Search for hundreds of thousands of exploits

"hits script 1.0 - 'item_name' SQL Injection"

Author

Exploit author

SajjadBnd

Platform

Exploit platform

php

Release date

Exploit published date

2020-04-29

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
# Exploit Title: hits script 1.0 - 'item_name' SQL Injection
# Date: 2020-04-27
# Exploit Author: SajjadBnd
# Vendor Homepage: https://hits.ir
# Software Link: http://dl.persianscript.ir/script/hitsir-script-persian%28PersianScript.ir%29.zip
# Software Link(mirror): http://dl.nuller.ir/hitsir-script-persian[www.nuller.ir].zip
# Version: 1.0
# Tested on: Win10 Professional x64

[ description of script ]

With this script you can set up a site to exchange statistics and traffic as well as
increase rankings. In this script, it is possible to exchange Google +1,
exchange Facebook points, exchange Twitter followers,
exchange YouTube visitors, exchange visit statistics.

[ poc ]

file : ipn.php

parameters : 'item_name' , 'item_number'
method : POST
source [

36: mysql_query $pack = mysql_fetch_object(mysql_query("SELECT * FROM `c_pack` WHERE `name`='{$item_name}' AND `coins`='{$item_number}'"));
19: $item_name = $_POST['item_name'];
20: $item_number = $_POST['item_number'];

requires:
4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename")))
31: if(!$fp) else
35: if(strcmp($res, "VERIFIED") == 0)

]

parameter : 'custom'
method : POST
source [

43: mysql_query mysql_query("UPDATE `users` SET `coins`=`coins`+'{$pack->coins}' WHERE `id`='{$custom}'");
27: $custom = $_POST['custom'];

requires:
4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename")))
31: if(!$fp) else
35: if(strcmp($res, "VERIFIED") == 0)
41: if(($receiver_email == $site->paypal) && ($payment_amount == $pack->price) && ($payment_status == 'Completed'))

]

parameters : 'item_name','mc_gross'
method : POST
source [

44: mysql_query mysql_query("INSERT INTO `transactions` (user, points, pack, money, date) VALUES('{$user->login}', '{$pack->coins}', '{$item_name}', '{$payment_amount}', NOW())");
19: $item_name = $_POST['item_name'];
22: $payment_amount = $_POST['mc_gross'];

requires:
4: if(!(mysql_connect("$host", "$user", "$pass") && mysql_select_db("$tablename")))
31: if(!$fp) else
35: if(strcmp($res, "VERIFIED") == 0)
41: if(($receiver_email == $site->paypal) && ($payment_amount == $pack->price) && ($payment_status == 'Completed'))

]


file : register.php

parameters : 'PlusREF','register'
method : COOKIE,POST
source [

22: mysql_query $user1 = mysql_query("SELECT * FROM `users` WHERE `id`='{$ref}'");
21: $ref = $_COOKIE['PlusREF'];

requires:
3: if(isset($_POST['register']))
19: if(!checkpwd ($sec['password'], $sec['password2'])) else
20: if(isset($_COOKIE['PlusREF']))

]

&

source [

40: mysql_query mysql_query("INSERT INTO `users`(email,login,IP,pass,passdecoded,ref,signup,activate) values('{$sec['email']}','{$sec['user']}','$final','$passc','$passa','{$ref}',NOW(),'{$activare}')") or
37: $final = visitorip ();
39: $passc = md5($passa);
38: $passa = $sec['password'];
38: $passa = $sec['password'];
21: $ref = $_COOKIE['PlusREF']; // if(isset($_COOKIE)),
26: $activare = rand(000000000, 999999909);

requires:
3: if(isset($_POST['register']))
19: if(!checkpwd ($sec['password'], $sec['password2'])) else

]
Release DateTitleTypePlatformAuthor
2020-06-01"QuickBox Pro 2.1.8 - Authenticated Remote Code Execution"webappsphps1gh
2020-06-01"Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation"webappsphp"Raphael Karger"
2020-06-01"VMware vCenter Server 6.7 - Authentication Bypass"webappsmultiplePhotubias
2020-05-29"Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass"webappsmultiple"Halis Duraki"
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"NOKIA VitalSuite SPM 2020 - 'UserName' SQL Injection"webappsmultiple"Berk Dusunur"
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
Release DateTitleTypePlatformAuthor
2020-06-01"Wordpress Plugin BBPress 2.5 - Unauthenticated Privilege Escalation"webappsphp"Raphael Karger"
2020-06-01"QuickBox Pro 2.1.8 - Authenticated Remote Code Execution"webappsphps1gh
2020-05-29"WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)"webappsphpUnD3sc0n0c1d0
2020-05-28"QNAP QTS and Photo Station 6.0.3 - Remote Command Execution"webappsphpTh3GundY
2020-05-28"Online-Exam-System 2015 - 'fid' SQL Injection"webappsphp"Berk Dusunur"
2020-05-28"EyouCMS 1.4.6 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"osTicket 1.14.1 - 'Saved Search' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
2020-05-27"Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting"webappsphp"China Banking and Insurance Information Technology Management Co."
2020-05-27"OXID eShop 6.3.4 - 'sorting' SQL Injection"webappsphpVulnSpy
2020-05-27"LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting"webappsphp"Matthew Aberegg"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/48399/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.