BAF - Blind Attacking Framework

What is BAF ? it's a framework written in python 2.7 that is being made specially for blind attacking , ie : attacking random targets with common security issues , targets are generated by the hackers search engine "shodan" and vulnerable hosts are hacked in an automated way . this framework is...

Information Disclosure

Moodle is vulnerable to information disclosure. The library does not properly hide student information during blind marking, allowing a malicious users to view student information on code inspection...

Joomla CCNewsLetter 2.1.9 Component - sbid Parameter SQL Injection Vulnerability

Exploit for php platform in category web applications "Joomla Component ccnewsletter 2.1.9 - 'sbid' Parameter SQL Injection" Exploit Title: Joomla Component ccnewsletter 2.1.9 - SQL Injection Date: 07-26-2017 Exploit Author: Shahab Shamsi Vendor Homepage:...

Joomla! Component CCNewsLetter 2.1.9 - 'sbid' SQL Injection

"Joomla Component ccnewsletter 2.1.9 - 'sbid' Parameter SQL Injection" Exploit Title: Joomla Component ccnewsletter 2.1.9 - SQL Injection Date: 07-26-2017 Exploit Author: Shahab Shamsi Vendor Homepage: https://extensions.joomla.org/extension/ccnewsletter/ Version: = 2.1.9 Final Version Tested on:...

Joomla! Component CCNewsLetter 2.1.9 - sbid SQL Injection

Joomla! Component CCNewsLetter 2.1.9 - sbid SQL Injection "Joomla Component ccnewsletter 2.1.9 - 'sbid' Parameter SQL Injection" Exploit Title: Joomla Component ccnewsletter 2.1.9 - SQL Injection Date: 07-26-2017 Exploit Author: Shahab Shamsi Vendor Homepage:...

WordPress Plugin Ads Pro < 3.4 - Cross-Site Scripting / SQL Injection

Exploit Title: Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager = 5.0.12 AND time-based blind Payload: bsaprostats=1&[email protected]&bsaproid=xx AND SLEEP5 Credits & Authors: ================== 8bitsec - https://tw...

CVE-2017-3221

Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords...

CVE-2017-3221

Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords...

CVE-2017-3221

Blind SQL injection in Inmarsat AmosConnect 8 login form allows remote attackers to access user credentials, including user names and passwords...

CVE-2017-3221

The CVE-2017-3221 issue is a Blind SQL Injection in Inmarsat AmosConnect 8 login form. The vulnerability allows attackers on the same network to access user credentials (usernames and passwords) stored by AmosConnect 8, with the ThreatPost report noting the server stores usernames and passwords i...

wordpress-gallery-transformation 1.0 - Blind SQL Injection

The wordpress-gallery-transformation WordPress plugin was affected by a Blind SQL Injection security vulnerability...

WordPress Plugin IBPS Online Exam <= 1.0 - Authenticated SQL Injection / Cross-Site Scripting

Exploit Author: 8bitsec Contact Author: https://twitter.com/8bitsec Stored XSS on exam input textfields and Blind SQL Injection on 'examappUserResult' page 'id' parameter. Authenticated Stored XSS: Logged as a student: Write the payload in the input textfields while attempting an exam. The payloa...

WordPress Plugin IBPS Online Exam <= 1.0 - Authenticated SQL Injection / Cross-Site Scripting

Exploit Author: 8bitsec Contact Author: https://twitter.com/8bitsec Stored XSS on exam input textfields and Blind SQL Injection on 'examappUserResult' page 'id' parameter. PoC Authenticated Stored XSS: Logged as a student: Write the payload in the input textfields while attempting an exam. The...

Joomla JoomRecipe 1.0.4 SQL Injection

Exploit Title: Joomla JoomRecipe 1.0.4 Component - Blind SQL Injection Vulnerability Date: 20.07.2017 Exploit Author: Teng Vendor Homepage: http://joomboost.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/food-a-beverage/joomrecipe/ Version: 1.0.4 Platform:...

Joomla! Component JoomRecipe 1.0.4 - search_author SQL Injection

Joomla! Component JoomRecipe 1.0.4 - searchauthor SQL Injection Exploit Title: Joomla JoomRecipe 1.0.4 Component - Blind SQL Injection Vulnerability Date: 20.07.2017 Exploit Author: Teng Vendor Homepage: http://joomboost.com/ Software Link:...

WordPress Plugin IBPS Online Exam 1.0 - SQL Injection Cross-Site Scripting

WordPress Plugin IBPS Online Exam 1.0 - SQL Injection Cross-Site Scripting Exploit Title: IBPS Online Exam Plugin for WordPress v1.0 - XSS SQLi Date: 2017-07-11 Exploit Author: 8bitsec Vendor Homepage: https://elfemo.com/demo/server2/order2032/ Software Link:...

Joomla! Component JoomRecipe 1.0.4 - 'search_author' SQL Injection

Exploit Title: Joomla JoomRecipe 1.0.4 Component - Blind SQL Injection Vulnerability Date: 20.07.2017 Exploit Author: Teng Vendor Homepage: http://joomboost.com/ Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/food-a-beverage/joomrecipe/ Version: 1.0.4 Platform:...

Inmarsat AmosConnect8 Mail Client Vulnerable to SQL Injection and Backdoor Account

Overview Inmarsat Solutions offers a shipboard email client service, AmosConnect 8 AC8, which was designed to be utilized over satellite networks in a highly optimized manner. IOActive has identified two security vulnerabilities in the client software: On-board ship network access could provide...

Grab: Blind stored xss [parcel.grab.com] > name parameter

Hi, my previously reported blind xss is fixed but i found same type of xss in diffrent area with more impact. Steps to repro: 1. create new account with name " here https://parcel.grab.com/ 2. afftected page is https://app.detrack.com/a/ where admin can see all the user's of application and this ...

Sql injection

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...