Logic design flaws in BMS CRM APP

CRM APP is a mobile sales customer management platform developed by Xiamen Ruipu Software Technology Co. CRM APP has a logical design loophole, the attacker forgets the password function to capture the packet to obtain the verification code, you can arbitrarily register users and reset any passwo...

Contact Manager 1.0 - 'femail' SQL Injection

Exploit Title: Contact Manager 1.0 - SQL Injection Dork: N/A Date: 15.09.2017 Vendor Homepage: http://savsofteproducts.com/ Software Link: http://www.contactmanagerscript.com/download/contactmanager1380185909.zip Demo: http://contactmanagerscript.com/demo/ Version: 1.0 Category: Webapps Tested on...

Contact Manager 1.0 - femail SQL Injection

Contact Manager 1.0 - femail SQL Injection Exploit Title: Contact Manager 1.0 - SQL Injection Dork: N/A Date: 15.09.2017 Vendor Homepage: http://savsofteproducts.com/ Software Link: http://www.contactmanagerscript.com/download/contactmanager1380185909.zip Demo: http://contactmanagerscript.com/dem...

Aier Eye Group's Eye Neighborhood Doctor's Edition App for Android Has Logic Design Flaws

Eye Neighborhood Doctor Edition App is an application designed and developed for ophthalmologists and ophthalmology practitioners. The Android version of Eye Neighborhood Doctor Edition APP of Aier Ophthalmology Group has a logical design vulnerability, which allows an attacker to reset any accou...

Logic design flaws in the Android version of Eye Neighborhood App of Aier Eye Group

Eye Neighborhood APP is an all-round eye health management application, which monitors your eye health anytime and anywhere, consults with professional ophthalmologists online, and connects with offline eye health medical products to provide users with professional checkups and treatment services...

Ellucian Banner Student Arbitrary Password Reset Vulnerability

Ellucian formerly known as SunGard Banner Student is a set of student information management system of the American Ellucian Company. The system has functions such as grade release, student attendance and student information statistics. A security vulnerability exists in Ellucian Banner Student...

Design/Logic Flaw

Ellucian formerly SunGard Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."...

CVE-2015-4689

Ellucian formerly SunGard Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."...

CVE-2015-4689

CVE-2015-4689 affects Ellucian Banner Student, versions 8.5.1.2 through 8.7. The vulnerability allows remote attackers to reset arbitrary passwords via unspecified vectors. The provided sources describe the issue as a “Weak Password Reset” vulnerability but do not specify the exact attack vector,...

CVE-2015-4689

Ellucian formerly SunGard Banner Student 8.5.1.2 through 8.7 allows remote attackers to reset arbitrary passwords via unspecified vectors, aka "Weak Password Reset."...

Logic design flaws in the Android version of the E-Care Online APP (Patient Side)

E-nursing online platform is a platform that provides professional nursing services for the majority of users through the development of an innovative health care service model by Shenyang Shengtai Internet Technology Co. There is a logical design vulnerability in the Android version of the...

Legal Robot: Password reset token issue

Hi Team, Step to Repro Request for password reset link. Go to email and click on password reset link https://app.legalrobot.com/password-reset/token?v=gHonjdcdLTpmax2pHSXtaRlQrs2eHpTl7TXUpMfjjh Now remove the token and use the link https://app.legalrobot.com/password-reset/ Observe that able to...

Legal Robot: Password reset token issue

Summary Can still change password without token Step to Reproduce - Request for password reset link. - Go to email and click on password reset link https://app.legalrobot.com/password-reset/token?v=uWeyFJS0-N9fIk0nG0b0NZ70lkwNNi7RdUZu0KhiaX - Now remove the token and use the link...

Radancy: [Cross Domain Referrer Leakage] Password Reset Token Leaking to Third party Sites.

Domain and URL: https://werkenbijdefensie.nl Summary:: Password Reset Token Leaking to Third party Sites from the link in the footer Description: Hello, I found that the if a user request for a password reset link and open it but don't change the password and click on the Third Parties Sites link...

Taringa: Over 28 Million Users' Data Exposed in Massive Data Breach

Exclusive — If you have an account on Taringa, also known as "The Latin American Reddit," your account details may have compromised in a massive data breach that leaked login details of almost all of its over 28 million users. Taringa is a popluar social network geared toward Latin American users...

Arbitrary Account Password Reset Vulnerability in Easy Nurse Android App

Easy Nurse Android App is a mobile nursing application. Easy Nurse Android APP has an arbitrary account password reset vulnerability. An attacker can reset any password by grabbing and modifying the password reset function...

Huicheng Gold app has logic design flaws

The Huicheng Gold app is an internet-based lending software. There is a logical design vulnerability in the Huicheng Gold Service app. Attackers can log into other users' systems, reset arbitrary passwords and perform unauthorized operations by capturing verification codes through packet grabbing...

Phoenix Gold app has logic design flaws

Phoenix Gold app is a financial information service platform created by Shenzhen Jinshi Internet Financial Service Co. Phoenix Gold Service app has a logical design vulnerability. Attackers can log in to other users' systems, reset arbitrary passwords and perform unauthorized operations by...

Rice Gold app has logic design flaws

Paddy Gold app is a financial service platform created by Xiamen Golden Paddy Financial. A logical design vulnerability exists in the Paddy Gold app. Attackers can log in to other users' systems, reset arbitrary passwords and perform unauthorized operations by capturing authentication codes in a...

Six Degrees of Gold app has logic design flaws

Six Degrees Gold app is an internet investment banking platform. Six Degrees of Gold app has a logical design vulnerability. Attackers can log into other users' systems, reset arbitrary passwords and perform unauthorized operations by capturing authentication codes in a packet...