4084 matches found
in pimcore/pimcore
Description I found unrestricted file upload, to force an image parser to allocate a large volume of memory based on the image headers large file in profile picture, 4250x64250 pixels whole image into memory, it tries to allocate 4128062500 pixels into memory, flooding the memory and causing DoS...
in zmister2016/mrdoc
Description When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication. Proof of Concept https://github.com/zmister2016/MrDoc/blob/master/appadmin/views.pyL985 ๆฎ้็จๆทไฟฎๆนๅฏ็ @loginrequired @logger.catch def...
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in mineweb/minewebcms
Description Hello, In the password reset it is possible to perform a Host Header Injection, so the victim will receive an email pointing to a third party site. By clicking, the attacker will be able to retrieve the victim's account reset token and use it to access his account. From Portswigger :...
Cross-Site Request Forgery (CSRF) in bytebase/bytebase
Description all part of application That use POST http method to change or create data are vulnerable to CSRF attacks. for example the PATCH methods are not vulnerable I will show just create a member POC for you and if you want to see other POCs of other endpoint just say me to provide them too ...
in mostafa-samir/zip-local
Description zip-local is vulnerable to Arbitrary File Write via Archive Extraction Zip Slip. Proof of Concept // PoC.js var zipper = require'zip-local'; zipper.unzip"zipslip.zip", functionerror, unzipped if!error // extract to the current working directory unzipped.savenull, function ; var...
in jspark311/buriedunderthenoisefloor
Description Uploaded files represent a significant risk to applications. The first step in many attacks is to get some code to the system to be attacked. Then the attack only needs to find a way to get the code executed. https://github.com/jspark311/BuriedUnderTheNoiseFloor/ is vulnerable to remo...
Cross-site Scripting (XSS) - Reflected in jspark311/buriedunderthenoisefloor
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end userโs browser has no way to know that the script should not be trusted, and will execut...
Cross-site Scripting (XSS) - Stored in leantime/leantime
Description Multiple Stored XSS on featuers 'Milestones' , 'Research', 'Retrospective' at Leantime 2.1.8 Proof of Concept // PoC.req POST /leantime/public/tickets/editMilestone/ HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:94.0 Gecko/20100101 Firefox/94.0...
in thedevdojo/wave
Description: There is no rate limit sent unlimited email victim or any email address. Proof of Concept: There is no rate limit return-password , attacker to send unlimited email to victim or any email address. Impact: Attacker can sent unlimited email to any mail address . Solution: Add 'throttle...
Cross-site Scripting (XSS) - Stored in fisharebest/webtrees
Description Stored XSS via upload file .svg allows for arbitrary execution of JavaScript Proof of Concept // PoC.req POST /demo-dev/tree/demo/add-media-file/X9222 HTTP/2 Host: dev.webtrees.net Cookie: Secure-WT-ID=63trarcpiic93psog3t8okts4h User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15;...
Cross-site Scripting (XSS) - Reflected in shannah/xataface
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end userโs browser has no way to know that the script should not be trusted, and will execut...
Cross-site Scripting (XSS) - Stored in fisharebest/webtrees
Description Multiple Stored XSS when Add new record at features Add a source citation, Add a shared note Proof of Concept // PoC.req POST /demo-stable/index.php?route=%2Fdemo-stable%2Ftree%2Fdemo%2Fcreate-source HTTP/2 Host: dev.webtrees.net Cookie: Secure-WT-ID=35jvr7cdk25bf0s6k0e1r91c3e...
Code Injection in yogeshojha/rengine
Description RCE via the YAML configuration of reNgine. In this configuration, the settings of the tools used in scans can be adapted. This functionality can be abused to executy arbitrary code. PoC In the yaml configuration of reNgine, edit the extensions field of dirfilesearch to make it look li...
Open Redirect in sbrl/pepperminty-wiki
Description I saw this report https://huntr.dev/bounties/89f222e4-2aaa-44f8-8b24-657d3a0e741f/ and this fix commit : https://github.com/sbrl/Pepperminty-Wiki/blob/f59e68127cb4147e49f9453e1f657cc24972fda5/modules/page-login.phpL167 and I find out that you never use the new $returntoredirect...
in fisharebest/webtrees
Description There is not rate limit protection , Rate limit bypass sent unlimited email victim or any email address. Proof of Concept There is no rate limit password-request , attacker to send unlimited email to victim or any email address. POST...
Cross-Site Request Forgery (CSRF) in gunet/openeclass
Description Missing CSRF Token at all form POST action in on Application Proof of Concept // CSRF PoC history.pushState'', '', '/' Impact With CSRF attack, the attacker can perform operations to add, edit, and delete data on the application through the victim...
Exposure of Sensitive Information to an Unauthorized Actor in blair2004/nexopos-4x
Description Unhandled exception leads to exposure of server side and sql query information. Proof of Concept 1. Go to demo page http://v4.nexopos.com and login using demo account 2. Go to Customer - Create coupon and try to create a coupon without entering coupon code leave it empty 3. See that t...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in blair2004/nexopos-4x
Description Session cookie nexopossession is not marked as Secure Proof of Concept 1. Open demo page https://v4.nexopos.com/sign-in using firefox; login using demo account 2. Go to Developer tool - Storage - Cookie and see that nexopossession has Secure = False...
in flarum/framework
Description Sensitive Data can be exposed even after logouting the application due to ui wrong action Proof of Concept 1 login to the application dashboard as admin https://demo.flarum.site/admin/ 2 Goto Any pages dashboard,permissions etc 3 Click logout 4 Click browser back button 5 Will Re-ente...
Cross-Site Request Forgery (CSRF) in attendize/attendize
Description Attacker is able to make an event live. Proof of Concept When you logged in open this POC.html in a browser. history.pushState'', '', '/' document.forms0.submit; Impact This vulnerability is capable of forging user to unintentional mark an event live. Test Tested on Safari. Fix You...
Open Redirect in jonschoning/espial
Description Open Redirect at add url with parameter ?next= Proof of Concept // PoC.request POST /api/add HTTP/2 Host: esp.ae8.org Cookie:...
Cross-site Scripting (XSS) - Stored in jonschoning/espial
Description Stored XSS in parameter description when add url Proof of Concept // PoC.request POST /api/add HTTP/2 Host: esp.ae8.org Cookie:...
Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition
Description Attacker is able to change a torrents featured state to un-featured if a logged in user visits attacker website. Proof of Concept When you logged in open this POC.html in a browser. You can check the torrents state changed to un-featured. history.pushState'', '', '/'...
in zikula/core
Description Rate limit bypass sent unlimited email victim or any email address Proof of Concept There is no rate limit lost-user-name, attacker to send unlimited email to victim or any email address. POST /zauth/account/lost-user-name HTTP/1.1 Host: demo.ziku.la User-Agent: Mozilla/5.0 Windows NT...
in khodakhah/nodcms
Description Clear Text submission of password through unencrypted channel Proof of Concept POST /en/login HTTP/1.1 Host: demo.nodcms.com User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:92.0 Gecko/20100101 Firefox/92.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language:...
Cross-Site Request Forgery (CSRF) in e107inc/e107
โ๏ธ Description Attacker or malicious user is able to change URL configuration if a logged in user visits attacker website. because lack of CSRF token ๐ต๏ธโโ๏ธ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally your search URL changed form /search.php...
Code Injection in jerrod-lankford/google-voice-desktop-app
โ๏ธ Description Attackers can execute malicious code on users computers using Google Voice Desktop App provided that users click on a malicious hyperlink in the app itself ๐ต๏ธโโ๏ธ Proof of Concept 1. Host the following index.html on a web server require'childprocess'.exec'calc'; 2. Users who click on...
Cross-site Scripting (XSS) - Stored in leantime/leantime
โ๏ธ Description A malicious actor is able to add new Milestone with a malicious payload, and upon opening the research menu, the XSS payload is being executed. ๐ต๏ธโโ๏ธ Proof of Concept - 1; Log in with a proper roled user - 2; Add a new Milestone to the system at the /tickets/roadmap URI with the +...
Cross-site Scripting (XSS) - Stored in leantime/leantime
โ๏ธ Description A malicious actor is able to add "new board" with a malicious payload to any target, and upon opening the research menu, the XSS payload is being executed. ๐ต๏ธโโ๏ธ Proof of Concept 1; Log in with a proper roled user 2; Add a new board to the system at research menu on the left 3;...
Command Injection in yogeshojha/rengine
โ๏ธ Description RCE via the proxy feature of Rengine. Proxies can be added in Rengine for executables like httpx to use in a scan. This functionality can be used to inject a command and run arbitrary code. ๐ต๏ธโโ๏ธ Proof of Concept Add this as the only proxy in the proxy list in the Proxy settings:...
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
โ๏ธ Description pimcore is a Open Source Data & Experience Management Platform PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce this package is vulnerable for Stored XSS custom meta data ๐ต๏ธโโ๏ธ Proof of Concept ๐ฅ Impact This vulnerability is capable of Stored XSS...
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
โ๏ธ Description csrf bug to update uploaded-file ๐ต๏ธโโ๏ธ Proof of Concept Bellow request is vulnerable to csrf bug to update uploaded-file. Submit request POST /siteadmin/file/edit/2 HTTP/1.1 Host: demo.livehelperchat.com Cookie: PHPSESSID=b8cdt7e1436rstdhbgq5mjqskq User-Agent: Mozilla/5.0 X11;...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
โ๏ธ Description The download/web-log endpoint does not have CSRF Protection. This could be used to force download error log and potentially sensitive information leakage. ๐ต๏ธโโ๏ธ Proof of Concept Login to user account. Create the following POC.html file and open the page in browser. To verify that you...
Cross-site Scripting (XSS) - Reflected in znixbtw/panel-v2
โ๏ธ Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end userโs browser has no way to know that the script should not be trusted, and will...
Cross-Site Request Forgery (CSRF) in erikdubbelboer/phpredisadmin
โ๏ธ Description The Import functionality in the application is vulnerable to CSRF attacks. ๐ต๏ธโโ๏ธ Proof of Concept history.pushState'', '', '/' ๐ฅ Impact This vulnerability can let an attacker import data to the database without the knowledge/interaction of the user...
Cross-Site Request Forgery (CSRF) in aces/loris
โ๏ธ Description Attacker able to delete any user with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks it...
Cross-Site Request Forgery (CSRF) in tsolucio/corebos
โ๏ธ Description Attacker able to delete any Document with CSRF attack because there is any CSRF protection for related endpoint. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the...
Session Fixation in projectsend/projectsend
โ๏ธ Description Project Send contains a Session Fixation Vulnerability. This vulnerability is one that can allow an attacker to fixate find or set another personโs session identifier. This most commonly happens when session tokens are now refreshed or renewed when they should be. It looks like the...
Cross-site Scripting (XSS) - Reflected in dolibarr/dolibarr
Description Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious...
in emoncms/dashboard
๐ฅ BUG account takeover via host-header injection It allow attacker to change url of account-verification link and verify any email-address . ๐ฅ STEP TO REPRODUCE 1. First as attacker create a account with email [email protected]. You dont own that email-address .\ You cant login untill you verify that...
in janeczku/calibre-web
โ๏ธ Description The app does not expire the user's session after the logout. It is possible to continue using the session even when the user has logged out. ๐ต๏ธโโ๏ธ Proof of Concept 1. Login as a user at /login. 2. Select logout, intercepting and copying the user's cookie. 3. After this logout, send a...
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
โ๏ธ Description CSRF bug to close a project ๐ต๏ธโโ๏ธ Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when closing a project ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
โ๏ธ Description CSRF bug to classify bill of sales-order ๐ต๏ธโโ๏ธ Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when classify bill of sales-order ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
โ๏ธ Description CSRF bug to validate inventory ๐ต๏ธโโ๏ธ Proof of Concept Here it does not check token parameter for csrf .You can remove token paramater from url. bellow request is vulnerable to csrf attack when validate inventory ....
Cross-Site Request Forgery (CSRF) in dolibarr/dolibarr
โ๏ธ Description CSRF bug to remove linked file ๐ต๏ธโโ๏ธ Proof of Concept bellow request is vulnerable to csrf attack when removing linked file.\ https://demo.dolibarr.org/expensereport/card.php?id=202&action=removefile&file=%28PROV202%29%2F%28PROV202%29.pdf&entity=1 ๐ฅ Impact csrf attack...
Cross-site Scripting (XSS) - Stored in chevereto/chevereto-free
โ๏ธ Description Stored xss via image upload TESTED VESRION latest github code as of 16/7/21 ๐ต๏ธโโ๏ธ Proof of Concept 1. First download https://github.com/ranjit-git/poc/blob/master/xss%22'%3E%3Cimg%20src%3Dx%20onerror%3Dalert123%3E.jpeg image file in linux . Dont change the file name . This type file...
in ampache/ampache
โ๏ธ Description According to PHP official documents 1 we have for mtrand function an security issue that says "This function does not generate cryptographically secure values, and should not be used for cryptographic purposes" and as we see in permalinks you use the mtrand function for generate...
Open Redirect in ionicabizau/parse-url
โ๏ธ Description parse-url improperly handles the user input such as https:/\ and interprets it as a relative path. Backslashes after the protocol are accepted by browsers and treated as normal slashes, but parse-url reads them as the relative path, which could lead to SSRF, open redirects, or other...
Open Redirect in unshiftio/url-parse
โ๏ธ Description url-parse mishandles certain uses of backslash such as https:/\ and interprets the URI as a relative path. Browsers accept backslashes after the protocol, and treat it as a normal slash, while url-parse sees it as a relative path. Similar attacks:...
Session Fixation in chatwoot/chatwoot
โ๏ธ Description The application is vulnerable to Session Fixation vulnerability even after a user changes its password the old sessions on other devices persist. ๐ต๏ธโโ๏ธ Proof of Concept 1. open chatwoot and login to your account on multiple browsers 2. change the password of the account on one of...