Page 3 - Exploit Author News Today

# Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS# Exploit Author: CraCkEr# Date: 20/08/2023# Vendor: SPA-Cart# Vendor Homepage: https://spa-cart.com/# Software Link: https://demo.spa-cart.com/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site# CVE: CVE-2023-4547# CWE: CWE-79 - CWE-74 - CWE-707## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushkaCryptoJob

# Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection# Exploit Author: CraCkEr# Date: 20/08/2023# Vendor: SPA-Cart# Vendor Homepage: https://spa-cart.com/# Software Link: https://demo.spa-cart.com/# Tested on: Windows 10 Pro# Impact: Database Access# CVE: CVE-2023-4548# CWE: CWE-89 - CWE-74 - CWE-707## GreetingsThe_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushkaCryptoJob (Twitter) twitter.com/0x0CryptoJob## DescriptionSQL injection

# Exploit Title: User Registration & Login and User Management System v3.0 - Stored Cross-Site Scripting (XSS)# Google Dork: NA# Date: 19/08/2023# Exploit Author: Ashutosh Singh Umath# Vendor Homepage: https://phpgurukul.com# Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/# Version: 3.0# Tested on: Windows 11# CVE : RequestedDescriptionUser Registration & Login and User Management System With admin panel 3.0 application from

# Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage# Date: 2023-08-09# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia# Vendor Homepage: https://tsplus.net/# Version: Up to 16.0.0.0# Tested on: Windows# CVE : CVE-2023-31069With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single sign-on web portal and remote desktop gateway that

# Exploit Title: TSplus 16.0.2.14 - Remote Access Insecure Files and Folders Permissions# Date: 2023-08-09# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia# Vendor Homepage: https://tsplus.net/# Version: Up to 16.0.2.14# Tested on: Windows# CVE : CVE-2023-31067TSplus Remote Access (v. 16.0.2.14) is an alternative to Citrix and Microsoft RDS for remote desktop access and

# Exploit Title: Global - Multi School Management System Express v1.0- SQL Injection# Date: 2023-08-12# Exploit Author: Ahmet Ümit BAYRAM# Vendor: https://codecanyon.net/item/global-multi-school-management-system-express/21975378# Tested on: Kali Linux & MacOS# CVE: N/A### Request ###POST /report/balance HTTP/1.1Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcwAccept: */*X-Requested-With: XMLHttpRequestReferer: http://localhostCookie: gmsms=b8d36491f08934ac621b6bc7170eaef18...

# Exploit Title: Color Prediction Game v1.0 - SQL Injection# Date: 2023-08-12# Exploit Author: Ahmet Ümit BAYRAM# Vendor: https://www.codester.com/items/44411/color-prediction-game-php-script# Tested on: Kali Linux & MacOS# CVE: N/A### Request ###POST /loginNow.php HTTP/1.1Host: localhostCookie: PHPSESSID=250594265b833a4d3a7adf6e1c136fe2User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0)Gecko/20100101 Firefox/116.0Accept: */*Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0...

# Exploit Title: Credit Lite 1.5.4 - SQL Injection# Exploit Author: CraCkEr# Date: 31/07/2023# Vendor: Hobby-Tech# Vendor Homepage: https://codecanyon.net/item/credit-lite-micro-credit-solutions/39554392# Software Link: https://credit-lite.appshat.xyz/# Tested on: Windows 10 Pro# Impact: Database Access# CVE: CVE-2023-4407# CWE: CWE-89 - CWE-74 - CWE-707## DescriptionSQL injection attacks can allow unauthorized access to sensitive data, modification ofdata and crash the application or

# Exploit Title: Hyip Rio 2.1 - Arbitrary File Upload# Exploit Author: CraCkEr# Date: 30/07/2023# Vendor: tdevs# Vendor Homepage: https://tdevs.co/# Software Link: https://hyiprio-feature.tdevs.co/# Tested on: Windows 10 Pro# Impact: Allows User to upload files to the web server# CVE: CVE-2023-4382## DescriptionAllows Attacker to upload malicious files onto the server, such as Stored XSS## Steps to

# Exploit Title: Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security# Date: 03/08/2023# Vendor: https://pyrocms.com/# Software Link: https://pyrocms.com/documentation/pyrocms/3.9/getting-started/installation# Vulnerable Version(s): 3.9# CVE: CVE-2023-29689# Notes: You need a user who has access to /admin privilege# Example Usage:# First, run the script: python3 CVE-2023-29689.py# Please follow these