billing-hack

Billing Hack For information about this code, go to http://sufficientlysecure.org/index.php/2013/10/29/google-play-billing-hacked/...

Room-Walkthrough-Billing

🧠 Room Walkthrough: Billing Written by: Aditya Bhatt | Open Source Contributor 📦 Overview In this walkthrough, we go full force into Billing Room , showcasing a vulnerable MagnusBilling instance, a juicy unauth RCE CVE-2023-30258, and a fail2ban sudo misconfig that screams “root me.” This room...

CVE-2023-30258-Exploit-For-Magnus-Billing-System

This repository does not have a README...

CVE-2022-3552

CVE-2022-3552 BoxBilling=4.22.1.5 - Remote Code Execution RCE Usages python3 .\CVE-2022-3552.py -d http://192.168.228.143 -u [email protected] -p [email protected]...

ghost-compact

Xint's OpenAI Compaction Research Two major findings in OpenAI's compaction API: GhostCompact : a billing bug that made OpenAI compaction, and the arbitrary inference it can perform, nearly free. Code: ghostcompact.py, ghostscan.py. blog post Compaction Smuggling : steering compaction to copy a...

CVE-2023-30258-magnus-billing-v7-exploit

Magnus Billing System v7 Exploit This Python script automates the exploitation of a command injection vulnerability in Magnus Billing System v7, specifically in the icepay.php script located at /mbilling/lib/icepay/icepay.php. The exploit leverages the democ parameter to execute arbitrary command...

CVE-2026-126482

OpenEMR before 8.5.0 contains an SQL injection vulnerability in SLEOB::slInvoiceNumber in src/Billing/SLEOB.php, which concatenates the CLP01 claim identifier from uploaded X12 835 ERA files into a query without escaping or parameter binding. Authenticated users with billing permissions, or a...

CVE-2026-126458

OpenEMR before 8.5.0 contains a missing authorization vulnerability in authorizationsfull.php that allows any authenticated staff user to authorize arbitrary patients' clinical records. Attackers can send a mode=authorize request with an attacker-chosen pid and their own CSRF token to set...

CVE-2026-126452

OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosisfull.php that allows authenticated users to delete or clear any billing record by ID. Attackers can supply a target billing ID in the id parameter with delete or clear mode to deactivate other patients' charges and...

CVE-2026-126428

OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to erapayments.php. Attackers with a database-write primitive such as SQL injection can register a backgroundservices row...

CVE-2026-126423

OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, makin...

CVE-2026-126418

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sleobinvoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes...

CVE-2026-126418

OpenEMR versions before 8.5.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability in interface/billing/sl_eob_invoice.php. The root cause is that the application fails to escape billing codes for JavaScript strings within an inline onkeyup handler, although it does escape them for...

EUVD-2026-125025

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sleobinvoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes...

CVE-2026-126424 OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbillcustomfull.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or...

CVE-2026-126423 OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression

OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries into memory without size or ratio checks. Authenticated billing or Carecoordination users can upload highly compressed ZIP archives to exhaust PHP memory and worker pools, makin...

CVE-2026-126423

OpenEMR versions before 8.5.0 are vulnerable to a Denial of Service (DoS) attack due to a lack of size or ratio checks when processing ZIP uploads in four specific paths. Authenticated users with billing or Carecoordination privileges can exploit this by uploading highly compressed ZIP archives, ...

CVE-2026-126428 OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services

OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to erapayments.php. Attackers with a database-write primitive such as SQL injection can register a backgroundservices row...

CVE-2026-126428 OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services

OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to erapayments.php. Attackers with a database-write primitive such as SQL injection can register a backgroundservices row...

EUVD-2026-125015

OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to erapayments.php. Attackers with a database-write primitive such as SQL injection can register a backgroundservices row...