Oracle MAF store bypass, a how-to

On a recent assignment I was asked to look at the security of a cloud-based solution for expenses, the Oracle® ExpensesCloud with Fusion applications. It was being used for employees to create/save/edit/submit claims to the employer. TL;DR Having default hardcoded credentials allows an attacker...

WordPress Booking Calendar 8.4.3 Plugin - Authenticated SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Booking Calendar v8.4.3 - Authenticated SQL Injection Vulnerability Exploit Author: B0UG Vendor Homepage: https://wpbookingcalendar.com/ Software Link: https://wordpress.org/plugins/booking/ Version: Tested on version...

PilusCart 1.4.1 SQL Injection

Exploit Title: PilusCart 1.4.1 - 'send' SQL Vulnerability Dork: N/A Date: 10-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://sourceforge.net/projects/pilus/ Software Link: https://sourceforge.net/projects/pilus/ Version: 1.4.1 Category: Webapps Tested on: Wampp @Win CVE: N/A...

PilusCart 1.4.1 - send SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: PilusCart 1.4.1 - 'send' SQL Vulnerability Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://sourceforge.net/projects/pilus/ Software Link: https://sourceforge.net/projects/pilus/ Version: 1.4.1 Category: Webapps Tested o...

PilusCart 1.4.1 - send SQL Injection

PilusCart 1.4.1 - send SQL Injection Exploit Title: PilusCart 1.4.1 - 'send' SQL Vulnerability Dork: N/A Date: 10-02-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: https://sourceforge.net/projects/pilus/ Software Link: https://sourceforge.net/projects/pilus/ Version: 1.4.1 Category: Webapp...

Dolibarr 8.0.4 - user privilege escalation Vulnerability

Exploit for php platform in category web applications Exploit title : Dolibarr 8.0.4 - user privilege escalation Google Dork : N/A Date : 06.02.2019 Exploit Author : Mikayıl İlyas / Cyber-warrior.org - Bug Researchers group Vendor Homepage : https://dolibarr.org Software download :...

Burp HMAC header extensions, a how-to

I was recently on a test where the client’s API used a custom authentication scheme to add a SHA256 HMAC dynamically on each request, based on the URL, time, and message body. My normal go-to for API testing is Postman especially when your client is lovely enough to give you definitions you can...

HackerOne: Race condition in claiming program credentials

Hi, Summary: I was invited to a private program and I tried to get test credentials so a request as follows was sent to your server: POST /graphql HTTP/1.1 Host: hackerone.com Connection: close Content-Length: 778 Accept: / X-Auth-Token: ████ User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64...

Qualys Cloud Platform 2.36 New Features

This release of the Qualys Cloud Platform version 2.36 includes updates and new features for AssetView Cloud Assets and Cloud Agents and Web Application Scanning, highlights as follows. AssetView Rules for Cloud Assets and Cloud Agents Rule-Based Method to Purge/Uninstall Cloud Assets and Cloud...

WordPress UserPro Privilege Escalation

Exploit Title: Wordpress Plugin UserPro 4.9.21 User Registration With Administrator Role Google Dork: inurl:/wp-content/plugins/userpro/ Date: 3rd January, 2019 Exploit Author: Noman Riffat Vendor Homepage: https://userproplugin.com/ Software Link:...

Wordpress Plugin UserPro 4.9.21 - User Registration Privilege Escalation

Wordpress Plugin UserPro 4.9.21 - User Registration Privilege Escalation Exploit Title: Wordpress Plugin UserPro 4.9.21 User Registration With Administrator Role Google Dork: inurl:/wp-content/plugins/userpro/ Date: 3rd January, 2019 Exploit Author: Noman Riffat Vendor Homepage:...

Wordpress UserPro < 4.9.21 Plugin - User Registration Privilege Escalation Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin UserPro 4.9.21 User Registration With Administrator Role Google Dork: inurl:/wp-content/plugins/userpro/ Exploit Author: Noman Riffat Vendor Homepage: https://userproplugin.com/ Software Link:...

WordPress Plugin UserPro < 4.9.21 - User Registration Privilege Escalation

Exploit Title: Wordpress Plugin UserPro 4.9.21 User Registration With Administrator Role Google Dork: inurl:/wp-content/plugins/userpro/ Date: 3rd January, 2019 Exploit Author: Noman Riffat Vendor Homepage: https://userproplugin.com/ Software Link:...

New Relic: Ability to view monitor names of other NR accounts through internal API (v3) via "monitor_id" parameter

NR Alerts gives you the granularity to set alert conditions on an alert policy depending on the conditions you specify at the https://alerts.newrelic.com/accounts/ACCOUNTNUMBER/policies/POLICYID/conditions/new URL. When you select an entity for the condition, the application does not check to...

FAST or Burp or both?

By @aLLy , Wallarm Research Hello guys, time to talk details about Wallarm FAST Framework for Application Security Testing. It’s a new automatic web vulnerability scanning and fuzzing detection tool by Wallarm Inc. It is well suited for security researchers in enterprise Red Teams as well as for...

Qualys Cloud Platform 2.35 New Features

This release of the Qualys Cloud Platform version 2.35 includes updates and new features for AssetView, Cloud Agent, Security Assessment Questionnaire, and Web Application Scanning, highlights as follows. Note: this post has been edited after publishing to remove the Rule-Based Method to...

Liberapay: Broken Authentication and session management OWASP A2

Hello @liberapay, Description: It seems now if attacker has csrf token & victim cookies then attacker can easily login to victim account without any login details. No need Of Any Username/Password Theory Proof-Of-Concept: - Go to https://liberapay.com/admin.101/edit/username any username/Self...

ZIP File Raider - Burp Extension For ZIP File Payload Testing

ZIP File Raider is a Burp Suite extension for attacking web application with ZIP file upload functionality. You can easily inject Burp Scanner/Repeater payloads in ZIP content of the HTTP requests which is not feasible by default. This extension helps to automate the extraction and compression...

Endpoint for Out-of-Band Exfiltration: Arecibo

In the process of identifying and exploiting vulnerabilities, it is sometimes necessary to resort to Out of Band OOB techniques in order to exfiltrate information through DNS resolutions or HTTP requests. To address this kind of situation the faster and simpler solution can be the use of a Burp...

FormAssembly: xmlrpc.php file is enable it will used for (DOS) and bruteforce attack

Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DDOS. The website https://www.formassembly.com/ has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. In order ...