Jason Colyvas

5 exploits Active since Oct 2021
CVE-2021-41647 NOMISEC CRITICAL WRITEUP
Online Food Ordering Web App 1.0 - Unauthenticated SQL Injection via Login Username Parameter
An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user.
CVSS 9.1
CVE-2021-41648 NOMISEC HIGH WRITEUP
online-shopping-system-advanced - Unauthenticated SQL Injection via action.php prId Parameter
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.
CVSS 7.5
CVE-2021-41649 NOMISEC CRITICAL WRITEUP
online-shopping-system-advanced - Unauthenticated SQL Injection via cat_id Parameter
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.
CVSS 9.8
CVE-2021-41651 NOMISEC HIGH WRITEUP
Hotel Management System - Blind SQL Injection via cid Parameter in process_update_profile.php
A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the database using the vulnerable cid parameter in process_update_profile.php.
CVSS 7.5
CVE-2021-41651 WRITEUP HIGH WORKING POC
Hotel Management System - Blind SQL Injection via cid Parameter in process_update_profile.php
A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the database using the vulnerable cid parameter in process_update_profile.php.
CVSS 7.5