FS Crowdfunding Script 1.0 SQL Injection

Exploit Title: FS Crowdfunding Script 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/crowdfunding-script/ Demo: http://crowdfunding.demonstration.co.in/ Version: 1.0 Category: Webapps Tested on:...

w3af - Web Application Attack and Audit Framework

w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site Scripting, SQL injection and OS commanding. Identify an...

How to harden AdwCleaner’s web backend using PHP

More and more applications are moving from desktop to the web, where they are particularly exposed to security risks. They are often tied to a database backend, and thus need to be properly secured, even though most of the time they are designed to restrict access to authenticated users only. PHP...

CVE-2017-17103

CVE-2017-17103 affects Fiyo CMS 2.0.7 with an SQL injection in the file /apps/app_user/sys_user.php via POST parameters name or email, enabling escalation from a normal user to administrator privileges. This vulnerability is documented across multiple sources (NVD/NVD-derived entries and CNVD-201...

web.baz.org XSS vulnerability

Open Bug Bounty ID: OBB-434523 Description| Value ---|--- Affected Website:| web.baz.org Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-5533 TIBCO JasperReports Server credentials disclosure

A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contains a vulnerability whic...

CVE-2017-15580

osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's contents and thus accepts any type of file, such as with a tickets.php request that is modified with a .html extension changed to a .exe extension. A...

CVE-2017-15580

osTicket 1.10.1 is vulnerable to an arbitrary file upload due to improper validation of uploaded file contents. The vulnerability allows an attacker to upload arbitrary files (e.g., PHP shells) by abusing the HTML upload mechanism, bypassing client-side checks, and changing file extensions to dis...

Why ArtsSEC decided to partner with Wallarm

by Maximiliano Soler, @maxisoler by Maximiliano Soller, CTO of ArtsSEC The greatest thing with partnerships is how well the organisations’ expertise complement each other. Our partnership with Wallarm has incredibly exceeded our expectations in their innovation and expertise in web application...

Kubebot: A Kubernetes Based Security Testing Slackbot

PenTestIT RSS Feed About a week ago, I blogged about List of Portable Hardware Devices for Penetration Testing. The tool that I am blogging about today - Kubebot - can be an awesome example and be installed very easily on a Raspberry Pi that you have lying around. Best part is that this is open...

Web Application Security Scanner: Spaghetti

Spaghetti is a web application security scanner tool. It is designed to find various default and insecure files, configurations and misconfigurations. Spaghetti is built on python2.7 and can run on any platform which has a Python environment. Installation $ git clone...

Spaghetti v0.1.1 - Web Application Security Scanner

Spaghetti is a web application security scanner tool. It is designed to find various default and insecure files, configurations, and misconfigurations. Spaghetti is built on python2.7 and can run on any platform which has a Python environment. Installation $ git clone...

Enterprise Edition Payment Processor Script 3.7 - SQL Injection

Exploit Title: Enterprise Edition Payment Processor Script 3.7 - SQL Injection Dork: N/A Date: 14.09.2017 Vendor Homepage: https://www.goterhosting.com/ Software Link: https://www.goterhosting.com/payment-processor-script.php Demo: http://www.enterprise-edition.gvmhosting.com/ Version: 3.7...

ICCallLimousine 1.1 - 'key' SQL Injection

Exploit Title: Car Rental Script 1.1 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/limousine-car-hire-script.html Demo: http://icloudcenter.net/demos/iccalllimousine/ Version: 1.1 Category: Webapps Tested on:...

ICStudents 1.2 - 'key' SQL Injection

Exploit Title: Students Course Assessment Test Script 1.2 - SQL Injection Dork: N/A Date: 13.09.2017 Vendor Homepage: http://www.icloudcenter.com/ Software Link: http://www.icloudcenter.com/student-course-assessment-test-script.htm Demo: http://icloudcenter.net/demos/icstudents/ Version: 1.2...

Escort Marketplace 1.0 - SQL Injection

Exploit Title: Escort Website Script 1.0 - SQL Injection Dork: N/A Date: 09.09.2017 Vendor Homepage: http://scriptzee.com/ Software Link: http://scriptzee.com/escort-website Demo: http://escortwebsite.scriptzee.com/ Version: 1.0 Category: Webapps Tested on: WiN7x64/KaLiLinuXx64 CVE: N/A Exploit...

Hot air classes on the site of the SQLi and XSS vulnerabilities bug-vulnerability warning-the black bar safety net

Last month in order to practice hand, I choices one of the more popular sites goodwesite.com as I penetrate the leaking test tool. In flaws in the excavation process, I've invented the Web PresenceSQL injectionandXSSflaws. The official start of the article content, let's first briefly understand...

Syntribos: An Open Source API Security Testing Tool

PenTestIT RSS Feed Web application security testing is a multi-faceted and yet important domains today. A few years ago, it was only the front end security tests and then came the backend. As newer endpoints are being exposed, it becomes imperative to test their security too. Syntribos is one suc...

Affiliate Niche Script 3.4.0 - SQL Injection

Exploit Title: Affiliate Niche Script 3.4.0 SQL Injection Dork: N/A Date: 21.08.2017 Vendor Homepage: https://scriptoffice.com/ Software Link: https://soft.scriptoffice.com/projects/affiliatenichescript/wiki/MainMenu Demo: http://demodesigns.affiliatenichescript.com/ Version: 3.4.0 Category:...

Photogallery Project 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Photogallery Project 1.0 - Multiple Vulnerabilities Dork: N/A Date: 17.08.2017 Vendor Homepage : http://surajkumar.in/ Software Link: http://surajkumar.in/product/photogallery-project-in-php/ Demo: http://surajkumar.in/ Version:...