in dolibarr/dolibarr

💥 BUG unprivileged user can upload file to a task associated with a project. 💥 IMPACT user who has read-only access to a project can add file to task associated with this project 💥 TESTED VERSION dolibarr 14.0.0-beta 💥 STEP TO REPRODUCE 1. First goto admin account and add user B as normal user ....

Spotweb-Develop 1.4.9 Cross Site Scripting

Exploit Title: Cross Site Scripting DOM Based spotweb-develop 1.4.9 Author: @nu11secur1ty Testing and Debugging: nu11secur1ty $ OWASP-ZAP Date: 05.20.2021 Vendor: https://www.nzbserver.com/ Link: https://github.com/spotweb/spotweb CVE: 2021-XXXX Proof: https://streamable.com/hix5o1 + Exploit...

Unchecked return value of transferFrom in function timeLockERC20

Handle shw Vulnerability details Impact In the function timeLockERC20 line 610, the return value of IERC20.transferFrom is unchecked. The return value could be false if the transferred token is not ERC20-compliant, indicating that the transfer fails. In that case, the variable timelockERC20Balanc...

Unbounded loop in _removeNft could lead to a griefing/DOS attack

Handle shw Vulnerability details Impact Griefing/DOS attack is possible when a malicious NFT contract sends many NFTs to the vault, which could cause excessive gas consumed and even transactions reverted when other users are trying to unlock or transfer NFTs. Proof of Concept 1. The function...

Incompatability with deflationary / fee-on-transfer tokens

Handle cmichel Vulnerability details Vulnerability Details The DInterest.deposit function takes a depositAmount parameter but this parameter is not the actual transferred amount for fee-on-transfer / deflationary or other rebasing tokens. Impact The actual deposited amount might be lower than the...

COVID19 Testing Management System 1.0 Cross Site Scripting

Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting XSS Date: 19/05/2021 Exploit Author: Rohit Burke Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on:...

COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting (XSS)

Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting XSS Date: 19/05/2021 Exploit Author: Rohit Burke Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on:...

Can lock more tokens than in contract

Handle cmichel Vulnerability details Vulnerability Details The Visor.timeLockERC20 allows locking any amount of tokens exceeding the contract's token balance. Impact The recipient might think that they'll receive the tokens after expiry but it could be that the contract is already out of tokens b...

Longer maturity leads to lower returns

Handle cmichel Vulnerability details Vulnerability Details The LinearDecayInterestModel computes the interestAmount on a deposit as depositAmount moneyMarketInterestRatePerSecond IRMultiplier depositPeriodInSeconds where the IRMultiplier is a function of the depositPeriodInSeconds computed in:...

getBalanceLocked on line 202 of Visor.sol doesn't return the total balance, just the highest balance

Handle Sherlock Vulnerability details Impact Causes some internal miscalculations allowing people to take out locked funds using timeUnlockERC20 and delegatedTransferERC20 Proof of Concept Tools Used Hardhat Recommended Mitigation Steps Calculate balance using balance.add lockData.balance on line...

COVID19 Testing Management System 1.0 - (Admin name) Cross-Site Scripting Vulnerability

Exploit Title: COVID19 Testing Management System 1.0 - 'Admin name' Cross-Site Scripting XSS Exploit Author: Rohit Burke Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/ Version: 1.0 Tested on: Windows 10 == Store...

Unbounded iteration

Handle cmichel Vulnerability details Vulnerability Details The Visor.removeNft iterates over all nfts. Anyone can add to this array by depositing NFTs, see Visor.onERC721Received. Other occurences that makes an unbounded iteration over arrays: Visor.getBalanceLocked Visor.getNftIdByTokenIdAndAddr...

delegatedTransferERC20() on line 442 of Visor.sol, able to get locked erc20 tokens

Handle Sherlock Vulnerability details Impact Because of getBalanceLocked not returning the full sum of the balances, if you have the approval you are able to transfer locked erc20 tokens. Proof of Concept Tools Used Hardhat Recommended Mitigation Steps Calculate balance using balance.add...

Cross-site Scripting (XSS) - Stored in dolibarr/dolibarr

💥 BUG Stored xss bypassing xss filter 💥 SUMMURY There are many different user with different role . Here using this xss bug lower level user can make xss attack against higher level user 💥 PAYLOAD XSS15 💥 STEP TO REPRODUCE 1. First goto your account and edit a product . Now put above xss payload ...

Customer Relationship Management (CRM) System 1.0 - (Category) Persistent Cross site Scripting

Exploit Title: Customer Relationship Management CRM System 1.0 - 'Category' Persistent Cross site Scripting Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Advanced Guestbook 2.4.4 - (Smilies) Persistent Cross-Site Scripting Vulnerability

Exploit Title: Advanced Guestbook 2.4.4 - 'Smilies' Persistent Cross-Site Scripting XSS Exploit Author: Abdulkadir AYDOGAN Vendor Homepage: https://www.ampps.com/apps/guestbooks/AdvancedGuestbook Software Link: https://www.ampps.com/apps/guestbooks/AdvancedGuestbook Version: 2.4.4 Advanced...

PT-2021-10680

Name of the Vulnerable Software and Affected Versions: GNU LibreDWG version 0.10 Description: A null pointer dereference issue exists in GNU LibreDWG. This issue is related to the get bmp function in the dwgbmp.c file. Recommendations: For GNU LibreDWG version 0.10, consider avoiding the use of t...

Simple Chatbot Application 1.0 - (Category) Stored Cross site Scripting Vulnerability

Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html Version: 1.0 Tested on:...

Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting

Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting Date: 16-05-2021 Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html Version:...

Unbounded for-loop bricks transferERC721()

Handle toastedsteaksandwich Vulnerability details Impact The nfts array in the Visor contract could become overpopulated, causing certain functions that loop over it to brick, due to the gas limit. These functions include transferERC721 and getNftIdByTokenIdAndAddr. The severity of this issue is...