Code injection

In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day...

CVE-2021-27200

In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day...

CVE-2021-27200

CVE-2021-27200 affects WoWonder 3.0.4. The issue is a weak cryptographic algorithm in recover.php, making the code parameter easily predictable from the time of day. This enables remote attackers to take over any account. The vulnerability is described consistently across multiple sources (NVD, R...

CVE-2021-27200

In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day...

WoWonder Social Network Platform 3.1 Authentication Bypass

Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass Date: 11.06.2021 Exploit Author: securityforeveryone.com Researchers : Security For Everyone Team - https://securityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...

Envato WoWonder 安全特征问题漏洞

Envato WoWonder is an application from the Australian company Envato. It provides a PHP social networking script. WoWonder suffers from a security signature issue vulnerability that stems from a weak encryption algorithm in recovery.php in WoWonder 3.0.4. An attacker can exploit this vulnerabilit...

WoWonder Social Network Platform 3.1 - Authentication Bypass

Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass Date: 11.06.2021 Exploit Author: securityforeveryone.com Researchers : Security For Everyone Team - https://securityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...

CVE-2021-26935

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

CVE-2021-26935

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

CVE-2021-26935

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

Sql injection

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

CVE-2021-26935

In WoWonder 3.1, remote attackers can gain access to the database by exploiting a requests.php?f=search-my-followers SQL Injection vulnerability via the eventid parameter...

CVE-2021-26935

CVE-2021-26935 affects WoWonder below version 3.1, where a SQL Injection flaw in requests.php?f=search-my-followers vulnerable to the event_id parameter allows remote attackers to access the database. The vulnerability is documented across multiple sources (NVD, CVE listings, and regional CN/VN s...

Envato WoWonder SQL注入漏洞

Envato WoWonder is an application from the Australian company Envato. It provides a PHP social networking script. A security vulnerability exists in WoWonder 3.1, which can be exploited by remote attackers to gain access to a database via request .php...

WoWonder Social Network Platform 3.1 - (event_id) SQL Injection Vulnerability

Exploit Title: WoWonder Social Network Platform 3.1 - 'eventid' SQL Injection Vendor Homepage: https://www.wowonder.com/ Software Link: https://codecanyon.net/item/wowonder-the-ultimate-php-social-network-platform/13785302 Version: 3.1 Tested on: Linux/Windows DESCRIPTION In WoWonder 3.1, remote...

WoWonder Social Network Platform 3.1 SQL Injection

Exploit Title: WoWonder Social Network Platform 3.1 - 'eventid' SQL Injection Date: 16.03.2021 Exploit Author: securityforeveryone.com Author Mail: helloATsecurityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...

WoWonder Social Network Platform 3.1 - 'event_id' SQL Injection

Exploit Title: WoWonder Social Network Platform 3.1 - 'eventid' SQL Injection Date: 16.03.2021 Exploit Author: securityforeveryone.com Author Mail: helloATsecurityforeveryone.com Vendor Homepage: https://www.wowonder.com/ Software Link:...

Wowonder CMS - Privilege Escalation Vulnerability

Exploit for php platform in category web applications Today I will explain an exploit of Privilege Escalation in Wowonder CMS. First we need firefox v56.0.2 or earlier and then download hackbar: https://addons.mozilla.org/es/firefox/addon/hackbar/ Note: If the bar does not appear, press F9 to mak...