CVE-2018-11444

A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0...

CVE-2018-11445

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11443: Improper Neutralization of Input During Web Page Generation

The parameter q is affected by Cross-site Scripting in jobcard-ongoing.php in EasyService Billing 1.0...

PT-2018-10575

Name of the Vulnerable Software and Affected Versions EasyService Billing version 1.0 Description A CSRF issue was found on the "system-settings-user-new2.php" page, specifically the User Add/System Settings Page, allowing a user to be added with the Admin role. Recommendations For EasyService...

PT-2018-10573

Name of the Vulnerable Software and Affected Versions EasyService Billing version 1.0 Description The issue affects the q parameter in jobcard-ongoing.php, where a Cross-site Scripting problem has been identified. Recommendations For EasyService Billing version 1.0, avoid using the q parameter in...

PT-2018-10574

Name of the Vulnerable Software and Affected Versions EasyService Billing version 1.0 Description A SQL Injection issue was observed in the parameter q in the jobcard-ongoing.php file. Recommendations For EasyService Billing version 1.0, avoid using the parameter q in the affected file until the...

PT-2018-10572

Name of the Vulnerable Software and Affected Versions EasyService Billing version 1.0 Description A CSRF issue was discovered, which can be triggered via a "quotation-new3-new2.php?add=true&id=" URI, allowing an attacker to add a new quotation. Recommendations For EasyService Billing version 1.0,...

CVE-2018-11445: Cross-Site Request Forgery (CSRF)

A CSRF issue was discovered on the User Add/System Settings Page system-settings-user-new2.php in EasyService Billing 1.0. A User can be added with the Admin role...

CVE-2018-11442: Cross-Site Request Forgery (CSRF)

A CSRF issue was discovered in EasyService Billing 1.0, which was triggered via a quotation-new3-new2.php?add=true&id= URI, as demonstrated by adding a new quotation...

CVE-2018-11444: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection issue was observed in the parameter "q" in jobcard-ongoing.php in EasyService Billing 1.0...

EasyService Billing 1.0 - p1 SQL Injection

EasyService Billing 1.0 - p1 SQL Injection Exploit Title: EasyService Billing 1.0 - 'customer-new-s.php' SQL Injection / Cross-Site Scripting Dork: N/A Date: 22.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage:...

EasyService Billing 1.0 - SQL Injection Cross-Site Scripting

EasyService Billing 1.0 - SQL Injection Cross-Site Scripting Exploit Title: EasyService Billing 1.0 - 'template.php' SQL Injection / Cross-Site Scripting Dork: N/A Date: 22.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage:...

EasyService Billing 1.0 - SQL Injection / Cross-Site Scripting

Exploit Title: EasyService Billing 1.0 - 'template.php' SQL Injection / Cross-Site Scripting Dork: N/A Date: 22.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 Version: 1.0...

EasyService Billing 1.0 - 'p1' SQL Injection

Exploit Title: EasyService Billing 1.0 - 'customer-new-s.php' SQL Injection / Cross-Site Scripting Dork: N/A Date: 22.05.2018 Exploit Author: Özkan Mustafa Akkuş AkkuS Vendor Homepage: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 Version:...

EasyService Billing 1.0 SQL Injection / Cross Site Scripting

------------------- Exploit 1 of 2: Exploit Title: EasyService Billing 1.0 - 'template.php' SQL Injection / Cross-Site Scripting Dork: N/A Date: 22.05.2018 Exploit Author: Azkan Mustafa AkkuA AkkuS Vendor Homepage:...

CVE-2018-10571: Improper Neutralization of Input During Web Page Generation

Multiple reflected cross-site scripting XSS vulnerabilities in OpenEMR before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 patient parameter to interface/main/finder/findernavigation.php; 2 key parameter to interface/billing/getclaimfile.php; 3 formid or 4 formseq...

PT-2018-9969

Name of the Vulnerable Software and Affected Versions: OpenEMR versions prior to 5.0.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via various parameters in different PHP files, including patient to /interface/main/finder/finder navigation.php, key to...

Hackers take over power billing records of Indian state; demand ransom

By Uzair Amir The AMR system automatic meter reading system of Uttar Haryana This is a post from HackRead.com Read the original post: Hackers take over power billing records of Indian state; demand ransom...

You down with P2P? 10 tips to secure your mobile payment app

If you look at the figures, you cannot deny that the eCommerce industry is steadily growing. More and more people are doing their shopping online, not only for products and services geared toward the use of technologies and the Internet, but also for items previously only found in brick and morta...

Trello: Trello Gold accounts free for 1 year

It is possible to create Trello Gold accounts and use it for free for 1 year. The issue lies in credit card validation. PoC: 1. Create a new trello account 2. After verification, go to Profile Trello Gold 3. Choose billed annually, enter a valid credit card number with $0 on it. and click on...