School Event Management System 1.0 Shell Upload

Exploit Title: School Event Management System 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/sems1.zip Version: 1.0...

Aplaya Beach Resort Online Reservation System 1.0 CSRF / SQL Injection

Exploit Title: Aplaya Beach Resort Online Reservation System 1.0 - Multiple Vulnerabilities Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

School Attendance Monitoring System 1.0 Shell Upload

Exploit Title: School Attendance Monitoring System 1.0 - Arbitrary File Upload Dork: N/A Date: 2018-10-29 Exploit Author: Ihsan Sencan Vendor Homepage: https://www.sourcecodester.com/users/janobe Software Link:...

Shell In A Box 2.2.0 Denial Of Service Exploit

Exploit for linux platform in category dos / poc Product: Shell In A Box aka shellinabox, shellinaboxd "Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal emulator. This emulator is accessible to any JavaScript and CSS enabled web browser a...

MPS Box 0.1.8.0 - Arbitrary File Upload

Exploit Title: MPS Box 0.1.8.0 - Arbitrary File Upload Dork: N/A Date: 2018-10-25 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.mpsbox.com/ Software Link: https://sourceforge.net/projects/mpsbox/files/latest/download Version: 0.1.8.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CV...

LANGO Codeigniter Multilingual Script 1.0 - Cross-Site Scripting

Exploit Title: LANGO Codeigniter Multilingual Script 1.0 - Cross-Site Scripting Date: 2018-10-16 Exploit Author: Ismail Tasdelen Vendor Homepage: http://pokkho.com/lango/ Software Link : http://pokkho.com/lango/auth/login Software : LANGO - Codeigniter Multilingual Script Version : 1.0...

SIM-PKH 2.4.1 - Arbitrary File Upload

SIM-PKH 2.4.1 - Arbitrary File Upload Exploit Title: SIM-PKH 2.4.1 - Arbitrary File Upload Dork: N/A Date: 2018-10-22 Exploit Author: Ihsan Sencan Vendor Homepage: https://simpkh.sourceforge.io/ Software Link: https://sourceforge.net/projects/simpkh/files/latest/download Version: 2.4.1 Category:...

LANGO Codeigniter Multilingual Script 1.0 Cross Site Scripting Vulnerability

LANGO Codeigniter Multilingual Script version 1.0 suffers from html injection and cross site scripting vulnerabilities. Exploit Title: LANGO - Codeigniter Multilingual Script 1.0 - HTML Injection and Stored XSS Exploit Author: Ismail Tasdelen Vendor Homepage: http://pokkho.com/lango/ Software Lin...

CAMALEON CMS 2.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: CAMALEON CMS 2.4 - Cross-Site Scripting Exploit Author: Ismail Tasdelen Vendor Homepage: http://camaleon.tuzitio.com/ Software Link : https://github.com/owen2345/camaleon-cms Software : CAMALEON CMS Version : 2.4 Vulernability...

HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin) Vulnerability

Exploit for perl platform in category web applications Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery Update Admin Exploit Author: Ihsan Sencan Vendor Homepage: http://www.sitejo.id Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download Version: 1.1 Category:...

CAMALEON CMS 2.4 Cross Site Scripting

Exploit Title: CAMALEON CMS 2.4 - Cross-Site Scripting Date: 2018-10-11 Exploit Author: Ismail Tasdelen Vendor Homepage: http://camaleon.tuzitio.com/ Software Link : https://github.com/owen2345/camaleon-cms Software : CAMALEON CMS Version : 2.4 Vulernability Type : Cross-site Scripting...

HaPe PKH 1.1 Cross Site Request Forgery

Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-12 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.sitejo.id Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download Version: 1.1 Category: Webapps Tested on:...

HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin)

Exploit Title: HaPe PKH 1.1 - Cross-Site Request Forgery Update Admin Dork: N/A Date: 2018-10-12 Exploit Author: Ihsan Sencan Vendor Homepage: http://www.sitejo.id Software Link: https://sourceforge.net/projects/hape-pkh/files/latest/download Version: 1.1 Category: Webapps Tested on:...

CVE-2018-17849

Navigate CMS 2.8 has Stored XSS via a navigateupload.php aka File Upload request with a multipart/form-data JavaScript payload...

PT-2018-14221

Name of the Vulnerable Software and Affected Versions Navigate CMS version 2.8 Description The issue concerns a Stored XSS vulnerability. It can be exploited via a request to the "navigate upload.php" endpoint, also known as File Upload, using a multipart/form-data JavaScript payload...

CVE-2018-17849: Improper Neutralization of Input During Web Page Generation

Navigate CMS 2.8 has Stored XSS via a navigateupload.php aka File Upload request with a multipart/form-data JavaScript payload...

CVE-2018-17836

JTBC(PHP) 3.0.1.6 is affected by CVE-2018-17836. A remote attacker can execute arbitrary PHP code by exploiting a file upload via /console/file/manage.php?type=action&action=addfile&path=..%2F in combination with a multipart/form-data PHP payload. The vulnerability stems from a path-traversal/uns...

PT-2018-14214

Name of the Vulnerable Software and Affected Versions JTBCPHP version 3.0.1.6 Description An issue allows remote attackers to execute arbitrary PHP code. This can be achieved by using a "/console/file/manage.php?type=action&action=addfile&path=..%2F" substring to upload a file, in conjunction wit...

CVE-2018-17836: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in JTBCPHP 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload...

DamiCMS Remote Code Execution Vulnerability

DamiCMS is a content management system CMS for building websites quickly. A remote code execution vulnerability exists in DamiCMS version 6.0.1, which can be exploited by a remote attacker to execute code by sending a multipart/form-data POST request containing PHP code to the...