Online Course Registration 1.0 - Unauthenticated Remote Code Execution

Exploit Title: Online Course Registration 1.0 - Unauthenticated Remote Code Execution Exploit Author: Bobby Cooke Credit to BKpatron for similar Auth Bypass on admin page - exploit-db.com/exploits/48559 Date: 2020-07-15 Vendor Homepage: Vendor Homepage:...

LibreHealth 2.0.0 Remote Code Execution Exploit

Exploit Title: LibreHealth v2.0.0 - Authenticated Remote Code Execution Exploit Author: Bobby Cooke Vendor Homepage: https://librehealth.io/ Software Link: https://github.com/LibreHealthIO/lh-ehr Version: 2.0.0 Tested On: Windows 10 Pro 1909 x6486 + XAMPP 7.4.4 Exploit Tested Using: Python 2.7.17...

Company Visitor Management System (CVMS) 1.0 SQL Injection

Exploit Title: Company Visitor Management System CVMS 1.0 - Authentication Bypass Date: 2020-07-20 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/company-visitor-management-system-using-php-and-mysql/...

Company Visitor Management System (CVMS) 1.0 SQL Injection Vulnerability

Company Visitor Management System CVMS version 1.0 suffers from multiple remote SQL Injection vulnerabilities, one of which allows for authentication bypass. Exploit Title: Company Visitor Management System CVMS 1.0 - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos68...

RiteCMS 2.2.1 - Remote Code Execution Exploit

Exploit for php platform in category web applications Exploit Title: RiteCMS 2.2.1 - Remote Code Execution Exploit Author: Enes Özeser Vendor Homepage: http://ritecms.com/ Version: 2.2.1 Tested on: Linux 1- Go to following url. http://CHANGE-THIS/ritecms/cms/ 2- Default username and password is...

File upload vulnerability in MCMS backend up***.do page

MCMS is a website building system of MINGFEI TECHNOLOGY CO. A file upload vulnerability exists in the MCMS backend up.do page. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Vehicle Parking Management System 1.0 SQL Injection Vulnerability

Vehicle Parking Management System version 1.0 suffer from multiple remote SQL Injection vulnerabilities, one of which allows for authentication bypass. Exploit Title: Vehicle Parking Management System 1.0 - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 |...

File upload vulnerability in MCMS frontend up***.do page

MCMS is a website building system of MINGFEI TECHNOLOGY CO. A file upload vulnerability exists in the MCMS frontend up.do page. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Arbitrary File Upload Vulnerability in Heartland OA Network Intelligent Office System

Heartland OA Network Intelligent Office System is a multi-functional intelligent office application software. An arbitrary file upload vulnerability exists in the HeartStone OA Network Intelligent Office System. An attacker can exploit the vulnerability to upload a webshell and gain server...

RiteCMS 2.2.1 - Remote Code Execution

Exploit Title: RiteCMS 2.2.1 - Remote Code Execution Date: 2020-07-03 Exploit Author: Enes Özeser Vendor Homepage: http://ritecms.com/ Version: 2.2.1 Tested on: Linux 1- Go to following url. http://CHANGE-THIS/ritecms/cms/ 2- Default username and password is admin:admin. 3- Go "Filemanager" and...

File upload vulnerability exists in Swordfish Forum (CNVD-2020-49099)

Swordfish Forum is a bbs forum system. A file upload vulnerability exists in Swordfish Forum. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

File upload vulnerability in MCMS backend wr***.do page

MCMS is a website building system of MINGFEI TECHNOLOGY CO. A file upload vulnerability exists in the MCMS backend wr.do page. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

File Upload Vulnerability in MCMS Backend

MCMS is a website building system of MINGFEI TECHNOLOGY CO. A file upload vulnerability exists in the MCMS backend. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Vehicle Parking Management System 1.0 SQL Injection

Exploit Title: Vehicle Parking Management System 1.0 - Authentication Bypass Date: 2020-07-16 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/vehicle-parking-management-system-using-php-and-mysql/ Software...

Teachers Record Management System 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Cyber Cafe Management System SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Cyber Cafe Management System - Authentication Bypass Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Teachers Record Management System 1.0 SQL Injection

Exploit Title: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection Date: 2020-07-14 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/...

Client Management System 1.0 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Client Management System 1.0 - 'searchdata' SQL Injection Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage:...

Client Management System 1.0 SQL Injection

Exploit Title: Client Management System 1.0 - 'searchdata' SQL Injection Date: 2020-07-14 Exploit Author: gh1mau Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/ Vendor Homepage: https://phpgurukul.com/client-management-system-using-php-mysql/ Software Link:...

RiteCMS 2.2.1 Remote Code Execution

Exploit Title: RiteCMS 2.2.1 - Authenticated Remote Code Execution Date: 2020-07-03 Exploit Author: Enes Özeser Vendor Homepage: http://ritecms.com/ Version: 2.2.1 Tested on: Linux 1- Go to following url. http://HOST/cms/ 2- Default username and password is admin:admin. We must know login...