The SOPlanning application is vulnerable to SQL Injection that leads to Remote Code Execution. Once you have extracted the admin hash, you can now use that to get command execution on the machine through another SQL Injection.
The SoPlanning 1.45 application is vulnerable to CSRF that allows for arbitrary user creation and for changing passwords (Specifically the admin password)
The School ERP Ultimate web application is vulnerable to Cross Site Request Forgery that leads to admin account creation and arbitrary user deletion.
The eLection Web application is vulnerable to authenticated SQL Injection which leads to remote code execution. Login to the admin portal and browse to the candidates section. Capture the request in BurpSuite and save it to file. Send the request to SQLMap with the following parameters: sqlmap -r getcandidate --level=5 --risk=3 --os-shell -p id. SQLMap will find the injection.
The Candid ATS Web application is vulnerable to CSRF to add a new admin user. A proof of concept is provided in the text, which includes a form with hidden inputs that can be used to add a new admin user.
The Ice HRM Web Application is vulnerable to CSRF that leads to arbitrary user creation or password change. The POC for user creation includes a form with hidden inputs that when submitted, creates a user with the username 'test' and email 'test@test.com'. The POC for password change includes a form with hidden inputs that when submitted, changes the password of the user with the ID 1 to 'admin123'.
The phpMyChat Plus 1.98 application is vulnerable to Sql Injection (Boolean based blind, Error-based, time-based blind) on the deluser.php page through the pmc_user parameter. POC code: Capture the request through Burpsuite and then use sqlmap to get the user tables.
The SOPlanning 1.45 application is vulnerable to SQL Injection which can be leveraged into getting the information for the users table.
The Cups Easy (Purchase & Inventory) 1.0 web application is vulnerable to Cross Site Request Forgery that would allow an attacker to change the Admin password and gain unrestricted access to the site or delete any user. Proof of Concept Code for Password Change and user delete is provided in the text.
Services By CQR