U.S. Dept Of Defense: View another user information with IDOR vulnerability

1- Navigate to the system. https://███████/login.php 2- Navigate to register page. https://██████████/register.phpi created user, username:██████ pass: TEst.123.! 3- Login to the system. https://███/login.php 4- Navigate to "My Profile Page". 5- Intercept the request. 6- Change the "UID2=4820038"...

CentOS Control Web Panel (CWP) 0.9.8.851 Arbitrary Database Drop Vulnerability

Exploit for linux platform in category web applications Exploit Title : CWP CentOS Control Web Panel Arbitrary database dropping Exploit Author : Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak Vendor Homepage : https://control-webpanel.com/ Software Link : Not available, user...

Exploit for Path Traversal in Rubyonrails Rails

CVE-2019-5418 - File Content Disclosure on Rails EDIT: th...

U.S. Dept Of Defense: [███] SQL injection & Reflected XSS

SQL injection test 1. Go to site ███████ 2. Intercept this request POST /viewem6.php HTTP/1.1 Host: ████ User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language:...

Chaturbate: Missing CSRF Protection in /stats EndPoint.

EndPoint /affiliates/stats. doesnot verify the CSRF Tokens Steps To Reproduce: 1. Login with the your account 2. Navigate to the URL https://chaturbate.com/affiliates/stats.. 3. Check the stats in default its todays date or this week in select period. 4. Intercept the request and change the...

DLink DIR-601 - Credential Disclosure

DLink DIR-601 - Credential Disclosure Exploit Title: DLink DIR-601 - Credential Disclosure Google Dork: N/A Date: 2018-06-24 Exploit Author: Kevin Randall Vendor Homepage: https://www.dlink.com Software Link: N/A Version: Firmware: 2.02NA Hardware Version B1 Tested on: Windows 10 + Mozilla Firefo...

Harvest: Project Disclosure of all Harvest Instances

Hello, The POST request to create new Retainer in admin panel can use and disclose all the projects in @harvest not just available in admin's @harvest instance. Steps to Reproduce: 1. Login to application using admin credentials and traverse to Invoices Retainers + New Retainers 2. Select valid...

Caught on the web of any user of the password reset vulnerability-vulnerability warning-the black bar safety net

Phone reset password password reset operation is not associated with a specific phone number, the lead can be reset to any phone registration account password. 1. The following url returns a result, you can traverse all the mobile phones registered account: http://api1.fun.tv/ajax/getmobilevcode/...

Vimeo: A user can enhance their videos with paid tracks without buying the track

It is possible to enhance videos with paid tracks without buying the track. Steps to verify: 1. Log into vimeo.com and navigate to https://vimeo.com/enhancer. 2. Click on any paid music track and note down the track id from the URL ex:...

X (Formerly Twitter): Fabric.io - an app admin can delete team members from other user apps

It is possible for an app admin to delete all the team members from other apps for which he doesn't have access. To reproduce the attack, create two apps and add different user roles as below, VictimApp - Aliceadmin, Alicemember HackerApp - Hackeradmin, Hackermember Before proceeding with the...