billing-hack

Billing Hack 关于此代码的信息，请访问 http://sufficientlysecure.org/index.php/2013/10/29/google-play-billing-hacked/...

CVE-2023-30258-Exploit-For-Magnus-Billing-System

此存储库没有 README。...

CVE-2023-30258-magnus-billing-v7-exploit

Magnus Billing System v7 漏洞利用脚本 该 Python 脚本可自动化利用 Magnus Billing System v7 中的命令注入漏洞，该漏洞位于 /mbilling/lib/icepay/icepay.php 脚本的 icepay.php 中。利用程序通过 democ 参数在目标系统上执行任意命令，最终在攻击者控制的机器上建立反向 shell。 漏洞概述 该漏洞允许未认证的攻击者通过精心构造的 GET 请求进行命令注入。原始概念验证（PoC）使用了以下 curl 命令： curl -s...

CVE-2022-3552

CVE-2022-3552 BoxBilling=4.22.1.5 - 远程代码执行 RCE 使用方法 python3 .\CVE-2022-3552.py -d http://192.168.228.143 -u [email protected] -p [email protected]...

stylesmuggler

StyleSmuggler HTTP PoC 针对本地 Magento Open Source 实验环境，对 StyleSmuggler（CVE-2026-75650）进行纯 HTTP 复现的私有研究仓库。 完整技术解析请阅读 Magento StyleSmuggler RCE: Report Poisoning to Code Execution。 该 Python PoC 执行完整的未认证攻击序列： 1. 污染 Magento 错误报告并从响应中读取其报告 ID； 2. 创建访客购物车； 3. 设置失败支付通知所需的访客邮箱； 4. 存储嵌套的账单地址解析器构造； 5...

Tryhackme_Billing

TryhackmeBilling Billing CTF 机器CVE-2023-30258远程代码执行...

PT-2026-104490

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.17.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a malicious filename is supplied to the ppress...

CVE-2023-30258-Magnus-Billing-v7-Command-Injection-PoC

CVE-2023-30258 — Magnus Billing v7 命令注入（PoC） Magnus Billing v7.3.0 存在未经身份验证的命令注入漏洞。icepay.php 中的 democ GET 参数未经过滤直接传递给 shell 函数，从而允许以 Web 服务器用户身份执行任意命令。该注入为盲注——输出不会反映在 HTTP 响应中——因此本漏洞利用脚本将每条命令的输出重定向到 webroot 内的文件中，并通过 HTTP 将其取回。 工作原理 1. 向 /mbilling/lib/icepay/icepay.php?democ=;; 发送 GET 请求。 2...

CVE-2026-92244

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-92244

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.16.1 . The root cause is insufficient input sanitization and output escaping within the Billing First Name , Last Name , and Company field...

CVE-2026-92244 PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-92244 PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

magnus_billing_7.3.0_RCE_CVE-2023-30258

magnusbilling7.3.0RCECVE-2023-30258 在 magnus billing 7.3.0 中存在一个远程代码执行漏洞，位于 "icepay.php" 资源的 "democ" 参数中，你可以绕过查询并执行任意命令。 漏洞代码 if isset$GET'democ' if strlen$GET'democ' 5 exec"touch " . $GET'democ' . '.txt'; else exec"rm -rf .txt"; "democ" 参数被传递给 exec 来创建新文件，但正如你所见，没有任何字符串清理，攻击者可以轻松转义 touch...

Room-Walkthrough-Billing

🧠 房间通关：Billing 作者： Aditya Bhatt | 开源贡献者 📦 概览 在本攻略中，我们将全力攻破 Billing 房间 ，展示一个脆弱的 MagnusBilling 实例、一个诱人的未授权 RCE（CVE-2023-30258）以及一个喊着“提权我吧”的 fail2ban sudo 配置错误。 这个房间完美融合了自动化利用与创造性权限提升，让我们亲手体验隐藏在 VoIP 计费软件中的真实漏洞。 我们将从初始侦察 一路走到Root Shell ，附带完整 PoC、评论和 🗿 风格。 🌐 第一步：枚举阶段 🏁 初始着陆 部署机器后，首先映入眼帘的就像一个配置错误的防火墙：...

CVE-2026-100616

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin a user holding org.updatesettings to update the entire row, including the internal billing pointer column...

CVE-2026-100616 capgo.app Authentication Bypass via PostgREST customer_id Mutation

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin a user holding org.updatesettings to update the entire row, including the internal billing pointer column...

EUVD-2026-87711

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin a user holding org.updatesettings to update the entire row, including the internal billing pointer column...

CVE-2026-100616

The capgo.app over-the-air update platform is vulnerable to an authentication bypass due to insecure row-level security (RLS) policies on the public.orgs table. Specifically, an authenticated organization admin with org.update_settings permissions can bypass the official update endpoint's restric...

CVE-2026-100616 capgo.app Authentication Bypass via PostgREST customer_id Mutation

capgo.app is an over-the-air update platform for Capacitor apps. In all versions prior to a fix, the row-level security UPDATE policy on the public.orgs table permits an organization admin a user holding org.updatesettings to update the entire row, including the internal billing pointer column...

PT-2026-99287

Name of the Vulnerable Software and Affected Versions capgo.app affected versions not specified Description An issue exists in the row-level security UPDATE policy on the public.orgs table. An authenticated organization administrator with org.update settings permissions can bypass the official...