Fingerprint Attendance 1.0 SQL Injection

Title: Fingerprint Attendance 1.0 Blind boolean SQLi To Rce Author: Hejap Zairy Date: 28.07.2022 Vendor: https://www.vetbossel.in/fingerprint-attendance-project-php/ Software: https://app.box.com/s/xlyqalhvayq8oi25tqykcbouzrrjytqy Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQ...

API Security Explained

As enterprises continue on their digital journeys, security teams are preparing for the good, the bad, and the ugly of APIs. We’ll explain in plain language what APIs do, how they are attacked, and how API security works either as a stand-alone solution or with Web Application Firewalls and DDoS...

Covid-19 Directory On Vaccination System 1.0 SQL Injection

Exploit Title: Covid-19 Directory on Vaccination System 1.0 - SQLi Authentication Bypass Date: 28/03/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Pay Slip PDF Generator System 1.0 SQL Injection

Title: Pay Slip PDF Generator System 1.0 Blind time SQLi To Rce Author: Hejap Zairy Date: 26.07.2022 Vendor: https://www.sourcecodester.com/php/15242/employees-pay-slip-pdf-generator-system-email-using-phpoop-free-source-code.html Software:...

Sports Complex Booking System 1.0 SQL Injection Vulnerability

Sports Complex Booking System version 1.0 suffers from a remote blind SQL injection vulnerability that can be used to escalate privileges and execute code. Title: Sports Complex Booking System 1.0 Blind SQLi To Rce Author: Hejap Zairy Vendor:...

Sports Complex Booking System 1.0 SQL Injection

Title: Sports Complex Booking System 1.0 Blind SQLi To Rce Author: Hejap Zairy Date: 24.07.2022 Vendor: https://www.sourcecodester.com/php/15236/online-sports-complex-booking-system-phpmysql-free-source-code.html Software:...

CVE-2021-43735

CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule...

CVE-2021-43735

CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule...

CVE-2021-43735

CmsWing 1.3.7 is affected by a SQL injection vulnerability in the behavior rule parameter. The root cause is insufficient escaping/ filtering of SQL data in these parameters, allowing potential unauthorized SQL execution. Impact is described as exposing or altering database data (high severity pe...

Inventory Management System 1.0 SQL Injection Vulnerability

Title: Inventory Management System 1.0 Blind SQLi To Rce Author: Hejap Zairy Vendor: https://www.vetbossel.in/inventory-management-system-php/ Software: https://cutt.ly/lOZ8lrr Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache vulnerability Code php php You have an error...

Inventory Management System 1.0 SQL Injection

Title: Inventory Management System 1.0 Blind SQLi To Rce Author: Hejap Zairy Date: 12.07.2022 Vendor: https://www.vetbossel.in/inventory-management-system-php/ Software: https://cutt.ly/lOZ8lrr Reference: https://github.com/Matrix07ksa Tested on: Windows, MySQL, Apache vulnerability Code php php...

Home Owners Collection Management System 1.0 SQL Injection

Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution Blind SQLi to RCE Date: 9/03/2022 Exploit Author: Hejap Zairy Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

CVE-2022-25607

FV Flowplayer Video Player WordPress plugin (versions ≤ 7.5.15.727) is affected by an authenticated SQL Injection vulnerability due to insufficient input validation. The vulnerability affects the plugin when used with WordPress; impact is partial to high across confidentiality, integrity, and ava...

SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users Create a new email petition /wp-admin/admin.php?page=dkspeakoutaddnew, check x Do not send email onl...

Metasploit Weekly Wrap-Up

This week’s Metasploit Framework release brings us seven new modules. IP Camera Exploitation Rapid7’s Jacob Baines was busy this week with two exploit modules that target IP cameras. The first module exploits an authenticated file upload on Axis IP cameras. Due to lack of proper sanitization, an...

NotificationX < 2.3.12 - Unauthenticated SQLi

The plugin does not validate and escape the id parameter in its notificationx/v1/notification REST endpoint before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL Injection attacks. PoC The apikey is the md5 of the homeurl either with http or https protocol...

Cab Management System 1.0 - (id) SQL injection (Authenticated) Vulnerability

Exploit Title: Cab Management System 1.0 - 'id' SQLi Authenticated Exploit Author: Alperen Ergel Contact: @alpernae IG/TW Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html Version : 1.0 Tested on: windows 10 xammp | Kali linux Category:...

WordPress Perfect Survey Plugin - 1.5.1 - SQL injection (Unauthenticated) Exploit

Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi Unauthenticated Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.getperfectsurvey.com/ Software Link: https://web.archive.org/web/20210817031040/https://downloads.wordpress.org/plugin/perfect-survey.1.5.1.zip Version:...

WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)

Exploit Title: WordPress Plugin WP User Frontend 3.5.25 - SQLi Authenticated Date 20.02.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://wedevs.com/ Software Link: https://downloads.wordpress.org/plugin/wp-user-frontend.3.5.25.zip Version: 3.5.25 Tested on: Ubuntu 20.04 CVE:...

WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)

Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi Unauthenticated Date 18.02.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://www.getperfectsurvey.com/ Software Link:...