CVE-2024-6516

This exploit demonstrates a stored XSS vulnerability in ABB Cylon Aspect's licenseUpload.php. It uploads a malicious .txt file containing an XSS payload, which is stored on the server and executed when accessed by users.

This exploit demonstrates an authenticated blind command injection vulnerability in ABB Cylon Aspect's bbmdUpdate.php. The POST parameters (e.g., hexMask2, NAThexMask2) are not sanitized, allowing arbitrary command execution via shell metacharacters (e.g., '; sleep 17; #').

This is a working proof-of-concept for a stored XSS vulnerability in ABB Cylon Aspect's licenseServerUpdate.php. The exploit demonstrates how an authenticated attacker can inject arbitrary JavaScript via the 'host' POST parameter.