International Islamic University Chittagong: i am because bug

I'm because I hacker found bug because I report this bug I want to report a bug and because want some $$$$ so please because you are telling me how much you pay money so I give you bug. Me because very poor :' want money because father :' F234714 Thank you wish you because pay lots $$$$$$$$...

International Islamic University Chittagong: Admin access on http://119.18.148.140/iiuc/ through leaked credentials

The researcher was able to access admin panel using admin credential that leaked as a plain text through error message...

International Islamic University Chittagong: Union Based SQL injection in https://ieeeiiucsb.org/registration/details

Due to the lack of proper sanitization on our registration system, the researcher able to find a sql vulnerability which expose the database name & user id. We'd like to thank him for a nice catch on our system...

International Islamic University Chittagong: PHP Myadmin Accesable & Database Error Information

Dear Team, MyPHPAdmin console is accessible over the internet as well as Directory of PHP documentation is accessible. Refer all attached images Kindly MOve this to 403 Forbidden resources Steps below to reproduce the same. enter this Url http://119.18.148.140/phpmyadmin/ accessible over Internet...

International Islamic University Chittagong: Improper error handler

during the analysis it was found that when we submit the form and try to upload a txt file then it show a error page with internal path disclosure...

International Islamic University Chittagong: Application fees changeable

When i submit the form of the Url http://119.18.148.140/iiuc/home/apply-online then I intercept the form request and change the 500 into 100. Application did not give the option to change the money but by intercepting the request we can change the money. Application should removed the application...

International Islamic University Chittagong: #2 Full Path Disclosure on http://119.18.148.140/iiuc/login/logining

This researcher able to bypass our fix on full path disclosure on login page...

International Islamic University Chittagong: SQL injection in http://119.18.148.140/hrd/js/makeemployeeid.php

Hello, The mentioned page takes at least two GET parameters, namely q and departmentname. The two parameters are vulnerable to SQL injection as both are placed into SQL query strings without proper sanitization. It seems like the PHP script uses the affected parameters into two SQL queries, since...

International Islamic University Chittagong: Another Internal Path Disclosure

Keeping your previous fixes in mind, I found another endpoint which is disclosing full internal path through 500 Internal Server error. POC-URL: http://119.18.148.140/iiuc/login/ Request: GET http://119.18.148.140/iiuc/login/ HTTP/1.1 Host: 119.18.148.140 Connection: keep-alive User-Agent:...

International Islamic University Chittagong: Directory Listing

https://ieeeiiucsb.org/assets/reg/assets/ It was observed that the above URLs are vulnerable to Directory Traversal Attack. Properly controlling access to web content is crucial for running a secure web server. Directory Traversal is an HTTP exploit which allows attackers to access restricted...

International Islamic University Chittagong: Default credentials on http://119.18.148.140/hrd/

Hello, When the mentioned URL is opened, the user is presented with a login form that logs them into the "HR & Payroll" system of the university. The issue here is that the credentials used are the application's default credentials, which are mentioned here...

International Islamic University Chittagong: Full Path Disclosure on http://119.18.148.140/iiuc/login/logining

A misconfiguration on login page leads to exposure of full path through error message...

International Islamic University Chittagong: Full Path Disclosed

Hi, i want to say that you have not fixed the previous report properly i can still find the path fix it properly the paths should be hidden text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.5 Referer: http://119.18.148.140/hrd/login.php? Cookie:...

AlienVault : DOM Based XSS in https://threatcrowd.org

Hello AlienVault security team, I found a DOM Based XSS in https://threatcrowd.org via report function. Proof of Concept Steps to reproduce: 1. https://threatcrowd.org/report.php?report= 2. Fill in with this payload: javascript:promptdocument.domain 3. Send link to victim, when victim click in to...

Mail.ru: Download attachments with traversal path into any sdcard directory (incomplete fix 106097)

Привет 106097 был исправлен не полностью, все еще можно скачать вложение в письме мимо downloads директории на sdcard. Если имя файла будет что-от вроде "../file.txt" то такой файл будет скачен мимо /sdcard/download. Для файлов "%2e%2e%2f/file.txt" скачивает правильно. Скачать можно только на...

International Islamic University Chittagong: Full Path Disclosure

Hi Team, i would like to report sensitive info disclosure via login page PoC: send below request to see the path disclosure. GET /hrd/logining.php HTTP/1.1 Host: 119.18.148.140 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:56.0 Gecko/20100101 Firefox/56.0 Accept:...

International Islamic University Chittagong: Information Exposure Through Directory Listing

Hi Team, I would like to report Information Exposure Through Directory Listing bug which is presented in iiucbd.com PoC: Navigate to the following Link: 'http://119.18.148.140/hrd/js/' internal pages are exposed. FIX: Disable the directory listing. Regards, mrroot...

International Islamic University Chittagong: XSS Via error message

Hi Team, found xss via error message. PoC: Navigate to http://119.18.148.140/hrd/login.php?error=%3Cscript%3Econfirm1%3C/script%3E%20ID%20or%20Password%20does%20not%20find. Regards, Mr.R3boot...

International Islamic University Chittagong: Information Exposure Through Directory Listing

Hi Team, I would like to report Information Exposure Through Directory Listing bug which is presented in iiucbd.com PoC: Navigate to the following Link: http://www.iiucbd.com/assets/admin/js/datables/src/ There are some sensitive API methods disclosed via above link. If you feel there is no...

International Islamic University Chittagong: Email HTML Injection and Possible Stored Cross-Site Scripting in ieeeiiucsb.org

Hello International Islamic University Chittagong I found a Email HTML Injection in ieeeiiucsb.org Summary: add summary of the vulnerability This attack can be use to create a phishing email using your email app Steps To Reproduce: 1. Go to https://ieeeiiucsb.org/registration/ 2. Choose any event...

Mavenlink: Uninitialized server memory disclosure via ImageMagick gif parser

A CVE in ImageMagick allowed an attacker to recover random server memory via GIF upload. GIF processing has since been disabled...

HackerOne: Reverse Tabnabbing Vulnerability in Outgoing Links

The external links in the reports are not properly handled, using the issue the links can access the openers and replace them with some other page. To Verify the issue, just go to any report which do have any external link and inspect the proceed button. Where the issue lies: rel="noreferrer"...

Infogram: Javascript Payload reflected Back in Report Embed Code

1Create new Report template 2Spoof its name with payload " My Report alertdocument.cookie;div id=" 3Visit Back to your library list https://infogram.com/app//library 4Select The Created report and click view on web,Click the Share Button 5Copy & embed the code somewhere in html file you ll triage...

Gratipay: Bypassing X-frame options

bypass X-Frame-Options Proxy protection NOT used DomainUsing: gratipay.com Proxy protection NOT used , i can bypass X-Frame-Options header and recreate clickjacking on the whole domain. I see that you don't have a reverse proxy protection this allows all users to proxy your website rather than...

HackerOne: GraphQL sessions aren't immediately invalidated when user password is changed

Summary: While changing password, once user clicks on "Change password" button after giving necessary values, on https://hackerone.com/settings/pass/edit, the session expires and the user is redirected to https://hackerone.com/users/signin for logging in again with the updated/changed password. A...

Infogram: Multiple xss on infogram templates

Hello Team, There is a multiple xss on some templates. Payload used : "...

Infogram: XSS when Shared

Introduction XSS on an embedded piece of code that, when shared, may make it seem as if it was infogram.com that was doing the malicious act. Proof of Concept 1. Create an account 2. Create a project titled "scriptalert1;" 3. Click on share Here's an example of the share embedded code:...

Inflection: Host Header Injection or cache poisoning in multiple domains

Researcher submitted a report related to host header injection, which is currently considered out of scope for our program, so we closed the report. Researcher requested public disclosure...

Infogram: HTML injection

hi team ... i found HTML i on https://infogram.com/app//library step .. 1- go to https://infogram.com/app//library 2- choose Report Templates . 3- Use Report Classic 4- click to editdata 5- edit cell Employee ID 5- payload hacked hacked hacked 6-execute HTML .. POC .. video on attached...

Razer US: XSS on Saved Carts page

The saved cart endpoint was vulnerable to a reflective XSS due to lack of sanitization of cartcode which is inserted back in the HTML document, which could allow execution of malicious Javascript on the client...

Razer US: Customer's e-mail disclosure

It was found that sharing saved cart to Facebook leaks the user e-mail, thus the audience can retrieve it from the link. We appreciate the contribution by @gdinar in helping keep Razer's online properties secure...

AlienVault : [www.threatcrowd.org] - reflected XSS in graphViewMap.php

Summary: I have found a reflected XSS in https://www.threatcrowd.org/graphViewMap.php in GET parameter email. This is similar to report 283633 Browsers Verified In: Firefox 56.0.1 Steps To Reproduce: 1. Browse to https://www.threatcrowd.org/graphViewMap.php?email=-alertdocument.domain- 2. Click o...

AlienVault : [www.threatcrowd.org] - reflected XSS in report.php

Summary: I have found a reflected XSS in https://www.threatcrowd.org/report.php in GET parameter report Browsers Verified In: Firefox 56.0.1 Steps To Reproduce: 1. Browse to https://www.threatcrowd.org/report.php?report=javascript%3aalertdocument.domain 2. Click on Visit...

Internet Bug Bounty: Out-Of-Bounds Read in timelib_meridian()

Description While deserializing an invalid dateTime value, wddxdeserialize would result in a heap out-of-bounds read in timelibmeridian. As wddxdeserialize is exposed to network data, and sometimes echo the results back to client, this issue could potentially allow remote peeking of the process...

AlienVault : [www.threatcrowd.org] - reflected XSS

Summary: I have found a reflected XSS in https://www.threatcrowd.org/graphHtml.php, in GET parameter email. Browsers Verified In: Firefox 56.0.1 Steps To Reproduce: 1. Browse to https://www.threatcrowd.org/graphHtml.php?email=%27-alertdocument.domain-%27 2. Click on the embed functionnality in th...

Infogram: XSS on infogram.com

Hello, There is a XSS on Report templates. Free templates : Report Classic When we modify the values of table we can put XSS Payload. Payload used : " "/...

Infogram: Password Reset Token Not Expired

Hello Team, Here in this scenario, I've found that the there's a kind of server side invalidation of Password Reset tokens. Like if I've requested for password reset token token1 and I don't use it, after I will make another request for password reset token token2. This time I'll use the token2...

VK.com: Stored xss в /lead_forms_app.php

XSS в "Форме сбора заявок". Жесть...

Inflection: XST(Cross Site Tracing)

Researcher reported that OPTIONS and TRACE HTTP methods are enabled. HTTP configuration best practices are not currently in scope for our HackerOne program, so we closed the report. Researcher requested that we disclose it...

Mail.ru: [health.mail.ru] Раскрытие SSI сценариев

SSI template content leaked on invalid HTTP request in health.mail.ru and few more projects. On the moment of reporting, health.mail.ru was in Main scope of bug bounty program...

Infogram: Login Cross Site Request Forgery

Login form is not protected against Cross Site Request Forgery. An attacker can craft html page containing POST information to have victim sign into an attacker's account, where the victim can add information assuming he/she is logged into the correct account, where in reality, the victim is sign...

X (Formerly Twitter): Open Redirect Protection Bypass

Hi Report 281538 is fixed but Attacker can Bypass this Open Redirect Protection. Give this link https://twitter.com/teams/authorize?targetscreenname=&authorizecallback=//www.facebook.com to authorized victim.Twitter will say him to authorize a different account for create team.After authorization...

Mavenlink: [app.mavenlink.com] IDOR to view sensitive information

The researcher found an IDOR that when exploited would result in an error message that was too verbose. The verbose error message included the title of the workspace that the user was attempting to access and being denied persmission to...

RecargaPay: IDOR exposes receipts of all users.

@cablej found an insecure direct object reference IDOR that could expose receipts from external users. Thanks for helping us make RecargaPay more secure!...

HackerOne: Private partial disclosure of h1 infrastructure

Description I've found that following servers & services can be potentially interesting when attacking h1-infrastructure: Payments Admin ██████ API Docs ██████████ API █████████ MailCatcher ██████████ Story Book ███ Karma ████████ Core Test Server █████████ Core Staging ████ Core Production...

HackerOne: Private Program all members disclosed

After receiving an invite to a private program, it was possible to view all of its team members: https://hackerone.com/invitations/invitation code.json "teammembers":"username":"","username":"","username":"","username":"","username":"","username":""...

Infogram: A10 – Unvalidated Redirects and Forwards

https://infogram.com/login Web applications frequently redirect and forward users to other pages and websites, and use untrusted data to determine the destination pages. Without proper validation. when i intercept the twitter request and change it to the google then it will redirect you to the...

IRCCloud: [IRCCloud Android] XSS in ImageViewerActivity

Hi, I'd like to report HTML/JS injection in activity com.irccloud.android.activity.ImageViewerActivity which is exported: xml so can be launched by arbitrary apps installed on the same device. On the newest Androids could be exploited also by Android Instant Apps directly from a web-browser...

IRCCloud: [IRCCloud Android] Opening arbitrary URLs/XSS in SAMLAuthActivity

Hi, I'd like to report a bug which allow to open arbitrary URLs in com.irccloud.android.activity.SAMLAuthActivity This activity is exported: xml it means that it can be accessed by any third-party apps installed on the same device. On the newest Androids it also could be exploited by Android...

HackerOne: View Any Program's Team Members through GET https://hackerone.com/invitations/

@nickcas discovered that it was possible to view all the team members of a program through a JSON response that is sent when a user is invited to collaborate on a report via the /invitations/ endpoint. He was able to provide a very clear PoC, which consisted of a list showing all the members of t...