3xpl01tc0d3r

Hello All, ​INTRODUCTION T​he  purpose  of this post is to let you know how I managed to get one more CVE​. Throughout this post, I will give you relevant examples/screenshots that demonstrates how I ended up finding the vulnerability. ​Alright, lets plunge into the Proof-Of-Concept ! ​ PATH OF EXPLORATION ​ After submitting the first vulnerability (Stored Cross Site Scripting) to the developer for phpwcms application I continued to test further for finding more vulnerability. While testing I saw that CSRF Token was submitted in all the request. I tried to tamper with the parameter which contained the CSRF Token and found that the application throws an error which discloses the Internal Path of the application where it has been hosted. THE MOST AWAITED DEEP DIVE POC​ 1) While submitting the profile page request I saw that the application passes one parameter (csrf_token_value) which as per the name suggest contains the csrf token as you can refer the ...

Hello All, ​INTRODUCTION T​he purpose of this post is to let you know how I managed to get my first CVE​ and more importantly how you as a reader can adopt a similar strategy to earn a CVE against your name. Throughout this post, I will give you relevant examples/screenshots that demonstrates how I ended up finding the vulnerability and tips that are extremely handy. ​Alright, lets plunge into the Proof-Of-Concept ! ​ PATH OF EXPLORATION ​ I was searching for a​n​ open source CMS based application which can help me in testing for some bugs for learning purpose.​ ​I ​stumbled upon phpwcms application ​which I found interesting and immediately download​ed​ the same. After configuring the application I started to create dummy pages ​for test​ing​. ​A few minutes​ later​ I came across a page where the administrator has the privilege to create users in phpwcms​. I found out that the username field does not properly filter / sanitize the user input which thus, result​ed​ into a ​...