0day.today - Dunyanin En Buyuk Exploit Veritabani
![](/img/logo_green.jpg)
Biz sadece bir adet ana domain kullaniyoruz DOMAIN_LINK
Eger exploit satin alacaksaniz ve ya hizmet icin odeme yapacaksaniz, altin almaniz gerekmekte. Biz sitemizi hack amacli kullanmak istemiyoruz, yani her turlu dogru olmayan, kanunsuz ve illegal yapilan eylemler diger hesaplari olumsuz yonde etkileyebilir ve sonrasinda buna yol acan/lar, web sitelerimize ve verilere erisimi tamamen kesilir, banlanir ve hesabini tarafimizca yok edilir.
Sadece bu sitenin yonetimine itibar edin. Sahtelere Dikkat!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
- Oku [ anlasma ]
- Oku [ Gonder ] kurallar
- Ziyaret et [ SSS ] page
- [ Uye Ol ] profil
- [ FIYAT ]
- Eger istiyorsaniz [ satmak ]
- Eger istiyorsaniz [ almak ]
- Eger kaybederseniz [ Hesap ]
- Herhangi bir sorunuz [ [email protected] ]
- Yetkili sayfa
- Uyelik sayfasi
- Hesap sayfasini geri yukle
- SSS sayfasi
- Iletisim sayfasi
- Paylasim kurallari
- Anlasma sayfasi
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Bize ulasabilirsiniz:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
FleetCart 4.1.1 Information Disclosure Vulnerability
Yazar
Risk
![](/img/risk/critlow_2.gif)
Security Risk Medium
]0day-ID
Kategori
Eklenme Tarihi
CVE
Platform
# Exploit Title: FleetCart 4.1.1 - WebPage Content Information Disclosure # Exploit Author: CraCkEr # Vendor: EnvaySoft # Vendor Homepage: https://codecanyon.net/item/fleetcart-laravel-ecommerce-system/23014826 # Software Demo Link: https://demo.fleetcart.envaysoft.com/en # Tested on: Windows 11 Pro 22H2 # Impact: Sensitive Information Leakage # CWE: CWE-200 - CWE-284 - CWE-266 # CVE: CVE-2024-5230 # CAPEC: CAPEC-19 / CAPEC-116 # ATT&CK: T1592 ## Description Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the "Razorpay" "razorpayKeyId". ## Steps to Reproduce: When you view the majority of the pages on the website, such as https://demo.fleetcart.envaysoft.com/en/login https://demo.fleetcart.envaysoft.com/en/categories/smartphones/products https://demo.fleetcart.envaysoft.com/en/products?query=123 There is information leaking in the body page response. +---------------------+ razorpayKeyId: 'rzp_test_oACp03vDsqdixc', +---------------------+ Note: the same leaked "razorpayKeyId" is added to "Razorpay" in the Administration Panel. on this Path: https://demo.fleetcart.envaysoft.com/en/admin/settings?tab=razorpay (Login as Administrator) [-] Done # 0day.today [2024-07-02] #