MTN Group: Cross-site Scripting (XSS) - Reflected on http://h1b4e.n2.ips.mtn.co.ug:8080 via Nginx-module

The Cross-site Scripting XSS vulnerability was discovered on http://h1b4e.n2.ips.mtn.co.ug:8080 via the Nginx module. The vulnerability allowed the injection of arbitrary JavaScript code through the URL, which could be executed in the victim's browser...

MTN Group: Cross-site Scripting (XSS) - Reflected on https://api.mtn.sd/carbon/admin/login.jsp via `msgId` parameter - CVE-2020-17453

A reflected cross-site scripting XSS vulnerability was discovered in the msgId parameter of the login page at https://api.mtn.sd/carbon/admin/login.jsp. This vulnerability allowed an attacker to execute arbitrary JavaScript code in the context of the vulnerable page...

MTN Group: Cross-site Scripting (XSS) - Reflected on http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via `callback` parameter

The vulnerability was a reflected cross-site scripting XSS found on the website http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via the "callback" parameter. The vulnerability allowed the execution of arbitrary JavaScript code...

DirDar - A Tool That Searches For (403-Forbidden) Directories To Break It And Get Dir Listing On It

bypass forbidden directories - find and identify dir listing - you can use it as directory brute-forcer as well Compatabily This tool is compatible with all kind of operating systems as long as you have GO compiler installed Install You can use this command if you have Go installed and configured...

MTN Group: RCE Apache Struts2 remote command execution (S2-045) on [wifi-partner.mtn.com.gh]

Summary: A Remote Code Execution vulnerability exists in Apache Struts2 when performing file upload based on Jakarta Multipart parser. It is possible to perform a RCE attack with a malicious Content-Type value. If the Content-Type value isn't valid an exception is thrown which is then used to...

MTN Group: Blind SQL Injection

hello dear support I have found Blind SQL Injection on https://futexpert.mtngbissau.com/signin/ parameters injectable phonenumber=0&pin=1&submit=Continuar via post URL:https://futexpert.mtngbissau.com/signin/ Post: email=0 my payload :...

MTN Group: Reflected XSS on mtnhottseat.mtn.com.gh

hello dear I have found Reflected XSS on mtnhottseat.mtn.com.gh parameters injectable /api/v2/subscribe/; my payload " URL: https://mtnhottseat.mtn.com.gh/api/v2/subscribe/;%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain%3E F1140524 Impact Malicious JavaScript has access to all the same objec...

MTN Group: 2x Remote file inclusion within your VMware Instances

Summary: 2x Remote file inclusion within your VMware Instances Hosts: nmc.vc.mtn.co.ug h28a.n1.ips.mtn.co.ug Steps To Reproduce: Navigate to the URLs given below, /etc/passwd will be displayed. https://nmc.vc.mtn.co.ug/eam/vib?id=/etc/passwd https://h28a.n1.ips.mtn.co.ug/eam/vib?id=/etc/passwd...

MTN Group: Reflected XSS on play.mtn.co.za

hello dear I have found Reflected XSS on play.mtn.co.za parameters injectable ?page=2 my payload "; URL: https://play.mtn.co.za/callertunez/?page=2%27%22%3E%3Cimg%20src=x%20onerror=alertdocument.domain%3E&search=A F1120432 Impact Malicious JavaScript has access to all the same objects as the rest...

MTN Group: No rate limit lead to otp brute forcing

Summary: Hello. There is no rate limit protection in the endpoint https://mtnonline.com/nim/submit , Which could lead to brute force otp code. How To Reproduce: Visit https://mtnonline.com/nim and complete all the required field and submit. when next page load, user will be ask otp code. Enter an...

MTN Group: No rate limit in otp code sending

Summary: There is no rate limit in sendind otp code. Thus, attacker can use this vulnerability to bomb out the mobile inbox of the victim. Steps To Reproduce: Step 1. Open burp suite, and click on "Intercept is on " button from Proxy tab. Step 2. Launch browser and visit https://mtnonline.com/nim...

MTN Group: Developer Mistake

Check this path https://mtn.cm/components/ Impact Admin Mistake...

MTN Group: [play.mtn.co.za] Application level DoS via xmlrpc.php

Description Wordpress that have xmlrpc.php enabled for pingbacks, trackbacks, etc. can be made as a part of a huge botnet causing a major DOS/SSRF. The website play.mtn.co.za has the xmlrpc.php file enabled and could thus be potentially used for such an attack against other victim hosts. hackeron...

MTN Group: CVE-2018-6389 exploitation - using scripts loader

Issue Description Unauthenticated attackers can cause a denial of service resource consumption by using the large list of registered .js files from wp-includes/script-loader.php to construct a series of requests to load every file many times. The vulnerability is registered as CVE-2018-6389 76172...

MTN Group: blind sql on [selfcare.mtn.com.af]

Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue get cid = sql SQL query - SELECT user FROM dual CONAPPMTNA HTTP Request GET /selfcare/HomePageDisplay?cid=26%20AND%20321=6%20AND%20498=498&location=MTNA HTTP/1.1 X-Requested-With:...

MTN Group: xss on [developers.mtn.com]

xss on history.pushState'', '', '/' F908897 Impact POC F908895 F908896...

MTN Group: SQL Injection on the administrator panel

Hello team. The admin panel of the website is mtngbissau.com or is vulnerable to sql attack via https://mtngbissau.com/webadmin/index.php Request POST /webadmin/index.php HTTP/1.1 Host: mtngbissau.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:68.0 Gecko/20100101 Firefox/68.0 Accept:...

MTN Group: Insecure crossdomain.xml on https://vdc.mtnonline.com/

Hi, https://vdc.mtnonline.com/crossdomain.xml contains the following xml file: Impact This will make any one able to receive content from https://vdc.mtnonline.com/ , attacker can steal CSRF tokens and user PII. More information about this issue is available here:...

MTN Group: Weak/Auto Fill Password

Summary: https://mtnc-selfservice.mtncameroon.net The following url has admin/admin as user name and password Steps To Reproduce: 1. open the url in any browser of your choice 1. enter admin as user name and password 1. booom .... full asset to super admin full panel Supporting Material/Reference...

MTN Group: Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]

Summary Hello. I was able to identify RCE vulnerability due to the outdated Oracle Weblogic instance on https://raebilling.mtn.co.za. Steps To Reproduce To reproduce, try this request with BurpSuite This request to the https://raebilling.mtn.co.za/wls-wsat/RegistrationRequesterPortType will trigg...