The Ice HRM Web Application is vulnerable to CSRF that leads to arbitrary user creation or password change. The POC for user creation includes a form with hidden inputs that when submitted, creates a user with the username 'test' and email 'test@test.com'. The POC for password change includes a form with hidden inputs that when submitted, changes the password of the user with the ID 1 to 'admin123'.
The phpMyChat Plus 1.98 application is vulnerable to Sql Injection (Boolean based blind, Error-based, time-based blind) on the deluser.php page through the pmc_user parameter. POC code: Capture the request through Burpsuite and then use sqlmap to get the user tables.
The SOPlanning 1.45 application is vulnerable to SQL Injection which can be leveraged into getting the information for the users table.
The Cups Easy (Purchase & Inventory) 1.0 web application is vulnerable to Cross Site Request Forgery that would allow an attacker to change the Admin password and gain unrestricted access to the site or delete any user. Proof of Concept Code for Password Change and user delete is provided in the text.
Services By CQR