CVE-2013-5664 PoC — Palo Alto Networks PAN-OS 基于Web的设备管理API浏览器跨站脚本漏洞

Source

https://github.com/phusion/rails-cve-2012-5664-test

Associated Vulnerability

Title:Palo Alto Networks PAN-OS 基于Web的设备管理API浏览器跨站脚本漏洞 (CVE-2013-5664)
Description:Cross-site scripting (XSS) vulnerability in the web-based device-management API browser in Palo Alto Networks PAN-OS before 4.1.13 and 5.0.x before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via crafted data, aka Ref ID 50908.

Description

Demo app showing how the Rails CVE-2013-5664 vulnerability works.

Readme

# Rails CVE-2012-5664 vulnerability demo

This demonstration application shows how the Rails CVE-2013-5664 vulnerability works. More information: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts

File Snapshot


 [4.0K]  /data/pocs/6ba7f306b10cf5aff22c5e267caf9c6b9435bf9d
├── [4.0K]  app
│   ├── [4.0K]  assets
│   │   ├── [4.0K]  images
│   │   │   └── [6.5K]  rails.png
│   │   ├── [4.0K]  javascripts
│   │   │   ├── [ 641]  application.js
│   │   │   └── [ 229]  posts.js.coffee
│   │   └── [4.0K]  stylesheets
│   │       ├── [ 546]  application.css
│   │       └── [ 176]  posts.css.scss
│   ├── [4.0K]  controllers
│   │   ├── [  80]  application_controller.rb
│   │   └── [ 134]  posts_controller.rb
│   ├── [4.0K]  helpers
│   │   ├── [  29]  application_helper.rb
│   │   └── [  23]  posts_helper.rb
│   ├── [4.0K]  mailers
│   ├── [4.0K]  models
│   │   └── [  60]  post.rb
│   └── [4.0K]  views
│       └── [4.0K]  layouts
│           └── [ 247]  application.html.erb
├── [4.0K]  config
│   ├── [2.8K]  application.rb
│   ├── [ 191]  boot.rb
│   ├── [ 576]  database.yml
│   ├── [ 164]  environment.rb
│   ├── [4.0K]  environments
│   │   ├── [1.4K]  development.rb
│   │   ├── [2.4K]  production.rb
│   │   └── [1.5K]  test.rb
│   ├── [4.0K]  initializers
│   │   ├── [ 404]  backtrace_silencers.rb
│   │   ├── [ 533]  inflections.rb
│   │   ├── [ 205]  mime_types.rb
│   │   ├── [ 511]  secret_token.rb
│   │   ├── [ 456]  session_store.rb
│   │   └── [ 465]  wrap_parameters.rb
│   ├── [4.0K]  locales
│   │   └── [ 214]  en.yml
│   └── [1.8K]  routes.rb
├── [ 170]  config.ru
├── [4.0K]  db
│   ├── [4.0K]  migrate
│   │   └── [ 147]  20130103004813_create_posts.rb
│   ├── [ 962]  schema.rb
│   └── [ 343]  seeds.rb
├── [4.0K]  doc
│   └── [ 211]  README_FOR_APP
├── [ 765]  Gemfile
├── [2.4K]  Gemfile.lock
├── [4.0K]  lib
│   ├── [4.0K]  assets
│   └── [4.0K]  tasks
├── [4.0K]  log
├── [4.0K]  public
│   ├── [ 728]  404.html
│   ├── [ 711]  422.html
│   ├── [ 643]  500.html
│   ├── [   0]  favicon.ico
│   └── [ 204]  robots.txt
├── [ 285]  Rakefile
├── [ 249]  README.md
├── [4.0K]  script
│   └── [ 295]  rails
├── [4.0K]  test
│   ├── [4.0K]  fixtures
│   │   └── [ 133]  posts.yml
│   ├── [4.0K]  functional
│   │   └── [ 132]  posts_controller_test.rb
│   ├── [4.0K]  integration
│   ├── [4.0K]  performance
│   │   └── [ 370]  browsing_test.rb
│   ├── [ 454]  test_helper.rb
│   └── [4.0K]  unit
│       ├── [4.0K]  helpers
│       │   └── [  72]  posts_helper_test.rb
│       └── [ 118]  post_test.rb
└── [4.0K]  vendor
    ├── [4.0K]  assets
    │   ├── [4.0K]  javascripts
    │   └── [4.0K]  stylesheets
    └── [4.0K]  plugins

36 directories, 47 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!