MagnusBilling Alarm Module - Cross-Site Scripting

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling Alarm Module modules allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php.This issue affects MagnusBilling-...

MagnusBilling Login Logs - Cross-Site Scripting

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is...

MagnusBilling - Remote Code Execution

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. id: CVE-2023-30258 info: name: MagnusBilling - Remote Code Execution author: gy741,mananispiwpiw severity: critical description: | Comman...

THM-MagnusBilling-CVE-2023-30258-Exploit

THM-MagnusBilling-CVE-2023-30258 ⸻ 🛡️ MagnusBilling RCE → Root CVE-2023-30258 📌 概要 • ターゲット: 10.145.148.203 • プラットフォーム: TryHackMe • 脆弱性: CVE-2023-30258 • アクセス: 未認証のリモートコード実行 RCE • 権限昇格: fail2ban の設定ミス • 最終アクセス: Root ⸻ 🔍 1. 偵察 ポートスキャン rustscan -a 10.145.148.203 📊 開いているポート ポート サービス 22 SSH 80 HTTP 330...

Room-Walkthrough-Billing

🧠 ルームウォークスルー: Billing 作成者: Aditya Bhatt | オープンソースコントリビューター 📦 概要 このウォークスルーでは、Billing Room に全力で取り組み、脆弱なMagnusBillingインスタンス、おいしい未認証RCE（CVE-2023-30258）、そして「私をrootにして」と叫んでいるfail2banのsudo設定ミスを紹介します。 このルームは、自動化された悪用と創造的な権限昇格を美しく融合させ、VoIP課金ソフトウェアに隠れた現実世界の欠陥を実践的に味わわせてくれます。 完全なPoC、解説、そして🗿な雰囲気とともに、初期偵察...

CVE-2025-52289

CVE-2025-52289: MagnusBilling v7.8.5.3 におけるアクセス制御の不備 説明 MagnusBilling の v7.8.5.3 より前のバージョンには、アクセス制御の不備 の脆弱性が存在します。新規登録ユーザーは、リクエストパラメータを変更することで、管理者の承認なしにアカウントステータスを pending から active に昇格させることができます。これにより、検証済みユーザーのみを対象としたシステム機能への不正アクセスが可能になります。 影響 重要度: 高 脆弱性タイプ: 権限昇格 / アクセス制御の不備 CVE ID: CVE-2025-522...

THM-Billing

🛡️ TryHackMe: Billing Linux Privilege Escalation | Web Ex...

Exploit for OS Command Injection in Magnussolution Magnusbilling

THM-MagnusBilling-CVE-2023-30258 Perfect! Let’s convert your f...

Exploit for OS Command Injection in Magnussolution Magnusbilling

THM-MagnusBilling-CVE-2023-30258 Perfect! Let’s convert your f...

📄 MagnusBilling 6 Server-Side Request Forgery / Path Traversal

Proof of concept exploit for MagnusBilling 6 vulnerabilities including server-side request forgery, path traversal, and cryptographic weaknesses. ============================================================================================================================================= | Title :...

EUVD-2025-7200

Malicious code in bioql PyPI...

EUVD-2025-23282

Malicious code in bioql PyPI...

EUVD-2025-7201

Malicious code in bioql PyPI...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

Exploit for Improper Privilege Management in Magnussolution Magnusbilling

CVE-2025-52289: Broken Access Control in MagnusBilling v7.8...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

MagnusBilling 安全漏洞

MagnusBilling is a fast, secure, efficient and highly available VOIP billing from MagnusSolution Open Source. A security vulnerability exists in MagnusBilling version v7.8.5.3 that stems from improper access control and could lead to elevation of privilege...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval...

CVE-2025-52289

A Broken Access Control vulnerability in MagnusBilling (versions prior to v7.8.5.3) allows newly registered users to perform privilege escalation . By sending a crafted request to the /mbilling/index.php/user/save API endpoint, an attacker can manually change their account status from pending to ...