Home > myaim
jio-router-vulnerability-cve-2019-7440

JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings-CVE-2019-7440

# Exploit Title: JioFi 4G M2S 1.0.2 devices have CSRF via the SSID name and Security Key field under Edit Wi-Fi Settings (aka a SetWiFi_Setting request to cgi-bin/qcmap_web_cgi) # Exploit Author: Vikas Chaudhary # Date: 21-01-2019 # Vendor Homepage: https://www.jio.com/ # Hardware Link: https://www.amazon.in/JioFi-Hotspot-M2S-Portable-Device/dp/B075P7BLV5/ref=sr_1_1?s=computers&ie=UTF8&qid=1531032476&sr=1-1&keywords=JioFi+M2S+Wireless+Data+Card++%28Black%29 # Version: JioFi 4G Hotspot M2S 150 Mbps Wireless Router # Category: Hardware # Contact: https://www.facebook.com/profile.php?id=100011287630308 # Web: https://gkaim.com/ # Tested on: Windows 10 X64- Firefox-65.0 # CVE-2019-7440 *********************************************************************** ## Vulnerability Description :- The application allows users

Read More
jio-router-vulnerability-cve-2019-7438-html

cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has HTML injection via the mask POST parameter-CVE-2019-7438 (HTML)

# Exploit Title: cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has HTML injection via the mask POST parameter. # Exploit Author: Vikas Chaudhary # Date: 21-01-2019 # Vendor Homepage: https://www.jio.com/ # Hardware Link: https://www.amazon.in/JioFi-Hotspot-M2S-Portable-Device/dp/B075P7BLV5/ref=sr_1_1?s=computers&ie=UTF8&qid=1531032476&sr=1-1&keywords=JioFi+M2S+Wireless+Data+Card++%28Black%29 # Version: JioFi 4G Hotspot M2S 150 Mbps Wireless Router # Category: Hardware # Contact: https://www.facebook.com/profile.php?id=100011287630308 # Web: https://gkaim.com/ # Tested on: Windows 10 X64- Firefox-65.0 # CVE-2019-7438-HTML *********************************************************************** ## Vulnerability Description (1)=> HTML injection is an attack that is similar to Cross-site Scripting (XSS). While in the

Read More
cve-2019-7437-vikas-chaudhary

PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting-CVE-2019-7437

******************************************************************************************* # Exploit Title: PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has reflected Cross-Site Scripting (XSS) via the Search field # Date: 30.12.2018 # Site Title : Opensource Classified Ads Script # Vendor Homepage: https://www.phpscriptsmall.com/ #Vendor Software: https://www.phpscriptsmall.com/product/professional-classified-ads-script/ # Software Link: http://198.38.86.159/~classic/ # Category: Web Application # Version: 3.2.2 # Exploit Author: Vikas Chaudhary # Contact: https://www.facebook.com/profile.php?id=100011287630308 # Web: https://gkaim.com/ # Tested on: Windows 10 -Firefox , # CVE-2019-7437 ***************************************************************************************** ## VENDOR SUMMARY :- PHP Scripts Mall Pvt. Ltd. is a professional software

Read More
cve-2019-7436-vikas-chaudhary

PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal-CVE-2019-7436

******************************************************************************************* # Exploit Title: PHP Scripts Mall Opensource Classified Ads Script 3.2.2 has directory traversal via a direct request for a listing of an uploads directory # Date: 30.12.2018 # Site Title : Opensource Classified Ads Script # Vendor Homepage: https://www.phpscriptsmall.com/ #Vendor Software: https://www.phpscriptsmall.com/product/professional-classified-ads-script/ # Software Link: 198.38.86.159/~classic/ # Category: Web Application # Version: 3.2.2 # Exploit Author: Vikas Chaudhary # Contact: https://www.facebook.com/profile.php?id=100011287630308 # Web: https://gkaim.com/ # Tested on: Windows 10 -Firefox # CVE-2019-7436 ***************************************************************************************** Vulnerability Description => A path traversal attack (also known as

Read More