: https://www.sourcecodester.com/download-code?nid=15370&title=Product+Show+Room+Site+in+PHP%2FOOP+Free+Source+Code
#### Version: Product Show Room Site 1.0
#### Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql

#### Description
Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being Non-Persistent (or Reflected) XSS and DOM-based XSS. In general, XSS attacks are based on the victim’s trust in a legitimate, but vulnerable, website or web application.Product Show Room Site does not filter the content correctly at the "Contact info-Telephone" module, resulting in the generation of stored XSS.

#### Payload used:
``

#### Proof of Concept

1. Login the CMS.
Default Admin Access
Username: admin
Password: admin123

1. Open Page http://172.24.5.107/psrs/admin/?page=system_info/contact_info and click View button

2. Put XSS payload (``) in the Telephone box and click on Update to publish the page
![image](https://user-images.githubusercontent.com/60683449/171591851-2068eea2-b789-464f-8afb-9f6b6f8eaedd.png)

3. Open http://172.24.5.107/psrs/?p=contact,Viewing the successfully published page,We can see the alert.
![image](https://user-images.githubusercontent.com/60683449/171591881-2962a429-f2de-4979-8e27-6fdd8f62c61c.png)
-------
# Product Show Room Site - 'Message' Stored Cross-Site Scripting(XSS)
#### Exploit Title: Product Show Room Site - 'Message' Stored Cross-Site Scripting(XSS)
#### Exploit Author: webraybtl@webray.com.cn inc
#### Vendor Homepage: https://www.sourcecodester.com/php/15370/product-show-room-site-phpoop-free-source-code.html
#### Software Link: https://www.sourcecodester.com/download-code?nid=15370&title=Product+Show+Room+Site+in+PHP%2FOOP+Free+Source+Code
#### Version: Product Show Room Site 1.0
#### Tested on: Windows Server 2008 R2 Enterprise, Apache ,Mysql

#### Description
Persistent XSS (or Stored XSS) attack is one of the three major categories of XSS attacks, the others being Non-Persistent (or Reflected) XSS and DOM-based XSS. In general, XSS attacks are based on the victim’s trust in a legitimate, but vulnerable, website or web application.Product Show Room Site does not filter the content correctly at the "Contact info-Telephone" module, resulting in the generation of stored XSS.

#### Payload used:
``

#### Proof of Concept

1. Login the CMS.
Default Admin Access
Username: admin
Password: admin123

1. Open Page http://172.24.5.107/psrs/?p=contact

2. Put XSS payload (``) in the Message box and click on Send Message to publish the page
![image](https://user-images.githubusercontent.com/60683449/171591580-cc3ca01c-9e37-4e05-9351-4b9d7c7749df.png)
![image](https://user-images.githubusercontent.com/60683449/171591599-be5e8d7f-1d95-43ad-875a-9884f7052fa6.png)
4. Open http://172.24.5.107/psrs/admin/?page=inquiries,Viewing the Top 1 of Inquiries page,We can see the alert.
![image](https://user-images.githubusercontent.com/60683449/171591660-c12ce9ac-aab1-45e9-b99f-7514dd28f698.png) Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Have we learned anything from the attacks by lapsus?

https://external-preview.redd.it/Kiskj3Bh1j8Z-6aX0gWi5N5wWAAlVr2R0Oyo9b0LhWg.jpg?width=320&crop=smart&auto=webp&s=b0ad207febbfb347015804c9bcea47463eafa24a submitted by /u/TheDigitalPrepper
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Fighting Follina: Application Vulnerabilities and Detection Possibilities

Although organizations should perform proper risk analysis and patch as soon as practical after there's a fix for this vulnerability, defenders still have options before that's released.

Dark Reading: Attacks/Breaches
'Clipminer' Malware Actors Steal $1.7 Million Using Clipboard Hijacking

The malware targets Windows users via Trojanized downloads of cracked or pirated software and then starts in on cryptocurrency mining and clipboard hijacking.

Dark Reading: Attacks/Breaches
Building America's Cybersecurity Infrastructure

The government is putting the right skills and expertise in place to fight the rising cyber threat.

Hacking on Medium
Hacking an AWS hosted Kubernetes backed product, and failing

https://cdn-images-1.medium.com/max/1920/1*Xl4Qt0EvIav3BuzlK4cCdw.jpeg
Tales from a recent pentest of a product hosted on the AWS cloud backed by Kubernetes (EKS) and a whole lot of secure design goodness that…

Continue reading on Appsecco »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Did you know that users can modify your JavaScript variables from Browser console?

https://cdn-images-1.medium.com/max/959/1*mXzNJ6aLwZUzbsFvMsfe6g.gif
You wouldn’t believe how easy it is to mess with client-side scripts. If you too use JS in your frontend to make backend calls, read along!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HOT QUICK Cashapp Paypal Western Union Transfer Secured High balance bank transfer

ALBERT’S CASH TEAM SERVICE WORLDWIDE(GET RICH NOW/SOLVE ALL PROBLEM NOW)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How CoFix user’s got hacked 150K USDT

https://cdn-images-1.medium.com/max/1188/1*bqx3x8Um5ZA27cHJOXsJEA.png
Hello there and warm welcome to Elessar Labs! We are a Hong Kong based blockchain R&D team specialized in ecosystem security.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Follina 0day — CVE-2022–30190

https://cdn-images-1.medium.com/max/1481/1*fY11cRFWMecJwk16FaQJOw.png
Por volta do dia 30/05 de 2022 a Microsoft publicou de forma oficial a vulnerabilidade denominada Follina na qual está presente no…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
FBI incauta dominios utilizados para vender datos robados, servicios DDoS

https://cdn-images-1.medium.com/max/1645/0*Xj1-mDT59usz3-mn
PUBLICADO EN 1 JUNIO, 2022 EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Las fugas de Conti revelan el interés de la banda de ransomware en los ataques basados ​​en…

https://cdn-images-1.medium.com/max/1673/0*rXFfrLyFc1dkymNd
PUBLICADO EN 2 JUNIO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video